CVE-2023-46604 (By Ruben Fobe & Klaas Stessens)

Intro

[WARNING]

This project is intended for educational and lab purposes only. Only use these techniques in environments you own or are authorized to test.

This lab will simulate the exploitation of CVE-2023-46604, by using a Kali Linux VM (attacker) and a Debian 11 server VM (victim).

This lab only works if your host operating system is Windows!
--> If you're using Linux, this lab will not work!

Prerequisites

• Oracle VirtualBox
• VBoxmanage (available in PATH)
• PowerShell
• SSH client
• Min ~30 GB free disk space

Software used

WARNING
The Apache & Java software will be auto-installed (using scripts) on the VM's. Do not install these manually on your host pc!

We use the following software in this exercise:

• VBoxManage
• Apache ActiveMQ 5.18.2 (ActiveMQ)
• Java OpenJDK 11.0.30 (Java)
• Metasploit Framework (Preinstalled on the Kali vm)

Preparation

Install VBoxManage, and make the command a env. variable:

• VboxManage setup

Clone or download the repository to a location of your choice. (the vboxmanage commands needs to be able to work in this folder)

• Example: C:\Users\<user_name>\CVE-2023-46604\

After you cloned the repository on your local system, add in that folder (\CVE-2023-46604\) a new folder VDI\.

Your folder structure should now look like this:

CVE-2023-46604\
│
├── .gitignore
│
├── LICENSE
│
├── README.md
│
├── scripts\
│   ├── DebCreate.ps1
│   ├── DebDelete.ps1
│   ├── KalCreate.ps1
│   ├── KalDelete.ps1
│   ├── sshDebian.ps1
│   ├── sshKali.ps1
│   ├── softwareInstallDebian.sh
│   └── softwareInstallKali.sh
│
└── VDI\

VDI's

The scripts in this lab make use of VDI's to create and delete VM's. We will now download the following VDI's:

Debian VDI installation

1. Install the Debian 11 Bullseye (server) virtualbox VDI.
2. Place the .vdi file in the CVE-2023-46604\VDI\ folder.
3. Save the .vdi in this folder as Debian-original.vdi

Kali VDI installation

1. Install the Kali Linux 2025.2 virtualbox VDI.
2. Place the .vdi file in the CVE-2023-46604\VDI\ folder.
3. Save the .vdi in this folder as Kali-original.vdi

Your folder structure should now look like this:

CVE-2023-46604\
│
├── .gitignore
│
├── LICENSE
│
├── README.md
│
├── scripts\
│   ├── DebCreate.ps1
│   ├── DebDelete.ps1
│   ├── KalCreate.ps1
│   ├── KalDelete.ps1
│   ├── sshDebian.ps1
│   ├── sshKali.ps1
│   ├── softwareInstallDebian.sh
│   └── softwareInstallKali.sh
│
└── VDI\
    ├── Debian-original.vdi   
    └── Kali-original.vdi

Debian Server VM creation

Credentials Debian VM:

Username: osboxes
Password: osboxes.org

Creation

1. Go to your scripts folder.

cd scripts

2. Create the Debian VM:

.\DebCreate.ps1

3. You see eventually the message The name of the victim VM is: Debian11 .
4. SSH into the Debian VM, and install the necessary software:

.\sshDebian.ps1

5. The terminal will after a few tries ask for the VM's password (see credentials), enter the password.

[NOTE]
On the first SSH connection, you may see a message like:

root@kitploit:~

The authenticity of host '[127.0.0.1]:2220' can't be established.
ED25519 key fingerprint is SHA256:...
Are you sure you want to continue connecting (yes/no/[fingerprint])?

This is normal. SSH is warning you that the VM's host key is not yet stored in your .ssh/known_hosts file.

6. After this the terminal will ask a second time the VM's password a second time, enter this again.
7. Now wait until the installation process is finished.
8. In the end you get the message ---- Software successfully installed ----.
9. Your Debian VM is now ready.

If you want to check out your Debian VM, you can ssh into the VM:

ssh -p2220 [email protected]

Kali Linux VM creation

Credentials Kali Linux VM:

Username: osboxes
Password: osboxes.org

Creation

1. Go to your scripts folder. Normally you are still here from the previous steps, otherwise:

cd scripts

2. Create the Kali Linux VM:

.\KalCreate.ps1

3. After you get the message The name of the attacker VM is: Kali Linux.
4. Start your Kali Linux VM in GUI mode (default mode):

vboxmanage startvm "Kali Linux"

5. When the VM has started enter the credentials:

• Username: osboxes
• Password: osboxes.org

6. Open the terminal en start the SSH server. After that you can close your VM:

# When enabling ssh, the server will from then on start on boot.
sudo systemctl enable ssh

# Power off the VM. 
sudo poweroff

From this point on, SSH will automatically start when the VM boots.

If you want to check out your Kali VM, you can ssh into the VM:

ssh -p2225 [email protected]

Exploitation

1. Go back into your CVE-2023-46604/scripts/ folder, and ssh into your Kali VM to configure the network settings and to start the exploit (using Metasploit):

.\sshKali.ps1

2. The script will attempt to use ssh to access the VM. When asked, enter the password.

[NOTE]
On the first SSH connection, you may see a message like:

root@kitploit:~

The authenticity of host '[127.0.0.1]:2225' cant be established.
ED25519 key fingerprint is SHA256:...
Are you sure you want to continue connecting (yes/no/[fingerprint])?

This is normal. SSH is warning you that the VM's host key is not yet stored in your .ssh/known_hosts file.

3. Then you'll get asked for the VM password 2 more times. The first time is for ssh into the VM, and the second for executing the exploit itself (using Metasploit).
4. The exploitation process may take some time to complete. Eventually, you get the message : "Command shell session 1 opened...Server stopped.". Now you have access to the Debian VM.

Verifying remote access

You now have Remote Command Execution (RCE) access to the Debian victim VM.

You can execute some Linux commands to verify that you now have remote acces to the Debian11 VM:

# Show the current directory
pwd

# Check the operating system
cat /etc/os-release

# Check the current user
whoami

# Check the kernel information
uname -a

Expected Result

After successful exploitation:

• A reverse shell is opened from the Debian VM to the Kali VM
• The attacker gains remote command execution access
• Commands can be executed on the victim system remotely

About the VM's

VM architecture

                        ┌─────────────────────┐
                        │     Host System     │
                        │   (VirtualBox Host) │
                        └─────────┬───────────┘
                                  │
                 ┌────────────────┴────────────────┐
                 │                                 │
      NAT + Port Forwarding             NAT + Port Forwarding
        SSH: localhost:2225              SSH: localhost:2220
                 │                                 │
     ┌───────────┴───────────┐         ┌───────────┴───────────┐
     │     Kali Linux VM     │         │    Debian 11 Server   │
     │      (Attacker)       │         │       (Victim)        │
     │                       │         │                       │
     │  NIC1: NAT            │         │  NIC1: NAT            │
     │  NIC2: Internal Net   │<───────>│  NIC2: Internal Net   │
     │         "inet"        │         │         "inet"        │
     └───────────────────────┘         └───────────────────────┘

VM Creation

When you want to create a VM, you just run the following command in the folder scripts/:

• Debian VM creation ==> .\DebCreate.ps1
• Kali VM creation ==> .\KaliCreate.ps1

When a new VM is created, the DebCreate.ps1 and KalCreate.ps1 scripts first make a copy of the original VDI file (ex. Debian-original.vdi). VBoxManage then uses this copy to create the VM.

This ensures that any software installations or configuration changes made inside a VM are not saved into future VM creations, which allows each new VM to start from a clean VDI .

VM Deletion

After exiting a VM, you can enter one of 2 commands to delete the VM (and a copy of the VDI). Run the following command in the folder scripts/:

• Debian VM deletion ==> .\DebDelete.ps1
• Kali VM deletion ==> .\KaliDelete.ps1

When the VM's are created, they use a copy to operate from of an original VDI. This way, when deleting a VM, you wont have the previously installed software still on a new VM.

Settings

Debian11

• VM Name : "Debian11"
• OS Type : Debian_64
• Memory : 4096 MB
• CPUs : 2
• VRAM : 128 MB
• Graphics Controller : VMSVGA
• Network Adapter 1 : NAT
• Network Adapter 2 : InternaL Network ("inet")
• Storage Controller : IntelAhci (SATA)
• Disk image : Debian11.vdi
• SSH Port Forwarding : 127.0.0.1:2220 -> VM:22

Kali Linux

• VM Name : "Kali Linux"
• OS Type : Linux_64
• Memory : 4096 MB
• CPUs : 2
• VRAM : 128 MB
• Graphics Controller : VMSVGA
• Network Adapter 1 : NAT
• Network Adapter 2 : InternaL Network ("inet")
• Storage Controller : IntelAhci (SATA)
• Disk image : KaliLinux.vdi
• SSH Port Forwarding : 127.0.0.1:2225 -> VM:22