IDS/IPS Lab - Protecting Apache ActiveMQ from RCE Attacks

This project evaluates how IDS and IPS mechanisms can detect and prevent exploitation of Apache ActiveMQ vulnerability CVE-2023-46604 in a controlled lab environment.

Project Overview

The lab was designed with separated attacker, gateway, and victim systems to simulate a realistic attack-and-defense workflow. The project includes vulnerability discovery, manual verification, exploitation, and mitigation.

My Work

• Built and tested the lab environment
• Scanned the target using GVM and Nmap
• Simulated the attack using Metasploit
• Implemented detection with Snort IDS/IPS
• Applied prevention controls using iptables and UFW
• Validated mitigation through practical testing and log analysis

Key Technologies

• GVM
• Nmap
• Metasploit
• Snort
• iptables
• UFW
• Ubuntu Server
• Kali Linux

Highlights

• Simulated Apache ActiveMQ RCE attack (CVE-2023-46604)
• Verified vulnerable service version manually
• Detected malicious traffic with Snort
• Blocked attack traffic with firewall controls
• Evaluated the effectiveness of deployed defenses

Full Report

See: DangTrungNguyen_22BA13239_FinalReport.pdf