CVE-2023-46604 PoC — Apache ActiveMQ 代码问题漏洞

介绍

# CVE-2023-46604-RCE

# Vulnerability
A deserialization vulnerability in the OpenWire transport unmarshaller in Apache ActiveMQ.
</p>
Affected versions include 5.18.0 through to 5.18.2, 5.17.0 through to 5.17.5, 5.16.0 through to
</p>
5.16.6, and all versions before 5.15.16.

# Setup
Change the Values inside the <B>POC.XML</B> as your needs (Your Command)
</p>
Host the <B>POC.XML</B>
</p>
pass the <B>POC.XML</B> URL to the script using -u arg, either testing a single ip or list of ips

# How To Use:
```
options:
  -h, --help            show this help message and exit
  -f FILE, --file FILE  File with a list of ActiveMQ Server IPs
  -i IP, --ip IP        ActiveMQ Server IP or Host (single IP)
  -p PORT, --port PORT  ActiveMQ Server Port
  -n THREADS, --threads THREADS
                        Number of threads
  -t TIMEOUT, --timeout TIMEOUT
                        Connection timeout for each requests
  -u URL, --url URL     XML Url
```

# Details:
I'm not the author of the Exploit itself</br>
I just Coded it into automation process, using Python</br>
the credits goes to </B>X1r0z<B>

# LINKS:
https://github.com/X1r0z/ActiveMQ-RCE</br>
https://exp10it.cn/2023/10/apache-activemq-%E7%89%88%E6%9C%AC-5.18.3-rce-%E5%88%86%E6%9E%90/</br>
https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt

# Disclaimer:

This proof-of-concept exploit is intended for educational and research purposes only. The author and the platform where this code is shared do not condone or encourage any unauthorized or malicious use of this code. Use this code at your own risk. The author is not responsible for any misuse, damage, or consequences that may arise from utilizing this code. Always ensure that you have the appropriate permissions and legal authorization before testing or deploying any security-related tools or exploits.

[![Hits](https://hits.seeyoufarm.com/api/count/incr/badge.svg?url=https%3A%2F%2Fgithub.com%2FNKeshawarz%2FCVE-2023-46604-RCE&count_bg=%2379C83D&title_bg=%23555555&icon=&icon_color=%23E7E7E7&title=N.K&edge_flat=false)](https://hits.seeyoufarm.com)

文件快照

备注