关联漏洞
标题：
Apache ActiveMQ 代码问题漏洞
(CVE-2023-46604)
描述：Apache ActiveMQ是美国阿帕奇（Apache）基金会的一套开源的消息中间件，它支持Java消息服务、集群、Spring Framework等。 Apache ActiveMQ 5.15.16之前、5.16.7之前、5.17.6之前或5.18.3之前版本存在代码问题漏洞，该漏洞源于允许具有代理网络访问权限的远程攻击者通过操纵 OpenWire 协议中的序列化类类型来运行任意 shell 命令。
介绍
# CVE-2023-46604
This repository contains an exploit script and a Proof of Concept (PoC) XML file for the CVE-2023-46604 vulnerability affecting Apache ActiveMQ. The vulnerability allows for remote code execution due to unsafe deserialization practices within the OpenWire protocol.
## Description
CVE-2023-46604 is a deserialization vulnerability that exists in Apache ActiveMQ's OpenWire protocol. This flaw can be exploited by an attacker to execute arbitrary code on the server where ActiveMQ is running. The exploit script in this repository automates the process of sending a crafted request to the server to trigger the vulnerability.
## Repository Contents
- `exploit.py` - The main Python exploit script that triggers the vulnerability.
- `poc.xml` - An XML file that serves as a proof of concept for the exploit.
## Prerequisites
Before running the exploit script, ensure that you have:
- Python 3.x installed on your system.
- Network access to the vulnerable ActiveMQ server.
- The URL to the `poc.xml` file, which should be accessible by the target ActiveMQ server.
## Usage
To use the exploit script, you need to provide the IP address of the target ActiveMQ server, the port number (default is 61616), and the URL to the `poc.xml` file.
```
python exploit.py -i <target-ip> -p <target-port> -u <url-to-poc.xml>
```
Replace `<target-ip>`, `<target-port>`, and `<url-to-poc.xml>` with the appropriate values for your target environment.
## Credits
The exploit script provided in this repository is based on an original exploit written in Go by [X1r0z](https://github.com/X1r0z/ActiveMQ-RCE). The Python version aims to provide a similar exploit in a different programming language while maintaining the effectiveness of the original exploit.
## Disclaimer
This exploit is provided for educational purposes only. The authors of this repository are not responsible for any misuse or damage caused by this material. Use it at your own risk.
## Contact
If you have any questions or feedback regarding this exploit, please open an issue in this repository.
文件快照
[4.0K] /data/pocs/fdd8365bde9fed568774c0336d44356054a138a5
├── [1.8K] exploit.py
├── [ 666] poc.xml
└── [2.0K] README.md
0 directories, 3 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。