讓ActiveMQ 攻擊具有權威性.pdf

《讓ActiveMQ 攻擊具有權威性.pdf》由會員分享，可在線閱讀，更多相關《讓ActiveMQ 攻擊具有權威性.pdf（24頁珍藏版）》請在三個皮匠報告上搜索。

1、Make ActiveMQ Attack Authoritative Speaker:yemoliAbout Me Reseacher CyberUtopian Focus On Web Security Static Analylize Pentest Blog:yml-sec.top Github:yemoliActiveMQ is a popular open-source message broker software that implements the Java Message Service(JMS)API for asynchronous communication betw

2、een applications.It supports multiple communication protocols,including OpenWire,Stomp,AMQP,and MQTTCVE-2023-46604ActiveMQ versions 5.18.2 and earlier have a deserialization vulnerability during communication using the OpenWire protocol.Attackers can execute code by controlling the serialization cla

3、ss type in the OpenWire protocol,causing arbitrary classes to be instantiatedorg.apache.activemq.openwire.OpenWireFormat#doUnmarshalThe utilization strategy in public and official announcements is to use ClassPathXmlApplicationContext in Spring to load remote XML and execution commands前置條件及限制目標需要出網如

4、果不出網需要落地xml通過xml來做后序利用操作有很多限制How to make it more powerful?Find a new gadget尋找單參數且參數類型為String的public修飾符修飾的構造方法IniEnvironment新建shiro ini配置對象加載傳入的配置項內容初始化配置initcreateObjectsWhat do we have?目前為止我們可控Shiro 配置文件的完整內容，同時進行配置文件的初始化About configurationhttps:/shiro.apache.org/configuration.htmlHow to exploit it?How to exploit it?mons.dbcp2.BasicDataSourceHow to exploit it?BcelClassLoaderHow to exploit it in a higher version of JDK?mand.ActiveMQObjectMessageHow to exploit it in a higher version of JDK?How to exploit it in a higher version of JDK?Gadget