Authenticated RCE in Apache ActiveMQ Fileserver via HTTP PUT/MOVE

This repository is a standalone Java Swing exploit toolkit for Apache ActiveMQ, not a Metasploit/Nuclei module. The project is Maven-based, with a single executable entry point in src/main/java/cc/kiiy/App.java that launches a GUI (MainFrame). The codebase is organized into service classes for exploitation/detection logic (EnvironmentService, VulnerabilityService), UI panels for each supported CVE and settings, and utility helpers for HTTP and local config handling. Core capability-wise, the tool supports both detection and exploitation. EnvironmentService fingerprints ActiveMQ by requesting the target URL and checking for the Apache ActiveMQ title, and can authenticate to /admin/ using HTTP Basic auth to extract hostname, version, and uptime from the admin console HTML. VulnerabilityService is the main exploit engine. For CVE-2015-5254, it accepts a user-provided Base64 serialized payload, decodes it, wraps it into an ActiveMQObjectMessage, and sends it over OpenWire/JMS to a chosen queue on tcp://<host>:<port> (default 61616), enabling broker-side deserialization when the message is processed/viewed. For CVE-2016-3088, it performs a PUT to /fileserver/<random>.txt and then a MOVE to file:///etc/cron.d/root, planting a cron entry that launches a Perl reverse shell back to the operator. This is a real exploitation path, not just a detector, but it depends on vulnerable behavior and elevated target privileges. The repository also includes support for CVE-2022-41678 workflows. Although the provided content truncates some of the implementation, the UI and service references clearly show functionality to write a default or custom webshell and then execute commands through it, with selectable methods such as auto, log4j2, and jfr. The included JfrTemplate.java contains a large embedded JFR configuration template, indicating one exploitation path abuses JFR-related file write/config behavior. BeanXmlPanel generates Spring BeanXML payloads using java.lang.ProcessBuilder for arbitrary command execution, likely intended to support XML-based ActiveMQ exploitation such as CVE-2023-46604-style xbean loading. The code also contains logic for a Jolokia-based probe labeled CVE-2026-34197 that sends an addNetworkConnector request with a vm://evil?brokerConfig=xbean:<xmlServer> argument, causing the target to fetch attacker-controlled XML from an external server. Network and fingerprintable artifacts are abundant: HTTP(S) access to the target web console and admin paths, OpenWire TCP access to port 61616, PUT/MOVE requests to /fileserver/, file destinations like file:///etc/cron.d/root, attacker XML hosting URLs, and Basic Authorization headers. The GUI exposes global custom headers and proxy settings, allowing the operator to tune requests and route traffic through a local proxy. Overall, this is an operational multi-CVE ActiveMQ exploitation toolkit with a GUI front end, combining reconnaissance, authenticated checks, payload generation, deserialization delivery, arbitrary file write abuse, XML-based RCE testing, and webshell management.

This repository contains a Python exploit script (CVE-2016-3088.py) targeting Apache ActiveMQ versions 5.x up to 5.14.0, exploiting CVE-2016-3088. The exploit works by uploading a base64-encoded JSP webshell (or a user-supplied script) to the target's /fileserver/ endpoint, then moving it to the /webapps/admin/ directory using a crafted HTTP MOVE request. Once in place, the attacker can access the webshell via the /admin/<random>.jsp URL and execute commands remotely. The script checks for vulnerability by attempting to upload a file and expects a 204 response code for success. The README.md provides usage instructions, requirements, and example output. The exploit is operational, providing a working webshell for remote command execution, and can optionally use a custom payload script. The main attack vector is network-based, targeting the HTTP interface of ActiveMQ. Key endpoints include the /fileserver/ upload URL, the /admin/ webshell access URL, and the filesystem path where the webshell is placed.

This repository contains a Python exploit script (CVE-2016-3088.py) targeting Apache ActiveMQ servers vulnerable to CVE-2016-3088. The exploit attempts to access the '/fileserver' and '/api' endpoints, checks for default credentials (admin:admin), and determines the ActiveMQ version. If the target is vulnerable, it uploads a JSP webshell via a PUT request and then moves it to a web-accessible directory using a MOVE request. The webshell allows remote command execution via HTTP requests. The repository also includes a brief README with usage instructions. The exploit is operational, providing a working payload and automating the exploitation process for vulnerable ActiveMQ instances.

This repository is a Go-based tool for detecting and exploiting vulnerabilities in Apache ActiveMQ instances. Its primary capabilities are: 1. Detection of default credentials on the ActiveMQ web admin console by attempting HTTP Basic Auth with common default values (admin/123456 and admin/admin). 2. Exploitation of the arbitrary file write vulnerability (CVE-2016-3088) by uploading a JSP webshell to the server's webapps directory using HTTP PUT and MOVE methods, then verifying successful exploitation by accessing the shell. The tool supports both single-target and batch scanning modes, with targets specified via command-line arguments or a file (url.txt). The main entry point is main.go, which invokes the scanning logic in DataHandle/Scan.go. The code is modular, with separate files for HTTP requests, configuration parsing, and vulnerability checks. The payload used is a simple JSP script that prints a known string, confirming code execution. Endpoints targeted include the ActiveMQ admin console (/admin), the system properties page (/admin/test/systemProperties.jsp), the file upload endpoint (/fileserver/123.txt), and the location where the webshell is written (/api/s.jsp). The tool is operational and can be used for both vulnerability assessment and exploitation of unprotected or misconfigured ActiveMQ servers.

This repository contains a Python exploit script (ActiveMQ_putshell.py) targeting Apache ActiveMQ servers vulnerable to CVE-2016-3088. The exploit leverages a path traversal vulnerability in the fileserver component to upload a JSP webshell to the /admin/ directory of the target server. The script first attempts to determine the correct file path using a crafted PUT request, then uploads a JSP payload as a .txt file, and finally uses the HTTP MOVE method to relocate the payload to a web-accessible location. The payload is a JSP webshell that allows remote command execution when accessed with the correct password parameter. The exploit requires the target to be accessible over HTTP and to have default or known credentials. The repository consists of the main exploit script and a README file with usage instructions.