HTB - Broker Writeup
![](/assets/site/avatar.png)
πΎ Machine Overview
This is a writeup of the machine Broker from HTB , itβs an easy difficulty Linux machine which featured unauthenticated RCE, and nginx local privesc.
π Enumeration
An initial nmap scan of the host gave the following results:
1 | nmap -sV -sC 10.129.230.87 |
Thereβs really only the website on port 80 to check out.
π ActiveMQ
The site was locked behind a basic auth prompt, for giggles I tried admin:admin
which happened to work.
It looks to be running Apache ActiveMQ, an open source message broker.
The management page shows that itβs running version 5.15.15
.
π₯ User
This version of ActiveMQ is vulnerable to CVE-2023-46604
, unauthenticated RCE. I cloned this POC to give it a shot.
Before running the exploit we need to:
- Edit
poc.xml
to have our IP - Start a netcat listener on the port specified in
poc.xml
- Start a simple python web server to host the
poc.xml
payload
Then we can run exploit.py
and see if it will pop a shell.
Sure enough, it pops a shell as the activemq
user.
π₯ Root
I started off by running LinPEAS to see if it turned up anything interesting
Looks like our user is able to run nginx as root without specifying a password. Whatever site configuration we specify can run as the root user. I wrote a one liner to create a site config and then spin it up.
1 | # Creating our site configuration |
This creates a site that lists the entire file system, and allows file uploads.
I first browsed to /root/root.txt
to grab the flag.
Then I used curl to upload my SSH key to the root userβs authorized keys file, allowing me to SSH into the box and grab the flag.
π Resources
π Hyperlink | βΉοΈ Info |
---|---|
CVE-2023-46604 | ActiveMQ RCE POC |
LinPEAS | Linux PrivEsc Script |
- Title: HTB - Broker Writeup
- Author: Liam Geyer
- Created at : 2024-07-26 00:00:00
- Updated at : 2024-09-02 08:34:29
- Link: https://lfgberg.org/2024/07/26/htb/broker/
- License: This work is licensed under CC BY-NC-SA 4.0.