Arbitrary File Upload and Remote Code Execution in Apache ActiveMQ Fileserver

This is a deliberately vulnerable training environment with a manual CVE-2016-3088 exploitation walkthrough, rather than a standalone automated exploit. Its 33 files include English and Chinese guides under app/, two image Dockerfiles and a cron-enabled entrypoint under base/, a central isoloom.yml specification, generated Docker/Kubernetes/Vagrant/Terraform deployment artifacts under .isoloom/, health checks, CTF metadata, and GitHub validation/publishing workflows. The upstream content is attributed to Vulhub commit 8fd63916f7a8711e2e01dda0d27237e4d6175d38; that is not established as the analyzed repository's own ref. The original repository URL, analyzed ref, and archive size were not supplied, so their metadata uses empty strings and a zero placeholder. The walkthrough exploits anonymous fileserver PUT uploads followed by MOVE requests with attacker-selected filesystem destinations. It provides a concrete cron-based Perl reverse-shell payload and a placeholder JSP-webshell example. Writes are constrained by the ActiveMQ process's permissions; cron execution requires root access and a running daemon, while accessing the JSP in admin/api requires authentication. SSH-key placement and JAR/Jetty configuration modification are only discussed, with the latter explicitly untested. No automated exploit client or complete JSP payload is present. The actual shell checks perform read-only GET requests to identify an ActiveMQ welcome page, require HTTP 401 from /admin/, and check that /fileserver/ does not return 404. They do not prove version 5.11.1, test PUT/MOVE, or demonstrate arbitrary writes. Generated checks also verify service readiness and blocked internet access. The generated lab exposes HTTP 8161 and OpenWire 61616, assigns ActiveMQ 10.61.18.10, and restricts egress through Docker route removal or Kubernetes network policies. This isolation can block the documented reverse-shell callback. Cloud deployment firewalls use a caller-supplied allowed_cidr; the Kubernetes LoadBalancer publishes both service ports. Provisioning downloads and filesystem cleanup belong to lab setup/CI, not evidence of a fake exploit. The code-file count comprises seven Terraform files, one Ruby Vagrantfile, six shell scripts, and two Dockerfiles; YAML/JSON configuration is excluded from that count. Perl appears as an embedded documentation payload. Isoloom is deployment tooling, not an exploit framework. Findings are based on static inspection only; no deployment or exploitation was performed.

This repository is a standalone Java Swing exploit toolkit for Apache ActiveMQ, not a Metasploit/Nuclei module. The project is Maven-based, with a single executable entry point in src/main/java/cc/kiiy/App.java that launches a GUI (MainFrame). The codebase is organized into service classes for exploitation/detection logic (EnvironmentService, VulnerabilityService), UI panels for each supported CVE and settings, and utility helpers for HTTP and local config handling. Core capability-wise, the tool supports both detection and exploitation. EnvironmentService fingerprints ActiveMQ by requesting the target URL and checking for the Apache ActiveMQ title, and can authenticate to /admin/ using HTTP Basic auth to extract hostname, version, and uptime from the admin console HTML. VulnerabilityService is the main exploit engine. For CVE-2015-5254, it accepts a user-provided Base64 serialized payload, decodes it, wraps it into an ActiveMQObjectMessage, and sends it over OpenWire/JMS to a chosen queue on tcp://<host>:<port> (default 61616), enabling broker-side deserialization when the message is processed/viewed. For CVE-2016-3088, it performs a PUT to /fileserver/<random>.txt and then a MOVE to file:///etc/cron.d/root, planting a cron entry that launches a Perl reverse shell back to the operator. This is a real exploitation path, not just a detector, but it depends on vulnerable behavior and elevated target privileges. The repository also includes support for CVE-2022-41678 workflows. Although the provided content truncates some of the implementation, the UI and service references clearly show functionality to write a default or custom webshell and then execute commands through it, with selectable methods such as auto, log4j2, and jfr. The included JfrTemplate.java contains a large embedded JFR configuration template, indicating one exploitation path abuses JFR-related file write/config behavior. BeanXmlPanel generates Spring BeanXML payloads using java.lang.ProcessBuilder for arbitrary command execution, likely intended to support XML-based ActiveMQ exploitation such as CVE-2023-46604-style xbean loading. The code also contains logic for a Jolokia-based probe labeled CVE-2026-34197 that sends an addNetworkConnector request with a vm://evil?brokerConfig=xbean:<xmlServer> argument, causing the target to fetch attacker-controlled XML from an external server. Network and fingerprintable artifacts are abundant: HTTP(S) access to the target web console and admin paths, OpenWire TCP access to port 61616, PUT/MOVE requests to /fileserver/, file destinations like file:///etc/cron.d/root, attacker XML hosting URLs, and Basic Authorization headers. The GUI exposes global custom headers and proxy settings, allowing the operator to tune requests and route traffic through a local proxy. Overall, this is an operational multi-CVE ActiveMQ exploitation toolkit with a GUI front end, combining reconnaissance, authenticated checks, payload generation, deserialization delivery, arbitrary file write abuse, XML-based RCE testing, and webshell management.

This repository contains a Python exploit script (CVE-2016-3088.py) targeting Apache ActiveMQ versions 5.x up to 5.14.0, exploiting CVE-2016-3088. The exploit works by uploading a base64-encoded JSP webshell (or a user-supplied script) to the target's /fileserver/ endpoint, then moving it to the /webapps/admin/ directory using a crafted HTTP MOVE request. Once in place, the attacker can access the webshell via the /admin/<random>.jsp URL and execute commands remotely. The script checks for vulnerability by attempting to upload a file and expects a 204 response code for success. The README.md provides usage instructions, requirements, and example output. The exploit is operational, providing a working webshell for remote command execution, and can optionally use a custom payload script. The main attack vector is network-based, targeting the HTTP interface of ActiveMQ. Key endpoints include the /fileserver/ upload URL, the /admin/ webshell access URL, and the filesystem path where the webshell is placed.

This repository contains a single Metasploit module (modules/exploits/multi/http/apache_activemq_upload_jsp.rb) that exploits CVE-2016-3088, a vulnerability in Apache ActiveMQ 5.x before 5.14.0. The exploit leverages the Fileserver web application, which allows unauthenticated or weakly authenticated users to upload and move files via HTTP PUT and MOVE requests. The module uploads a JSP web shell and a Java payload (JAR), then triggers the JSP to execute the payload, resulting in remote code execution on the target server. The exploit requires HTTP Basic Authentication credentials (default: admin/admin) and targets the management interface, typically on port 8161. The module is weaponized, allowing the attacker to select and deliver arbitrary Metasploit payloads. The code is written in Ruby and is structured as a standard Metasploit exploit module, with clear separation of initialization, exploitation, and cleanup logic. Key endpoints include /fileserver/<filename> for file upload, /admin/test/ for installation path discovery, and /webapps/api/ or /webapps/admin/ as upload destinations for the web shell.

This repository contains a Python exploit script (CVE-2016-3088.py) targeting Apache ActiveMQ servers vulnerable to CVE-2016-3088. The exploit attempts to access the '/fileserver' and '/api' endpoints, checks for default credentials (admin:admin), and determines the ActiveMQ version. If the target is vulnerable, it uploads a JSP webshell via a PUT request and then moves it to a web-accessible directory using a MOVE request. The webshell allows remote command execution via HTTP requests. The repository also includes a brief README with usage instructions. The exploit is operational, providing a working payload and automating the exploitation process for vulnerable ActiveMQ instances.

This repository is a Go-based tool for detecting and exploiting vulnerabilities in Apache ActiveMQ instances. Its primary capabilities are: 1. Detection of default credentials on the ActiveMQ web admin console by attempting HTTP Basic Auth with common default values (admin/123456 and admin/admin). 2. Exploitation of the arbitrary file write vulnerability (CVE-2016-3088) by uploading a JSP webshell to the server's webapps directory using HTTP PUT and MOVE methods, then verifying successful exploitation by accessing the shell. The tool supports both single-target and batch scanning modes, with targets specified via command-line arguments or a file (url.txt). The main entry point is main.go, which invokes the scanning logic in DataHandle/Scan.go. The code is modular, with separate files for HTTP requests, configuration parsing, and vulnerability checks. The payload used is a simple JSP script that prints a known string, confirming code execution. Endpoints targeted include the ActiveMQ admin console (/admin), the system properties page (/admin/test/systemProperties.jsp), the file upload endpoint (/fileserver/123.txt), and the location where the webshell is written (/api/s.jsp). The tool is operational and can be used for both vulnerability assessment and exploitation of unprotected or misconfigured ActiveMQ servers.

This repository contains a Python exploit script (ActiveMQ_putshell.py) targeting Apache ActiveMQ servers vulnerable to CVE-2016-3088. The exploit leverages a path traversal vulnerability in the fileserver component to upload a JSP webshell to the /admin/ directory of the target server. The script first attempts to determine the correct file path using a crafted PUT request, then uploads a JSP payload as a .txt file, and finally uses the HTTP MOVE method to relocate the payload to a web-accessible location. The payload is a JSP webshell that allows remote command execution when accessed with the correct password parameter. The exploit requires the target to be accessible over HTTP and to have default or known credentials. The repository consists of the main exploit script and a README file with usage instructions.