Broker — HTB Writeup | The Hack Sparrow

Executive summary — Broker is an Easy Linux box built around a well-known flaw: Apache ActiveMQ 5.15.15 is vulnerable to CVE-2023-46604, a critical unauthenticated RCE in the OpenWire protocol (port 61616). After a shell as activemq, sudo -l shows we can run nginx as root with any config: we stand up an nginx with WebDAV (PUT) rooted at / to write our key into /root/.ssh/authorized_keys. Path: ActiveMQ RCE → nginx sudo → root.

Platform	Hack The Box
Operating system	Linux
Difficulty	Easy
Status	Retired
Target IP	`10.129.12.34`

Attack map

[61616] Apache ActiveMQ 5.15.15 (OpenWire) → CVE-2023-46604 (unauth RCE)
   │  exploit sends remote XML → Spring ClassPathXmlApplicationContext
   ▼
[SHELL]  activemq  (user.txt)
   │  sudo -l → (ALL) NOPASSWD /usr/sbin/nginx
   ▼
[ROOT]  nginx with malicious config (root / + WebDAV PUT) → write authorized_keys

1. Reconnaissance

We run nmap against the messaging/ActiveMQ ports plus the usual ones so we don't miss anything in the stack:

nmap -sCV -p 22,80,1883,5672,8161,61613,61614,61616 10.129.12.34

Relevant results:

Port	Service	Version
`22`	SSH	OpenSSH 8.9p1
`80`	HTTP	nginx 1.18.0
`61616`	ActiveMQ (OpenWire)	5.15.15

What matters is port 61616 running Apache ActiveMQ 5.15.15: that exact version is vulnerable to CVE-2023-46604, a critical unauthenticated RCE disclosed in late 2023 and actively exploited in the wild (including ransomware campaigns) within days of publication.

Resumen ejecutivo — Broker es un Linux Easy centrado en una vulnerabilidad muy sonada: Apache ActiveMQ 5.15.15 es vulnerable a CVE-2023-46604, un RCE critico sin autenticacion en el protocolo OpenWire (puerto 61616). Tras conseguir shell como activemq, sudo -l revela que podemos ejecutar nginx como root con cualquier configuracion: montamos un nginx con WebDAV (PUT) y raiz en / para escribir nuestra clave en /root/.ssh/authorized_keys. Recorrido ActiveMQ RCE → nginx sudo → root.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.12.34`

Mapa del ataque

[61616] Apache ActiveMQ 5.15.15 (OpenWire) → CVE-2023-46604 (RCE sin auth)
   │  exploit envia XML remoto → Spring ClassPathXmlApplicationContext
   ▼
[SHELL]  activemq  (user.txt)
   │  sudo -l → (ALL) NOPASSWD /usr/sbin/nginx
   ▼
[ROOT]  nginx con config maliciosa (root / + PUT WebDAV) → escribir authorized_keys

1. Reconocimiento

Lanzamos nmap sobre los puertos de servicios de mensajeria y ActiveMQ, ademas de los habituales, para no perdernos nada del stack:

nmap -sCV -p 22,80,1883,5672,8161,61613,61614,61616 10.129.12.34

Resultados relevantes:

Puerto	Servicio	Version
`22`	SSH	OpenSSH 8.9p1
`80`	HTTP	nginx 1.18.0
`61616`	ActiveMQ (OpenWire)	5.15.15

Lo importante es el puerto 61616 con Apache ActiveMQ 5.15.15: esa version concreta es vulnerable a CVE-2023-46604, un RCE critico sin autenticacion publicado a finales de 2023 y explotado activamente en el mundo real (incluido en campañas de ransomware) muy poco despues de su divulgacion.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.