Sploitus

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Activemq

gitee Β· 2020-06-12

Exploit Code

MARKDOWN2 lines
## https://sploitus.com/exploit?id=D31688EF-BA8C-5A64-A847-FBAEB2132E2A
This repository is an offensive tool for collecting or writing various vulnerability PoCs (proofs of concept) and exploits. The primary tool in this repository is a Python script named `ActiveMQExP/ActiveMQExPV1.0.py`, which is designed to exploit a vulnerability in Apache ActiveMQ, specifically CVE-2016-3088. This vulnerability allows an attacker to upload a malicious file to the ActiveMQ server, which can lead to remote code execution. The script takes several parameters, including the URL of the ActiveMQ server, the username, and the password. It also allows the user to specify the path where the malicious file will be uploaded. The script uses the `urlparse` and `urlunparse` functions to parse and construct URLs, and it employs the `socket` module to establish a connection to the ActiveMQ server. The script also uses the `base64` module to encode and decode data. The `ActiveMqExpTool` class in the script is responsible for handling the exploit process. The script is designed to be used in a controlled environment, such as a testing lab, and should not be used in a production environment without proper authorization and testing.