CVE-2023-46604-LAB

CVE-2023-46604 – Apache ActiveMQ RCE OpenWire Protocol This repository documents a lab environment used to understand and detect the CVE-2023-46604 vulnerability affecting Apache ActiveMQ. The goal of this project: Understand how the exploit behaves at the protocol level Capture malicious OpenWir...

activemq-cve-2023-46604-lab

此存储库没有 README。...

CVE-2026-34197

CVE-2026-34197 通过 Jolokia API 实现 Apache ActiveMQ 远程代码执行...

CVE-2026-34197-payload-Apache-ActiveMQ-

ActiveMQ Jolokia RCE 漏洞复现指南 本仓库提供了一个基于 Apache ActiveMQ 暴露的 Jolokia API 接口（/api/jolokia/）的远程代码执行 RCE 漏洞复现环境和利用脚本。 通过调用 addNetworkConnector 操作，强制 ActiveMQ 解析恶意构造的远程 Spring XML 配置文件，从而利用 MethodInvokingFactoryBean 执行系统命令。 📁 包含文件 payload.py : 利用主脚本，发送带有动态 Broker 名称的 HTTP POST 请求。 payload.xml : 恶意的...

CVE-2026-74761

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2;...

CVE-2026-74761 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2;...

CVE-2026-74761

CVE-2026-74761 is an improper input validation flaw in the TopicRegion component of Apache ActiveMQ (Broker, All, and standalone). An authenticated client can spoof the clientId when removing a durable topic subscription, potentially allowing removal of another client's subscription. Affected ver...

EUVD-2026-74829

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2;...

CVE-2026-74761 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2;...

ActiveMQ_putshell-CVE-2016-3088

ActiveMQputshell-CVE-2016-3088- ActiveMQputshell直接获取webshell Usage： python3 ActiveMQputshell.py -u url...

CVE-2023-46604_ActiveMQ_RCE_Recurrence

1、Navega a activemq/bin, selecciona x64 o x32, y ejecuta activemq.bin con permisos de administrador. Accede a admin bajo el puerto 8161, credenciales: admin/admin. Si no se puede iniciar, verifica si el puerto está ocupado; modifica activemq.xml en conf. En mi máquina, el puerto MQTT estaba...

CVE-2026-34197

CVE-2026-34197 — Apache ActiveMQ Classic 通过 Jolokia API 实现远程代码执行 TL;DR Apache ActiveMQ Classic 中存在一个远程代码执行 漏洞，攻击者可通过 Jolokia API（/api/jolokia/）调用 addNetworkConnectorString MBean 操作来执行任意代码。攻击者嵌入一个指向远程 Spring XML 文件的恶意 brokerConfig 参数，ActiveMQ 会获取并解析该文件，从而实例化任意 Java 对象并实现代码执行。 在 ActiveMQ 6.0.0 至...

CVE-2016-3088

CVE-2016-3088 Statement 一个基于Python的CVE-2016-3088利用脚本。 这是我的第一个脚本，所以可能有些地方不太合适。 但在我测试时它似乎运行正常。 Discription 该脚本可以在渗透CVE-2016-3088时省去抓包步骤， 从而让我们直接写入和移动文件。 Usage root@kitploit: python CVE-2016-3088.py --url http://ip:port/ --path absolutepath --script filename.txt 参数--script是可选的，如果不带该参数运行程序，它将使用内置的有效载...

ActiveMQ_RCE_Pro_Max

ActiveMQRCEGUI Enhanced version, short for Pro Max Version v1.0.3 Added version identification Added vulnerability version verification v1.0.2 Added proxy Removed Help button...

CVE-2026-34197

CVE-2026-34197 — Apache ActiveMQ RCE 通过 Jolokia API 描述 CVE-2026-34197 是 Apache ActiveMQ Classic 中的一个远程代码执行（RCE）漏洞，允许攻击者通过 Web 控制台中暴露的 Jolokia API 在服务器操作系统上执行任意命令。 该漏洞已存在超过 13 年，源于多个组件之间的交互：Jolokia（HTTP-JMX 桥接）、ActiveMQ 的 MBeans、网络连接器和 VM 传输。 漏洞信息...

cve-2023-46604

Apache ActiveMQ CVE-2023-46604 CVE-2023-46604 is a widely exploited vulnerability that appears on CISA's KEV list. This go-exploit implementation can execute a reverse shell on the targets using a Nashorn payload, or download a binary to the target and execute it. Compiling To build the exploit...

ActiveMQ-RCE

ActiveMQ RCE Effect version verison open -a calculator Open a http server root@kitploit: python3 -m http.server Run the Main.java file change the address as needed...

activemq-rce-cve-2023-46604

README simple analysis for CVE-2023-46604 https://thinkycx.me/2024-04-19-activemq-cve-2023-46604-analysis.html...

PT-2026-88926

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2;...

ExploitScript-CVE-2023-46604

ExploitScript-CVE-2023-46604 Disclaimer This repository contains proof-of-concept code for CVE-2023-466064 and is intended strictly for educational purposes. The authors and contributors do not endorse any illegal activity. The information presented here is for academic, security research, and...