https://appl3b0y.com/tags/deserialization/ Recent content in Deserialization on appl3b0y Hugo en-us Thu, 04 Jun 2026 00:00:00 +0000 https://appl3b0y.com/writeups/broker/ Thu, 04 Jun 2026 00:00:00 +0000 https://appl3b0y.com/writeups/broker/ <h2 id="introduction">Introduction</h2> <p><strong>Broker</strong> is an easy Linux box built around a single, very topical vulnerability: <strong>CVE-2023-46604</strong>, the Apache ActiveMQ OpenWire remote code execution bug that made a lot of noise in late 2023. It is a clean, two-step machine: get RCE on the message broker, then abuse one over-permissive <code>sudo</code> rule to become root.</p> <p>The foothold is almost handed to us. The ActiveMQ web console uses default <code>admin:admin</code> credentials, which is enough to read the exact version (5.15.15) and confirm it is vulnerable. From there, the OpenWire protocol on <strong>61616</strong> lets us trigger a deserialization gadget that makes the broker fetch and execute a remote Spring XML, which runs our payload and returns a shell as the <code>activemq</code> user. Privesc is a textbook GTFOBins move: <code>activemq</code> can run <code>nginx</code> under <code>sudo</code>, so we start a root-owned nginx with WebDAV <code>PUT</code> enabled and simply write our SSH key into <code>/root/.ssh/authorized_keys</code>.</p>