HTB Linux Easy: Broker

Nmap

Initial Foothold

Enumerate HTTP (Port 61616)

ActiveMQ is running on port 61616. The version is 5.15.15, as disclosed by Nmap. We can use a Python PoC to gain shell access to the machine (modify poc.xml)

Priv Esc

Sudo -l output.

The Zimbra Nginx local root exploit PoC script can be used to escalate to root:

User.txt

Root.txt

You have PWNED

Sources

• Activemq PoC
• Priv-Esc