Wassup MOM? Owning the Message Oriented Middleware
summary
Claims a practical audit of JMS security with working exploits: an attacker uses JMSDigger to brute force credentials, decrypt ActiveMQ stored passwords at roughly 1 million decryptions in 240s on a single thread, dump queues via JMS queue browsers, create and delete durable subscribers, and exploit default unauthenticated web admin on ActiveMQ (61616 open, default creds common). Demonstrations show tools and techniques that actually retrieve live messages, bypass JMS auth, and cause data exfiltration or DoS.
AI-written summary · about
chapters (21)
- 0:00Start
- 0:16Enterprise Messaging Security
- 0:35Agenda
- 2:41Enterprise Messaging
- 4:16How a Typical Enterprise Messaging Application Looks like
- 6:52Cues and Topics
- 19:37Pre-Exploitation Phase
- 22:58Authentication Schemes
- 23:22Simple Authentication Plugin
- 23:45Activemq Simple Authentication
- 26:09Jmfs and Its Encryption
- 27:17Jazz Based Authentication
- 28:30Login Failure
- 30:06Retrieve the Messages from the Message Broker
- 31:18The Sql Injection Vulnerability
- 32:44Queue Browser
- 33:26Dump Destinations
- 37:18Byte Messages
- 39:48Demo
- 40:20How To Create Durable Subscribers
- 47:49Active Mq Administration Page
related talks
49mPwning Your Java Messaging With Deserialization Vulnerabilities
34mHacking the Oracle Application Framework
58mExploiting web messaging implementations
23mMight As Well JUMP: Exploit Development For Java Serialization
49mActiveMQ - Journey to 1 Billion msg/day
14mPractical Attacks on a Decentralized Secure Messenger Session
48mA Journey From JNDI/LDAP Manipulation to Remote Code Execution Dream Land
24mSecurity – only developers can make it proactive