Apache ActiveMQ 5.17.3, vulnerable to CVE-2023-46604: an OpenWire exception response can name any class with a String constructor, so the broker builds a Spring ClassPathXmlApplicationContext from the player's URL and runs the beans it defines.
Not startedDockercommit 4e9ca9bx86_64 · aarch64Secret
One-shot by default: solve each challenge from its prompt alone.
Opening guided steps or hints is recorded. A solve without them counts as stronger evidence for your skills.
Get code execution on the ActiveMQ broker through its OpenWire port and read /ctf/flag.
The brief for this lab lives in its repository.