5671,5672 - Pentesting AMQP

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Taarifa za Msingi

Kutoka kwa cloudamqp:

RabbitMQ ni programu ya kuorodhesha ujumbe inayojulikana pia kama wakala wa ujumbe au msimamizi wa foleni. Kwa kifupi; ni programu ambapo foleni zinafafanuliwa, ambazo maombi huunganisha ili kuhamisha ujumbe au ujumbe kadhaa.
Ujumbe unaweza kujumuisha aina yoyote ya taarifa. Kwa mfano, unaweza kuwa na taarifa kuhusu mchakato au kazi ambayo inapaswa kuanzishwa kwenye programu nyingine (ambayo inaweza hata kuwa kwenye seva nyingine), au inaweza kuwa ujumbe mfupi tu wa maandishi. Programu ya msimamizi wa foleni huhifadhi ujumbe hadi programu mpokeaji iunganishe na ichukue ujumbe kutoka kwenye foleni. Programu mpokeaji kisha inachakata ujumbe huo.
Ufafanuzi kutoka .

Bandari ya chaguo-msingi: 5672,5671

PORT     STATE SERVICE VERSION
5672/tcp open  amqp    RabbitMQ 3.1.5 (0-9)

Uorodheshaji

Kwa mkono

import amqp
#By default it uses default credentials "guest":"guest"
conn = amqp.connection.Connection(host="IP", port=5672, virtual_host="/")
conn.connect()
for k, v in conn.server_properties.items():
print(k, v)

Otomatiki

nmap -sV -Pn -n -T4 -p 5672 --script amqp-info IP

PORT     STATE SERVICE VERSION
5672/tcp open  amqp    RabbitMQ 3.1.5 (0-9)
| amqp-info:
|   capabilities:
|     publisher_confirms: YES
|     exchange_exchange_bindings: YES
|     basic.nack: YES
|     consumer_cancel_notify: YES
|   copyright: Copyright (C) 2007-2013 GoPivotal, Inc.
|   information: Licensed under the MPL.  See http://www.rabbitmq.com/
|   platform: Erlang/OTP
|   product: RabbitMQ
|   version: 3.1.5
|   mechanisms: PLAIN AMQPLAIN
|_  locales: en_US

Brute Force

Bandari nyingine za RabbitMQ

In https://www.rabbitmq.com/networking.html you can find that rabbitmq uses several ports:

Angalia pia

4222 Pentesting Nats

Shodan

  • AMQP

Marejeo

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks