mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2025-12-26 04:41:55 -08:00
81 lines
3.3 KiB
Markdown
81 lines
3.3 KiB
Markdown
# AWS - MQ Enum
|
|
|
|
{{#include ../../../banners/hacktricks-training.md}}
|
|
|
|
## Amazon MQ
|
|
|
|
### Introduction to Message Brokers
|
|
|
|
**Message brokers** serve as intermediaries, facilitating communication between different software systems, which may be built on varied platforms and programmed in different languages. **Amazon MQ** simplifies the deployment, operation, and maintenance of message brokers on AWS. It provides managed services for **Apache ActiveMQ** and **RabbitMQ**, ensuring seamless provisioning and automatic software version updates.
|
|
|
|
### AWS - RabbitMQ
|
|
|
|
RabbitMQ is a prominent **message-queueing software**, also known as a _message broker_ or _queue manager_. It's fundamentally a system where queues are configured. Applications interface with these queues to **send and receive messages**. Messages in this context can carry a variety of information, ranging from commands to initiate processes on other applications (potentially on different servers) to simple text messages. The messages are held by the queue-manager software until they are retrieved and processed by a receiving application. AWS provides an easy-to-use solution for hosting and managing RabbitMQ servers.
|
|
|
|
### AWS - ActiveMQ
|
|
|
|
Apache ActiveMQ® is a leading open-source, Java-based **message broker** known for its versatility. It supports multiple industry-standard protocols, offering extensive client compatibility across a wide array of languages and platforms. Users can:
|
|
|
|
- Connect with clients written in JavaScript, C, C++, Python, .Net, and more.
|
|
- Leverage the **AMQP** protocol to integrate applications from different platforms.
|
|
- Use **STOMP** over websockets for web application message exchanges.
|
|
- Manage IoT devices with **MQTT**.
|
|
- Maintain existing **JMS** infrastructure and extend its capabilities.
|
|
|
|
ActiveMQ's robustness and flexibility make it suitable for a multitude of messaging requirements.
|
|
|
|
## Enumeration
|
|
|
|
```bash
|
|
# List brokers
|
|
aws mq list-brokers
|
|
|
|
# Get broker info
|
|
aws mq describe-broker --broker-id <broker-id>
|
|
## Find endpoints in .BrokerInstances
|
|
## Find if public accessible in .PubliclyAccessible
|
|
|
|
# List usernames (only for ActiveMQ)
|
|
aws mq list-users --broker-id <broker-id>
|
|
|
|
# Get user info (PASSWORD NOT INCLUDED)
|
|
aws mq describe-user --broker-id <broker-id> --username <username>
|
|
|
|
# Lits configurations (only for ActiveMQ)
|
|
aws mq list-configurations
|
|
## Here you can find if simple or LDAP authentication is used
|
|
|
|
# Creacte Active MQ user
|
|
aws mq create-user --broker-id <value> --password <value> --username <value> --console-access
|
|
```
|
|
|
|
> [!WARNING]
|
|
> TODO: Indicate how to enumerate RabbitMQ and ActiveMQ internally and how to listen in all queues and send data (send PR if you know how to do this)
|
|
|
|
## Privesc
|
|
|
|
{{#ref}}
|
|
../aws-privilege-escalation/aws-mq-privesc/README.md
|
|
{{#endref}}
|
|
|
|
## Unauthenticated Access
|
|
|
|
{{#ref}}
|
|
../aws-unauthenticated-enum-access/aws-mq-unauthenticated-enum/README.md
|
|
{{#endref}}
|
|
|
|
## Persistence
|
|
|
|
If you know the credentials to access the RabbitMQ web console, you can create a new user qith admin privileges.
|
|
|
|
## References
|
|
|
|
- [https://www.cloudamqp.com/blog/part1-rabbitmq-for-beginners-what-is-rabbitmq.html](https://www.cloudamqp.com/blog/part1-rabbitmq-for-beginners-what-is-rabbitmq.html)
|
|
- [https://activemq.apache.org/](https://activemq.apache.org/)
|
|
|
|
{{#include ../../../banners/hacktricks-training.md}}
|
|
|
|
|
|
|
|
|