Files
hacktricks-cloud/src/pentesting-cloud/aws-security/aws-services/aws-mq-enum.md
2025-10-09 12:26:40 +02:00

81 lines
3.3 KiB
Markdown

# AWS - MQ Enum
{{#include ../../../banners/hacktricks-training.md}}
## Amazon MQ
### Introduction to Message Brokers
**Message brokers** serve as intermediaries, facilitating communication between different software systems, which may be built on varied platforms and programmed in different languages. **Amazon MQ** simplifies the deployment, operation, and maintenance of message brokers on AWS. It provides managed services for **Apache ActiveMQ** and **RabbitMQ**, ensuring seamless provisioning and automatic software version updates.
### AWS - RabbitMQ
RabbitMQ is a prominent **message-queueing software**, also known as a _message broker_ or _queue manager_. It's fundamentally a system where queues are configured. Applications interface with these queues to **send and receive messages**. Messages in this context can carry a variety of information, ranging from commands to initiate processes on other applications (potentially on different servers) to simple text messages. The messages are held by the queue-manager software until they are retrieved and processed by a receiving application. AWS provides an easy-to-use solution for hosting and managing RabbitMQ servers.
### AWS - ActiveMQ
Apache ActiveMQ® is a leading open-source, Java-based **message broker** known for its versatility. It supports multiple industry-standard protocols, offering extensive client compatibility across a wide array of languages and platforms. Users can:
- Connect with clients written in JavaScript, C, C++, Python, .Net, and more.
- Leverage the **AMQP** protocol to integrate applications from different platforms.
- Use **STOMP** over websockets for web application message exchanges.
- Manage IoT devices with **MQTT**.
- Maintain existing **JMS** infrastructure and extend its capabilities.
ActiveMQ's robustness and flexibility make it suitable for a multitude of messaging requirements.
## Enumeration
```bash
# List brokers
aws mq list-brokers
# Get broker info
aws mq describe-broker --broker-id <broker-id>
## Find endpoints in .BrokerInstances
## Find if public accessible in .PubliclyAccessible
# List usernames (only for ActiveMQ)
aws mq list-users --broker-id <broker-id>
# Get user info (PASSWORD NOT INCLUDED)
aws mq describe-user --broker-id <broker-id> --username <username>
# Lits configurations (only for ActiveMQ)
aws mq list-configurations
## Here you can find if simple or LDAP authentication is used
# Creacte Active MQ user
aws mq create-user --broker-id <value> --password <value> --username <value> --console-access
```
> [!WARNING]
> TODO: Indicate how to enumerate RabbitMQ and ActiveMQ internally and how to listen in all queues and send data (send PR if you know how to do this)
## Privesc
{{#ref}}
../aws-privilege-escalation/aws-mq-privesc/README.md
{{#endref}}
## Unauthenticated Access
{{#ref}}
../aws-unauthenticated-enum-access/aws-mq-unauthenticated-enum/README.md
{{#endref}}
## Persistence
If you know the credentials to access the RabbitMQ web console, you can create a new user qith admin privileges.
## References
- [https://www.cloudamqp.com/blog/part1-rabbitmq-for-beginners-what-is-rabbitmq.html](https://www.cloudamqp.com/blog/part1-rabbitmq-for-beginners-what-is-rabbitmq.html)
- [https://activemq.apache.org/](https://activemq.apache.org/)
{{#include ../../../banners/hacktricks-training.md}}