1414 - Pentesting IBM MQ
Previous1098/1099/1050 - Pentesting Java RMI - RMI-IIOPNext1433 - Pentesting MSSQL - Microsoft SQL Server
Last updated
Last updated
Learn & practice AWS Hacking: Learn & practice GCP Hacking:
IBM MQ is an IBM technology to manage message queues. As other message broker technologies, it is dedicated to receive, store, process and classify information between producers and consumers.
By default, it exposes IBM MQ TCP port 1414. Sometimes, HTTP REST API can be exposed on port 9443. Metrics (Prometheus) could also be accessed from TCP port 9157.
The IBM MQ TCP port 1414 can be used to manipulate messages, queues, channels, ... but also to control the instance.
IBM provides a large technical documentation available on .
A suggested tool for easy exploitation is , with Docker usage. The tool is actively using the Python library pymqi.
For a more manual approach, use the Python library . are needed.
IBM MQ dependencies needs to be installed and loaded:
Decompress (tar xvzf 9.0.0.4-IBM-MQC-LinuxX64.tar.gz).
Run sudo ./mqlicense.sh to accept licenses terms.
If you are under Kali Linux, modify the file
mqlicense.sh: remove/comment the following lines (between lines 105-110):
Install these packages:
Then, temporary add the .so files to LD: export LD_LIBRARY_PATH=/opt/mqm/lib64, before running other tools using these dependencies.
Simply use: sudo docker run --rm -ti leonjza/punch-q.
After, it can be used with punch-q command.
You can try to enumerate the queue manager name, the users, the channels and the queues with punch-q or pymqi.
Sometimes, there is no protection against getting the Queue Manager name:
punch-q is using an internal (modifiable) wordlist to find existing channels. Usage example:
It happens that some IBM MQ instances accept unauthenticated MQ requests, so --username / --password is not needed. Of course, access rights can also vary.
As soon as we get one channel name (here: DEV.ADMIN.SVRCONN), we can enumerate all other channels.
The enumeration can basically be done with this code snippet code/examples/dis_channels.py from pymqi:
... But punch-q also embed that part (with more infos!). It can be launch with:
There is a code snippet with pymqi (dis_queues.py) but punch-q permits to retrieve more pieces of info about the queues:
You can target queue(s)/channel(s) to sniff out / dump messages from them (non-destructive operation). Examples:
Do not hesitate to iterate on all identified queues.
You can find a list of PCF commands:
There is also a warning of the command in the docs: "Attention: This command allows a user to run an arbitrary command with mqm authority. If granted rights to use this command, a malicious or careless user could define a service which damages your systems or data, for example, by deleting essential files."
Note: always according to IBM MQ documentation (Administration Reference), there is also an HTTP endpoint at
/admin/action/qmgr/{qmgrName}/mqscto run the equivalent MQSC command for service creation (DEFINE SERVICE). This aspect is not covered yet here.
The service creation / deletion with PCF for remote program execution can be done by punch-q:
Example 1
In the logs of IBM MQ, you can read the command is successfully executed:
You can also enumerate existing programs on the machine (here /bin/doesnotexist ... does not exist):
Be aware that the program launch is asynchronous. So you need a second item to leverage the exploit (listener for reverse shell, file creation on different service, data exfiltration through network ...)
Example 2
For easy reverse shell, punch-q proposes also two reverse shell payloads :
One with bash
One with perl
Of course you can build a custom one with the execute command.
For bash:
For perl:
You can dig into the IBM MQ documentation and directly use pymqi python library to test specific PCF command not implemented in punch-q.
Example:
If you want to test the IBM MQ behavior and exploits, you can set up a local environment based on Docker:
Having an account on ibm.com and cloud.ibm.com.
Create a containerized IBM MQ with:
By default, the authentication is enabled, the username is admin and the password is passw0rd (Environment variable MQ_ADMIN_PASSWORD). Here, the queue manager name has been set to MYQUEUEMGR (variable MQ_QMGR_NAME).
You should have the IBM MQ up and running with its ports exposed:
The old version of IBM MQ docker images are at: https://hub.docker.com/r/ibmcom/mq/.
Create an account (IBMid) on .
Download IBM MQ libraries from . For Linux x86_64 it is 9.0.0.4-IBM-MQC-LinuxX64.tar.gz.
Then, you can clone the project : it contains interesting code snippets, constants, ... Or you can directly install the library with: pip install pymqi.
Clone the project then follow the readme for installation (pip install -r requirements.txt && python3 setup.py install).
Some details before continuing: IBM MQ can be controlled though multiple ways: MQSC, PCF, Control Command. Some general lists can be found in . (Programmable Command Formats) is what we are focused on to interact remotely with the instance. punch-q and furthermore pymqi are based on PCF interactions.
, and
.
One interesting command is MQCMD_CREATE_SERVICE and its documentation is available . It takes as argument a StartCommand pointing to a local program on the instance (example: /bin/sh).
If you cannot find the constant names, you can refer to the .
Example for (Decimal = 73). It needs the parameter MQCA_CLUSTER_NAME (Decimal = 2029) which can be * (Doc: ):
