HackTricks
Search…
Pentesting
Powered By GitBook
1883 - Pentesting MQTT (Mosquitto)

Basic Information

MQTT stands for MQ Telemetry Transport. It is a publish/subscribe, extremely simple and lightweight messaging protocol, designed for constrained devices and low-bandwidth, high-latency or unreliable networks. The design principles are to minimise network bandwidth and device resource requirements whilst also attempting to ensure reliability and some degree of assurance of delivery. These principles also turn out to make the protocol ideal of the emerging “machine-to-machine” (M2M) or “Internet of Things” world of connected devices, and for mobile applications where bandwidth and battery power are at a premium.
Default port: 1883
1
PORT STATE SERVICE REASON
2
1883/tcp open mosquitto version 1.4.8 syn-ack
Copied!

Pentesting MQTT

Authentication is totally optional and even if authentication is being performed, encryption is not used by default (credentials are sent in clear text). MITM attacks can still be executed to steal passwords.
To connect to a MQTT service you can use: https://github.com/bapowell/python-mqtt-client-shell and subscribe yourself to all the topics doing:
1
> connect (NOTICE that you need to indicate before this the params of the connection, by default 127.0.0.1:1883)
2
> subscribe "#" 1
3
> subscribe "$SYS/#"
Copied!
Or you could run this code to try to connect to a MQTT service without authentication, subscribe to every topic and listen them:
1
#This is a modified version of https://github.com/Warflop/IOT-MQTT-Exploit/blob/master/mqtt.py
2
import paho.mqtt.client as mqtt
3
import time
4
import os
5
6
HOST = "127.0.0.1"
7
PORT = 1883
8
9
def on_connect(client, userdata, flags, rc):
10
client.subscribe('#', qos=1)
11
client.subscribe('$SYS/#')
12
13
def on_message(client, userdata, message):
14
print('Topic: %s | QOS: %s | Message: %s' % (message.topic, message.qos, message.payload))
15
16
def main():
17
client = mqtt.Client()
18
client.on_connect = on_connect
19
client.on_message = on_message
20
client.connect(HOST, PORT)
21
client.loop_start()
22
#time.sleep(10)
23
#client.loop_stop()
24
25
if __name__ == "__main__":
26
main()
Copied!

More information

The Publish/Subscribe Pattern

The publish/subscribe model is composed of:
    Publisher: publishes a message to one (or many) topic(s) in the broker.
    Subscriber: subscribes to one (or many) topic(s) in the broker and receives all the messages sent from the publisher.
    Broker: routes all the messages from the publishers to the subscribers.
    Topic: consists of one or more levels that are separated by a a forward slash (e.g., /smartshouse/livingroom/temperature).
Figure 01: The Publish/Subscribe Model

Packet Format

Every MQTT packet contains a fixed header (Figure 02).Figure 02: Fixed Header
The first field of the fixed header represents the type of the MQTT Packet. All packet types are listed in table 01.Table 01: MQTT Packet Types

Shodan

    port:1883 MQTT
Last modified 1yr ago