In the MQTT protocol, there are three roles and one main concept. The three roles are Publisher, Subscriber, and Broker, with the main concept being Topic.

The sender of the message is called the Publisher, while the receiver is called the Subscriber. Both the sender and subscriber connect to the Broker to publish or subscribe to messages. The Broker generally serves as the server, and the container storing messages is the Topic. The Publisher sends messages to the Topic, and the Subscriber must first “subscribe to the Topic” before receiving messages. In each subscription, the Subscriber can receive all messages from the Topic.

The flowchart of the MQTT protocol is as follows:

This article does not go into too much detail about the protocol; those interested can refer to the citations at the end.

Based on its characteristics, the following attack points can be expanded:

1. Authorization: Anonymous connection issues; anonymous access means anyone can publish or subscribe to messages. If sensitive data or commands are present, it could lead to information leakage or malicious commands from attackers;

2. Transmission: Default unencrypted messages can be subjected to man-in-the-middle attacks, allowing retrieval of verified usernames and passwords;

3. Authentication: Weak password issues; weak passwords can be brute-forced, posing security risks;

4. Application: Plaintext configuration on the subscriber side can lead to leakage of verified usernames and passwords;

5. Vulnerabilities: Defects in the server software can be exploited, or improper parsing of content on the subscriber or server side can create security vulnerabilities, affecting the entire system.

Utilization of MQTT

There are currently open-source tools targeting MQTT, primarily focusing on mqtt-pwn. This tool is powerful and easy to use. The GitHub address is

https://github.com/akamai-threat-research/mqtt-pwn, and the documentation can be found at

https://mqtt-pwn.readthedocs.io/en/latest/.

Tool Installation

Installing mqtt-pwn is straightforward. It can be installed directly on the local machine or used via Docker. The text will use the Docker method. First, ensure that Docker and Docker Compose are installed, then run the following commands for installation:

git clone https://github.com/akamai-threat-research/mqtt-pwn.git

cd mqtt-pwn

docker-compose up –build –detach

Run:

docker-compose ps

docker-compose run cli

Then you will see the mqtt-pwn interface.

MQTT Anonymous Access

Use the connect command of mqtt-pwn to connect. connect -h displays help information; other commands function similarly. When using, refer to the help and documentation to quickly familiarize yourself. For services with anonymous access, simply use connect -o host; this command also supports entering usernames and passwords. If no connection exception is displayed, it indicates a successful connection. After a successful connection, you can use system_info to view system information.

Next, you can check the topic information and other content. First, execute discovery and wait for “scan #1 has finished” to display. Then execute scans -i followed by the serial number, and then execute the topics command to see the topic information. The discovery command can use the -t parameter to set the timeout. The topics command can use the -l parameter to set the number of entries to view.

You can enter messages to view the content of the topic. Use -l to limit the number of entries, and -i to view the content of a specific message.

MQTT Username and Password Brute Force

Metasploit includes a brute force module for MQTT, but actual tests have shown that the effectiveness is not ideal. Here, we will continue to introduce mqtt-pwn. mqtt-pwn has a brute force function and comes with a simple dictionary to brute force MQTT usernames and passwords.

bruteforce –host host –port -uf user_dic -pf pass_dic

The default port is 1883, and the user and password dictionaries are located in the mqtt-pwn’s resources/wordlists folder.

For example, execute bruteforce –host 127.0.0.1 for brute forcing. After a successful brute force, you can use the obtained information to connect and operate, adding the username and password options when connecting.

mqtt-pwn also supports more features, such as Owntracks (GPS Tracker), Sonoff Exploiter, etc. Interested parties can refer to the documentation for testing.

Discoveries in Applications

In actual usage scenarios, we can capture verification information from traffic through man-in-the-middle hijacking. Below is the content captured by Wireshark.

In addition, since various languages have implemented MQTT clients, web applications also have WebSocket MQTT. This allows verification information to be obtained through web source code or network requests.

Server Vulnerabilities

Here are some historical MQTT vulnerabilities for reference.

CVE-2017-7296

CVE-2017-7650

CVE-2018-17614

CVE-2019-5432

CVE-2020-13849

Mosquitto Vulnerability List