mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-27 07:01:09 +00:00
167 lines
8.9 KiB
Markdown
167 lines
8.9 KiB
Markdown
# 1883 - Kupima Usalama wa MQTT (Mosquitto)
|
|
|
|
<details>
|
|
|
|
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
|
|
|
Njia nyingine za kusaidia HackTricks:
|
|
|
|
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
|
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
|
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
|
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
|
|
|
</details>
|
|
|
|
### [WhiteIntel](https://whiteintel.io)
|
|
|
|
<figure><img src="../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
|
|
|
[**WhiteIntel**](https://whiteintel.io) ni injini ya utaftaji inayotumia **dark-web** ambayo inatoa huduma za **bure** za kuangalia ikiwa kampuni au wateja wake wame **vamiwa** na **malware za kuiba**.
|
|
|
|
Lengo kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulio ya ransomware yanayotokana na malware za kuiba taarifa.
|
|
|
|
Unaweza kutembelea tovuti yao na kujaribu injini yao **bure** kwa:
|
|
|
|
{% embed url="https://whiteintel.io" %}
|
|
|
|
***
|
|
|
|
## Taarifa Msingi
|
|
|
|
**Usafirishaji wa Telemetri ya MQ (MQTT)** unajulikana kama **itifaki ya ujumbe wa kuchapisha/kusikiliza** ambayo inajulikana kwa unyenyekevu wake wa kipekee na uzito wake mdogo. Itifaki hii imeundwa mahsusi kwa mazingira ambapo vifaa vina uwezo mdogo na vinatumika kwenye mitandao ambayo inajulikana kwa upungufu wa wigo wa bandari, kuchelewa kwa juu, au uhusiano usioaminika. Malengo makuu ya MQTT ni pamoja na kupunguza matumizi ya wigo wa mtandao na kupunguza mahitaji kwenye rasilimali za kifaa. Aidha, lengo lake ni kudumisha mawasiliano yanayoweza kutegemewa na kutoa kiwango fulani cha uhakikisho wa utoaji. Malengo haya hufanya MQTT kuwa sahihi sana kwa uga unaokua wa **mawasiliano ya mashine-kwa-mashine (M2M)** na **Intaneti ya Vitu (IoT)**, ambapo ni muhimu kuunganisha vifaa vingi kwa ufanisi. Zaidi ya hayo, MQTT ni muhimu sana kwa programu za simu, ambapo kuhifadhi wigo na maisha ya betri ni muhimu.
|
|
|
|
**Bandari ya default:** 1883
|
|
```
|
|
PORT STATE SERVICE REASON
|
|
1883/tcp open mosquitto version 1.4.8 syn-ack
|
|
```
|
|
## Ukaguzi wa trafiki
|
|
|
|
Wakati pakiti ya **CONNECT** inapopokelewa na wakala wa MQTT, pakiti ya **CONNACK** hutumwa kujibu. Pakiti hii ina msimbo wa kurudi ambao ni muhimu kwa kuelewa hali ya uunganisho. Msimbo wa kurudi wa **0x00** una maana kuwa anwani za siri zimekubaliwa, ikionyesha uunganisho uliofanikiwa. Kwa upande mwingine, msimbo wa kurudi wa **0x05** unamaanisha kuwa anwani za siri si sahihi, hivyo kuzuia uunganisho.
|
|
|
|
Kwa mfano, ikiwa wakala atakataa uunganisho kutokana na anwani za siri zisizo sahihi, hali itaonekana kama ifuatavyo:
|
|
```
|
|
{
|
|
"returnCode": "0x05",
|
|
"description": "Connection Refused, not authorized"
|
|
}
|
|
```
|
|
.png>)
|
|
|
|
### [**Kuvunja Nguvu MQTT**](../generic-methodologies-and-resources/brute-force.md#mqtt)
|
|
|
|
## Pentesting MQTT
|
|
|
|
**Uthibitisho ni hiari kabisa** na hata kama uthibitisho unafanywa, **encryption haijatumika kwa chaguo-msingi** (mikopo hutumwa kwa maandishi wazi). Mashambulizi ya MITM bado yanaweza kutekelezwa kuiba nywila.
|
|
|
|
Kuunganisha kwenye huduma ya MQTT unaweza kutumia: [https://github.com/bapowell/python-mqtt-client-shell](https://github.com/bapowell/python-mqtt-client-shell) na kujisajili kwenye mada zote kwa kufanya:
|
|
```
|
|
> connect (NOTICE that you need to indicate before this the params of the connection, by default 127.0.0.1:1883)
|
|
> subscribe "#" 1
|
|
> subscribe "$SYS/#"
|
|
```
|
|
Unaweza pia kutumia [**https://github.com/akamai-threat-research/mqtt-pwn**](https://github.com/akamai-threat-research/mqtt-pwn)
|
|
|
|
Unaweza pia kutumia:
|
|
```bash
|
|
apt-get install mosquitto mosquitto-clients
|
|
mosquitto_sub -t 'test/topic' -v #Subscribe to 'test/topic'
|
|
mosquitto_sub -h <host-ip> -t "#" -v #Subscribe to ALL topics.
|
|
```
|
|
Au unaweza **kutekeleza nambari hii ili kujaribu kuunganisha kwenye huduma ya MQTT bila uthibitishaji, kusajili kila mada na kuzisikiliza**:
|
|
```python
|
|
#This is a modified version of https://github.com/Warflop/IOT-MQTT-Exploit/blob/master/mqtt.py
|
|
import paho.mqtt.client as mqtt
|
|
import time
|
|
import os
|
|
|
|
HOST = "127.0.0.1"
|
|
PORT = 1883
|
|
|
|
def on_connect(client, userdata, flags, rc):
|
|
client.subscribe('#', qos=1)
|
|
client.subscribe('$SYS/#')
|
|
|
|
def on_message(client, userdata, message):
|
|
print('Topic: %s | QOS: %s | Message: %s' % (message.topic, message.qos, message.payload))
|
|
|
|
def main():
|
|
client = mqtt.Client()
|
|
client.on_connect = on_connect
|
|
client.on_message = on_message
|
|
client.connect(HOST, PORT)
|
|
client.loop_start()
|
|
#time.sleep(10)
|
|
#client.loop_stop()
|
|
|
|
if __name__ == "__main__":
|
|
main()
|
|
```
|
|
## Taarifa zaidi
|
|
|
|
kutoka hapa: [https://morphuslabs.com/hacking-the-iot-with-mqtt-8edaf0d07b9b](https://morphuslabs.com/hacking-the-iot-with-mqtt-8edaf0d07b9b)
|
|
|
|
### Mfano wa Kuchapisha/Kusikiliza <a href="#b667" id="b667"></a>
|
|
|
|
Mfano wa kuchapisha/kusikiliza unajumuisha:
|
|
|
|
* **Mchapishaji**: huchapisha ujumbe kwa moja (au zaidi) ya mada katika mpatanishi.
|
|
* **Msikilizaji**: husikiliza moja (au zaidi) ya mada katika mpatanishi na hupokea ujumbe wote uliotumwa na mchapishaji.
|
|
* **Mpatanishi**: huarifu ujumbe wote kutoka kwa wachapishaji kwa wasikilizaji.
|
|
* **Mada**: inajumuisha kiwango kimoja au zaidi kilichotenganishwa na mstari wa mbele (k.m., /smartshouse/livingroom/temperature).
|
|
|
|
### Muundo wa Pakiti <a href="#f15a" id="f15a"></a>
|
|
|
|
Kila pakiti ya MQTT ina kichwa kilichofungwa (Mchoro 02).Mchoro 02: Kichwa Kilichofungwa
|
|
|
|
|
|
|
|
### Aina za Pakiti
|
|
|
|
* CONNECT (1): Kuanzishwa na mteja kuomba uhusiano kwa seva.
|
|
* CONNACK (2): Kuthibitisha seva ya uhusiano uliofanikiwa.
|
|
* PUBLISH (3): Hutumiwa kutuma ujumbe kutoka kwa mteja kwenda kwa seva au kinyume chake.
|
|
* PUBACK (4): Kuthibitisha pakiti ya PUBLISH.
|
|
* PUBREC (5): Sehemu ya itifaki ya utoaji ujumbe ikidhibitisha ujumbe umepokelewa.
|
|
* PUBREL (6): Hakikisho zaidi katika utoaji wa ujumbe, ikionyesha kutolewa kwa ujumbe.
|
|
* PUBCOMP (7): Sehemu ya mwisho ya itifaki ya utoaji ujumbe, ikionyesha kukamilika.
|
|
* SUBSCRIBE (8): Ombi la mteja kusikiliza ujumbe kutoka kwa mada.
|
|
* SUBACK (9): Kuthibitisha ya seva ya ombi la SUBSCRIBE.
|
|
* UNSUBSCRIBE (10): Ombi la mteja kuacha kupokea ujumbe kutoka kwa mada.
|
|
* UNSUBACK (11): Majibu ya seva kwa ombi la UNSUBSCRIBE.
|
|
* PINGREQ (12): Ujumbe wa moyo wa kupelekwa na mteja.
|
|
* PINGRESP (13): Majibu ya seva kwa ujumbe wa moyo.
|
|
* DISCONNECT (14): Kuanzishwa na mteja kumaliza uhusiano.
|
|
* Thamani mbili, 0 na 15, zimewekwa kama zimehifadhiwa na matumizi yake ni marufuku.
|
|
|
|
## Shodan
|
|
|
|
* `port:1883 MQTT`
|
|
|
|
### [WhiteIntel](https://whiteintel.io)
|
|
|
|
<figure><img src="../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
|
|
|
[**WhiteIntel**](https://whiteintel.io) ni injini ya utaftaji inayotumiwa na **dark-web** inayotoa huduma za **bure** kuchunguza ikiwa kampuni au wateja wake wameathiriwa na **malware za wizi**.
|
|
|
|
Lengo kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulio ya ransomware yanayotokana na malware za kuiba habari.
|
|
|
|
Unaweza kutembelea tovuti yao na kujaribu injini yao kwa **bure** hapa:
|
|
|
|
{% embed url="https://whiteintel.io" %}
|
|
|
|
<details>
|
|
|
|
<summary><strong>Jifunze kuhusu kuvamia AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
|
|
|
Njia nyingine za kusaidia HackTricks:
|
|
|
|
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
|
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
|
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
|
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Shiriki mbinu zako za kuvamia kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|