TryHackMe — AOC2024: Day 24

Story Overview:

In the bustling town of Wareville, the joyous spirit of SOC-mas was nearly dimmed by a cunning cyber sabotage orchestrated by the infamous Mayor Malware. The town, proud of its investment in smart lighting and HVAC systems, fell victim to a malicious attack that left their smart systems unresponsive. The townspeople, concerned about the festive mood, turned to their hero, McSkidy, to unravel the mystery behind the malicious commands that disrupted their systems. Armed with knowledge of network protocols and a keen eye for detail, McSkidy embarked on a mission to restore light and warmth to Wareville, saving SOC-mas once again.

Learning Objectives:

• The basics of the MQTT protocol
• How to use Wireshark to analyze MQTT traffic
• Reverse engineering a simple network protocol

Introduction To MQTT Protocol:

Modern smart devices often rely on the MQTT (Message Queuing Telemetry Transport) protocol for communication. MQTT is a lightweight messaging protocol designed for resource-constrained environments like IoT systems. It uses a publish/subscribe model to facilitate communication between devices, making it ideal for smart home applications.

Here are the key components of the MQTT protocol:

• MQTT Clients: Devices such as sensors and controllers that publish or subscribe to messages.
• Example: A temperature sensor publishes temperature data, while an HVAC system subscribes to it to adjust heating or cooling.
• MQTT Broker: The central hub that receives messages from publishing clients and forwards them to subscribing clients based on topics of interest.
• Example: A broker forwards temperature data to the HVAC controller.
• MQTT Topics: Labels that categorize messages, allowing clients to subscribe to relevant data streams.
• Example: The topic “home/temperature” could carry temperature readings, while “home/lights” controls lighting.

By using Wireshark to analyze MQTT traffic, McSkidy could identify the commands sabotaging Wareville’s smart systems and reverse engineer the protocol to restore normal functionality.

Challenges:

In this task we are given to analyze the Message Queing Telemetry Transport (MQTT) Protocol which is used by IOT devices for communication or message passing using wireshark and turning on the light by analyzing previous packets.

1. What is the flag?

• Start the Machine, open a Terminal, and navigate to cd ~/Desktop/MQTTSIM/challenge/ * Type ./challenge.sh and open wireshark.
• Click any in Interface and apply mqtt filter.
• Click on the Subscribe request and note down the topic value since the packet is sending on message to the server.
• Now Type the below command with the Topic value which turns on the Lights. mosquitto_pub -h localhost -t “some_topic” -m "on” * Answer:THM{Ligh75on-day54ved}

Key Takeaways:

• Efficient Communication in IoT: The MQTT publish/subscribe model facilitates seamless interaction among devices.
• Importance of Security Measures: Network isolation, authentication mechanisms, and monitoring are essential for safeguarding IoT systems.
• Practical Use of Protocol Analysis: Tools like Wireshark reveal valuable insights into device communication, enabling quick identification and mitigation of threats.