1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
|
local mqtt = require "mqtt"
local nmap = require "nmap"
local shortport = require "shortport"
local stdnse = require "stdnse"
local table = require "table"
description = [[
Dumps message traffic from MQTT brokers.
This script establishes a connection to an MQTT broker and subscribes
to the requested topics. The default topics have been chosen to
receive system information and all messages from other clients. This
allows Nmap, to listen to all messages being published by clients to
the MQTT broker.
For additional information:
* https://en.wikipedia.org/wiki/MQTT
* https://docs.oasis-open.org/mqtt/mqtt/v3.1.1/os/mqtt-v3.1.1-os.html
]]
---
-- @usage nmap -p 1883 --script mqtt-subscribe <target>
--
-- @output
-- PORT STATE SERVICE REASON
-- 1883/tcp open mosquitto version 1.4.8 syn-ack
-- | mqtt-subscribe:
-- | Topics and their most recent payloads:
-- | $SYS/broker/load/publish/received/5min: 0.27
-- | $SYS/broker/publish/messages/received: 7
-- | $SYS/broker/heap/current: 39240
-- | $SYS/broker/load/messages/sent/15min: 21.54
-- | $SYS/broker/load/bytes/sent/5min: 647.13
-- | $SYS/broker/clients/disconnected: 40
-- | $SYS/broker/clients/connected: 1
-- | $SYS/broker/subscriptions/count: 40
-- | $SYS/broker/load/publish/received/15min: 0.46
-- | $SYS/broker/clients/inactive: 40
-- | $SYS/broker/messages/sent: 2318
-- | $SYS/broker/load/publish/sent/1min: 2.48
-- | $SYS/broker/load/sockets/1min: 0.09
-- | $SYS/broker/load/connections/15min: 0.41
-- | $SYS/broker/load/bytes/sent/15min: 822.79
-- | $SYS/broker/load/sockets/15min: 0.81
-- | $SYS/broker/version: mosquitto version 1.4.8
-- | $SYS/broker/load/messages/received/5min: 1.24
-- | $SYS/broker/load/publish/sent/15min: 20.39
-- | $SYS/broker/uptime: 225478 seconds
-- | $SYS/broker/load/publish/received/1min: 0.05
-- | $SYS/broker/publish/messages/dropped: 0
-- | $SYS/broker/retained messages/count: 47
-- | $SYS/broker/messages/received: 293
-- | $SYS/broker/load/connections/5min: 0.28
-- | $SYS/broker/load/messages/sent/1min: 2.78
-- | $SYS/broker/bytes/sent: 83026
-- | $SYS/broker/load/bytes/received/5min: 13.98
-- | $SYS/broker/load/messages/received/1min: 0.35
-- | $SYS/broker/messages/stored: 47
-- | $SYS/broker/publish/messages/sent: 2070
-- | $SYS/broker/load/sockets/5min: 0.53
-- | $SYS/broker/clients/active: 1
-- | $SYS/broker/timestamp: Sun, 14 Feb 2016 15:48:26 +0000
-- | $SYS/broker/load/bytes/received/15min: 17.83
-- | $SYS/broker/publish/bytes/received: 49
-- | $SYS/broker/load/publish/sent/5min: 16.03
-- | $SYS/broker/publish/bytes/sent: 9752
-- | $SYS/broker/load/bytes/sent/1min: 100.49
-- | $SYS/broker/load/bytes/received/1min: 2.72
-- | $SYS/broker/load/connections/1min: 0.06
-- | $SYS/broker/clients/expired: 0
-- | $SYS/broker/load/messages/received/15min: 1.49
-- | $SYS/broker/load/messages/sent/5min: 17.00
-- | $SYS/broker/bytes/received: 2520
-- | $SYS/broker/heap/maximum: 41992
-- |_ $SYS/broker/clients/total: 41
--
-- @xmloutput
-- <table key="Topics and their most recent payloads">
-- <elem key="$SYS/broker/load/messages/sent/15min">23.48</elem>
-- <elem key="$SYS/broker/bytes/received">2469</elem>
-- <elem key="$SYS/broker/load/sockets/5min">0.63</elem>
-- <elem key="$SYS/broker/messages/sent">2268</elem>
-- <elem key="$SYS/broker/load/publish/sent/15min">22.25</elem>
-- <elem key="$SYS/broker/load/publish/received/1min">0.05</elem>
-- <elem key="$SYS/broker/load/bytes/sent/1min">626.45</elem>
-- <elem key="$SYS/broker/publish/messages/received">7</elem>
-- <elem key="$SYS/broker/load/connections/15min">0.39</elem>
-- <elem key="$SYS/broker/heap/current">38864</elem>
-- <elem key="$SYS/broker/load/sockets/1min">0.36</elem>
-- <elem key="$SYS/broker/messages/stored">47</elem>
-- <elem key="$SYS/broker/load/bytes/sent/15min">897.46</elem>
-- <elem key="$SYS/broker/version">mosquitto version 1.4.8</elem>
-- <elem key="$SYS/broker/clients/inactive">39</elem>
-- <elem key="$SYS/broker/subscriptions/count">39</elem>
-- <elem key="$SYS/broker/timestamp">Sun, 14 Feb 2016 15:48:26 +0000</elem>
-- <elem key="$SYS/broker/uptime">225280 seconds</elem>
-- <elem key="$SYS/broker/publish/bytes/sent">9520</elem>
-- <elem key="$SYS/broker/publish/messages/sent">2023</elem>
-- <elem key="$SYS/broker/load/bytes/received/1min">10.58</elem>
-- <elem key="$SYS/broker/load/connections/5min">0.31</elem>
-- <elem key="$SYS/broker/load/messages/received/15min">1.58</elem>
-- <elem key="$SYS/broker/publish/messages/dropped">0</elem>
-- <elem key="$SYS/broker/clients/connected">1</elem>
-- <elem key="$SYS/broker/load/messages/received/5min">1.51</elem>
-- <elem key="$SYS/broker/retained messages/count">47</elem>
-- <elem key="$SYS/broker/load/bytes/received/15min">18.78</elem>
-- <elem key="$SYS/broker/messages/received">289</elem>
-- <elem key="$SYS/broker/clients/disconnected">39</elem>
-- <elem key="$SYS/broker/load/publish/received/15min">0.46</elem>
-- <elem key="$SYS/broker/load/sockets/15min">0.82</elem>
-- <elem key="$SYS/broker/load/publish/sent/5min">21.44</elem>
-- <elem key="$SYS/broker/bytes/sent">81121</elem>
-- <elem key="$SYS/broker/publish/bytes/received">49</elem>
-- <elem key="$SYS/broker/load/connections/1min">0.18</elem>
-- <elem key="$SYS/broker/load/messages/received/1min">1.45</elem>
-- <elem key="$SYS/broker/clients/expired">0</elem>
-- <elem key="$SYS/broker/load/publish/received/5min">0.27</elem>
-- <elem key="$SYS/broker/load/messages/sent/5min">22.63</elem>
-- <elem key="$SYS/broker/load/bytes/received/5min">16.53</elem>
-- <elem key="$SYS/broker/load/messages/sent/1min">16.80</elem>
-- <elem key="$SYS/broker/clients/total">40</elem>
-- <elem key="$SYS/broker/clients/active">1</elem>
-- <elem key="$SYS/broker/load/publish/sent/1min">15.57</elem>
-- <elem key="$SYS/broker/load/bytes/sent/5min">863.85</elem>
-- <elem key="$SYS/broker/heap/maximum">41992</elem>
-- </table>
--
-- @args mqtt-subscribe.client-id MQTT client identifier, defaults to
-- <code>nmap</code> with a random suffix.
-- @args mqtt-subscribe.listen-msgs Number of PUBLISH messages to
-- receive, defaults to 100. A value of zero forces this script
-- to stop only when listen-time has passed.
-- @args mqtt-subscribe.listen-time Length of time to listen for
-- PUBLISH messages, defaults to 5s. A value of zero forces this
-- script to stop only when listen-msgs PUBLISH messages have
-- been received.
-- @args mqtt-subscribe.password Password for MQTT brokers requiring
-- authentication.
-- @args mqtt-subscribe.protocol-level MQTT protocol level, defaults
-- to 4.
-- @args mqtt-subscribe.protocol-name MQTT protocol name, defaults to
-- <code>MQTT</code>.
-- @args mqtt-subscribe.topic Topic filters to indicate which PUBLISH
-- messages we'd like to receive.
-- @args mqtt-subscribe.username Username for MQTT brokers requiring
-- authentication.
author = "Mak Kolybabi <mak@kolybabi.com>"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"safe", "discovery", "version"}
portrule = shortport.version_port_or_service({1883, 8883}, {"mqtt", "secure-mqtt"}, "tcp")
local function parse_args()
local args = {}
local protocol_level = stdnse.get_script_args(SCRIPT_NAME .. '.protocol-level')
if protocol_level then
-- Sanity check the value from the user.
protocol_level = tonumber(protocol_level)
if type(protocol_level) ~= "number" then
return false, "protocol-level argument must be a number."
elseif protocol_level < 0 or protocol_level > 255 then
return false, "protocol-level argument must be in range between 0 and 255 inclusive."
end
else
-- Indicate to the library that it should choose this on its own.
protocol_level = false
end
args.protocol_level = protocol_level
local protocol_name = stdnse.get_script_args(SCRIPT_NAME .. '.protocol-name')
if protocol_name then
-- Sanity check the value from the user.
if type(protocol_name) ~= "string" then
return false, "protocol-name argument must be a string."
end
else
-- Indicate to the library that it can choose this on its own.
protocol_name = false
end
args.protocol_name = protocol_name
local client_id = stdnse.get_script_args(SCRIPT_NAME .. '.client-id')
if not client_id then
-- Indicate to the library that it should choose this on its own.
client_id = false
end
args.client_id = client_id
local max_msgs = stdnse.get_script_args(SCRIPT_NAME .. '.listen-msgs')
if max_msgs then
-- Sanity check the value from the user.
max_msgs = tonumber(max_msgs)
if type(max_msgs) ~= "number" then
return false, "listen-msgs argument must be a number."
elseif max_msgs < 0 then
return false, "listen-msgs argument must be non-negative."
end
else
-- Many brokers have ~50 $SYS/# messages, so we double that number
-- for how many messages we'll receive.
max_msgs = 100
end
args.max_msgs = max_msgs
local max_time = stdnse.get_script_args(SCRIPT_NAME .. '.listen-time')
if max_time then
-- Convert the time specification from the CLI to seconds.
local err
max_time, err = stdnse.parse_timespec(max_time)
if not max_time then
return false, ("Unable to parse listen-time: %s"):format(err)
elseif max_time < 0 then
return false, "listen-time argument must be non-negative."
elseif args.max_msgs == 0 and max_time == 0 then
return false, "listen-time and listen-msgs may not both be zero."
end
else
max_time = 5
end
args.max_time = max_time
local username = stdnse.get_script_args(SCRIPT_NAME .. '.username')
if not username then
username = false
end
args.username = username
local password = stdnse.get_script_args(SCRIPT_NAME .. '.password')
if password then
-- Sanity check the value from the user.
if not username then
return false, "A password cannot be given without also giving a username."
end
else
password = false
end
args.password = password
local topic = stdnse.get_script_args(SCRIPT_NAME .. '.topic')
if topic then
-- Sanity check the value from the user.
if type(topic) ~= "table" then
topic = {topic}
end
else
-- These topic filters should receive most messages.
topic = {"$SYS/#", "#"}
end
args.topic = topic
return true, args
end
action = function(host, port)
local output = stdnse.output_table()
-- Parse and sanity check the command line arguments.
local status, options = parse_args()
if not status then
output.ERROR = options
return output, output.ERROR
end
-- Create an instance of the MQTT library's client object.
local helper = mqtt.Helper:new(host, port)
-- Connect to the MQTT broker.
local status, response = helper:connect({
["protocol_level"] = options.protocol_level,
["protocol_name"] = options.protocol_name,
["client_id"] = options.client_id,
["username"] = options.username,
["password"] = options.password,
})
if not status then
output.ERROR = response
return output, output.ERROR
elseif response.type ~= "CONNACK" then
output.ERROR = ("Received control packet type '%s' instead of 'CONNACK'."):format(response.type)
return output, output.ERROR
elseif not response.accepted then
output.ERROR = ("Connection rejected: %s"):format(response.reason)
return output, output.ERROR
end
-- Build a list of topic filters.
local filters = {}
for _, filter in ipairs(options.topic) do
table.insert(filters, {["filter"] = filter})
end
-- Subscribe to receive PUBLISH messages that match our topic
-- filters.The MQTT standard allows sending PUBLISH messages before
-- the SUBACK message, so we explicitly ignore any non-CONNACK
-- messages at this point.
local status, response = helper:request("SUBSCRIBE", {["filters"] = filters}, "SUBACK")
if not status then
output.ERROR = response
return output, output.ERROR
end
-- For each topic to which we tried to subscribe, the MQTT broker
-- informs us whether we were successful. We will note if any
-- subscriptions fail, but continue so long as any succeeded.
local success = false
local results = response.filters
for i, result in ipairs(results) do
local topic = options.topic[i]
if result.success then
stdnse.debug3("Topic filter '%s' was accepted with a maximum QoS of %d.", topic, result.max_qos)
success = true
else
stdnse.debug3("Topic filter '%s' was rejected.", topic)
end
end
if not success then
output.ERROR = "Every topic filter was rejected."
return output, output.ERROR
end
-- We are now in a position to receive PUBLISH messages for at least
-- one of our topic filters. We will record the topic of every
-- PUBLISH message, but only retain the most recent payload.
--
-- We will continue to listen for PUBLISH messages until one of two
-- conditions is met, whichever comes first:
-- 1) We have listened for max_time
-- 2) We have received max_msgs
local end_time = nmap.clock_ms() + options.max_time * 1000
local topics = {}
local keys = {}
local msgs = 0
while true do
-- Check for the first condition.
local time_left = end_time - nmap.clock_ms()
if time_left <= 0 then
break
end
status, response = helper:receive({"PUBLISH"}, time_left / 1000)
if not status then
break
end
local name = response.topic
if not topics[name] then
table.insert(keys, name)
end
topics[name] = response.payload
-- Check for the second condition.
msgs = msgs + 1
if options.max_msgs ~= 0 and msgs >= options.max_msgs then
break
end
end
-- Disconnect from the MQTT broker.
helper:close()
-- We're not going to error out if the last response was an error if
-- there were successful responses before it, but we will log it.
if not status then
if #keys > 0 then
stdnse.debug3("Received error while listening for PUBLISH messages: %s", response)
else
output.ERROR = response
return output, output.ERROR
end
end
-- Try and offer information on what software the MQTT broker is
-- running through the version identification interface. Sadly this
-- is often just a version number with no product name.
local ver = topics["$SYS/broker/version"]
if ver then
port.version.name = ver
nmap.set_port_version(host, port)
end
-- Format the topics and payloads we received.
table.sort(keys)
local topics_in_order = {}
for _, key in ipairs(keys) do
topics_in_order[key] = topics[key]
end
output["Topics and their most recent payloads"] = topics_in_order
return output, stdnse.format_output(true, output)
end
|