The document discusses vulnerabilities in the Mosquitto protocol utilized in smart routers, specifically focusing on a targeted analysis of the Ruijie EW-300N router. It describes the MQTT protocol's characteristics and outlines methods for exploiting a specific vulnerability (CVE-2024-42936) linked to the router's service. The document concludes with suggested solutions, including awaiting firmware updates and avoidance of the product.

1. Mosquitto
Hacking
Remote Code Execution in Smart
Router
@smrx86

2. WHoami
WHoami
Father of one son
Security consultant @xynexis
Int’l since 2015
Independent security
researcher.
Speaker @Idsecconf 2013,
2014, 2015, 2019,
2020.2022,2023, 2024

3. Agenda
Defining MQTT
Agenda
The targets Analysis Exploitation

4. Agenda
Relevant research

5. Defining MQTT
~ Wikipedia: MQTT
(originally an initialism of MQ Telemetry Transport[a]) is a lightweight, publish-subscribe, machine to
machine network protocol for message queue/message queuing service. It is designed for connections
with remote locations that have devices with resource constraints or limited network bandwidth, such as
in the Internet of Things (IoT). It must run over a transport protocol that provides ordered, lossless, bi-
directional connections—typically, TCP/IP.[1] It is an open OASIS standard and an ISO recommendation
(ISO/IEC 20922).

6. MQTT publisher
33%
MQTT
Topology
MQTT Broker
33%
MQTT Subscriber
33%

7. Smarrouter ruijie EW-300N.
The Targets
The Targets

8. The Targets
The Targets

9. The Targets
The Targets
system type : MT7628
machine : EW300N
cpu model : MIPS 24KEc V5.5
MemTotal : 59720 kB
WAN port : 1
LAN port : 4
Voltage : 12V 1Ampere
Flashrom : SOIC NOR FLASH 16 MB MD AY2329 25Q128S18
ReyeeOS 1.300.1422

10. Firmware
analysis
o
p
Firmware Ekstraction
Via flashrom (failed)

11. Firmware Decryption

12. Firmware Decryption
http://www.hzhcontrols.com/new-2062820.html.

13. Firmware Decryption

14. Sniif mobile app with Burpsuite
Dynamic Analysis

15. debug web cloud
Dynamic Analysis

16. TApp WAN port with WIRESHARK
Dynamic Analysis

17. TApp WAN port with Non-HTTP Proxy Extension for
Burp Suite (NoPE) https://github.com/summitt/Nope-
Proxy
Dynamic Analysis

18. Mapping

19. MQTT message from
broker

20. message from router
(mqtt_pub) to MQTT
broker

21. Vulnerable router service
(/usr/sbin/mqlink.elf ~ CVE-2024-42936)

22. Vulnerable router service
(/usr/sbin/mqlink.elf ~ CVE-2024-42936)

23. Exploitation
Exploitation

24. Exploitation
Exploitation (POC)
https://gist.github.com/
smrx86/2008111b12ab47882b3928d0cbc9e415

25. Exploitation
Exploitation (POC)

26. Solutions
Solutions
. - wait for fixed firmware
. - Don’t buy this product

27. FIN