Impacket mqtt_check.py
Back to the Category Index / Back to the Command Index
Overview
Section titled “Overview”Sends CONNECT to an MQTT broker and checks whether anonymous connections are accepted and what the broker returns.
| Item | Details |
|---|---|
| Implementation | examples/mqtt_check.py |
| Category | MSSQL / Exchange / MQTT |
| Size | 84 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and Inputs
Section titled “CLI and Inputs”Check python examples/mqtt_check.py -h for the current option definitions.
| Argument | Description |
|---|---|
--help | Show the help message and exit. |
target | [[domain/]username[:password]@]<targetName> |
-client-id | Client ID used for authentication (random by default). |
-ssl | Enable SSL. |
-port | Connection port (default: 1883). |
-debug | Enable debug logging. |
-ts | Add timestamps to log output. |
Detailed Processing Flow
Section titled “Detailed Processing Flow”The command creates a socket from the target, client ID, port, and TLS option, then sends an MQTT CONNECT packet. It receives and parses CONNACK, reports connection status from the return code, and closes the socket.
How It Works
Section titled “How It Works”An MQTT client sends CONNECT as its first packet, and the broker replies with CONNACK to indicate protocol acceptance and the authentication result. This command does not attempt username/password authentication. It checks anonymous access with a minimal CONNECT containing a client ID and clean-session setting.
The MQTT fixed header uses variable-length encoding for remaining length.
The CONNECT payload contains the protocol name and version, connect flags,
keepalive, and UTF-8 client ID in order. The impacket.mqtt structure builds
the packet, which the socket or TLS path sends to the specified port. On
receipt, read at least a complete CONNACK frame before interpreting its return code.
A successful TCP connection, TLS handshake, MQTT protocol acceptance, and anonymous authorization are separate stages. Do not mistake an old/new MQTT version mismatch or rejected identifier for “authentication required.” Treat short packets, excessive remaining lengths, and an immediate broker close as explicit outcomes.
Key Implementation Elements
Section titled “Key Implementation Elements”| Symbol | Location | Entry Point for Tracing Behavior |
|---|---|---|
MQTT_LOGIN | 32 | __init__(), run() |
Dependencies
Section titled “Dependencies”Internal Impacket Modules
Section titled “Internal Impacket Modules”| Module | Main Names Used |
|---|---|
impacket | version |
impacket.examples | logger |
impacket.examples.utils | parse_target |
impacket.mqtt | CONNECT_ACK_ERROR_MSGS, MQTTConnection |
Output, Side Effects, and Required Privileges
Section titled “Output, Side Effects, and Required Privileges”- Primarily queries and authentication attempts. Repeated runs can affect audit logs, account lockouts, and target load.
Failure Paths and Cleanup
Section titled “Failure Paths and Cleanup”- Distinguish missing input files, damaged files, truncated reads, and unsupported formats.
When Changing the Implementation
Section titled “When Changing the Implementation”This command depends on impacket.mqtt and standard sockets/TLS; MQTT_LOGIN.run() handles the packet exchange. Validate MQTT remaining length and short or malformed responses, and distinguish TLS handshake errors from broker rejections.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/mqtt_check.py - CLI:
python examples/mqtt_check.py -h - No test specific to this command was found. Choose shared-module tests and, if needed, a run in an isolated environment.