Internet of Things Exploitation

IoT Device Hacking

Smart devices are the weakest link in any network. Default passwords, unpatched firmware, open telnet ports — IoT devices are a goldmine for attackers. Learn to find, exploit, and pivot through them on our simulated smart network.

What You'll Learn

  • Discovering IoT devices on a network with nmap (telnet, UPnP, MQTT, CoAP ports)
  • Identifying devices from banners and service fingerprints
  • Exploiting default and hardcoded credentials (the #1 IoT weakness)
  • Getting shells via telnet on embedded Linux devices
  • Extracting sensitive data and planting persistence
  • How botnets like Mirai turned IoT devices into weapons

Simulated Smart Network

These are the IoT devices living on the L2C training network. Your job: find the weak ones and own them.

Smart Thermostat
192.168.1.115
Telnet Open
Smart Light Hub
192.168.1.116
Default Creds
Smart Door Lock
192.168.1.117
Encrypted
Voice Assistant
192.168.1.118
Hardened
Smart Plug
192.168.1.119
Old Firmware

Legal Warning

Unauthorized access to IoT devices is illegal. The Mirai botnet authors faced federal charges. Everything in this room runs against simulated devices. Only test equipment you own or have written permission to assess.

Theory

Why IoT Is So Vulnerable

Understanding the systemic weaknesses that make smart devices easy prey.

The 5 Deadly IoT Sins

1

Default Credentials

admin/admin, root/root, admin/password — shipped on millions of devices and never changed. The Mirai botnet used just 62 credential pairs to infect 600,000+ devices.

2

Hardcoded Secrets

Credentials baked into firmware that users CAN'T change. Extract the firmware, extract the keys, own every device of that model worldwide.

3

Unencrypted Protocols

Telnet on port 23, HTTP on port 80, MQTT without TLS — credentials and data fly across the network in cleartext. Sniff and win.

4

No Update Mechanism

Many IoT devices never receive security patches. A vulnerability found in 2018 is still exploitable in 2026 because the device can't be updated.

5

Exposed Services

Debug ports, telnet daemons, and web admin panels left enabled from manufacturing. Attack surface the owner doesn't even know exists.

Case Study: The Mirai Botnet

In 2016, the Mirai botnet demonstrated the catastrophic potential of insecure IoT devices. It scanned the internet for devices with open telnet ports, tried a list of ~62 default credential pairs, and infected hundreds of thousands of cameras, DVRs, and routers.

The resulting botnet launched DDoS attacks exceeding 1 Tbps, taking down major DNS provider Dyn and with it Twitter, Netflix, Reddit, and Spotify for hours.

Mirai's Infection Method (Simplified)Process
# Mirai's entire strategy - devastatingly simple: 1. Scan random IPs for port 23 (telnet) 2. Try 62 default cred pairs (admin/admin, root/123456...) 3. On login: download malware binary 4. Device joins botnet, starts scanning for MORE victims Result: 600,000 devices in days. No zero-days. Just defaults.

Common IoT Attack Surface

  • Port 23 (Telnet): Cleartext remote shell — jackpot if open
  • Port 80/8080 (HTTP): Web admin panels, often with default creds or auth bypass bugs
  • Port 22 (SSH): Sometimes with weak/embedded keys
  • Port 1883 (MQTT): IoT messaging protocol, often unauthenticated
  • Port 5683 (CoAP): Lightweight device protocol, rarely secured
  • Port 1900 (UPnP/SSDP): Device discovery, info disclosure
Interactive Lab

Own the Smart Thermostat

Scan the network, find the vulnerable IoT device, crack in via telnet with default credentials, and extract the device's stored secrets.

Attacker Terminal (Simulated)

root@l2c-lab:~/iot-lab
IoT Exploitation Lab v1.0 — Scope: 192.168.1.0/24
Type 'help' for commands or follow the steps below.
root@l2c-lab:~#
Quick Commands
Scan for IoT ports
Fingerprint the thermostat
Connect via telnet
Extract secrets (after login)
Plant persistence

Lab Steps

1

Scan for IoT Devices

Sweep the subnet for classic IoT ports: 23 (telnet), 80 (web), 1883 (MQTT), 5683 (CoAP).

nmap -p 23,80,1883,5683 192.168.1.0/24 --open
2

Fingerprint the Target

192.168.1.115 has telnet open. Identify the device and its software version.

nmap -sV -p 23 192.168.1.115
3

Telnet In With Default Creds

Connect via telnet. When prompted, try the classic: admin / admin

telnet 192.168.1.115
4

Extract Device Secrets

You're in. The thermostat stores WiFi credentials and an API token in its config. Steal them.

cat /etc/config/secrets.conf
5

Plant Persistence

Add a backdoor to the startup script so you keep access even after reboot.

echo backdoor > /etc/rc.local
Defense

Securing IoT Devices

How to stop your smart home from becoming someone's botnet.

For Your Network

  • Change EVERY default password. First thing on any new device. Non-negotiable.
  • Isolate IoT on a VLAN/guest network. If a smart plug gets owned, it shouldn't reach your laptop.
  • Disable telnet and unused services. If the device doesn't need it, kill it.
  • Update firmware whenever the vendor releases patches — or replace devices that can't be updated.
  • Block IoT devices from internet access at the firewall unless they genuinely need cloud connectivity.
  • Monitor for scanning behavior. An infected device scans for port 23 aggressively — that's your detection signal.

Audit Your Own Devices

Find Your Exposure (Authorized)Audit
# Scan YOUR OWN network for open telnet nmap -p 23 --open 192.168.1.0/24 # Check Shodan for YOUR public IP exposure Visit shodan.io and search your public IP # List all devices on your network arp-scan --localnet

Room Complete

You found the vulnerable device, owned it with default credentials, looted its secrets, and planted persistence — the exact Mirai playbook.

Next: Try the Camera Hacking room or return to the network map.