The attack on the Pearl Restaurant began on Friday evening.
“Six civilians were martyred in the attack … and 10 others were wounded. Three brave members of the security forces were martyred,” the Somali Police Force said, adding that 84 people were rescued from the premises.
Security forces “neutralised” rebels who carried out “the desperate terrorist attack on the Pearl Beach … in Mogadishu”, SNTV reported on Saturday.
It said security forces rescued “many civilians from inside the hotel” and had shot and killed attackers.
The Somali National News Agency posted photos of soldiers in the restaurant on Twitter. One stood next to a glass door with a bullet hole in it, while sandals and a dustpan lay nearby.
Hussein Mohamed, a waiter at another restaurant, told Reuters he heard an explosion followed by gunfire when the attack started.
“The whole area is cordoned off by security forces,” he said.
Abdikadir Abdirahman, the director of Aamin Ambulance Services, said they had so far treated seven people who had been wounded.
“The mujahideen managed to enter the Pearl beach and are still fully in control,” Al Shabab said earlier, claiming the attack.
In November, the group, which controls parts of the country, attacked another hotel in Mogadishu, killing nine people.
Al Shabab controlled a vast area of Somalia before being pushed back in government counteroffensives since last year, although they remain capable of launching significant attacks on government, commercial and military targets.
In late May, its fighters attacked a base housing Ugandan peacekeepers 130 kilometres south-west of Mogadishu, killing 54 soldiers.