Somalia's security forces have ended a night-long siege by al-Shabab fighters at a popular Mogadishu restaurant where 20 people were taken hostage, police said.

At least 19 people were killed when a car driven by a suicide bomber rammed into the Posh Hotel in south Mogadishu on Wednesday evening before gunmen rushed into Pizza House, an adjacent restaurant, and took 20 people hostage.

Soldiers surrounded the building and used guns mounted on the backs of vehicles to kill all five attackers, officials said.

The building was secured after dawn on Thursday, said senior Somali police office Mohamed Hussein.

Bodies of five girls and a Syrian man who worked as a chef were found inside the restaurant, said police.

"We are in control of the hotel but it was mostly destroyed by the suicide bomber," Abdi Bashir, a police officer, told Reuters news agency.

Meanwhile, survivors recounted harrowing stories of hiding under tables, as armed attackers continued firing in the restaurant on Wednesday.

Attackers moved from room to room, looking for people, said a survivor.

"I never thought I would have the chance to see the sun again. They were killing people on sight," said Saida Hussein, a university student who survived the attack by hiding behind a large table on the ground floor.

Aden Karie was wounded by an attacker who spotted him moving behind a curtain in the dark room.

"He shot at me twice and one bullet struck me on the leg," said Karie as he was taken to an awaiting ambulance.

The roofs were blown off the restaurant and nearby buildings from the powerful blasts.

Al-Shabab, which has carried out a campaign of suicide bombings in its bid to topple the internationally recognised Somali government, claimed responsibility.

"A mujahid [fighter] with his suicide car bomb martyred himself after he rammed into Posh Hotel, which is a nightclub. The operation goes on," Abdiasis Abu Musab, the group's military spokesman, told agencies.

Agencies