search

Wifinetic

Wifi Box!

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 10.129.68.239 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-16 18:57 +08
Nmap scan report for 10.129.68.239
Host is up (0.020s latency).
Not shown: 52717 closed tcp ports (conn-refused), 12815 filtered tcp ports (no-response)
PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh
53/tcp open  domain

FTP is open, so we should check for anonymous access.

hashtag
Anonymous FTP -> Wifi Password -> SSH

There were quite a few files within this FTP server:

$ ftp 10.129.68.239                                               
Connected to 10.129.68.239.
220 (vsFTPd 3.0.3)
Name (10.129.68.239:kali): anonymous
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||44452|)
150 Here comes the directory listing.
-rw-r--r--    1 ftp      ftp          4434 Jul 31 11:03 MigrateOpenWrt.txt
-rw-r--r--    1 ftp      ftp       2501210 Jul 31 11:03 ProjectGreatMigration.pdf
-rw-r--r--    1 ftp      ftp         60857 Jul 31 11:03 ProjectOpenWRT.pdf
-rw-r--r--    1 ftp      ftp         40960 Sep 11 15:25 backup-OpenWrt-2023-07-26.tar
-rw-r--r--    1 ftp      ftp         52946 Jul 31 11:03 employees_wellness.pdf

The most interesting is the .tar file that contained a backup of some sorts. When we download this and extract the files, it shows that this is the /etc/ file:

Within the /etc/config file, there was a wireless file. Since this was a Wifi themed box, I read the file and found a password:

The question now is whether the box is transmitting stuff over the air, or if there's a user that uses this password. Reading the passwd file shows us a few users:

The netadmin user reused it:

hashtag
Privilege Escalation

hashtag
Enumeration

Since this is a Wifi box, we can check ifconfig for the interfaces available:

There's a mon0 interface listening, and checking iwconfig shows that it is in Monitor mode:

Interesting. There wasn't much else I could do, so I ran linpeas.sh to enumerate for me, and it found reaver, a program I wasn't familiar with:

This tool can be used to brute force Wifi passwords out. Using this tool, combined with our Monitor mode mon0 interface, we can start sniffing stuff from wlan0 and wlan1. We can grab the ether value and feed it into reaver:

Afterwards, we can su to root:

PreviousValidationNextWriteup

Last updated