Last updated
Last updated
Scope
IP Address: 10.10.11.247
Nmap Scan
FTP
Talk a look at backup-OpenWrt-2023-07-26.tar . I could see that it's a backup for configuration files located at /etc
So, from the file above, We can information about two Access Points and their passwords
User flag: 15b1159827f23a58a8xxxxxxxxxxxxxx
All the above capabilities are standard ones except reaver, So I will search for this tool and see what exactly it does
WIFI Protected Setup (WPS) is a standard designed to make joining a Wi-Fi router easier, especially in home settings. The device would have an 8 digit pin printed on the device, and the user could enter that pin to join the network. reaver is a tool to brute force WPS PIN associated with any AP
I run ifconfig to see available interfaces
For the first moment, I could say that mon0 interface for monitoring mode and other wlanX are the interfaces for Access points on the machine.
The next step is to get more info about these APs
We can conclude that mon0 is the interface that we will use for attacking the access points and wlan1 is the target access point as it's the only one that have ESSID: "OpenWrt" with SSID:02:00:00:00:00:00
I can now start reaver to brute force WPS PIN
As there is no path for me now to root, I will try to authenticate to root with the WPA PSK key obtained above:
Success :)
Root flag: 1114dd5c6d353295d8xxxxxxxxxxxxx
Wifinetic is an easy difficulty Linux machine which presents an intriguing network challenge, focusing on wireless security and network monitoring.
