WifineticTwo is a medium-difficulty Linux machine that features OpenPLC running on port 8080, vulnerable to Remote Code Execution through the manual exploitation of [CVE-2021-31630]. After obtaining an initial foothold on the machine, a WPS attack is performed to acquire the Wi-Fi password for an Access Point (AP). This access allows the attacker to target the router running OpenWRT and gain a root shell via its web interface.
Enumeration
Scope
IP Address: 10.10.11.7
Nmap Scan
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Cascade]
└─$ nmap -p- --min-rate 10000 $ip -Pn
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack
8080/tcp open http-proxy syn-ack
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Reel2]
└─$ nmap -p -sCV $ip -oN Nmap/script-scan
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
| 256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
|_ 256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
8080/tcp open http-proxy Werkzeug/1.0.1 Python/2.7.18
|_http-server-header: Werkzeug/1.0.1 Python/2.7.18
| http-title: Site doesn't have a title (text/html; charset=utf-8).
|_Requested resource was http://10.10.11.7:8080/login
<SNIP>
* Open ports: 22 - 8080
* Services: SSH - HTTP
* Important notes: openPLC
root@attica01:~# ip addr show wlan0
5: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 02:00:00:00:02:00 brd ff:ff:ff:ff:ff:ff
inet6 fe80::ff:fe00:200/64 scope link
valid_lft forever preferred_lft forever
Adding one.
I wasn't sure which CIDR IP to assign to the interface, so I decided to give it a try.
Add the network route to ligolo interface and Ping sweep the network with fping
┌──(kali㉿kali)-[~/…/HTB/machines/WifineticTwo]
└─$ sudo ip route add 192.168.1.0/24 dev ligolo
┌──(kali㉿kali)-[~/…/HTB/machines/WifineticTwo]
└─$ fping -asgq 192.168.1.0/24
192.168.1.1
192.168.1.5
192.168.1.5 is the IP I assigned to wlan0 interface, So I will attack 192.168.1.1
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/WifineticTwo]
└─$ nmap 192.168.1.1 -F -Pn
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-23 00:19 EDT
Nmap scan report for 192.168.1.1
Host is up (0.10s latency).
Not shown: 92 closed tcp ports (conn-refused)
PORT STATE SERVICE
7/tcp filtered echo
22/tcp open ssh
53/tcp open domain
80/tcp open http
443/tcp open https
514/tcp filtered shell
2001/tcp filtered dc
49154/tcp filtered unknown
I found ssh is there, so I tried to connect to it as root
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/WifineticTwo]
└─$ ssh root@192.168.1.1
The authenticity of host '192.168.1.1 (192.168.1.1)' can't be established.
ED25519 key fingerprint is SHA256:ZcoOrJ2dytSfHYNwN2vcg6OsZjATPopYMLPVYhczadM.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.1.1' (ED25519) to the list of known hosts.
BusyBox v1.36.1 (2023-11-14 13:38:11 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt 23.05.2, r23630-842932a63d
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@ap:~#
