Last updated
Last updated
WifineticTwo is a medium-difficulty Linux machine that features OpenPLC running on port 8080, vulnerable to Remote Code Execution through the manual exploitation of [CVE-2021-31630]. After obtaining an initial foothold on the machine, a WPS attack is performed to acquire the Wi-Fi password for an Access Point (AP). This access allows the attacker to target the router running OpenWRT and gain a root shell via its web interface.
Scope
IP Address: 10.10.11.7
Nmap Scan
http://10.10.11.7:8080/login
A quick search about OpenPLC CVEs
I don't have credential yet, So I tried default one: openplc:openplc and It worked
http://10.10.11.7:8080/dashboard
The exploit we have need credential, now I can run it.
Receive Connection
Upgrade the shell
I found my myself running command as root, maybe I'm in docker container or kind of virtualization.
The user flag is in /root directory
User Flag: 850e68329cf676exxxxxxxxxxxxxxxx
The IP Address of the machine is not here, that makes me sure I'm not on the actual host. There is wlan0 interface also.
I uploaded linpeas.sh to the hox to enumerate and collect useful info from the host but didn't find anything interesting
linpeas.sh tells me that it's a virtual machine (lxc)
Enumerating installed program shows that there are wireless tools here
Following up this post, I was able to deal with wireless technology in that host:
I got a hint from community about oneshot tool that attacks wireless by brute force attack.
Connect to plcrouter network
Verify successful connection
But I didn't get an IP Address
Adding one.
I wasn't sure which CIDR IP to assign to the interface, so I decided to give it a try.
I set up a tunnel to enumerate the new network from my kali machine.
Add the network route to ligolo interface and Ping sweep the network with fping
192.168.1.5 is the IP I assigned to wlan0 interface, So I will attack 192.168.1.1
I found ssh is there, so I tried to connect to it as root
Root Flag: bd361577bf4d8653xxxxxxxxxxxxxxxx
