HTB: Wifinetic Walkthrugh

Plattform: Hack the Box
Link: https://www.hackthebox.com/machines/wifinetic
Difficulty: Easy 🟠

Enumeration

NMAP

21/tcp open  ftp        vsftpd 3.0.3
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.10.14.13
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 4
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r--    1 ftp      ftp          4434 Jul 31  2023 MigrateOpenWrt.txt
| -rw-r--r--    1 ftp      ftp       2501210 Jul 31  2023 ProjectGreatMigration.pdf
| -rw-r--r--    1 ftp      ftp         60857 Jul 31  2023 ProjectOpenWRT.pdf
| -rw-r--r--    1 ftp      ftp         40960 Sep 11  2023 backup-OpenWrt-2023-07-26.tar
|_-rw-r--r--    1 ftp      ftp         52946 Jul 31  2023 employees_wellness.pdf
22/tcp open  ssh        OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
53/tcp open  tcpwrapped
Device type: general purpo

FTP

This contains details regarding a planned system migration to Debian. The only file of significance is the backup file.

The passwd file contains a potential username.

Search for possibile passwords…

Possibile SSH-Keys

This involves SSH keys used by Dropbear, a lightweight SSH client/server commonly used on IoT devices.
Installation required:

sudo apt install dropbear-bin

User-Flag

With the key and the passwort its possibile to connect to the system.

The system appears to have a large number of user accounts.

It seems that the device is operating as a wireless access point.

Wifi

Upon examining the configuration of the Wi-Fi interfaces and the backup configuration file, it becomes clear that wifinet1 is operating in station mode, meaning it behaves as a client and connects to OpenWrt — specifically via wlan1 in this case.
Several attempts to sniff traffic using tcpdump failed due to insufficient permissions to monitor the interfaces.
After some research, I came across Reaver, a tool commonly used to perform attacks against Wi-Fi networks.

https://github.com/t6x/reaver-wps-fork-t6x

Based on the collected information, the following command can be constructed.
Reaver listens on the monitoring interface, with the BSSID of the target access point specified. Verbose mode is enabled, along with the appropriate channel.

reaver -i mon0 -b 02:00:00:00:00:00 -vv -c1

And here we go — this reveals the WPA pre-shared key (PSK) and the WPS PIN.

Since the password from the backup configuration worked for the netadmin user, it is reasonable to assume that the same password might also work for the root user.