Week 11. WifineticTwo
TL;DR
This is a nice Linux machine that resembles an IT and hardware pentesting scenario, where the goal is rooting a WiFi access point. For the IT part we have to root a machine by exploiting a vulnerability (CVE-2021-31630) in an OpenPLC server, this will be enough for the user flag. Later, for the privilege escalation part, the machine developers have set in place a cool WiFi virtualization environment. First we attack the WiFi with OneShot, which will enable us to obtain the WPA-PSK network key. Once inside the WLAN, access to the WiFi AP is gained by abusing a security misconfiguration related to the root account in the AP embedded Linux (OpenWRT).
KEYWORDS
OpenPLC, CVE-2021-31630, WiFi, WPA-PSK, WPS, OneShot, Pixie Dust attack, OpenWRT.
REFERENCES
https://autonomylogic.com/docs/2-1-openplc-runtime-overview
https://www.cvedetails.com/cve/CVE-2021-31630
https://www.exploit-db.com/exploits/49803
https://unix.stackexchange.com/questions/283722/how-to-connect-to-wifi-from-command-line
https://miloserdov.org/?p=3393
https://github.com/kimocoder/OneShot
https://openwrt.org/docs/guide-quick-start/walkthrough_login
ENUMERATION
Port scan.
Enumerate the open ports.
Enumerate the port 8080 with Firefox, an OpenPLC web server appears.
Default credentials are available in the online documentation (https://autonomylogic.com/docs/2-1-openplc-runtime-overview).
Use them to login, the user dashboard appears.
According to the documentation, the OpenPLC webserver runs PLC programs created on the OpenPLC editor tool, and the web server dashboard allows the user to configure several parameters of the runtime. At this moment we see in the dashboard the loaded file is called blank_program.st and the server is stopped.
USER
If you look for OpenPLC vulnerabilities you'll find this one: https://www.cvedetails.com/cve/CVE-2021-31630, and this PoC: https://www.exploit-db.com/exploits/49803
The PoC provides RCE when run against the host, it just needs passing user credentials as argument. Before it, change the file name in the compile_program in the code to match the file currently loaded in the host OpenPLC.
Start a listener and fire the exploit.
A reverse shell is successfully received on port 1919 (although the script reports it failed to receive a connection).
Which can be used to retrieve the user flag (in the /root directory).
ROOT
Start from the root shell obtained with the exploit and upgrade the shell.
Enumerate the system.
We have root privileges on this machine, but still do not have access to the root.txt flag, meaning we will probably need to move laterally to another machine. For this we will need to do configuration changes on this machine (and this is why we are root).
Having a look at the machine's name, there is probably something related to the wireless network configuration. Let's enumerate the network interfaces.
There is a wireless network interface wlan0, check its configuration.
Having root access to the machine enables us to make configuration changes on the wireless configuration, meaning the machine is running some kind of cool WiFi virtualization.
There are online tutorials on WiFi management from command line here: https://askubuntu.com/questions/16584/how-to-connect-and-disconnect-to-a-network-manually-in-terminal, and here: https://unix.stackexchange.com/questions/283722/how-to-connect-to-wifi-from-command-line
Let's start scanning for available WiFi networks.
We see there is a WiFi called plcrouter in range, and has WPS mode enabled. The BSSID is 02:00 :00:00:01:00
Since WPS is enabled we could try an OneShot attack, which is a WPS attack issued from network interfaces in managed mode. More info here: https://en.kali.tools/?p=1002, and here: https://miloserdov.org/?p=3393
You can find a Python OneShot script here: https://github.com/kimocoder/OneShot. We will use it to fire a Pixie Dust attack following the tutorials in the links provided.
The script dumps the WPA-PSK key. Connect to the WiFi from command line as indicated in the links provided.
Verify the wireless configuration is correctly loaded. If not, repeat the wpa_supplicant command again.
Verify the network interface configuration.
Although we have correctly associated with the WiFi AP, we haven't been assigned an IP address by the DHCP service. Assign yourself an IP address corresponding to a typical private class C network with 255.255.255.0 mask.
Once inside the WLAN we will enumerate the network; for this, transfer an standalone nmap64 package to the host. Unpack the binaries and fire a ping sweep to discover network nodes.
There are 2 hosts, the gateway (192.168.1.1) and our machine (192.168.1.100). Enumerate the AP ports.
Let's do a quick enumeration of the HTTP/HTTPS open ports.
A quick Google search reveals LuCI stands for LUA Configuration Interface, a web-based user interface designed for embedded devices (https://launchpad.net/luci). It is usually part of OpenWRT, an open source Linux operating system for embedded devices (
Place a chisel so we can get access to the LuCI portal from Kali.
Now browse the web page from Kali, a welcome login portal appears.
In the documentation (https://openwrt.org/docs/guide-quick-start/walkthrough_login) you can find the default login for root (root:<blank password>).
Navigate to System -> Administration. Here you can configure the router root password, SSH access and SSH keys. For example, configure the SSH settings, make sure port 22 and root access are both enabled.
In the "Router Password" tab you can change the root SSH password and log in, or you can just use the credential you used to log into the router to open an SSH connection.
You are root.
ALT. ENDING
The router configuration allows the user to add his own RSA public key for SSH logins. For this we need to put in place a socks chisel port forwarding.
Modify the proxychains configuration accordingly.
Enable Firefox proxy on port 8081, and navigate to http://192.168.1.1, so the HTTP traffic is forwarded through the socks tunnel.
Add your public key in System -> Administration -> SSH keys
Finally, in the "SSH Access" tab, uncheck the "Login with password" options.
Now you can login from Kali anytime without knowing the root password. Open an SSH session without password prompt using proxychains and your private key.
You are root again.
Last updated