Airtouch HTB
AirTouch Target Overview AirTouch is a medium-difficulty Linux machine built around a wireless attack path initiated from a consultant workstation. Starting with SNMP enumeration, valid credentials for the consultant account can be recovered, granting access to a workstation that contains multiple wireless interfaces. From there, two relevant wireless networks are identified: AirTouch-Internet (protected with WPA-PSK) and AirTouch-Office (protected with WPA-EAP). The first objective is to compromise the PSK network by capturing and cracking a handshake. After decrypting the captured traffic, the attacker extracts an HTTP session cookie that grants access to an internal router interface. By tampering with the role information in the cookie, the attacker gains administrative access to the web panel and abuses an insecure upload mechanism to achieve remote code execution. This leads to SSH access on the PSK access point and the recovery of certificates needed for the second phase of the attack. With valid certificates, the attacker creates a rogue enterprise access point for AirTouch-Office and forces clients to connect to it by repeatedly deauthenticating them from both legitimate APs. Through this process, MSCHAPv2 material is captured and can be cracked. After joining the management network, the attacker accesses the remote host and discovers additional credentials in the hostapd configuration. These credentials enable pivoting into a privileged administrative account capable of using sudo, leading to full compromise. Before starting the box Huge respect to author of this box r4ulcl Enumeration Initial Network Scanning Nmap Scan The initial TCP scan only exposed SSH on port 22. Since wireless and infrastructure-related services often rely on UDP, a UDP scan was performed next to identify additional exposed services. SNMP Enumeration Setting Up Host Mapping Before starting enumeration, I added the target hostname to my /etc/hosts file: we see username as admin@AirTouch.htb and we got password : RxBlZhLmOkacNWScmZ6D and pc name is Consultant we tried to login the ssh but failed with admin user , so i tried with consultant it worked SSH LOGIN We have two image files in home directory , Let's copy them to our host machine using your favourite file transfer method, in my case aim using SCP: download them to our location : Let's see what these PNG images contain.. image image Wireless Network Analysis This will be our attack path : | SSID | Security | Channel | Notes | | --- | --- | --- | --- | | AirTouch-Internet | WPA2-PSK | 44 (5 GHz) | General Access Network | | AirTouch-Office | WPA2-EAP | 44 (5 GHz) | Enterprise Network (802.1X) | From these diagrams we can already infer the main structure of the lab. We are sitting on the consultant laptop, and there are two Wi-Fi networks in play: AirTouch-Internet, which uses WPA2-PSK\ AirTouch-Office, which uses WPA2-Enterprise / MGT Currently we are already in Consultant , let see the IP of our machine : At this stage, we already have access to the consultant network. The next objective is to pivot into the remaining wireless networks. Let's check what permissions we have in consultant user. The consultant user had unrestricted sudo privileges, allowing direct privilege escalation: We found an application called EAPHammer. This tool requires trusted certificates to verify authenticity, which we do not currently possess. This may become useful later in the attack path. EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks. It is designed to be used in full scope wireless assessments and red team engagements. As such, focus is placed on providing an easy-to-use interface that can be leveraged to execute powerful wireless attacks with minimal manual configuration. To illustrate just how fast this tool is, our Quick Start section provides an example of how to execute a credential stealing evil twin attack against a WPA/2-EAP network in just commands. General Words: EAPHammer is a tool used by security testers to create a fake company Wi-Fi and check whether users or devices connect to it and leak their login credentials. The next step was to enumerate the available network interfaces: Total 9 network adapters are detected Wireless Interface Preparation One wireless adapter was prepared for monitoring wireless traffic: Let's place an adapter into monitor mode and scan for Wi‑Fi devices : now its time for airmon-ng to change the interface card from managed mode to monitor mode , I confirmed that aircrack-ng suite is already installed on this box. I will run airodump-ng wlan0mon -band abg to start capturing traffic on 5 GHZ too . By default, it only captures on 2.4 GHz channels. --band abg tells it to capture on 802.11a (5 GHz), 802.11b (2.4 GHz), and 802.11g (2.4 GHz). we can see that AirTouch-office and AirTouch-Internet are in our scope and other names like WIFI-JOHH, vodafoneFB6N ..etc look like neighbour network. from the results we can see that AirTouch-Office is under MGT auth and AirTouch-Internet is PSK auth , it is easy to crack the Preshared key auth compared to MGT. Capturing the WPA2 Handshake Let's try to capture the handshake so that we can try to crack the PSK. The following deauthentication packets were sent to disconnect the client from the network. so then when it reconnects we can get the handshake done The purpose of the de-authentication attack was to forceably disconnect the client from the wireless network. When the client automatically reconnected, the WPA handshake could be captured for offline cracking. I will copy that AirTouch-Interet.cap-01.cap to my host machine so that I can crack it; I will be using SCP for this transfer With the WPA handshake captured, the next step was to crack the WPA2-PSK password using a wordlist attack: The WPA2-PSK password was successfully cracked using the RockYou wordlist. This provided access to the internal wireless network. Connecting to AirTouch-Internet: we used wpa_passphrase to generate a config file with below details: Connecting to the Wireless Network Now we are establishing the connection to that network: I used wlan4 as our interface to connect and this brings up the interface, but it doesn’t have an IP yet: Let's assign the IP : Requesting IP from Dhclient IP is assigned now : We remembered that we captured the handshake. let decrypt it with airdecap-ng tool : Traffic Decryption and Analysis now we have AirTouch-Interet.cap-01-dec.cap open with wireshark to check what's in it . I will transfer the decrypted file to my host machine , Open with wireshark : image We can see /lab.php image now right click on that packet and select Follow and select Http-stream. image The captured session cookie appears to provide authenticated access to the router interface. on 192.168.3.1 SSH Dynamic Port Forwarding Before login do these steps: image used foxyProxy extension and configured to use socks5 Now its time for SSH dynamic login which enable us to form the tunnelling now we have a login page image I rembered that we have a phpsession id , that we got from Wi‑Fi handshake , Let's use that session id here by replacing in developer tools inside network tab : also I added a extra tab for UserRole and changed the username from user to admin. image After modifying the session values, administrative access to the router panel was obtained: image We can upload files, for example I created a sample payload.php : and tried to upload it but it got rejected the .php extension image I tried other extensions like .php3, .php4, and .php5 but all are blocked, and .phtml worked finally. image Now Let's check , we can see that it uploaded to /uploads folder : image The payload executed successfully: image Remote command execution was now possible through the uploaded web shell. Running pwd revealed the current working directory: >/var/www/html/uploads after some enumeration we got creds from this path ./login.php http://192.168.3.1/uploads/payload.phtml?cmd=cat%20../login.php image >'user' => array('password' => 'JunDRDZKHDnpkpDDvay', 'role' => 'admin'), \ 'manager' => array('password' => '2wLFYNh4TSTgA5sNgT4', 'role' => 'user') SSH Access to the PSK Access Point SSH login as user : by checking the permission on the box we have root level access : by simply running sudo su - returns root At this stage, full access to the PSK access point had been achieved, and the user flag could be retrieved. USER.TXT Privilege Escalation Enumerating Sensitive Files Let's see what in home directory We have this files After checking each file i got a password for user remote. user= Remote \ Password : xGgWEwqUpfoOVsLeROeG --- Earlier, we identified that EAPHammer required trusted certificates to impersonate the enterprise access point successfully. I will copy this certs to my host machine : firstly copying the files to the /home/user/ home directory. so that we can easily copy them by using scp Transferring Certificates scp : Now connect to the ssh session of consultant user , i will copy the certs-backup to here . The recovered certificates were extremely important because WPA2-Enterprise environments rely heavily on certificate trust. Importing the legitimate certificates into EAPHammer allowed the rogue access point to appear trusted to client devices. Before moving on, stop wpa_supplicant to disconnect from the PSK network. Note: This is the point where the enterprise attack becomes real. Once we import the genuine certs, we are no longer trying to bypass trust; we are fitting into the trust model the client already expects. WPA2-Enterprise Rogue Access Point Attack Importing Trusted Certificates With the trusted cert imported, create the Rogue AP again: Keep the rogue AP running while sending deauthentication frames. , we will send deauth packets Forcing Clients to Reconnect Capturing Credentials The rogue access point successfully captured MSCHAPv2 authentication material. image Cracking the Captured Credentials The captured MSCHAPv2 challenge-response material was then cracked using Hashcat: The credentials for the WPA2-Enterprise network were successfully recovered: Adding the credentials to the conf file so that we use this config to connect to Wi‑Fi. Connecting to the AirTouch-Office Network The connection to the WPA2-Enterprise network was successfully established. Requesting the IP from the DHCP We received the IP address 10.10.10.38 from 10.10.10.1 Accessing the Enterprise Management Network ssh login : Unlike the previous host, the remote user did not have sudo privileges: Process Enumeration Let's check processes ; The process list points toward hostapd, so that is the first place worth checking. we don't have permissions to read the /root/mgt/hostapd_wpe.conf file Enumerating Hostapd Configuration Let's check the /etc/hostpad directory : Reading hostapd_wpe.eap_user reveals another credential tied to the MGT Wi-Fi setup: We can confirm that the other password stored in cleartext only , so we can directly try to login with that password . Using the recovered credentials, access to the admin account was successfully obtained: Final Privilege Escalation As a admin user we can run the sudo : The admin user had unrestricted sudo privileges, making privilege escalation trivial: Root Flag : ATTACK PATH DIAGRAM :