Wifinetic

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Wifinetic (Ubuntu, attack surface: OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0) (22), tcpwrapped (53), vsftpd 3.0.3 (21)). Foothold via the vulnerable entry point; privilege escalation to root. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC wifinetic.htb --min-rate 1000

Enumeration highlights

• Detected OS: Ubuntu.
• Open services: ftp (21), ssh (22), tcpwrapped (53).
• Scan used: nmap -p- -sV -sC wifinetic.htb --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~/Downloads]
└─$ nmap -p- -sV -sC wifinetic.htb --min-rate 1000
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-23 22:41 PDT
Nmap scan report for wifinetic.htb (10.10.11.247)
Host is up (0.029s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT   STATE SERVICE    VERSION
21/tcp open  ftp        vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r--    1 ftp      ftp          4434 Jul 31  2023 MigrateOpenWrt.txt
| -rw-r--r--    1 ftp      ftp       2501210 Jul 31  2023 ProjectGreatMigration.pdf
| -rw-r--r--    1 ftp      ftp         60857 Jul 31  2023 ProjectOpenWRT.pdf
| -rw-r--r--    1 ftp      ftp         40960 Sep 11  2023 backup-OpenWrt-2023-07-26.tar
|_-rw-r--r--    1 ftp      ftp         52946 Jul 31  2023 employees_wellness.pdf
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.10.14.8
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 4
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open  ssh        OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
53/tcp open  tcpwrapped
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 20.50 seconds

1. Based from the nmap results, the machine opens FTP service, ssh service, and it's unclear what service is running at port 53. But based on it's port number, most likely it acts as a DNS Server.
2. Noticed we can login using anonymous user in FTP.

LOGIN USING ANONYMOUS USER

1. Found few files there! Let's download eadh files from current FTP directory to our local machine.
2. Upon reviewing each files, .tar file contained configuration files along with users registered on the machine.

Dirs and files inside the .tar file

1. Reviewing the passwd, found a normal user (netadmin).

2. Interestingly, there is no shadow file. So we can't crack hashes, the approach seems to identify any disclosed information or any weak configurations.

3. Long story short, upon traversing and reviewing each files, found one file which disclosed a password.

4. I'm speculating it's the cred for netadmin user, let's try it.

We are authenticated and got the user flag.

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

NOTES:

mon0 interface is a monitor mode, this interface commonly used for wireless network monitoring. Also it
can be used for testing purposes (which also can be used for bruteforcing the WPS PIN).

1. Interesting, now we can focus on wlan1, wlan0, and mon0.
2. Now let's identify which interface acts as AP and which acts as the Client Wifi.

Execute --> iw config

1. But again, to make sure our understanding we can check the hostapd and wpa_supplicant files.

RESULT FOR BOTH FILES

1. Awesome now we found our target, let's bruteforce the WPS PIN of WLAN1.

2. Tool used to bruteforce the PIN, is using reaver. To identify whether the machine has reaver, simply execute the basic bins enumeration --> getcap -r / 2>/dev/null.

3. Found it. To bruteforce the WPS PIN, we need to identify the BSSID or AP of WLAN1.

4. To identify it, we can using iwconfig.

5. Now, remembering there is mon0 interface, we can use it to perform the WPS PIN Attack because that interface is used to capture WPS handshake packets exchanged during the WPS PIN authentication process.

6. To perform it, we also use reaver to leverage captured WPS handshake packets to perform offline brute-force attacks against the WPS PIN. This can be done by repeatedly attempting different PIN combinations.

NOTES:

Monitoring interfaces, such as mon0 can also be used for passive sniffing of WI-FI traffic
without associating with specific network.

Knowing this, the attackers are allowed to capture and analyze Wi-Fi frames, including
those related to the WPS negotiation.

1. Another tricky part, to use reaver we also need to identify the channel number of the frequency.
2. To identify it simly open the wikipedia for each frequencies's channel.
3. Since our target has frequency of 2.412 GHz, hence the channel number is 1.

Reaver Command

reaver -i mon0 -c 1 -vv -b 02:00:00:00:00:00

1. Awesome we got the PIN and also we got the PSK password.
2. Now we can switch to root!

Root flag: REDACTED

Flags

Lessons Learned

1. FTP Anonymous Login (information disclosure).
2. Enumerating Wireless Network Interfaces.
3. Identifying which network interface used as Access Point (BSSID) and which one is used as the WIFI Client.
4. Dump Detailed each of Wireless Network Configurations (identified misconfig).
5. Bruteforce WPS PIN using reaver (gained root access to the actual WIFI, because we could also get the PSK).