In this post, I would like to share a walkthrough of the WifineticTwo Machine from Hack the Box

This room will be considered a Medium machine on Hack the Box

What will you gain from the WifineticTwo machine?

For the user flag, you need to play around with proxy server redirects to an OpenPLC login page. Using the default OpenPLC credentials (openplc/openplc), we log in and exploit CVE-2021-31630 to upload a C-based reverse shell payload on the server, which grants us root access. However, the /root directory only contains the user flag.

As for the root flag, you need to abuse network interfaces (ifconfig) to reveals a wifi interface (wlan0). Its enumeration shows the wifi network’s name (SSID, “plcrouter”), and also that WPS (Wifi Protected Setup) is enabled. Despite the name “WPS”, it is a dangerous parameter that makes wifi vulnerable to the Pixie Dust. This attack allows us to retrieve the PSK (Pre-Shared Key) required to connect to the network. There is an existing Python exploit which does just that. With the PSK in our possession, we can create a configuration file and connect to the network with wpa_supplicant (a daemon process that manages wireless connections on Linux). Once connected to the wifi network, we can SSH into the router which has the default address 192.168.1.1., and this is where we find the root flag.

Information Gathering on Wifinetictwo Machine

Once we have started the VPN connection which requires a download from Hackthebox, we can start