SOLDIERX.COM Nobody Can Stop Information Insemination

Introduction
This is a Proof of Concept article describing a BlackBox pentest on a low-level target giving way to a High-level vulnerability in a big name company.

During Pre-engagement the target was identified only by BSSID and ESSID (great..one of those tests). The reinterpreted mission Scope: "Reconnect target 'without' brute-force or noisy network activity." The verbatim Scope: "Discover any possibilities of attacking victim or victims account status without using aggressive attack methods."

For this mission 'Wifi Hacking', 'Common Sense', & 'Possible Social Engineering' are at the disposal of the attacker.

You can read my notes at the end of this article

[disclaimer statement]

For obvious reasons detailed steps are omitted for sake of brevity and the safety of other innocent targets which are not aware of attacker activities. Please note: I am trained and authorized to perform these objectives disclosed in this article. I assume no responsibility for others attempting to reproduce the actions discussed in this article. If you are aware of the missing information, please be ethical in your actions.

As always, the information I provide in articles is purely for Educational purposes ONLY!

[/disclaimer statement]

Mission 1: Identify the Target

Identifying the target proved to be an easy task since the target is identified by BSSID and ESSID only. Naturally, a scan within range of the Pre-engagement site topped the list of 'to-dos'. To begin this objective Airmon-ng, Airodump-ng and Aircrack-ng are the tools of choice.

(Note: If you are unaware of the steps required to perform this attack, consult google. Describing the syntax and options used in a Wifi attack are beyond the scope of this article. This is not a tutorial)

//Airmon-ng succeeded in starting interface
//Airodump-g succeeded in displaying APs

At this point, the attack became focused on the BSSID, Channel, WPS & ESSID of target. It is essential at this stage to avoid disrupting network traffic using 'deauth' or 'packet injection' as it goes against the Scope of the project. Thus, this scan was conducted at an adverage rate of apprx:2hrs. (Amazingly, the hours went by without bother from client) "How's it coming" "Sent memo" etc..

One surprise I found was that the target was using a WEP CIPHER!! (WOW)

Mission 2: Access the Target Network

After the proper amount of .ivs were captured it was time for aircrack-ng to get to work. I named the file with the first few characters of the APs ESSID.

//Aircrack-ng succeeded in finding the APs PSK

Discovery of the APs PSK lead to its compromise via 802.11. There are still no fireworks yet, the recon phase has to start again.

Mission 3: Verify Target Connectivity

Of course it is always a good idea to check connectivity of AP.

As bad as I wanted to scan the network for other devices or monitor the network for additional traffic, I had to push on. The next step here, open up a web browser, and simply navigate to a web page where the victim is identified by IP. This is where the real work begins.

At this stage, it is discovered that the victim has internet connectivity with limitations. This is what the client intends. Circumventing these limitations is the vulnerability. Not just bypassing these limitations but doing so as an unauthorized user.

Mission 4: Reconnect Target

//Target supplied victims account information successfully without brute-force or noisy network traffic

As show above, this information is vital to my initial objective. The ease of acquiring this information is troublesome. In the next few lines I will explain how simple this attack was to circumvent the client and exploit their target by using their customer as my victim, thus, reconnecting the target.

NOTES

Because the victim is a customer it is important for the client to have some say so in their account status should events occur requiring the customer to be 'cast'. This role in this case means the client has a limitation on network connectivity, meaning the customer cannot access the Internet until other conditions are met. i.e (activating an account, paying a bill, or signing-up for service)

In order to succeed at this mission I needed to go Overt. First step: "Identify the reason for the limitation". For convenience of the customer, the client provides them with a way to 'comply' with the conditions needed to restore service. This is a bonus for an attacker because it is a way for the attacker to understand the target. Notice I say target because the victim is the customer and the client is the company..the target is objective or client's controls.

The limitation discovered here is "Service Disruption". So since there is no way to simply restore it through authorized means, I must look into the profile of the customer and restore service in their name, but how?

Second step: "Access victims account". After reviewing the controls set for the customer I noticed that everything asked of the customer is personal information known only to the customer his/herself.

Details include :"Last Name, First Name, Zip" >> "Account Number, Zip" >> "Username, Password"

Guessing any of this information leads back to breaking the SCOPE of project as it requires either brute-forcing or raising flags to the target, thus banning of IP addresses required to access the information. Not a good look! It is obvious to view the source code of these controls to discover not-so-confidential information to further the cause.

Viewing the source code to search for file paths was my only hope. I discovered the following file paths which lead to the confidential information of the victim giving way to removing the controls set by the client::

This information will never be hidden however, it is important for the client to authenticate the user in a limited manner to prevent circumventing the controls set forth. This attack did not require SQLi, XSS, Directory Traversal, Brute Forcing, or the usage of MSF.

The information provided could have lead to further exploitation of the victim rather than just the target...for example.

Mission 5: Write PoC

You are looking at it... I hope you enjoyed exploring this with me. Leave a comment about what you have learned or what you would have done if you had this objective. PS I think you are cool too!

os13115