Hello everybody and welcome to this tutorial.
Today we're gonna do some pre-authentication exploitation whereby we
will pull the credentials without actually authenticating with the router.
We're not gonna pull the router's credentials in this particular case,
we're gonna pull some information on the wireless.
Now, there are some pretty interesting facts about this method and this approach.
For example, I have seen it used.
Well, I haven't actually seen it with my own eyes.
I've just read about it on the net.
And I've read the reports.
So basically, here's what people did.
Because there was a vulnerability within peeling routers, that you can pull
wireless log, wireless credentials, wireless login keys, provided
of course that you have the external router IP address.
And now that is the catch, so how do you get the IP address?
When you are not authenticated with the service, I mean,
there really is no easy way of doing it.
So what some people came up with, I mean,
this is clearly in the realm of illegal and you definitely shouldn't do this.
I mean, it's very unlikely that you will get a permission to do this.
But, you know, rules vary from one ISP provider to another.
And they did the following.
They basically conducted a full-wide scan of all the IP
addresses within one country, and they've basically,
because Nmaps supports scripting, you see some of those scripts in front of me,
I'm going to clear the screen because I'm going to show you how to install them.
Because Nmaps supports scripting,
it has allowed them to run one single automated command and
just let it run there, and it didn't run for even that long.
It ran for maybe a couple of, not
a couple of hours, but It ran for a day for sure, something of a kind.
And it scanned one IP address after another and it would confirm that the IP
address was vulnerable, that the services running on that IP address were actually
vulnerable, they would be exploited immediately by Nmap scripts and
credentials would be pulled.
So these scripts ran for about a day or so.
They had a massive amount of wireless passwords and
even though they didn't have all of them,
because not everybody within the country uses the same wireless routers,
most of the routers were actually vulnerable.
Primarily because firms, companies that produce routers,
they use very very similar firmware on similar
routers which are designed for similar purposes.
For example, for home routers, you will find that the firmware
from one router to the other is very similar indeed.
And the same vulnerabilities usually apply.
Anyway, this doesn't of course necessarily need to be true.
So they grab this huge amount of wireless passwords.
Of course they couldn't use all of them.
The idea was that they would manage to grab wireless password keys
from wireless access points that were within their range.
So, within the range of their network, wireless network card.
And they did actually manage to pull those as well except they pulled
a lot of others as well.
They pulled thousands and thousands of others as well.
And of course, they've stored that into a file, one huge file.
And then they began searching.
Searching through the file for ESSIDs.
Of wireless access points around them,
if any of them corresponded to the ESSIDs within the file.
And of course, they were matches.
And once they found those matches, they've had wireless passwords for
all of the networks around them.
For all of the wireless access points around them.
Which was great, it was hilarious,
it was a complete success except it was completely illegal.
Not sure whether it got caught or not but it made it into the newspapers or
something of a kind.
So I assume that they have.
Anyway, what we're going to do today is exactly that, but we're not going to do
anything illegal, I'm not going to do any mass scanning or anything like that.
Whatever I do, I will do within the confines of my own home network.
But the principle is the same, really.
The only difference is the IP address that you pass,
although I am definitely not encouraging you to do this, you could get in serious
trouble by mass scanning, especially from your home or something of a kind.
Make sure to inquire about regulations of your ISP provider,
what is permitted and what is not.
Pretty much all the ISP providers out there will allow scanning,
but they have some regulation in regard to that scanning.
You either need a permission or you need to say that you will do it, and so
on and so forth.
So just make sure that you are acquainted with your local ISP
provider's rules in regard to the scanning.
You don't need to call anybody or anything like that if you're uncomfortable with it.
Just go on the net.
These sort of things, they're in the public domain, they're public information.
So, they will give it to you.
That's not a problem.
They all have these specific rules and
they like when people follow them through so they're public, and so on.
What I'm trying to tell you is,
make sure that you're not doing anything illegal here.
Anyway, without further ado, let's just go ahead and start having some fun with Nmap.
So first of all I, will be exploiting my home wireless router, which is set up for
this particular exercise.
And I do believe I have a small file here that I've prepared for myself.
Yep, there we go.
So we have one command down at the bottom and
we have two different file directories which we're going to use.
So anyway, let's go ahead and give it a shot.
And before we actually do the scan itself, I wanna show you how
you can install scripts because, as you can see from this last command,
you have R file equals and then you have, sorry, not R file.
You have dash, dash, script.
And then http-tplink-dir-traversal.nse.
And then you have arguments for that particular script.
Anyway, if you don't, you don't need to actually memorize this long command.
If we just go over to the website, the Nmap website,
you will see that no matter what script you actually choose at the bottom,
well, close to the bottom anyway, you will have example usage.
They've done this in such a fantastic way.
I mean, you don't even need to think about it that much.
You just need to read what the particular script does.
Once you do that you can literally just copy/paste this command and
Then in addition to that, you can just assign a target or targets.
As you will soon see.
But before you can actually utilize any of these scripts,
you need to know how to install them.
And that can be tricky from time to time because there isn't exactly a clean way of
doing it, like there is for example, packages,
which are in the official repositories that you can pool with.
This is a bit more complex, but nothing too hard, so you see you have,
at the beginning it says download, http://nmap.org and then scripts.
So just go ahead and click on that link basically.
Oops, let's do it like this.
So, open link in new tab.
Excellent, so you have this rather large script here.
Go ahead and Ctrl+A to make sure that you have selected everything.
Ctrl+C to copy it.
And, well.
Okay, so no problems.
Where is the?
There we go.
And now what you need to do,
is figure out where these scripts are located.
I am already in the scripts folder but if I C-D back to root and
clear, I have no idea where the Nmap scripts are located, but what do I know?
I know that the Nmap script extensions end up with .nse.
So let's just go ahead and type in the command locate.
Locate, what do you think this command does?
It says locate.
It literally locates the file.
But we're going to use a wild card argument dot and then nse.
What this command means is, Please locate all files that have an extension of .nse,
press enter, and there we go we have a bunch of them, a lot of them here.
But that's really irrelevant,
what we have here is a path to where these scripts are located.
I'm not gonna use a full path,
I'm gonna zoom in a little bit first and
then go ahead and type in cd/usr/share and
nmap, Enter, Clear, LS, Exon.
So we are here in this Nmap folder, and we have scripts over here, but
there's also one more thing which you need to pay attention.
It says nselib.
It's right next to the scripts, right here.
It's nselib.
And these are the two folders which will probably be used extensively.
There's also payloads and so on and so forth.
And we might do this at a different time, but for the time being let's just focus on
these two and see how these scripts are actually installed.
Let's just go ahead and clear the screen, cd into scripts ls.
And there we go, we have a lot of them here.
So, these scripts are all used to either scan or exploit different types
of vulnerabilities depending on what sort of scripts they are.
And, the way you would do it is, actually, let me just see if I already
have this script installed so I don't do it, like twice over.
Copy.
So LS, this is one of the ways to confirm it.
And, yes, I actually do.
So I can just do cat and then let's paste it again, press Enter, and
there you go, you have the entire script listed here.
Pretty much just copy, pasting.
There we go.
It starts from here and just copy, pasting what we saw in the website, so.
Over here.
These two files are exactly the same so just select everything that is here
and copy it into, into the script folder.
Clear.
So I already have the file.
I already have that script here, but
in case I didn't, what I would do is type in the following.
I would touch, that's a command.
I'm not gonna touch anything, obviously, aside from my keyboard.
Type in touch.
And then we would need a name of the file, so you would just do this.
Apparently, I have created it.
Let me just L-S the same thing.
Okay so it's already there, so it can't actually create it, no problems.
Anyway, you would actually create it or, you don't even need to use touch.
You can just use nano and then paste the name,
remember that the name needs to remain the same, and then I would just paste the code
from the website into this particular file, the new file that I would create.
So what you need to do is type in nano, name of the new file that you wish
to create, this one is full obviously, but I can delete all of this and
copy that from the website, and that would be all that I would need to do.
Make sure that the name is as exactly as it says on the website.
So you can grab the name of the script from here.
No problems here.
I can just open link in new tab.
I have some vone scripts here and let's just pick
the first one, so this one would be APF copy.
Do I have it here?
LS based.
Yep, I even have this one.
I have a vast majority of these scripts, here.
So, I don't have any problems with that.
But, you will need to manually install some of them and I've just showed you how.
So, just create a file with the specific name of the script,
which you can grab from the site, and then fill that script up
with information that you can find on the download link at the top of the site.
So just Ctrl+A,
Ctrl+C and then you would paste it obviously in the file in the terminal.
That is the way to use it.
Now down at the bottom it says requires.
So these are some of the things that it requires, and you go down into Libraries.
Control+F, vulms, and there you go.
It says vulms.
That's one of the libraries required, so let me just go through it.
Yep, there we go.
Source, copyright.
Those are your functions down below.
I'm not interested in that.
Anyway, example of [INAUDIBLE] script.
The following example illustrates, Illustrates.
There is bound to be a link somewhere.
To match different from abilities, exploit ability
table There we go.
Source.
Sorry. There's no download section here.
It just says source, if you click on it,
again, you are given the same screen,
which you can just Ctrl+A to copy and, no problems there.
Same procedure as with the script,
you just Ctrl+A to copy everything within this.
You come back, you actually need to have the same name for
this library, and you go ahead and open up your terminal,
you go out of the scripts because we don't want to be there, you go LS.
Mm, where is it?
nselib, LS.
And you will basically create it here.
Make sure that the extension has, let's just go ahead and enter that.
Oh [NOISE] this is not what
I wanted to create,
give me a second here so, nano.
Go back to the website, vulms.lua.
Go back to the terminal, paste.
Oh, okay, so I already have this one as well.
But if I didn't, I would just paste the code into here and
I would press Ctrl+O to save it.
That is all you need to do.
There is nothing else, quite literally, that you would need to do,
it's just a bunch of copy-paste action.
That is all.
A lot of these files and a lot of scripts you will have by default install,
so don't worry about it.
Just in case you need something very specific, you would actually need
to go on over to their website, and just copy-paste the code.
That is it.
You don't need to do anything else.
I'll just clear the screen.
If you still have some problems with this, or something of a kind,
feel free to address me in the question section,
I will be more than happy to help you out any way I can.
Anyway, let's employ this last command.
Based and include the script.
So it says here target, my target's gonna be 192.168.0.1.
And this is my wireless router.
Now, I am giving it a LAN address,
but you can give it a external IP address as well, if you have it.
I don't have Internet.
I don't have access onto internet from my wireless router,
so I'm using it like this.
Press enter and there we go, we have a vpa key, oh sorry, a vpa passphrase.
A wonderful passphrase, seriously, like test123456789,
the most original one you will ever see.
ESSID is somewhere in here as well.
Feel free to just go about looking for it.
More importantly WPS default pin is here.
Make sure to grab this, because if the user changes the password,
you want to know the pin.
You'll want to know the pin because you can retrieve that password afterwards,
the way I showed you where we used revert in order to extract
the VPA Password, passphrase, or a passkey with a PIN.
If you give reaver the default PIN,
it's gonna pull the password no problems, immediately.
Anyway, I will wrap the tutorial up here.
This is one of the ways in which you can get the IP addresses.
The VPS2 passkeys.
Aside from the IP address here, you can type in -il and
then give it a file which contains a list of IP addresses.
A file which contains a list of IP addresses would look something like this.
So it would have 192.168.1.
One to two hundred and, actually, 195.
So again, 192.168.44 to 98.1.
.1 to, I don't know, 33.
So these are the IP ranges which you can put into this file and then later on,
you can actually pass them to Nmap with an il command and, just type in test.
And the Nmap will actually take all those IP address ranges and
will do exactly the same thing for every single IP address there.
In any case, I would like to bid you all farewell,
and I'll hope to see you in the next tutorial.