Todays Quick Fun PenTest Project-and reason for Network Segmentation

 Goal:    to Get to the storage of THAT Raspberry Pi (left circle with a USB drive Plugged in) from this laptop (hotspotted on my phone) through a drop box (right circle) made from a RaspberryPi Zero 2 with a POE Ethernet hat on it.  




Essentially the thought was, "If I could gain access to a local network by plugging in this drop box, could I easily gain access to the files on the file share.

Topography of the setup for the remote access and resonance. 

The laptop and the "drop box" were setup having ZeroTier Nodes.   essentially putting bot on the same network over the internet.   

Using Putty and the IP address provided by ZeroTier. I was able to SSH into the drop box remotely: 


once in the network I could run an ip addr to find the subnet that the drop box got from the local DHCP server keeping in mind that we want the address of the bridge as this drop bix has 2 purposes.   It is a wireless access point if we are close and provides the remote access through the ZeroTier Network:




from here I know the local subnet and can start network scans via nmap and see what is on the network and what's open.    In this case I did a scan for FTP ports.   (sudo nmap -sV 192.168.0.1-254 -p22)


For example i was able to find devices and open ports.



If I find the device, I could use WinSCP to load and more importantly download logs and files, collected from the network to the drop box:





Also from her I could SSH into the Pi 
Or if it was an open shared folder i could pull them from the network.

BUT, i did not find the Pi that i was looking for though....   Why?

NETWORK SEGMANTATION-    the drop box was plugged into a port that pulled an IP from default VLAN but the Pi that I was looking for was on a separate VLAN that the other VLANs did not have access to....


Mission accomplished.


The next step is using the drop box to scan WiFi and see if I can pivot across the Wifi to get to the box.



















Comments

Post a Comment

Popular posts from this blog

Internal VPN

Image
 To tighten up home network, and to test,  I recently made a Wireguard server behind the Sophos firewall. My Sophos Firewall is built on an old PC and I have Proxmox on a little mini PC.  The ProxMox server is setup for various services like a Unifi Controller, FreePBX, Wazuh, and most recently a Wireguard server. Essentially, a client at work mentioned that they wanted "everyone to be on a VPN" and a friend was complaining about their VPN not working when they went to the office.  Everyone at the shop mocked the idea and said it would not work....   After building this setup with a Wireguard server and setting up some special rules on the firewall to allow VPN access across VLANS, I am convinced this is the best way to segment a network.  First you can VLAN everything separating various resources but then to limit access within those VLANS is easiest with the Internal VPN server.   
Read more

Its been a while...

 Too Much to talk about: Smart TVs are using the speaker as a microphone- they dont actually turn off when you hit the power button (who would have guessed any of that?  hahahha)....   did an Geolocation ban on my network... why are the "bad countries" always hitting my network?   data has been compromised so many times most people don't even care...   Froze my my credit with the 3 agencies a year or so back...  I would suggest you do it too
Read more

Physical Security/Automation

Image
 Fun little project. I had some of these RCWL-0516 boards laying around and a Raspberry Pi Pico so I started to wonder if I could make a motion sensor toy that would turn the lights on as i needed in my little workspace in the basement. Super easy cute python project: basically set it up to sense motion, and close a relay that turns on the LED light.    When you walk in the room the RCWL-0516 senses via microwave that there is motion, tells the Pico and the Pico sends a signal to the relay to close.   The relay will remained closed for 10 seconds after the motion is no longer detected. I am not sure how I am going to use this.... maybe a logging of detected motion and alerts?   IDK yet.
Read more