[mread]

This always puzzles me. So you hack the router, you really can't do much in terms of hacking the web interface itself and there usually isn't a command-line like application, so the best you can do (I think) is seeing if you can configure it in a way that allows you to attack the network deeper.

So far, I've thought of this:

->Routers usually have a page that states what devices are connected to its interfaces. You can check those and through trial and error use port forwarding until you get to an open port on those devices.

->You can somehow make the router use a VPN to your machine and capture their traffic, altough many times such option isn't available.

Sometimes routers have ssh which makes this easier, but the most difficult routers for me usually have only Telnet and maybe a ftp server.

Summarizing, imagine that you have a router which:
->Has a web interface and maybe FTP and/or Telnet (if it doesn't they usually can be enabled from the web interface)
->No command-prompt like feature and no ssh

Can you run remotely a file that you upload through FTP?
Can you somehow use Telnet as a terminal? I've been running a honeypot and Mirai sends shell commands through Telnet, however Telnet usually has it's own... language? so how does Mirai do this?

What do you do in these cases?

[EBizzle]

It depends what you're trying to do really.
Lots of business-class routers do have CLI. Cisco IOS for example.

If you gain access to the router, you can turn off the DHCP and set up your own DHCP via a VPN - this allows you to control DNS.
Which in turn allows you to redirect websites.
For example, you could set up a Facebook spoof login page that captures login credentials.

Is there something specific that you're trying to achieve?

[mread]

It depends what you're trying to do really.
Lots of business-class routers do have CLI. Cisco IOS for example.

Interesting.

If you gain access to the router, you can turn off the DHCP and set up your own DHCP via a VPN - this allows you to control DNS.
Which in turn allows you to redirect websites.
For example, you could set up a Facebook spoof login page that captures login credentials.

What if I can't use a VPN with the router?

Is there something specific that you're trying to achieve?

I'm just trying to find a more general approach.

[๖ۣۜJinx]

For me, I start pivoting to get to other devices and try to infect them or able to control them by using some exploits, if you want to start learning this then look up Armitage and Cobalt Strike (it's Linux based). Another thing I would try on a router is to see if the router haves exploits for that certain router. If you want to check it out then go [Here]. I would like to talk more about this subject but currently, I have to go somewhere so I might make a EDIT when I come back (depending on the thread).

[EBizzle]

If you can't use VPN, then as Jinx says - you want to try and infect the machines connected to that network.
Once connected to those, there's a whole plethora of things you can do.
From social engineering for passwords etc, to inspecting packets, to ransomware or a RAT.
Figure out what your end goal is and then research from there. :)

[LD_PRELOAD]

Attempt to reach arbitrary execution. If do, elevate privs until satisfied. Document everything and report.

[mread]

Attempt to reach arbitrary execution. If do, elevate privs until satisfied. Document everything and report.

How do I reach arbitrary execution?

---

If you can't use VPN, then as Jinx says - you want to try and infect the machines connected to that network.

Yeah, the issue is that I don't know how without some sort of shell or pivoting. All I can think of in this case is port forwarding.

[Faith Connors]

How do I reach arbitrary execution?

theres not one answer

[LD_PRELOAD]

How do I reach arbitrary execution?

You see what you get and attempt to work your way with it. Say, you logged in a CGI web panel of some sort. Look for the shell interface, whether it's displayed normally or hidden ("Install remote router update" also counts). Another way is just to look for vulnerabilities in the web service. There are lots.

[mread]

("Install remote router update" also counts).

How so?

[/wrists]

open up ports and command the whole router by hosting your payload on the network and the rest is easy from there

[StopBackDooring]

You can always look at the devices list and spoof as one of the devices and grab that whatsapp by the ass.

[_Pr0xy]

I personally don't know if it is possible or not but if you have access to the router page then maybe install some custom firmware to the router? Maybe a backdoor or something?

[LD_PRELOAD]

How so?

It's usually an available option. Not sure whether remotely or not, but sometimes you can update the router's firmware out of an http link or an sd card. That's code execution.

[mread]

It's usually an available option. Not sure whether remotely or not, but sometimes you can update the router's firmware out of an http link or an sd card. That's code execution.

But you'd have to have access to the original firmware so that you could modify it, right?

If not and if I am not mistaken, firmware files are .bin files, so technically you could just save some shellcode directly to a .bin file and upload it and have it run as a firmware update? Wouldn't that crash the router or something?