Hacking the IoT Goat software

Summary

In this practical hacking demonstration, the user walks through the process of compromising an IoT device. They begin by scanning the network to identify the target device, extract its firmware using `binwalk`, and crack passwords using common IoT credential lists. The user gains SSH and root access through password cracking and netcat. To maintain persistent control, they set up a cron job to run a backdoor script every minute, ensuring continuous access. This demonstration highlights common techniques used in penetration testing to exploit and maintain control over IoT devices.

Takeaways

• 😀 Network scan is the first step in identifying an IoT device on the network, which reveals open ports and services (e.g., port 22 for SSH).
• 😀 Binwalk is used to extract and analyze firmware images, enabling exploration of embedded files and executable code within IoT devices.
• 😀 Common tools like `binwalk` help extract system information from firmware, which is crucial for identifying potential vulnerabilities.
• 😀 Cracking passwords from the extracted shadow and password files is a critical step in gaining access to the device's system.
• 😀 A standard IoT password wordlist, containing common usernames and passwords, is used in combination with `John the Ripper` for password cracking.
• 😀 Once the password is cracked, SSH access is used to log into the device’s shell and explore its system files for further exploitation.
• 😀 In addition to SSH, Netcat (nc) can be used to connect to alternative open ports for a backdoor entry into the system.
• 😀 After gaining access, the attacker can navigate the filesystem, check for cron jobs, and identify potential places to install a backdoor.
• 😀 A backdoor is established by placing a reverse shell script in a cron job, ensuring the attacker maintains access even after a reboot or session reset.
• 😀 The attacker verifies the persistence of the backdoor by ensuring the reverse shell runs at regular intervals, such as every minute or on specific timings.
• 😀 This process demonstrates both the technical steps involved in IoT hacking and highlights the need for network and device security to mitigate such risks.

Q & A

What is the first step in hacking an IoT device according to the video?

The first step is to discover the IoT device on the network by performing a network scan to identify the device’s IP address and open ports. In the video, the device with IP address `192.168.1.108` and Port 22 open for SSH is found.

Why is the 'binwalk' tool used in the process?

'Binwalk' is used to extract embedded files and executable code from firmware images. It helps to analyze the structure of firmware by identifying file systems and other data that could be exploited on the device.

What are the two key files examined on the IoT device to find user credentials?

The two key files examined are `/etc/passwd` and `/etc/shadow`. These files contain user account information and hashed passwords, which are crucial for gaining access to the device.

How does the attacker crack the password for the IoT device?

The attacker cracks the password by using a precompiled wordlist, which contains common IoT default passwords, and employs a tool like 'John the Ripper' to perform a brute-force attack on the hashed password stored in the `/etc/shadow` file.

What methods are used to gain access to the IoT device after cracking the password?

The attacker gains access by either logging into the device using SSH with the cracked password or by connecting via Netcat to one of the discovered open ports (in this case, port 5550).

What is the significance of setting up a backdoor on the IoT device?

Setting up a backdoor ensures persistent access to the device, allowing the attacker to regain control even if the device is rebooted or its credentials are changed. This is done by adding a cron job to automatically run a reverse shell.

What is the purpose of the cron job that the attacker sets up?

The cron job is configured to execute a reverse shell script every minute. This ensures that the attacker maintains access to the device by automatically reconnecting to their machine, providing persistence.

How does the attacker establish a persistent reverse shell on the IoT device?

The attacker sets up an HTTP server to host the malicious shell script, uses the `wget` command to download the script to the IoT device, and then sets up a cron job to execute the script regularly, thus creating a persistent backdoor.

Why is it important to use tools like 'John the Ripper' and wordlists in ethical hacking?

Tools like 'John the Ripper' and precompiled wordlists are important for performing efficient password cracking in ethical hacking, which helps security professionals identify weak or default passwords on IoT devices that could be exploited by attackers.

What precautions should security professionals take when performing penetration testing on IoT devices?

Security professionals should always seek explicit permission from device owners before conducting penetration testing. They should also ensure compliance with local laws and ethical guidelines to avoid unauthorized access and damage to systems.