WiFi Recon → SSH Takeover

KaliRange ~ lab briefing

┌──(student㉿kalirange)-[~] └─$ cat mission.txt MISSION : WiFi Recon → SSH Takeover SCOPE : Two machines, one Wi-Fi network, same subnet PATH : recon → discover → enumerate → crack → access → detect STATUS : authorized lab environments only └─$ ./read_briefing.sh

1. Lab Briefing

🔴 Authorized lab environments only

Only run this against devices and networks you own or have explicit written permission for. Both machines in this briefing belong to the same person on a private lab Wi-Fi. Never reuse the demo password anywhere real.

Network Topology

Wi-Fi SSID: kalirange Computer A Kali Linux role: attacker interface: wlan0 Computer B MacBook (macOS) role: target service: sshd :22 same subnet · 192.168.1.0/24 · 256 possible addresses

• Both machines join Wi-Fi "kalirange" → same subnet, 192.168.1.0/24.
• ARP is a broadcast — everyone on the subnet can hear it, even on encrypted Wi-Fi.
• Target runs OpenSSH on port 22 — that's the whole attack surface here.

Attack Workflow

ATTACK CHAIN OVERVIEW 1. RECON T1040 — Sniffing 2. DISCOVERY T1018 — Remote Sys. 3. ENUMERATION T1046 — Svc. Disc. 4. CREDENTIAL ATK T1110.001 — Brute 5. ACCESS T1021.004 — SSH 6. DETECTION Blue Team Review

Each phase depends on the one before it — skip host discovery and you don't know what to scan; skip enumeration and you don't know SSH is even open.

Safe / concept

Beginner tip

Danger / legal risk

Discovery / info-gathering

Milestone (access)

2. Full Walkthrough

The whole lab — one page.

🔴 Legal

Only run this against devices/networks you own or have written permission for. Both machines here belong to the same person on a private lab Wi-Fi. Never reuse the demo password anywhere real.

1

Scope & Setup

enable Remote Login on target

sudo systemsetup -setremotelogin on

Create a throwaway test account with a weak demo password (e.g. labuser / Summer2024!). Confirm your own interface with ip a.

2

Passive Recon

T1040 — Network Sniffing

sudo tshark -i wlan0 -f arp

Listen only — don't touch the target yet. One device announcing itself on ARP is your first lead.

3

Active Discovery

T1018 — Remote System Discovery

nmap -sn 192.168.1.0/24
sudo arp-scan --localnet

Sweep the subnet to turn the lead into a confirmed IP address.

4

Service Enumeration

T1046 — Network Service Discovery

nmap -sV -p 22,21,80,443 <ip>

Confirm SSH (22) is open and get its exact version.

5

Credential Attack

T1110.001 — Brute Force

hydra -L users.txt -P passwords.txt ssh://<ip>

Small hand-built wordlist on purpose. -L/-P = lists; -l/-p = single value.

6

Gaining Access

T1021.004 — Remote Services: SSH

ssh labuser@<ip>

Cracked credentials → full interactive shell, same as sitting at the keyboard.

7

Detection

Blue Team review

log stream --predicate 'process == "sshd"'

Many "Failed password" lines followed by one "Accepted password" = classic brute-force signature.

Flag Reference

3. Feynman Notes

Explain it like I'm five.

> PLAIN-ENGLISH WALKTHROUGH_

Two computers joined the same Wi-Fi, which put them on the same "street" of addresses. We quietly listened first and heard one device introduce itself. We then knocked on every door on that street to get its exact address, asked what services it was running, found a locked door (SSH), and tried a handful of common weak keys until one worked. Once in, we had the exact same access as someone typing at that computer directly. Then we switched hats and checked the security camera (the logs) — and sure enough, the break-in left a very obvious trail.

Everyday Analogies

<table class="flag-table analogy-table"><tbody><tr><td>Subnet</td><td>Everyone living on the same street — shout out the window and the neighbors hear it.</td></tr><tr><td>ARP broadcast</td><td>Shouting "who owns this address?" — anyone on the street can hear the shout.</td></tr><tr><td>Port</td><td>A numbered door on a house. Port 22 is always the SSH door.</td></tr><tr><td>Brute force</td><td>Trying every key on a big keyring until one opens the lock.</td></tr><tr><td>SSH login</td><td>The right key doesn't just open the door — it lets you walk through the whole house.</td></tr><tr><td>Logs</td><td>The security camera that was recording the whole time, whether anyone was watching live or not.</td></tr></tbody></table>

⭐ IF YOU REMEMBER ONLY 3 THINGS

1. SSH keys, not passwords. No password means nothing for Hydra to guess — the single strongest fix.
2. fail2ban / sshguard. Auto-bans an IP after a few failed logins, long before a real attack finishes.
3. Watch for the pattern. Many failed logins from one IP, then a success, is the universal brute-force signature — in any log, on any OS.

// same attack, same defenses, on any OS — the discipline is the point, not the tool //