Break into Router Gateways with Patator
Router gateways are responsible for protecting every aspect of a network’s configuration. With unfettered access to these privileged configurations, an attacker on a compromised Wi-Fi network can perform a wide variety of advanced attacks.
Brute-Forcing Router Logins with Patator
After hacking a Wi-Fi router with tools like Aircrack, Wifiphisher, and Wifite2, there are several avenues an attacker may explore to further compromise the network. Assuming the gateway isn’t using default credentials, the attacker will try to exploit a vulnerability in the router or perform a brute-force attack.
With access to the router’s gateway and complete control over the configurations, a hacker in this position of power can perform a variety of attacks. They could do any of the following, and then some.
- perform DNS poisoning attacks
- modify or manipulate forwarding ports
- reset the gateway password
- inject JavaScript into a browser on the network
- reset the Wi-Fi name and password
- install a malicious firmware
- modify or delete login and system logs
- modify or disable the firewall
Patator, like Hydra and Medusa, is a command-line brute-forcing tool. The developers have tried to make it more reliable and flexible than its predecessors. My favorite feature of Patator is the raw_request module that allows penetration testers to brute-force HTTP logins much like Burp’s Intruder module.
A General Outline for an Attack
To demonstrate, I’m going to show how to use Patator against two popular consumer routers found on Amazon. Not all router gateways handle authentication the same. I’ll show a kind of general procedure to follow when performing such attacks.
- Capture a login request: A single login attempt is captured in Burp to analyze the request.
- Identify the parameters: It’s important to identify where the dynamic parameters (i.e., username and password) are stored in the request as some login forms handle authentication differently.
- Modify and save the request: After the parameters have been identified, insert a placeholder into the request to help Patator iterate through the desired wordlist.
- Generate a targeted wordlist: A targeted wordlist containing 10,000 passwords is usually more effective than a wordlist of 10 million random passwords. Some authentication methods involve hashing or encoding the credentials in the client’s browser before making the request. The wordlist will need to reflect this as needed.
- Identity and filter failed requests: With modern routers, very rarely will a successful login attempt makes itself known. Understanding and filtering HTTP status codes play a big part in identifying the difference between a failed and successful login attempt.
Now, a word of caution: Patator isn’t very beginner-friendly, so there’s a bit of a learning curve with the syntax that can take some getting used to. Before proceeding, you should have a general understanding of HTTP requests, HTTP status codes, and some experience with Burp’s Intruder module.
