Network Admin :: Q4=================
Challenge Prompt--------
> The network admin is busy today, from the pcap, figure out the following questions.> > What is the network admins password?
-------------------
__For these challenges, three files were supplied: [`NET_ADMIN.pcapng`](../NET_ADMIN.pcapng), [`NET_ADMIN2.pcapng`](../NET_ADMIN2.pcapng), and [`Net_admin_Diagram.png`](../Net_admin_Diagram.png)__
The target [PCAP] file for this challenge is the second one, [`NET_ADMIN2.pcapng`](../NET_ADMIN2.pcapng), since that is the one that has the packets for actual authentication. If you dig deep into [Wireshark] on the packets that include his name and the "`Password`" string you can see fields for `User-Authenication` but the password is encrypted.
You can notice though that it is the [RADIUS][RADIUS] protocol. That at least gave us some keywords we use to start some research.
I Googled for a good while and eventually found out that the [Jumbo John The Ripper] has support for scraping out a [RADIUS][RADIUS] "shared secret" with a [PCAP]. That sounded like everything we needed, with everything we had... but it wasn't exactly _a password._ The shared secret, though, could help us uncover the password.
So I downloaded [Jumbo John The Ripper] with [`git`][git] and ran the [`radius2john.pl`][radius2john.pl] script to get a format that [Jumbo John The Ripper] could work with. Then I compiled [Jumbo John The Ripper] and ran it.
```git clone "https://github.com/magnumripper/JohnTheRipper"cd JohnTheRipper/run./radius2john.pl ../../NET_ADMIN2.pcapng > hashes.txtcd ../srcconfiguremakecd ../run./john hashes.txt```
It got the shared secret pretty quickly!
```Using default input encoding: UTF-8Loaded 1 password hash (dynamic_1017 [md5($s.$p) (long salt) 256/256 AVX2 8x3])Warning: no OpenMP support for this hash type, consider --fork=4Press 'q' or Ctrl-C to abort, almost any other key for statusferrari          (10.10.2.200)1g 0:00:00:00 DONE 2/3 (2017-10-21 14:27) 33.33g/s 173600p/s 173600c/s 173600C/s 123456..GeronimoUse the "--show" option to display all of the cracked passwords reliablySession completed```
So shared secret was `ferrari`... but this isn't the flag, it's not the password. 
I banged my head against the wall for a while to figure out how I could get a [RADIUS] password with the shared secret.... eventually my research found that I could just use [Wireshark].
The article describing such is here: [http://wifiphil.blogspot.com/2015/12/troubleshooting-decrypt-radius-packets.html](http://wifiphil.blogspot.com/2015/12/troubleshooting-decrypt-radius-packets.html)
With that in effect, [Wireshark] would show me the password in plaintext. 
Now this is a challenge I actually liked. It was difficult, but I felt like I was researching and learning and finding tools and techniques to get what I want. That is a CTF; not a GTF.
__Flag: `routergod`__
[pcap]: https://en.wikipedia.org/wiki/Pcap[PCAP]: https://en.wikipedia.org/wiki/Pcap[CyberSEED]: https://www.csi.uconn.edu/cybersecurity-week/[RTL-SDR]: https://www.rtl-sdr.com/[System76]: https://system76.com/[PCAP]: [pcap]: https://en.wikipedia.org/wiki/Pcap[regex]: https://en.wikipedia.org/wiki/Regular_expression[scapy]: http://www.secdev.org/projects/scapy/[Wireshark]: https://www.wireshark.org/[RADIUS]: https://en.wikipedia.org/wiki/RADIUS[John The Ripper]: https://github.com/magnumripper/JohnTheRipper[Jumbo John The Ripper]: https://github.com/magnumripper/JohnTheRipper[git]: https://git-scm.com/[radius2john]: https://github.com/piyushcse29/john-the-ripper/blob/master/run/radius2john.pl[radius2john.pl]: https://github.com/piyushcse29/john-the-ripper/blob/master/run/radius2john.pl[rockyou.txt]: https://wiki.skullsecurity.org/Passwords