Instructor: Welcome back
time to check out the default credentials vulnerability
on your router.
Now,
this tutorial is something that you cannot follow
because this is going to be different
for every type of router that someone has.
I can just show you the process of how I went
and discovered the default credentials
and you can try to do the same thing in order
to see whether you can gain access to your router.
So the first thing that I did is I typed Netstat dash
NR to check out the IP address of my gateway,
which is most likely going to be the IP address
of your router.
Then I went to Google Home and visited that IP address.
If you do the same for your router
it'll most likely lead you to some type of a login page
where it'll ask you for the username and the password.
Once you type the username and the password
you will have access to the router settings
and you will be able to change a few things here and there
from setting up wireless, to port forwarding
and similar settings like that.
Now, if you haven't changed the default password
for your router, you'll most likely be able to
find it on the internet.
Which I did.
I just searched the name
of the router that I have right here
and I found the username to be telecom
and password to be telecom.
Nobody changed this username and password,
therefore they're exactly the same.
And we even get this warning that says
A data breach on a site or app exposed your passwords.
Chrome recommends changing your password
for this IP address.
Now we're going to click on, okay,
and pretty much we already gained access
to the router settings.
We can set up the firewall VLAN settings.
We can check out different settings that we have right here.
We have some security settings right here.
We also get the port forwarding, which we can perform
and this is something that they tested
on multiple home routers,
and many of them appear to have default credentials
where it allows you to log into the router
and change these type of settings.
But these are not the only default credentials
that you can find.
For example,
if I go right here and I run an Nmap scan
with dash sT command on my router IP address
I will also discover that it has some ports open.
For example, it has this telnet port open.
We already know how we can connect to the telnet.
We can type the command telnet and then the IP address
of the targeted we want to connect to.
If I press enter,
we will get another login screen.
So if I type something like telekom, once again
it will tell me that the password is incorrect.
Hmm.
So after three attempts,
it simply just closes the connection to the router,
and I figured,
well
if the router default credentials weren't changed
then probably I can find the telnet credentials as well
on the internet.
And after a few minutes of Googling,
I ran across this website where I scrolled a little bit down
and I found this post that was posted by someone.
It says my router name, which is this one
and we can compare it right here.
It is the same name,
and we get the username and password.
We also get how we can enable the shell inside
of that router.
So let's give it a try.
The username is admin and the password is this.
Let's go and run Telnet once again.
Type username to be admin and password to be
Z T
O N
P K.
And here it is.
We are inside of CLI.
Now, the next thing that this person does
is it types enable.
Then it enters the password of zTe
and then it enables shell.
Let's give it the try.
If I type enable
Type zTe,
and then shell,
hmm, another login attempt.
But luckily, this person also provided us
with username and password for that.
This is something that we will most likely never
be able to brute force
in case we didn't know because this is a really
strong username and strong password.
However, it is default one
and this is something that we can find on the internet.
For your router
of course, this will not be the same
but you can go through the same process
of searching for the default credentials.
Just figure out the name of your router,
type it in in Google,
and try to find some default credentials.
For example,
we notice that I have opened Port SSH and Telnet.
You might be able to target SSH and not telnet
or you might be able to target some different port.
It could all depend on your router.
However, now I'm targeting Telnet,
and let's go and type in the username
and password that this person sent us.
So I have it written on my left screen, and I will type
F N
N S D
three z x
h n h
1 6 8
n v
three one.
For some reason it says bad username.
Let's try once again.
Maybe we type something incorrectly.
So let's go admin
Password
Let's enable the password, the zTe, and let's go into Shell.
Here we want to type
F N
N
S D three z
x
h n h
1 6 8
n v three one
which is the login and the password.
S Z
X H
N H
1 6 8
N V three one.
And here we are.
We are inside of the Shell.
If I type ls
we're going to be able to see the files on our router.
I can type the ifconfig command
to be able to to see all
of the interfaces the tower router has.
Here the first interface has the IP address
of 192
.168
.1.1
And down here we are also going to be able to
find the public IP address,
which is right here.
Okay, great.
We have gained access to the router.
We can also go and change the directories
to different directories if we want to.
We can run different commands
that you can usually run from your terminal,
and that's how you can gain access
to your router with default credentials.
Now, give it a try on your own router.
Try searching the name of the router.
First try logging into this page right here
which will grant you an access
to some of the router settings.
And even if you don't manage to do that
try scanning your router with Nmap.
Figure out whether it has some interesting ports open
and then target those ports
with default credentials that you might manage
to find online just like I did right here.
Okay, now that we covered this
we're ready to continue with our exploitation section.
See you in the next video.