fakeAP_pwn (v0.3)

An update to the script, fakeAP_pwn, which is a bash script to automate creating a "Fake Access Point" and "pwn" whoever connects to it!

Links

Watch video on-line:

Download video: http://download.g0tmi1k.com/videos_archive/fakeAP_pwn-v0.3.mp4

Download Script (fakeAP_pwn-v0.3.tar): *Coming soon*

Download Script (fakeAP_pwn.v0.3-127.tar.gz): *Coming soon*

There are lots of "moving parts" in this and "different environments" it has to work in too.

It was made with BackTrack 4 is out - it hasn't been updated for backtrack 5.

I'm going to re-do it all "soon", however not right now. For the people which are having trouble - I'm unable to give support right now - due to lack of free time. You're on your own until fakeAP_pwn v0.4 is out.

Method

  • Creates an access point, runs a DHCP & web server.
  • Creates an exploit via Metasploit.
  • Waits for the target to connect, download and run the "update".
  • Once successfully exploited, it automatically uploads a payload; SBD, VNC or WKV via the exploit
  • Depending on the mode, it will grant internet access after infection
  • The attacker has the option to run a few "sniffing" programs to "monitor" what the target does on our access point!

Tools

  • The tar file, fakeAP_pwn-v0.3.tar (1018.5KB, SHA1:7C8605F19210FEDC3219822D4D28CC7D1E4A4996)
  • A wireless card - that supports monitor mode
  • Optional: Another interface (wired or wireless) with internet access
  • aircrack-ng suite, dhcpd3, apache2, metasploit, dnsiff suite, wget --- All on BackTrack!
  • Optional: Subversion, hostapd, macchanger, sbd, vnc, squid, mogrify, imsniff, driftnet, sslstrip, ettercap - Which all can be install by fakeAP_pwn

Whats new?

In short, a lot. =)

When comparing it to an older version just about everything has changed, expect for the original idea! See the changelog at the end for more details.

Whats in the tar file?

  • fakeAP_pwn.sh - Bash script
  • www/index.php - The page that the target is forced to see before they have access to the Internet.
  • www/Linux.jpg, OSX.jpg, Windows.jpg, your operating system.jpg - OS pictures
  • www/tick.jpg, favicon.ico - Other images
  • www/sbd.exe - SBD payload
  • www/vnchooks.dll, winvnc.exe, vnc.reg - VNC payloads
  • www/wkv-x86.exe, wkv-x64.exe - WKV payloads

How do I use it?

  1. Extract the tar file (tar xf fakeAP_pwn-v0.3.tar).
  2. Copy the "www" folder to /var/www/fakeAP_pwn (cp www/* /var/www/)
  3. Either edit fakeAP_pwn.sh or specify, via command line, your interface(s)/mode/payload. (You can view your interfaces via ifconfig and use kate to edit.)
  4. Wait for a connection...
  5. ...Game over. =)

Commands

1
2
3
4
5
6
7
8
9
10
11
12
13
14
tar xf fakeAP_pwn-v0.3.tar
cd fakeAP_pwn
ls
mkdir /var/www/fakeAP_pwn
cp www/* /var/www/fakeAP_pwn
bash fakeAP_pwn.sh
clear
ifconfig
bash fakeAP_pwn.sh -?
bash fakeAP_pwn.sh -m non -p wkv -v
bash fakeAP_pwn.sh -m normal -V
bash fakeAP_pwn.sh -m flip -d
ls
kate fakeAP_pwn.log

Troubleshooting

  • "Odd"/Hidden SSID
    • airbase-ng doesn't always work... Re-run the script
    • Try hostap
  • Can't connect
    • airbase-ng doesn't always work... Re-run the script
    • Try hostap
    • Try using two WiFi cards with Diagnostics mode enabled
    • Target is too close/far away
    • I've found "Window 7" connects better/more than "Windows XP"
  • No IP address
    • Use latest version of dhcp3-server
    • Re-run the script
  • Slow
    • Don't run/target a virtual machine
    • Try hostap
    • Try using a different MTU value
    • Your hardware (Example, 802.11n doesn't work too well)
  • Bypassing "Problem" programs
    • Anti Virus - As of 2010-09-02, you MAY be able to bypass a SOME by uncommenting line 1397 - BackTrack only.
    • Windows Firewall - I'm working on it for the next release =)
    • UAC - Not sure... )=
  • ... still not working correctly?
    • Re run with Diagnostics mode enabled (-d)
    • Make a note of the setup (Hardware, versions etc)
    • Get in touch!

Notes

  • Big thanks to joker5bb for giving a helping hand with the coding
  • Thanks to everyone testing out the beta releases/giving feedback
  • Tested in BackTrack 4, R1. Works with Ubuntu 10.04 too!
  • It's worth doing this "manually" (without the script) before using this, so you have an idea of what's happening, and why. The script is only meant to save time.
  • I'm running BackTrack 4 R1 in VM, The target is running Windows 7 Ultimate (fully up-to-date 2010-09-02), with firewall enabled, no AV and with UAC enabled (Windows 7 Default). The other target is running in a VM using Windows XP SP3 Professional.
  • All connections are reversed - meaning the connections come from the target to the attacker, therefore, as the attacker is the server, so it could help out with firewalls...
  • As you can see in the code there is a "roadmap", one day I plan for this to also affect Linux and OSX, support multiple clients, have a different "delivery system" and a "Cloning" mode.
  • The video doesn't demonstrate everything...
  • The video uses fakeAP_pwn v0.3 #100

Song: Sigma - Paint It Black & The Prodigy - One Love & Zombie Nation - Kernkraft. 400

Video length: 11:48

Capture length: 33:07

Blog Post: https://blog.g0tmi1k.com/2010/09/script-video-fakeappwn-v03/

Changelog

2010-10-28 - v0.3 (Build 125)

  • Added: IP info
  • Added: Logging of IPTables
  • Added: Port check & Kill apps
  • Changed: "DHCP Server" (Using dhcpd3 again)
  • Changed: "Temp" output folder
  • Fixed: Display bug (when gateway was wrong)
  • Fixed: Hostapd detecting bug
  • Fixed: Install "apps" bug
  • Fixed: IPTables - "Clear" bug
  • Fixed: IPTables - "Force" bug
  • Fixed: www/ folder copy bug
  • Updated: "Help" screen (Removed unused commands)
  • Updated: Internal working (Bug fixes, Renamed values, Uses less output windows, etc)
  • Updated: Metasploit script
  • Updated: Ping tests
  • Updated: Screen outputs

2010-09-02 - v0.3 (Build 100)

  • Added: 'Diagnostics' and 'Verbose' modes
  • Added: 'HostAP' to create access point
  • Added: 'Monitoring connections_' feature
  • Added: 'Normal' & 'Flip' (Upside-Down-Ternet) modes
  • Added: 'Update' feature
  • Added: 'WKV' payload
  • Added: More 'checks' & 'self fixes'
  • Added: More programs to 'extra' features
  • Changed: The DNS server
  • Fix: lots of bugs/errors
  • Renamed and moved sections about
  • Updated: 'index' & OS images
  • Updated: 'metasploit, 'dhcpd3', 'apache' scripts
  • Updated: 'sbd.exe' & 'vnc.exe' & 'vnc.reg'
  • Updated: The 'help' screen
  • Updated: The all of the internal structure/workings'
  • Updated: The command line arguments
  • ...and a couple of extra 'little' things