[Script] [Video] fakeAP_pwn (v0.3)

[parrotface]

Great work guy’s script looks good; I can't wait to get mine working.
Using version #102 with atheros wifi on eeepc using BT4-r1

First problem
can't get consistent results using airbase-ng, sometimes XP or Vista won't connect, the next time it connects OK. I have tried changing line 1412 as previous discussions. (Removed -W 0 & -a) in various configurations still same. Tried different environments, distance between machines and the results are never the same. I think some of the better results were in an area where there were NO other AP’s, so I guess it may be interference from other signals.

Second problem
When I do get my client connected firefox gets Server Not Found, and 10.0.0.1 Failed to connect. (It has worked it many, many times in previous versions, even had wkv working but not much success in the last couple of weeks)
Log shows –
Monitoring connections
Connections~watch –d –n 1 “arp –n –v –I at0”
Waiting for target to run “update” file
Started reverse handler on 10.0.0.1:4564
Starting the payload handler…
Client 00:1A:73:xx:xx:xx associated (unencrypted) to ESSID “Free-WiFi 102”

Tried HostAP but this fails to start. Any pointers to getting hostAP working as I hope this may solve some problems then I can concentrate on the other nice things.
So frustrating as the script now looks awesome and so much work put into it.
Great Work .

[AlphaOmega]

Nice Work, very easy to do as well. I have been fooling around with new methods airbase and airplay ad hocs and this takes the cake. I do not think most people see the big picture with this exploit . GoT MilK & GoT sKiLLs!

[g0tmi1k]

Yes, I`m 150% that i used the right link, when i click on download at first i got error: files doesnt exist, and now just a blank page, and mozzila, ie, opera,... stop loading.

I can confirm the links both on this project and the evilDEB script/tutorial are unavailable, looks like mediafire is having a problem.

Ive just tired all the links for fakeAP_pwn/evilDEB/evilGrade - both the scripts and video links are working for me.
I've found a few little fixes for fakeAP_pwn as it is, the next time I update the SVN, Ill upload a copy to GoogleCode for another mirror. (if you cant wait - PM me your email address)

Great work guy’s script looks good; I can't wait to get mine working.
Using version #102 with atheros wifi on eeepc using BT4-r1

First problem
can't get consistent results using airbase-ng, sometimes XP or Vista won't connect, the next time it connects OK. I have tried changing line 1412 as previous discussions. (Removed -W 0 & -a) in various configurations still same. Tried different environments, distance between machines and the results are never the same. I think some of the better results were in an area where there were NO other AP’s, so I guess it may be interference from other signals.

Second problem
When I do get my client connected firefox gets Server Not Found, and 10.0.0.1 Failed to connect. (It has worked it many, many times in previous versions, even had wkv working but not much success in the last couple of weeks)
Log shows – T
Monitoring connections
Connections~watch –d –n 1 “arp –n –v –I at0”
Waiting for target to run “update” file
Started reverse handler on 10.0.0.1:4564
Starting the payload handler…
Client 00:1A:73:xx:xx:xx associated (unencrypted) to ESSID “Free-WiFi 102”

Tried HostAP but this fails to start. Any pointers to getting hostAP working as I hope this may solve some problems then I can concentrate on the other nice things.
So frustrating as the script now looks awesome and so much work put into it.
Great Work .

First problem - Sounds like your using airbase-ng.
Yeah, it does have a few bugs. I think it depends on your hardware/drivers. If you can, its worth doing hostapd

Second problem - Using the latest version of dhcp3-server?
Does the target get an IP address? Can get target ping itself? 10.0.0.1?

Ive only just got my laptop back from repairs, so I havent look into hostapd too much. Joker knows alot more, and has it working.
What hardware are you using? How are you running backtrack?

Thanks for the thanks, and I hate it when something SHOULD work, but doesn't.

Nice Work, very easy to do as well. I have been fooling around with new methods airbase and airplay ad hocs and this takes the cake. I do not think most people see the big picture with this exploit . GoT MilK & GoT sKiLLs!

Thanks for thanks!

[parrotface]

First problem - Sounds like your using airbase-ng.
Yeah, it does have a few bugs. I think it depends on your hardware/drivers. If you can, its worth doing hostapd

Yes I am using airbase as I can't get hostAP to run

Second problem - Using the latest version of dhcp3-server?
Does the target get an IP address? Can get target ping itself? 10.0.0.1?

target gets IP address no problem did not try to ping 10.0.0.1, browser won't connect to 10.0.0.1

I have bt4-r1 installed on an 8gb sdhc card running in eeepc. wifi is atheros
will set it up again as soon as I get time & try ping.
many thanks

[joker5bb]

how did you compile hostapd?

[Itachi]

Hey
i try it and it worked
but i just made a payload for my new AP
My AP works on every OS
can be a separate AP(like yours)
And can be use to fuse with any AP you want and place your fake page on it
thanks

[Eatme]

when i try to connect to "free wifi" using window xp sp3, it connects with limited access... ap is in the next room.

[g0tmi1k]

when i try to connect to "free wifi" using window xp sp3, it connects with limited access... ap is in the next room.

Well...What mode do you have fakeAP_pwn set to run in!?
It might be working correctly, just not the mode you want it in!
Example, it will be "limited" if you have it in "non".

[parrotface]

how did you compile hostapd?

Not got my head round hostapd yet, I need to spent more time looking.
All Ive done was apt-get to install. I have found the hostapd.conf but not made any changes yet.
/etc/init.d/hostapd start seems to work. If I try and use hostapd in the script it says "hostapd failed to start"
Also tried install via the script with same results.

Does the target get an IP address? Can get target ping itself? 10.0.0.1?

I have changed the attacker machine to HP laptop with Broadcom WiFi and the FreeWiFi does not show up as an AP on the target machine(another HP laptop). But using a USB adapter (zd1211) in the attack machine (wlan1) things work better. The target can connect to FreeWiFi, down load and get a meterpreter session, and also shell works, but NO access to the internet.
Target gets IP 10.0.0.150 and can ping 10.0.0.1
I can also ping the router 192.168.1.250
Is this a DNS problem? But I can’t ping googles IP.
Many thanks

[Eatme]

Well...What mode do you have fakeAP_pwn set to run in!?
It might be working correctly, just not the mode you want it in!
Example, it will be "limited" if you have it in "non".

no i have it on Transparent

ok it connects now...but

when I run the update file on the victim(s) machine, nothing happens...

Attacker machine just sits at:

[i] Waiting for the target to run the "update" file

everything is set to:
mode:transparent
payload="vnc"

victim1 OS=Windows XP SP3 32-Bit
victim2 OS=Windows 7 64-Bit

same thing happens on both scenarios...

help, thanks.