Jump to content

IMcPwn

Active Members
 View Profile  See their activity

  • Posts

    36

  • Joined

  • Last visited

  • Days Won

    1

 Content Type 

Posts posted by IMcPwn

    [Open Source] BrowserBackdoor: Cross platform WebSocket Remote Access Tool built with Electron

    in Community Projects

    Posted

    Hey guys. After having fun with the LAN Turtle and WiFi Pineapple Nano I took a break and started working on my own project.

     

    It's called BrowserBackdoor. It's an Electron application that includes a JavaScript WebSocket backdoor that connects to my Ruby listener.

    The Electron application runs in the background with no user interface and is basically Chromium so it hasn't been flagged by any Anti Viruses I've tested it against.

    The Ruby listener can send commands or modules to the Electron application for it to execute and send the results back.

     

    Here are the modules I've created so far:
    enableStartup, screenshot, downloadFile, beep, execCommand, readClipboard, moveToTrash, readDir, openURL, createFile, writeClipboard

    The up to date list is here: https://github.com/IMcPwn/browser-backdoor/tree/master/server/modules

     

    I've also taken some screenshots of what the console looks like: https://github.com/IMcPwn/browser-backdoor/wiki/Screenshots

     

    If anyone is interested in suggesting anything I should add or working on the project with me let me know!

     

    Github link: https://github.com/IMcPwn/browser-backdoor

    I'm also trying out Discord for live text/voice chat: https://discord.gg/013wk2VPnnuw9iLmU

    VPN with Nano

    in WiFi Pineapple NANO

    Posted

    Thanks Darren!

    I tried forwarding LAN to WAN in /etc/config/firewall but it made no difference.

    I want to do what you're doing in the video but using OpenVPN community edition instead of access server but there is absolutely no information on how add a client as a gateway anywhere I can find, do you know how?

    VPN with Nano

    in WiFi Pineapple NANO

    Posted

    Hey guys, I got an OpenVPN client working on the Nano super easily. The command is

    opkg update && opkg install openvpn-openssl --dest sd

    Anyway once I have it connected I cannot ping (or connect in any other way) the nano from my computer (the OpenVPN server) but I can do the reverse.

    I have temporarily disabled ALL iptables rules and set the chain defaults to ACCEPT and still nothing.

    I'd like to say I'm decent at figuring out iptables but I can't work with the zone_wan_input and zone_lan_input, etc chains but I'm assuming that's not the problem because I deleted all of them (temporarily).

    This is also an issue on the Turtle for me.

    I have not tried setting the Nano or Turtle as default gateways on my server because I'm not using openvpn-as (access server), just plain old openvpn command line community edition so I'm not sure how to do that and can't find anything on google on how to do that.

    Here are my current iptables rules on the openvpn server:

    ip=`curl -sS -4 http://icanhazip.com`
iptables -A FORWARD -s 10.8.0.0/24 -d 10.8.0.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to $ip

    It'd be great if anybody had some insight on a solution, thanks in advance!

    Concern on Web UI Security

    in WiFi Pineapple NANO

    Posted · Edited by IMcPwn

    @Darren

    I'm not concerned with regular users. This is for the sysadmins or people who would look up WiFi Pineapple to find out what it is or people who already own one being able to find out information about yours. Ex: they could find out if you have Cabinet or any other module installed by going to http://172.16.42.1:1471/#/modules/Cabinet without needing to log on.

    @audibleblink's CSS solves the issue of someone looking up WiFi Pineapple and going to your site and to find out information unless they know you can disable that CSS on the right side of Chrome's Developer Tools which makes it look exactly how it did before.

    l3dOmFNl.png

    Concern on Web UI Security

    in WiFi Pineapple NANO

    Posted

    Hi, I really love the new UI design, besides the pre-login phase. It looks as below:

    FKNiMt5l.png

    Initially this concerned me because I thought it showed data in the background before you logged in which is false.

    Later when I was learning the new API on my own I developed a module called "Reboot" that does as expected, reboots and turns off the machine. My problem is the below is shown even before I log in:

    5dlgTgxl.png

    In the background there is a leak of information about the module. This can be viewed for any module that's installed to see what the Pineapple owner might be doing or working on. Would it be possible to have an option to force a user to look at a generic login page before viewing anything or do you think that would be excessive?

    Thanks for the consideration

    Exclude Pineapple Subnet from Shared Network

    in WiFi Pineapple NANO

    Posted

    So I learned the order of iptables rules matters and that solved my problem. Below are the commands I appended to my /etc/firewall.user file to block access to local subnets. The pineapple is still accessible though (possibly because it's the default gateway?).

    #block all traffic to any possible private network address (10.*.*.*, 172.16-32.*.*, 192.168.*.*)
iptables -I FORWARD 1 -d 192.168.0.0/16 -j DROP
iptables -I FORWARD 1 -d 172.16.0.0/12 -j DROP
iptables -I FORWARD 1 -d 10.0.0.0/8 -j DROP

    Exclude Pineapple Subnet from Shared Network

    in WiFi Pineapple NANO

    Posted

    Huh. I still can't seem to figure it out. Thanks anyway.

    Here's a few of the many things I've tried:

    config rule
option src lan
option dest wan
option dest_ip 192.168.1.1/24
option target REJECT
    config rule
option src lan
option dest wan
option dest_ip 192.168.1.1/24
option proto tcpudp
option target REJECT

    They seem to not be doing anything. Even after /etc/init.d/firewall restart. Sorry for being a noob.

    Exclude Pineapple Subnet from Shared Network

    in WiFi Pineapple NANO

    Posted

    Hello. I would like to have an option to exclude clients on the Pineapple from being able to access the network the Pineapple is getting Internet from.

    For example,

    I have a home router with the subnet of 192.168.1.1/24

    The pineapple has a subnet of 172.16.42.1/24 and is getting Internet from a computer on the subnet 192.168.1.1/24.

    I would like users on 172.16.42.1/24 to NOT be able to access IPs on the 192.168.1.1/24 subnet.

    Is this possible?

    Thanks for any responses!

    Question Regarding Adding SSL to Interface

    in WiFi Pineapple NANO

    Posted

    By the way, some paths in running 

    nginx -V

    seem invalid.

    root@Pineapple:/etc/nginx# nginx -V
nginx version: nginx/1.4.7
built by gcc 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r46581)
configure arguments: --crossbuild=Linux::mips --prefix=/usr --conf-path=/etc/nginx/nginx.conf --add-module=/home/sebkinne/raid/hak5/pineapple/nano-firmware/build_dir/target-mips_34kc_uClibc-0.9.33.2/nginx-1.4.7/nginx-naxsi/naxsi_src --without-http-cache --add-module=/home/sebkinne/raid/hak5/pineapple/nano-firmware/build_dir/target-mips_34kc_uClibc-0.9.33.2/nginx-1.4.7/nginx-syslog --error-log-path=/var/log/nginx/error.log --pid-path=/var/run/nginx.pid --lock-path=/var/lock/nginx.lock --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/body --http-proxy-temp-path=/var/lib/nginx/proxy --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --with-cc=mips-openwrt-linux-uclibc-gcc --with-cc-opt='-I/home/sebkinne/raid/hak5/pineapple/nano-firmware/staging_dir/target-mips_34kc_uClibc-0.9.33.2/usr/include -I/home/sebkinne/raid/hak5/pineapple/nano-firmware/staging_dir/target-mips_34kc_uClibc-0.9.33.2/include -I/home/sebkinne/raid/hak5/pineapple/nano-firmware/staging_dir/toolchain-mips_34kc_gcc-4.8-linaro_uClibc-0.9.33.2/usr/include -I/home/sebkinne/raid/hak5/pineapple/nano-firmware/staging_dir/toolchain-mips_34kc_gcc-4.8-linaro_uClibc-0.9.33.2/include -Os -pipe -mno-branch-likely -mips32r2 -mtune=34kc -fno-caller-saves -fhonour-copts -Wno-error=unused-but-set-variable -msoft-float -mips16 -minterlink-mips16' --with-ld-opt='-L/home/sebkinne/raid/hak5/pineapple/nano-firmware/staging_dir/target-mips_34kc_uClibc-0.9.33.2/usr/lib -L/home/sebkinne/raid/hak5/pineapple/nano-firmware/staging_dir/target-mips_34kc_uClibc-0.9.33.2/lib -L/home/sebkinne/raid/hak5/pineapple/nano-firmware/staging_dir/toolchain-mips_34kc_gcc-4.8-linaro_uClibc-0.9.33.2/usr/lib -L/home/sebkinne/raid/hak5/pineapple/nano-firmware/staging_dir/toolchain-mips_34kc_gcc-4.8-linaro_uClibc-0.9.33.2/lib'

    Specifically /home/sebkinne which doesn't exist :)

    Question Regarding Adding SSL to Interface

    in WiFi Pineapple NANO

    Posted

    I found a tutorial for adding SSL to the Wifi Pineapple Mark V. https://github.com/hak5/wifipineapple-wiki/blob/gh-pages/add_ssl.md

    To my knowledge this does not work on the Nano.

    First issue appears when installing with the --dest usb option.

     * resolve_pkg_dest_list: Unknown dest name: `usb'.

    I figured this was for the SD card and installed it without that parameter, no errors.

    The Nginx configuration part does not work at all though following the configuration exactly. I've never used nginx before so I'm unfamilar how to fix

    nginx: [emerg] the "ssl" parameter requires ngx_http_ssl_module in /etc/nginx/nginx.conf:61

    My exact configuration is (yes the certs are valid and exist)

    user root root;

    worker_processes 1;



    events {
    worker_connections 1024;
    }


    http {
    include mime.types;
    index index.php index.html index.htm;
    default_type text/html;

    sendfile on;
    keepalive_timeout 65;
    gzip on;

    gzip_min_length 1k;
    gzip_buffers 4 16k;
    gzip_http_version 1.0;
    gzip_comp_level 2;
    gzip_types text/plain application/x-javascript text/css application/xml;
    gzip_vary on;
    server {
    listen 80; # Port, make sure it is not in conflict with another http daemon.
    server_name www; # Change this, reference -> http://nginx.org/en/docs/http/server_names.html
    error_page 404 =200 /index.php;
    error_log /dev/null;
    access_log /dev/null;
    fastcgi_connect_timeout 300;
    fastcgi_send_timeout 300;
    fastcgi_read_timeout 300;
    fastcgi_buffer_size 32k;
    fastcgi_buffers 4 32k;
    fastcgi_busy_buffers_size 32k;
    fastcgi_temp_file_write_size 32k;
    client_body_timeout 10;
    client_header_timeout 10;
    send_timeout 60; # 60 sec should be enough, if experiencing alof of timeouts, increase this.
    output_buffers 1 32k;
    postpone_output 1460;

    root /www/; # Your document root, where all public material is.

    location ~ \.php$ {
    fastcgi_index index.php;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

    if (-f $request_filename) {
    # Only throw it at PHP-FPM if the file exists (prevents some PHP exploits)
    fastcgi_pass unix:/var/run/php5-fpm.sock; # The upstream determined above
    }
    }
    error_page 404 =200 /index.php;
    }

    server {
    listen 1471 ssl; # Port, make sure it is not in conflict with another http daemon.
    server_name pineapple; # Change this, reference -> http://nginx.org/en/docs/http/server_names.html
    ssl_certificate /etc/ssl/certs/server.pem;
    ssl_certificate_key /etc/ssl/certs/server.key;
    ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!MD5;

    error_page 404 =200 /index.php;
    error_log /dev/null;
    access_log /dev/null;
    fastcgi_connect_timeout 300;
    fastcgi_send_timeout 300;
    fastcgi_read_timeout 300;
    fastcgi_buffer_size 32k;
    fastcgi_buffers 4 32k;
    fastcgi_busy_buffers_size 32k;
    fastcgi_temp_file_write_size 32k;
    client_body_timeout 10;
    client_header_timeout 10;
    send_timeout 60; # 60 sec should be enough, if experiencing alof of timeouts, increase this.
    output_buffers 1 32k;
    postpone_output 1460;

    root /pineapple/; # Your document root, where all public material is.
    add_header 'Cache-Control' 'must-revalidate';

    location ~ \.php$ {
    fastcgi_index index.php;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

    if (-f $request_filename) {
    # Only throw it at PHP-FPM if the file exists (prevents some PHP exploits)
    fastcgi_pass unix:/var/run/php5-fpm.sock; # The upstream determined above
    }
    }
    }
    }

    So far loving the hardware and UI, thanks Hak5!

    New module for Stageless Meterpreter

    in LAN Turtle

    Posted

    Hi. I'm IMcPwn.

    This is my first post and I'm not sure exactly what the etiquette is here but I just wanted to get some feedback on a new module I contributed to.

    You can't really say I made it because it's mostly Darren Kitchen's work with my modifications plus a payload by msfvenom.

    Anyway the module is "meterpreter_sl" and here's the link to module's pull request: https://github.com/hak5/lanturtle-wiki/pull/6

    The direct meterpreter_sl executable would have to be accepted first if the module is to work, which can be seen here: https://github.com/hak5/lanturtle-files/pull/3

    Basically what the module does is adds a new payload "php/meterpreter_reverse_tcp" which is the stageless version of the current "php/meterpreter/reverse_tcp".

    For those who don't know a stageless meterpreter session has the payload build-in so less data is sent over the network when the session is opened, therefore being stealthier.

    Just looking to get some feedback to see if the community wants this.

    Thanks guys and happy LAN Turtling!

    • Upvote 4
×
×
  • Create New...