Jump to content

Detection of the pineapple in the wild & evasion methods


Recommended Posts

PROBLEM

Smart system administrators can setup their IPS/IDS to detect, block and/or alert them at the precense of a pineapple within the area by simply setting up a rule to alert them when a pineapple mac address pops up anywhere on their network.

WORKAROUND

I have wrote a very clunky script that changes the hostname and mac address automatically on boot to but it's somewhat buggy at the moment and doesn't work every time.

SOLUTION

There are people here that are much smarter than myself and can do a much better job at writing scripts. Can someone here help the community out and write a simple script/infusion for the pineapple that automatically changes the hostname and mac address (macchanger) at every boot on the pineapple. Much appreciated.

Edited by Patriot
Link to post
Share on other sites

Umm... here's a script.

#!/bin/sh

ifconfig wlan0 down

ifconfig wlan1 down

macchanger -A wlan0

macchanger -A wlan1

ifconfig wlan0 up

ifconfig wlan1 up

Link to post
Share on other sites

^ That's very similar to the script I am using but that only gives it a random mac address.

We still have to:

- randomize the hostname

- execute both macchanger and hostname changer scripts at startup of the pineapple

In other words an ideal script would randomize both the mac address and hostname at startup of the pineapple so when it's booted up it's random every single time.

Link to post
Share on other sites

^ That's very similar to the script I am using but that only gives it a random mac address.

We still have to:

- randomize the hostname

- execute both macchanger and hostname changer scripts at startup of the pineapple

In other words an ideal script would randomize both the mac address and hostname at startup of the pineapple so when it's booted up it's random every single time.

Instead of using a script, why not use your DIP switches to execute the MAC changer commands?

To make sure I understand... you want to change your hostname from Pineapple to something random? Depending on the type of hostname you want, you may need a dictionary file that contains the list of hostnames.

Link to post
Share on other sites

Instead of using a script, why not use your DIP switches to execute the MAC changer commands?

To make sure I understand... you want to change your hostname from Pineapple to something random? Depending on the type of hostname you want, you may need a dictionary file that contains the list of hostnames.

wouldn't a dip switch use a script anyways? A random mac @ boot saves that limited dip switch for other uses, I'd think.

Link to post
Share on other sites

Anode,

Well, the DIPs have to be used for something... so why not use them to change the MACs?

Also, macchanger doesn't need to be issued by a script.

You could always write your own infusion that executes on boot.

Link to post
Share on other sites

Hey Anode,

The following will do the job [although chriswhat's DIP switch/infusiion suggestion is interesting, must play around with those sometime soon]

This comes from a similar script I use in kali with a few mods.

create /etc/init.d/randhostnamemac

#!/bin/bash

### BEGIN INIT INFO

# Provides: randhostnamemac

# Randomises hostname and MAC

# placed in /etc/init.d.

### END INIT INFO

#create hosts.old if not there

if [ ! -a /etc/hosts.old ]; then

cp /etc/hosts /etc/hosts.old

fi

#assign the variable newhn a random value as defined below

newhn=$(cat /dev/urandom | tr -dc 'A-Za-z' | head -c8)

#update hostname and hosts with new value

echo $newhn > /etc/hostname

echo "127.0.1.1 $newhn" > /etc/hosts

cat /etc/hosts.old >> /etc/hosts

#update uci

uci set system.@system[0].hostname=$newhn

uci commit system

echo $(uci get system.@system[0].hostname) > /proc/sys/kernel/hostname

#randomise MAC for wlan0 and wlan1

ifconfig wlan0 down

ifconfig wlan1 down

macchanger -A wlan0

macchanger -A wlan1

ifconfig wlan0 up

ifconfig wlan1 up

exit

Then simply set it up to run on boot

chmod +x /etc/init.d/randhostnamemac

ln -s /etc/init.d/newhostname /etc/rc.d/S27randhostnamemac

S27 will put it running after the network starts @ S20
Tested on a MK5 and seems fine .
Edited by cillian
Link to post
Share on other sites

anyone get this working? Ive tried but when I use macchanger in a dip switch it does not bring up the pineapple ssid after

Same issue since performing factory reset. After enabling wlan0 with ifconfig wlan0 up, it reflects that it's up but it doesn't broadcast. I have to use the network tile to enable it.

Link to post
Share on other sites

cillian,

After running that script does the Mk5 setup br-lan correctly? And does it still set the management port to whatever is called out in the Configuration Tab? I can't think of any infusion that would be impacted by doing this. And it's a great idea overall for obfuscation.

Link to post
Share on other sites

Hi thesugarat,

no problems with anything network I have noticed, never had any issues doing it this way on other Linux based sys,

Hi newbi3 having it in a separate script fits in my trouble shooting process, hadn't thought about rc.local if I'm honest. :)

I like having blocks that do a certain thing so I can disable if I think their causing trouble, this way its a one liner to disable rather then an edit of a larger file.

In other sys I would tend to have quite a few custom scripts run at boot and require them to process in a certain order to function properly, I suppose that's the habit part.

On that note chriswhat whats the command/s being run from the dip switch? Is it something like

ifconfig wlan0 down; ifconfig wlan1 down; macchanger -A wlan0; macchanger -A wlan1; ifconfig wlan0 up; ifconfig wlan1 up

I can't seem to find where they run in the boot order, though I must admit I haven't looked very hard, so maybe that's the issue. From the samples I've seen they seem to be executed quite late in the boot process.

Why not associate a script with a dip switch, I have not played with the dip switches but would that not ensure a graceful interface reset with changes? It also means you can add ts lines to write out to a file and see what's happening...

[sorry will have to try it myself later as work calls]

Edited by cillian
Link to post
Share on other sites
  1. Mac Address Identification
  2. Default Pineapple_XXXX SSID Identification

Solution :

  1. use the macchanger package (scripted using 'DIP switch' or /etc/rc.local)
  2. Change the default SSID (under "Configuration")

Why I don't bother with the hostname... they would have to be connected to one of the pineapples interfaces, at this point they've connected to an AP their not really authorised to connect to? If they are connecting - surely they already think its a rogue AP.

Simple.

Link to post
Share on other sites
Why I don't bother with the hostname... they would have to be connected to one of the pineapples interfaces, at this point they've connected to an AP their not really authorised to connect to?

Um... no. Anyone can listen to unencrypted traffic that's in the air. An IPS could conceivably watch unencrypted traffic in the air for signs of a Pineapple. No need to connect - just watch others who are connected.

And, of course, you do realize that the Pineapple can be used as more than just an AP? If you use client mode, then its hostname will show up at the DHCP server you get a lease from. As well as to anyone who listens in on that.

Edited by Some Guy
Link to post
Share on other sites

Um... no. Anyone can listen to unencrypted traffic that's in the air. An IPS could conceivably watch unencrypted traffic in the air for signs of a Pineapple. No need to connect - just watch others who are connected.

And, of course, you do realize that the Pineapple can be used as more than just an AP? If you use client mode, then its hostname will show up at the DHCP server you get a lease from. As well as to anyone who listens in on that.

Guess it all depends on your TEST system.

Remember the Disclaimer!

Link to post
Share on other sites

Guess it all depends on your TEST system.

Remember the Disclaimer!

We are discussing ways to avoid a third-party sniffing the air to detect that I have a Pineapple. Why would the behaviour of the third-party's IPS system "depend" on whether or not I'm using my Pineapple responsibly? My detectability remains the same regardless of my intentions.

I could be doing nothing but giving out free Internet from a 4G dongle, but an IPS could still sniff the air and see that I have a Pineapple, even without connecting to it.

Edited by Some Guy
Link to post
Share on other sites

On that note chriswhat whats the command/s being run from the dip switch? Is it something like

ifconfig wlan0 down; ifconfig wlan1 down; macchanger -A wlan0; macchanger -A wlan1; ifconfig wlan0 up; ifconfig wlan1 up

I can't seem to find where they run in the boot order, though I must admit I haven't looked very hard, so maybe that's the issue. From the samples I've seen they seem to be executed quite late in the boot process.

Why not associate a script with a dip switch, I have not played with the dip switches but would that not ensure a graceful interface reset with changes? It also means you can add ts lines to write out to a file and see what's happening...

[sorry will have to try it myself later as work calls]

I am running a script from my dip switch:

ifconfig wlan0 down
ifconfig wlan1 down
macchanger -A wlan0
macchanger -A wlan1
ifconfig wlan0 up
ifconfig wlan1 up

I am guessing the issue is that dip switches run very late in boot order though and thats the problem with using dip switches to change your mac if you are not connecting with ethernet

Link to post
Share on other sites

I am running a script from my dip switch:

ifconfig wlan0 down
ifconfig wlan1 down
macchanger -A wlan0
macchanger -A wlan1
ifconfig wlan0 up
ifconfig wlan1 up

I am guessing the issue is that dip switches run very late in boot order though and thats the problem with using dip switches to change your mac if you are not connecting with ethernet

you will need to execute the wifi command so that the changed MAC actually holds.

Link to post
Share on other sites
ifconfig wlan0 down
ifconfig wlan1 down
macchanger -A wlan0
macchanger -A wlan1
wifi
That should do it.

So I put that in a script for a dip switch and the pineapple ssid now comes back up but when I look at wifi manager both radios have their stock macs :-S

Link to post
Share on other sites

So I put that in a script for a dip switch and the pineapple ssid now comes back up but when I look at wifi manager both radios have their stock macs :-S

Yup. This was an issue with the previous pineapple, and appartently its a "bug".

If this "bug" is fixed that would enable people to run the pineapple completly anonymously, we cant have that :P

Edited by tone
Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...