Added Payload

[Brisk4t]

Payload Captive Portal has been added.
Redirects traffic to phishing page and saves collected data to text file.
Uses RNDIS attack method with optional supplementary methods.

[Swiftb0y]

Looks promising, but it why does it only Support Windows? It would be nice if you could add some legit-looking templates and support ECM and maybe Wifi (changes to the core would have to be made so it can setup an open hotspot). Setup would still be possible through Bluetooth. Also, I would not hardcode the ip addresses and use the variables from the setup.cfg ($IF_IP for example)

[Brisk4t]

I'm working on the ECM support, as for wifi I'll have to look into it.
As for $IF_IP, I'll add the commit later today (just an oversight :p)

[Swiftb0y]

Ok. And Apache and PHP are kind off heavy requirements, so it would be nice if you could replace them with something like a modified Python http server.

[Brisk4t]

Sure, I'll try to add the ECM and $IF_IP in the next commit but python and wifi will take another commit after that since i have my gripes with python servers.

p.s : Just a quick question : Can I use $active_interface with ecm (or at all, since i couldn't get it working on RNDIS either) since some Linux systems seem to use the enp* adapter naming system.

[Swiftb0y]

P4wnP1 runs on raspbian, so as far as I know, using $active_interace should work fine. Some Linux Distros (like Kali) have drivers for ECM and RNDIS but that should not cause any trouble since one gets disabled after a connection was established. The OS/Linux-flavor of target shouldn't matter since the only "code" running on the target is the served html.

[mame82]

Apache2 seems to be fine in this case, as it is manually started by this payload. As long as the service isn't globally enabled ot shouldn't have impact on boot time of other payloads.
Interpreting PHP would be hard to interpret without a proper HTTP server and seems to be needed by the script to grab the request headers.

It should be mentioned that something similar could be achieved with responder forcing HTTP basic auth on every HTTP request.

According $active_interface: the variable refers to the internal interface used by P4wnP1 which is always usb0 or usb1 (depending on usage of RNDIS vs CDC ECM). So it doesn't depend on targets interface name. I consider changing this, by adding both, RNDIS and CDC ECM interface, to a bridge interface some day.

According the payload: I very much appreciate receiving a first payload commit. Author notice and credits for author of the original script are in place. I hope some folks are able to test this, before I merge, because I'm not able to test it myself during the next days.

[Brisk4t]

I've added the IP variable but ECM seems to not work with ROUTE_SPOOF, it still looks for a gateway in my router's IP (which on my Kali VM is disconnected). IIf not that it will fail to redirect to the Pi's IP.
I'll be looking at some forums for possible errors in the code but any help here is appreciated.

[Brisk4t]

ECM now works. The last thing I'll be working on for this payload is the wifi honeypot. I still need to figure out how to change to DNS server of a phone but it shouldn't be too long before I get the WIFI working. I'm kind of sceptical about using HTML login templates since they may have licencing issues but I'll try pushing a free one into this branch

Really hope people like it.

[Swiftb0y]

You can make a guide on how to modify the html locally so people can make their own captive portals from proprietary websites.
I'm really looking forward to try this payload.

[mame82]

As stated I'm involved into some other tasks, which doesn't allow me to work on P4wnP1 right now.

Anyway, as I'm preparing some talks (including WiFi security) I have a solution ready, including code and a template for a custom captive portal:

https://github.com/mame82/awareness_wifi?files=1

I'm planning to move everything over to P4wnP1 (excluding the Karma attack, as the nexmon firmware needs to be patched), as soon as I have time to. Feel free to use the template meanwhile, but please don't include the backdoored app.

[Brisk4t]

I added a more legit portal now, so it should look like something made by a more reputable company and not some guy in his basement. Credits and license are included too.

Also mame the readme for the wifi talks has a few typos.

[Swiftb0y]

@mame82 is the core still in development or am I free to add some new features in the meantime?

[mame82]

@Swiftb0y not able to review PRs for next 3 weeks

[Brisk4t]

@Swiftb0y, you tried the payload yet? I want to know if anything is glitchy.

[Swiftb0y]

Sorry im currently not able to connect the pi to the Internet. I maybe able to gym that to work again this week.

[Brisk4t]

Anyone have any progress testing or any suggestions?

[HitItAll]

@Brisk4t Yes I have tested the new Payload, would be nice if once credentials are stored the P4wnP1 disconnects itself (I don't know if this is possible.

…

On Fri, Dec 8, 2017, 07:11 Brisk4t ***@***.***> wrote: Anyone have any progress testing or any suggestions? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#152 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ASxAJcz_KTiI2S7zUy3nls8-l-MVhsbNks5s-SdpgaJpZM4QB8Ki> .

[Brisk4t]

Thanks, ill try to add that, any bugs that you know of?

[HitItAll]

Yes, not sure how or why but sometimes the browser will jump between P4wnP1 page and actual site. Maybe if the website was previously cached?

…

On Fri, Dec 8, 2017, 07:48 Brisk4t ***@***.***> wrote: Thanks, ill try to add that, any bugs that you know of? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#152 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ASxAJa9D-ZvarJ5-cykN6Mx5Cj46qq1fks5s-TAogaJpZM4QB8Ki> .

[Brisk4t]

Yea, that's caching alright, unless you can use the site properly.