viernes, 21 de agosto de 2020

WiFi Hacking On Tablets

Disclaimer: Don't hack anything where you don't have the authorization to do so. Stay legal.

Ever since I bought my first Android device, I wanted to use the device for WEP cracking. Not because I need it, but I want it :) After some googling, I read that you can't use your WiFi chipset for packet injection, and I forgot the whole topic.

After a while, I read about hacking on tablets (this was around a year ago), and my first opinion was: 
"This is stupid, lame, and the usage of that can be very limited".

After playing one day with it, my opinion just changed: 
"This is stupid, lame, the usage is limited, but when it works, it is really funny :-)"

At the beginning I looked at the Pwn Pad as a device that can replace a pentest workstation, working at the attacker side. Boy was I wrong. Pwn Pad should be used as a pentest device deployed at the victim's side!

You have the following options:
  1. You have 1095 USD + VAT + shipping to buy this Pwn Pad
  2. You have around 200 USD to buy an old Nexus 7 tablet, a USB OTG cable, a USB WiFi dongle (e.g. TP-Link Wireless TL-WN722N USB adapter works).



In my example, I bought a used, old 2012 Nexus WiFi. Originally I bought this to play with different custom Android ROMs, and play with rooted applications. After a while, I found this Pwn Pad hype again and gave it a shot.

The Pwn Pad community edition has an easy-to-use installer, with a proper installation description. Don't forget to backup everything from your tablet before installing Pwn Pad on it!

I don't want to repeat the install guide, it is as easy as ABC. I booted a Ubuntu Live CD, installed adb and fastboot, and it was ready-to-roll. I have not measured the time, but the whole process was around 20 minutes.


The internal WiFi chipset can be used to sniff traffic or even ARP poisoning for active MiTM. But in my case, I was not able to use the internal chipset for packet injection, which means you can't use it for WEP cracking, WPA disauth, etc. This is where the external USB WiFi comes handy. And this is why we need the Pwn Pad Android ROM, and can't use an average ROM.

There are two things where Pwn Pad really rocks. The first one is the integrated drivers for the external WiFi with monitor mode and packet injection capabilities. The second cool thing is the chroot wrapper around the Linux hacking tools. Every hacking tool has a start icon, so it feels like it is a native Android application, although it is running in a chroot Kali environment.

Wifite

The first recommended app is Wifite. Think of it as a wrapper around the aircrack - airmon - airodump suite. My biggest problem with WEP cracking was that I had to remember a bunch of commands, or have the WEP cracking manual with me every time I have to crack it. It was overcomplicated. But thanks to Wifite, that is past.

In order to crack a WEP key, you have to:
  1. Start the Wifite app
  2. Choose your adapter (the USB WiFi)

  3. Choose the target network (wep_lan in the next example)
  4. Wait for a minute 
  5. PROFIT!

SSH reverse shell

This is one of the key functionalities of the Pwn Pad. You deploy the tablet at the Victim side, and let the tablet connect to your server via (tunneled) SSH.

The basic concept of the reverse shells are that an SSH tunnel is established between the Pwn Pad tablet (client) and your external SSH server (either directly or encapsulated in other tunneling protocol), and remote port forward is set up, which means on your SSH server you connect to a localport which is forwarded to the Pwn Pad and handled by the Pwn Pad SSH server.

I believe the best option would be to use the reverse shell over 3G, and let the tablet connect to the victim network through Ethernet or WiFi. But your preference might vary. The steps for reverse shells are again well documented in the documentation, except that by default you also have to start the SSH server on the Pwn Pad. It is not hard, there is an app for that ;-) On your external SSH server you might need to install stunnel and ptunnel if you are not using Kali. The following output shows what you can see on your external SSH server after successful reverse shell.

root@myserver:/home/ubuntu# ssh -p 3333 pwnie@localhost
The authenticity of host '[localhost]:3333 ([127.0.0.1]:3333)' can't be established.
ECDSA key fingerprint is 14:d4:67:04:90:30:18:a4:7a:f6:82:04:e0:3c:c6:dc.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[localhost]:3333' (ECDSA) to the list of known hosts.
pwnie@localhost's password:
  _____      ___  _ ___ ___   _____  _____ ___ ___ ___ ___
 | _ \ \    / / \| |_ _| __| | __\ \/ / _ \ _ \ __/ __/ __|
 |  _/\ \/\/ /| .` || || _|  | _| >  <|  _/   / _|\__ \__ \
 |_|   \_/\_/ |_|\_|___|___| |___/_/\_\_| |_|_\___|___/___/

 Release Version: 1.5.5
 Release Date: 2014-01-30
 Copyright 2014 Pwnie Express. All rights reserved.

 By using this product you agree to the terms of the Rapid Focus
 Security EULA: http://pwnieexpress.com/pdfs/RFSEULA.pdf

 This product contains both open source and proprietary software.
 Proprietary software is distributed under the terms of the EULA.
 Open source software is distributed under the GNU GPL:
 http://www.gnu.org/licenses/gpl.html

pwnie@localhost:~$

Now you have a shell on a machine that is connected to the victim network. Sweet :) Now Metasploit really makes sense on the tablet, and all other command-line tools.

EvilAP and DSniff

Start EvilAP (it is again a wrapper around airobase), choose interface (for me the Internal Nexus Wifi worked), enter an SSID (e.g freewifi), enter channel, choose whether force all clients to connect to you or just those who really want to connect to you, and start.


The next step is to start DSniff, choose interface at0, and wait :) In this example, I used a popular Hungarian webmail, which has a checkbox option for "secure" login (with default off). There are sooo many problems with this approach, e.g. you can't check the certificate before connecting, and the login page is delivered over HTTP, so one can disable the secure login checkbox seamlessly in the background, etc. In this case, I left the "secure" option on default off.



In the next tutorial, I'm going to show my next favorite app, DSploit ;)

Lessons learned

Hacking has been never so easy before
In a home environment, only use WPA2 PSK
Choose a long, nondictionary passphrase as the password for WPA2
Don't share your WiFi passwords with people you don't trust, or change it when they don't need it anymore
Don't let your client device auto-connect to WiFi stations, even if the SSID looks familiar

I believe during an engagement a Pwn Plug has better "physical cloaking" possibilities, but playing with the Pwn Pad Community Edition really gave me fun moments.

And last but not least I would like to thank to the Pwn Pad developers for releasing the Community Edition!

Related links
  1. Top Pentest Tools
  2. Pentest Tools Github
  3. Hacking Tools For Windows
  4. Pentest Tools For Windows
  5. What Are Hacking Tools
  6. Hack Tools For Ubuntu
  7. Hackers Toolbox
  8. How To Hack
  9. Hack Tools For Windows
  10. Hacker Tools Online
  11. Kik Hack Tools
  12. Hack Tools
  13. Hack Tools Online
  14. Pentest Tools Alternative
  15. Hacking Tools Name
  16. Hacking Apps
  17. Hacker
  18. Hack Tools For Pc
  19. Pentest Tools Kali Linux
  20. Easy Hack Tools
  21. Hacker Tool Kit
  22. Hacking Tools Usb
  23. Hacking Tools Hardware
  24. Hacker Tools Mac
  25. Hacking Tools For Windows
  26. Hacking Tools Software
  27. Hacking Tools Name
  28. Hacking Tools For Kali Linux
  29. Pentest Tools Subdomain
  30. Hacker
  31. Pentest Tools For Android
  32. Ethical Hacker Tools
  33. Hacker Tools 2020
  34. Pentest Tools Url Fuzzer
  35. Hacker Tools Linux
  36. Pentest Tools Website
  37. Hacker Security Tools
  38. Best Pentesting Tools 2018
  39. Hacking Tools Name
  40. Pentest Tools Android
  41. Pentest Tools Apk
  42. How To Install Pentest Tools In Ubuntu
  43. Hacker Tools Apk Download
  44. Nsa Hack Tools
  45. Physical Pentest Tools
  46. Hacking Tools For Games
  47. Hacker Tools For Pc
  48. Pentest Tools List
  49. Hack Tools Mac
  50. Pentest Tools Online
  51. Usb Pentest Tools
  52. Hack Website Online Tool
  53. Hack Tools Online
  54. Hacking Tools For Kali Linux
  55. Pentest Tools Url Fuzzer
  56. New Hacker Tools
  57. What Is Hacking Tools
  58. Hack App
  59. Kik Hack Tools
  60. Hacker Tools Windows
  61. Pentest Tools Framework
  62. Pentest Tools Windows
  63. Free Pentest Tools For Windows
  64. Hack Tools For Windows
  65. Hack Tool Apk
  66. Top Pentest Tools
  67. Pentest Automation Tools
  68. Pentest Tools Port Scanner
  69. Pentest Tools Subdomain
  70. Game Hacking
  71. Pentest Tools Subdomain
  72. Free Pentest Tools For Windows
  73. Pentest Tools Linux
  74. Hacker Hardware Tools
  75. Hack Tools Download
  76. Growth Hacker Tools
  77. Blackhat Hacker Tools
  78. Hacker Tools For Mac
  79. Hacker Tools 2020
  80. Android Hack Tools Github
  81. Hacking App
  82. Top Pentest Tools
  83. How To Hack
  84. Wifi Hacker Tools For Windows
  85. Best Pentesting Tools 2018
  86. Pentest Reporting Tools
  87. Underground Hacker Sites
  88. Hacking Tools For Pc
  89. Hack Tools Online
  90. Top Pentest Tools
  91. Black Hat Hacker Tools
  92. World No 1 Hacker Software
  93. Hacking Tools Kit
  94. Hack App
  95. Hack Tools For Mac
  96. Hacker Tools Linux
  97. Hacker Tools 2019
  98. Hacker Tools Online
  99. Bluetooth Hacking Tools Kali
  100. Pentest Tools Open Source
  101. What Is Hacking Tools
  102. Growth Hacker Tools
  103. Pentest Automation Tools
  104. Hacking App
  105. Hacks And Tools
  106. Pentest Tools For Windows
  107. Pentest Tools Free
  108. Pentest Tools Review
  109. Hacker Tools Online
  110. Hack Tools Download
  111. Pentest Recon Tools
  112. Pentest Tools Online
  113. Install Pentest Tools Ubuntu
  114. Pentest Recon Tools
  115. Hack Tools
  116. Hack Tool Apk No Root
  117. Pentest Tools Port Scanner
  118. Hack Tools Download
  119. Hack Tools For Ubuntu
  120. Hack Tools Github
  121. Pentest Tools Kali Linux
  122. Ethical Hacker Tools
  123. Hacking Tools Windows 10
  124. Hacker Tools Github
  125. Hack Tools Online
  126. Hack Tools For Ubuntu
  127. Hacker
  128. Pentest Tools For Windows
  129. Hacker Tools Free
  130. Hacking Tools Hardware
  131. Blackhat Hacker Tools
  132. Pentest Tools List
  133. Android Hack Tools Github
  134. Pentest Tools Linux
  135. Hacking Tools Mac
  136. Hack Tools For Mac
  137. Tools 4 Hack
  138. Hacking Tools Software
  139. Hacking Tools Hardware
  140. Hack Tools
  141. Hacking Tools Windows 10
  142. Pentest Tools Apk
  143. Hacking Tools For Games
  144. Hacker Tools
  145. Nsa Hacker Tools
  146. Top Pentest Tools
  147. Top Pentest Tools
  148. Usb Pentest Tools
  149. Hacking Tools For Kali Linux
  150. Hack Apps
  151. Hacking Tools For Mac
  152. Physical Pentest Tools
  153. Hacker Tools Online
  154. Pentest Tools Port Scanner
  155. Pentest Tools Nmap
  156. Pentest Automation Tools
  157. Hack Tools Github
  158. Hacking Tools For Windows
  159. Hacking App
  160. Hack Tool Apk No Root
  161. Hacking Tools Online
  162. Pentest Tools Online
  163. Ethical Hacker Tools
  164. How To Make Hacking Tools
  165. Pentest Tools Kali Linux
  166. Hacker
  167. Hacker

No hay comentarios:

Publicar un comentario