Administrator Manual. Network Surveillance Apparatus. WiFiSpi. Aaron Collier, Steven Tran-Giang, Scott Matheson APRIL 10, 2015

Transcription

1 WiFiSpi SAIT Polytechnic APRIL 10, 2015 Administrator Manual Network Surveillance Apparatus Aaron Collier, Steven Tran-Giang, Scott Matheson NETWORK SURVEILLANCE APPARATUS

2 Table of Contents Preface... 2 Materials Needed... 3 System Installation... 4 Tool Configuration... 5 DHCPD (/etc/dhcpd.conf)... 5 wpa_supplicant (Wireless connection tool for cli)... 5 airbase-ng (Wireless access point)... 5 iptables (interface bridging and nat translation)... 6 Final Configuration Steps... 6 Other Commands... 6 Example Script... 7 WIFISPI PROJECT CHARTER PAGE 1

3 Section A Preface The following manual will guide you through the installation, configuration, and management of the Network Surveillance Apparatus developed by Team WiFiSpi. This guide assumes you have a foundational knowledge of Linux operating system, a scripting language (Perl is used throughout the course of this manual), and Linux network tools. This is a very early alpha prototype and is still missing some of the more advanced features and configurations. FORMAL REPORT NETWORK SURVEILLANCE APPARATUS PAGE 2

4 Section 1 Materials Needed Hardware: ARM Microcomputer (Solid-run Hummingboard-I2eX used in this example) 2 Wireless network adapters (Atheros chipset recommended) o Comprehensive list of chipset compatibility with aircrack-ng suite MicroSD storage (32-64Gb recommended) Back end server capable of running as an FTP server, as well as Snort detection box o Linux based operating system recommended for best results Wireless router Wireless host system Software: Linux based operating system o Archlinux is recommended due to its lightweight design Aircrack-ng suite o Please note: Additional driver patches may be necessary to ensure wireless adapter functionality DHCPD - dhcp server daemon DHCPCD dhcp client daemon Tcpdump iwconfig wpa_supplicant & wpa_passphrase iptables SDFormatter Win32DiskImager FORMAL REPORT NETWORK SURVEILLANCE APPARATUS PAGE 3

5 Section 2 System Installation 1. Download the Operating system image of your choice (Installation may vary depending on hardware configuration) 2. Prepare the SD card by performing a full format - SDFormatter is a simple Windows tool to achieve this - df may be used on Linux systems 3. Image the Operating System onto the SD card - Win32DiskImager is a simple windows disk imaging tool - dd is a linux tool that can be used to image disks 4. Insert the SD card into the Microcomputer and run any updates/initial configurations as defined by the developer. 5. Begin installation of all required tools and modules from official system or git repositories. Note: some tools may come pre-packaged with your chosen distribution; verify if they are pre-installed before attempting to install any tools. - Aircrack-ng suite - dhcpd - dhcpcd - tcpdump - iwconfig - wpa_supplicant - wpa_passphrase - iptables FORMAL REPORT NETWORK SURVEILLANCE APPARATUS PAGE 4

6 Section 3 Tool Configuration The following are example configurations used in testing to enable basic functionality of the device. These configurations may be changed in order to promote further and more advanced functions. DHCPD (/etc/dhcpd.conf) option domain-name-servers , ; default-lease-time 600; max-lease-time 7600; ddns-update-style none; authoritative; log-facility local7; subnet netmask range ; option routers ; option domain-name-servers , ; wpa_supplicant (Wireless connection tool for cli) wpa_passphrase WirelessSSID WPA2Passphrase > /etc/wpa_supplicant.conf - Creates configuration file with your wireless credentials wpa_supplicant B D nl80211,wext -i wlan0 c /etc/wpa_supplicant.conf - Uses wireless credentials to establish connection dhcpcd wlan0 - Client-side dhcp client airbase-ng (Wireless access point) airmon-ng start wlan1 - Starts monitor mode wireless interface airbase-ng -e WirelessSSID -c 1 mon0 & - Creates unencrypted soft access point interface on channel 1 as background job ifconfig at0 up - Makes the SoftAP interface active ifconfig at netmask Assigns an IP and network mask to the interface to match DHCPD configuration ifconfig at0 mtu Increases the max transmission unit (in bytes) for the interface route add -net netmask gw Adds interface into linux route table FORMAL REPORT NETWORK SURVEILLANCE APPARATUS PAGE 5

7 iptables (interface bridging and nat translation) iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE iptables -A FORWARD -i wlan0 -o at0 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i at0 -o wlan0 -j ACCEPT echo 1 > /proc/sys/net/ipv4/ip_forward - Creates a simple NAT bridge between network interfaces to carry traffic in and out Final Configuration Steps echo > /var/lib/dhcp/dhcpd.leases - Clears leases file (Note: The file path may vary with distribution) dhcpd at0 - Starts dhcp server on SoftAP allowing hosts to obtain IP leases tcpdump -ni at0 -s 0 -w /path/to/captures/capture.pcap & - Begins a dump of network traffic to a pcap file Other Commands iwconfig wlan0 channel x - Changes the channel of wlan0 (and all software interfaces using it) to x airodump-ng mon0 - Dumps a wireless network scan, very useful in gathering information on networks. aireplay-ng - Tool offering various methods of client de-authentication FORMAL REPORT NETWORK SURVEILLANCE APPARATUS PAGE 6

8 Section 4 Example Script #!/usr/bin/perl $wireless=x; $backpass=x; print "Quick start Configuration script\n\n"; while($wireless ne "Y" && $wireless ne "N") print "Will you be using a wireless backend? (Y/N): "; chomp($wireless=<stdin>); $wireless=uc($wireless); if($wireless eq Y) system("iwconfig"); print "Please indicate wireless interface you wish to use: "; chomp($backadapt=<stdin>); print "Please indicate the SSID(name) of the wireless connection you wish to use: "; chomp($backssid=<stdin>); while($backpass ne "Y" && $backpass ne "N") print "Is there a passphrase on this connection? Y/N: "; chomp($backpass=<stdin>); $backpass=uc($backpass); if($backpass eq "Y") print "Please enter the passphrase (Case sensitive): "; system("stty -echo"); chomp($passphrase=<stdin>); system("stty echo"); print "\n"; elsif($backpass eq "N") print "No wireless passphrase selected\n"; else print "Error: Invalid input\n\n"; FORMAL REPORT NETWORK SURVEILLANCE APPARATUS PAGE 7

9 elsif($wireless eq N) system("ifconfig"); print "Please indicate physical interface you wish to use: "; chomp($backadapt=<stdin>); else print "Error: Invalid input\n\n"; system("iwconfig"); print "NOTE: If using a wireless backend you must use a secondary wireless interface for soft AP configuration\n"; print "Please indicate wireless interface you wish to use for soft access point: "; chomp($apadapt=<stdin>); print "Please indicate the name(ssid) you wish to broadcast: "; chomp($apssid=<stdin>); print "Please wait while system in configured..\n"; sleep(2); system("killall -9 dhcpd"); system("killall -9 airbase-ng"); system("killall -9 dhcpcd"); system("killall -9 wpa_supplicant"); system("killall -9 tcpdump"); system("airmon-ng stop mon3"); system("airmon-ng stop mon2"); system("airmon-ng stop mon1"); system("airmon-ng stop mon0"); system("iptables -F"); system("iptables -X"); system("iptables -t nat -F"); system("iptables -t nat -X"); system("iptables -P INPUT ACCEPT"); system("iptables -P FORWARD ACCEPT"); system("iptables -P OUTPUT ACCEPT"); sleep (3); if($wireless eq "Y") system("ip link set $backadapt up"); sleep (2); system("wpa_passphrase $backssid $passphrase > /etc/wpa_supplicant.conf"); system("wpa_supplicant -B -D nl80211,wext -i $backadapt -c /etc/wpa_supplicant.conf"); sleep (10); system("dhcpcd $backadapt"); sleep (5); FORMAL REPORT NETWORK SURVEILLANCE APPARATUS PAGE 8

10 system("airmon-ng start $apadapt"); sleep (5); system("airmon-ng start $apadapt"); sleep (5); system("airbase-ng -e $apssid -c 1 mon0 &"); sleep (5); system("ifconfig at0 up"); system("ifconfig at netmask "); system("ifconfig at0 mtu 1800"); system("route add -net netmask gw "); system("iptables -t nat -A POSTROUTING -o $backadapt -j MASQUERADE"); system("iptables -A FORWARD -i $backadapt -o at0 -m state --state RELATED,ESTABLISHED -j ACCEPT"); system("iptables -A FORWARD -i at0 -o $backadapt -j ACCEPT"); system("echo 1 > /proc/sys/net/ipv4/ip_forward"); system("echo > /var/lib/dhcp/dhcpd.leases"); system("dhcpd at0"); system("tcpdump -ni at0 -s 0 -w /root/capture/capture.pcap &"); sleep (2); system("echo Setup Complete. ); FORMAL REPORT NETWORK SURVEILLANCE APPARATUS PAGE 9

11 [PROJECT CHARTER NETWORK SURVEILLANCE APPARATUS PAGE 10