search

FluxionNetwork / fluxion

Fluxion is a remake of linset by vk496 with enhanced functionality.
https://fluxionnetwork.github.io/fluxion/
GNU General Public License v3.0
5.02k stars 1.4k forks source link

Captive portal (login page) doesn't show for clients after jamming target AP #255

Closed ghost closed 6 years ago

ghost commented 7 years ago

Do you want to request a feature or report a bug?

Bug

What is the current behaviour?

Captive portal (login page) doesn't show for clients after jamming target AP

If the current behaviour is a bug, please provide the steps to reproduce it.

Install current repository Go through launch steps (selecting network and pre-captured cap file) Get program up and running

What do you think the expected behaviour should be?

Program should kick all users off of real network and ask them to re-authenticate to your captive portal. Instead it jams the real network, kicks them off, and then doesn't show any form of authentication portal when trying to log in

If this is a feature request, what is the motivation or use case for the added feature?

N/A

Specs

[ FLUXION Info ]
FLUXION V3.4

[ BASH Info ]
GNU bash, version 4.4.12(1)-release (x86_64-pc-linux-gnu)
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Path: /bin/bash

[ Interface (wlan1mon) Info ]
Device: Unknown
basename: missing operand
Try 'basename --help' for more information.
Driver: Unsupported
Chipset:
Injection Test: ioctl(SIOCGIFINDEX) failed: No such device
failed

[ XTerm Info ]
Version: XTerm(330)
Path: /usr/bin/xterm
Test: XServer/XTerm success!

[ HostAPD Info ]
hostapd v2.4
User space daemon for IEEE 802.11 AP management,
IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator
Copyright (c) 2002-2015, Jouni Malinen <j@w1.fi> and contributors
Path: /usr/sbin/hostapd

[ Aircrack-ng Info ]

  Aircrack-ng 1.2 rc4 - (C) 2006-2015 Thomas d'Otreppe
  http://www.aircrack-ng.org

[ System Info ]
Linux version 4.12.0-kali1-amd64 (devel@kali.org) (gcc version 6.4.0 20170820 (Debian 6.4.0-4) ) #1 SMP Debian 4.12.6-1kali6 (2017-08-30)

Note: I'm currently using Kali-Rolling for the OS, and a AWUSO36NH for the wireless interface

usama7628674 commented 7 years ago

iw dev iw phy#[write number here that you observed from iw dev] info paste the output of these commands I think awus036nh doesn't support AP mode.

deltaxflux commented 7 years ago

Program should kick all users off of real network and ask them to re-authenticate to your captive portal. Instead it jams the real network, kicks them off, and then doesn't show any form of authentication portal when trying to log in

First it deauth the client from victims network, it does work. Ask them to re-authenticate to your captive portal is not possible they have to connect to them by there own. Do you see the fakedns window on the button left-hand side ?

Do you have some errors flying arround and do you have python2.7 installed?

ghost commented 7 years ago

@usama7628674 The following is from the command output for the AWUSO36NH:

Wiphy phy1
    max # scan SSIDs: 4
    max scan IEs length: 2257 bytes
    max # sched scan SSIDs: 0
    max # match sets: 0
    max # scan plans: 1
    max scan plan interval: -1
    max scan plan iterations: 0
    Retry short long limit: 2
    Coverage class: 0 (up to 0m)
    Device supports RSN-IBSS.
    Supported Ciphers:
        * WEP40 (00-0f-ac:1)
        * WEP104 (00-0f-ac:5)
        * TKIP (00-0f-ac:2)
        * CCMP-128 (00-0f-ac:4)
        * CCMP-256 (00-0f-ac:10)
        * GCMP-128 (00-0f-ac:8)
        * GCMP-256 (00-0f-ac:9)
    Available Antennas: TX 0 RX 0
    Supported interface modes:
         * IBSS
         * managed
         * AP
         * AP/VLAN
         * monitor
         * mesh point
    Band 1:
        Capabilities: 0x17e
            HT20/HT40
            SM Power Save disabled
            RX Greenfield
            RX HT20 SGI
            RX HT40 SGI
            RX STBC 1-stream
            Max AMSDU length: 3839 bytes
            No DSSS/CCK HT40
        Maximum RX AMPDU length 32767 bytes (exponent: 0x002)
        Minimum RX AMPDU time spacing: 2 usec (0x04)
        HT TX/RX MCS rate indexes supported: 0-7, 32
        Bitrates (non-HT):
            * 1.0 Mbps
            * 2.0 Mbps (short preamble supported)
            * 5.5 Mbps (short preamble supported)
            * 11.0 Mbps (short preamble supported)
            * 6.0 Mbps
            * 9.0 Mbps
            * 12.0 Mbps
            * 18.0 Mbps
            * 24.0 Mbps
            * 36.0 Mbps
            * 48.0 Mbps
            * 54.0 Mbps
        Frequencies:
            * 2412 MHz [1] (20.0 dBm)
            * 2417 MHz [2] (20.0 dBm)
            * 2422 MHz [3] (20.0 dBm)
            * 2427 MHz [4] (20.0 dBm)
            * 2432 MHz [5] (20.0 dBm)
            * 2437 MHz [6] (20.0 dBm)
            * 2442 MHz [7] (20.0 dBm)
            * 2447 MHz [8] (20.0 dBm)
            * 2452 MHz [9] (20.0 dBm)
            * 2457 MHz [10] (20.0 dBm)
            * 2462 MHz [11] (20.0 dBm)
            * 2467 MHz [12] (20.0 dBm) (no IR)
            * 2472 MHz [13] (20.0 dBm) (no IR)
            * 2484 MHz [14] (20.0 dBm) (no IR)
    Supported commands:
         * new_interface
         * set_interface
         * new_key
         * start_ap
         * new_station
         * new_mpath
         * set_mesh_config
         * set_bss
         * authenticate
         * associate
         * deauthenticate
         * disassociate
         * join_ibss
         * join_mesh
         * set_tx_bitrate_mask
         * frame
         * frame_wait_cancel
         * set_wiphy_netns
         * set_channel
         * set_wds_peer
         * probe_client
         * set_noack_map
         * register_beacons
         * start_p2p_device
         * set_mcast_rate
         * connect
         * disconnect
         * set_qos_map
         * Unknown command (121)
    Supported TX frame types:
         * IBSS: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
         * managed: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
         * AP: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
         * AP/VLAN: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
         * mesh point: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
         * P2P-client: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
         * P2P-GO: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
         * P2P-device: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
    Supported RX frame types:
         * IBSS: 0x40 0xb0 0xc0 0xd0
         * managed: 0x40 0xd0
         * AP: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0
         * AP/VLAN: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0
         * mesh point: 0xb0 0xc0 0xd0
         * P2P-client: 0x40 0xd0
         * P2P-GO: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0
         * P2P-device: 0x40 0xd0
    software interface modes (can always be added):
         * AP/VLAN
         * monitor
    valid interface combinations:
         * #{ AP, mesh point } <= 8,
           total <= 8, #channels <= 1
    HT Capability overrides:
         * MCS: ff ff ff ff ff ff ff ff ff ff
         * maximum A-MSDU length
         * supported channel width
         * short GI for 40 MHz
         * max A-MPDU length exponent
         * min MPDU start spacing
    Device supports TX status socket option.
    Device supports HT-IBSS.
    Device supports SAE with AUTHENTICATE command
    Device supports low priority scan.
    Device supports scan flush.
    Device supports AP scan.
    Device supports per-vif TX power setting
    Driver supports full state transitions for AP/GO clients
    Driver supports a userspace MPM
    Device supports configuring vdev MAC-addr on create.

@=@=@=@=@=@=@=@=@=@=@=@=@=@=@=@=@=@=@=@=@=@

@deltaxflux I see the FakeDNS window. It has the message pyminifakeDwebconfNS:: dom.query. 60 IN A 192.168.254.1 and nothing else. No errors there. Python2.7 is installed as it's a dependency IIRC.

My issue is that when I attacked my network and tried logging in from another computer, it didn't show any form of login page when I launched a web browser. The other thing that makes me wonder if something is wrong is that the CLIENTS ONLINE list is empty, even though I know there's someone connected because Wifite used them to intercept the handshake.

The window that does have an error is the AP Jammer:

read failed: Network is down
wi_read(): Network is down
ghost commented 7 years ago

Figured a step by step process might help diagnose the issue:

  1. Clone the current repository and cd into it
  2. Run ./fluxion.sh to launch Fluxion 3
  3. Select English
  4. Select my AWUSO36NH to place it into monitor mode
  5. Monitor all channels
  6. Wait a few seconds and close the monitor panel
  7. Select the target network
  8. Select Captive Portal (I already have a handshake file from Wifite)
  9. Select the AWUSO36NH again for the Captive Portal interface
  10. Select Rogue AP - hostapd
  11. Point Fluxion to the captured handshake with direct pathing
  12. Select Pyrit Verification
  13. Select "Create an SSL certificate"
  14. Select the generic portal for English (7)

After all of this it idles on the screen you can see in the screenshot. AP DHCP never moves past "Server starting service" and eventually the jammer says the network is down.

fluxion_screenshot

victor-ab commented 7 years ago

@Schneiderism That's an known issue. https://github.com/FluxionNetwork/fluxion/issues/172

ghost commented 7 years ago

@underscrew

What part of this is relevant to that ticket?

On Nov 18, 2017 11:10 AM, "victorhab1" notifications@github.com wrote:

@Schneiderism https://github.com/schneiderism That's an known issue.

172 https://github.com/FluxionNetwork/fluxion/issues/172

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/FluxionNetwork/fluxion/issues/255#issuecomment-345463924, or mute the thread https://github.com/notifications/unsubscribe-auth/AKhmOEZnCCUjtwGS0r4tEr1jgLbuH-hCks5s3yupgaJpZM4Qi5xB .

MPX4132 commented 7 years ago

Sounds like a driver problem, make sure your card supports virtual interfaces. Other than that, you can try the slower service to see if that works.

You need to rerun the diagnostics script and replace the interface with your interface.

ghost commented 7 years ago

@MPX4132 Here's the redone diag output:

Wiphy phy3
    max # scan SSIDs: 4
    max scan IEs length: 2257 bytes
    max # sched scan SSIDs: 0
    max # match sets: 0
    max # scan plans: 1
    max scan plan interval: -1
    max scan plan iterations: 0
    Retry short long limit: 2
    Coverage class: 0 (up to 0m)
    Device supports RSN-IBSS.
    Supported Ciphers:
        * WEP40 (00-0f-ac:1)
        * WEP104 (00-0f-ac:5)
        * TKIP (00-0f-ac:2)
        * CCMP-128 (00-0f-ac:4)
        * CCMP-256 (00-0f-ac:10)
        * GCMP-128 (00-0f-ac:8)
        * GCMP-256 (00-0f-ac:9)
    Available Antennas: TX 0 RX 0
    Supported interface modes:
         * IBSS
         * managed
         * AP
         * AP/VLAN
         * monitor
         * mesh point
    Band 1:
        Capabilities: 0x17e
            HT20/HT40
            SM Power Save disabled
            RX Greenfield
            RX HT20 SGI
            RX HT40 SGI
            RX STBC 1-stream
            Max AMSDU length: 3839 bytes
            No DSSS/CCK HT40
        Maximum RX AMPDU length 32767 bytes (exponent: 0x002)
        Minimum RX AMPDU time spacing: 2 usec (0x04)
        HT TX/RX MCS rate indexes supported: 0-7, 32
        Bitrates (non-HT):
            * 1.0 Mbps
            * 2.0 Mbps (short preamble supported)
            * 5.5 Mbps (short preamble supported)
            * 11.0 Mbps (short preamble supported)
            * 6.0 Mbps
            * 9.0 Mbps
            * 12.0 Mbps
            * 18.0 Mbps
            * 24.0 Mbps
            * 36.0 Mbps
            * 48.0 Mbps
            * 54.0 Mbps
        Frequencies:
            * 2412 MHz [1] (20.0 dBm)
            * 2417 MHz [2] (20.0 dBm)
            * 2422 MHz [3] (20.0 dBm)
            * 2427 MHz [4] (20.0 dBm)
            * 2432 MHz [5] (20.0 dBm)
            * 2437 MHz [6] (20.0 dBm)
            * 2442 MHz [7] (20.0 dBm)
            * 2447 MHz [8] (20.0 dBm)
            * 2452 MHz [9] (20.0 dBm)
            * 2457 MHz [10] (20.0 dBm)
            * 2462 MHz [11] (20.0 dBm)
            * 2467 MHz [12] (20.0 dBm) (no IR)
            * 2472 MHz [13] (20.0 dBm) (no IR)
            * 2484 MHz [14] (20.0 dBm) (no IR)
    Supported commands:
         * new_interface
         * set_interface
         * new_key
         * start_ap
         * new_station
         * new_mpath
         * set_mesh_config
         * set_bss
         * authenticate
         * associate
         * deauthenticate
         * disassociate
         * join_ibss
         * join_mesh
         * set_tx_bitrate_mask
         * frame
         * frame_wait_cancel
         * set_wiphy_netns
         * set_channel
         * set_wds_peer
         * probe_client
         * set_noack_map
         * register_beacons
         * start_p2p_device
         * set_mcast_rate
         * connect
         * disconnect
         * set_qos_map
         * Unknown command (121)
    Supported TX frame types:
         * IBSS: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
         * managed: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
         * AP: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
         * AP/VLAN: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
         * mesh point: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
         * P2P-client: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
         * P2P-GO: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
         * P2P-device: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
    Supported RX frame types:
         * IBSS: 0x40 0xb0 0xc0 0xd0
         * managed: 0x40 0xd0
         * AP: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0
         * AP/VLAN: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0
         * mesh point: 0xb0 0xc0 0xd0
         * P2P-client: 0x40 0xd0
         * P2P-GO: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0
         * P2P-device: 0x40 0xd0
    software interface modes (can always be added):
         * AP/VLAN
         * monitor
    valid interface combinations:
         * #{ AP, mesh point } <= 8,
           total <= 8, #channels <= 1
    HT Capability overrides:
         * MCS: ff ff ff ff ff ff ff ff ff ff
         * maximum A-MSDU length
         * supported channel width
         * short GI for 40 MHz
         * max A-MPDU length exponent
         * min MPDU start spacing
    Device supports TX status socket option.
    Device supports HT-IBSS.
    Device supports SAE with AUTHENTICATE command
    Device supports low priority scan.
    Device supports scan flush.
    Device supports AP scan.
    Device supports per-vif TX power setting
    Driver supports full state transitions for AP/GO clients
    Driver supports a userspace MPM
    Device supports configuring vdev MAC-addr on create.

From what I've read, the AWUSO36NH is a plug-and-play device so the drivers are installed automatically. I've used Wifite to retrieve handshakes before so I know the device works correctly.

MPX4132 commented 6 years ago

This is more than likely a driver issue. From what I've seen in past posts, the driver the AWUSO36NH uses does not support virtual interfaces.