eaphammer v1.14 releases: evil twin attacks against WPA2-Enterprise networks

EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks. It is designed to be used in full scope wireless assessments and red team engagements. As such, the focus is placed on providing an easy-to-use interface that can be leveraged to execute powerful wireless attacks with minimal manual configuration. To illustrate how fast this tool is, here’s an example of how to set up and execute a credential-stealing evil twin attack against a WPA2-TTLS network in just two commands:

# generate certificates

./eaphammer --cert-wizard



# launch attack

./eaphammer -i wlan0 --channel 4 --auth ttls --wpa 2 --essid CorpWifi --creds

Features

• Steal RADIUS credentials from WPA-EAP and WPA2-EAP networks.
• Perform hostile portal attacks to steal AD creds and perform indirect wireless pivots
• Perform captive portal attacks
• Built-in Responder integration
• Support for Open networks and WPA-EAP/WPA2-EAP
• No manual configuration is necessary for most attacks.
• No manual configuration necessary for the installation and setup process
• Leverages the latest version of hostapd (2.8)
• Support for evil twin and karma attacks
• Generate timed Powershell payloads for indirect wireless pivots
• Integrated HTTP server for Hostile Portal attacks
• Support for SSID cloaking
• Fast and automated PMKID attacks against PSK networks using hcxtools
• Password spraying across multiple usernames against a single ESSID

EAPHammer now supports attacks against 802.11a and 802.11n networks. This includes the ability to create access points that support the following features:

• Both 2.4 GHz and 5 GHz channel support
• Full MIMO support (multiple inputs, multiple output)
• Frame aggregation
• Support for 40 MHz channel widths using channel bonding
• High Throughput Mode
• Short Guard Interval (Short GI)
• Modulation & coding scheme (MCS)
• RIFS
• HT power management

Changelog v1.14

• Merged feature from @r4ulcl that adds ESSID stripping capabilities to hostapd and CLI
• Merged fix from @DroidKali that fixes environment issue in some Linux versions (fixes #200 and #190)
• Merged fix for a typo in README.md from @DamieFC
• Merged update to raspbian-setup by @JBalanza
• Added SECURITY.md file
• Merged unattended setup script for Ubuntu from @DroidKali
• Merged autocrack fix from @DroidKali
• Merged build fix from @rdeprera (fixes #203) (fixes #197 and #163)
• Merged Python3 migration fixes, python3 UTF-8 to ASCII conversion fixes from @Att4ck3rS3cur1ty
• Fixed additional Python3 migration issues in payload generator
• Reduced overall length of hostapd ctrl_interface prefix and postfix values to accomodate 100 byte max_len for Unix domain sockets, which is exceeded in deeply nested directories. (fixes #201 and #189)
• Addressed disappearing --version flag
• Fixed Responder issues (fixes #192)
• Website cloner now works with self-signed certificates (resolves #173)
• Website cloner is now single threaded to avoid deadlocks introduced by upstream dependency (pywebcopy) (resolves #172)
• Fixed ParrotOS setup issues by referencing backports package distribution list (fixes #204)
• Merged fix from @r4ulcl that pins pem version (resolves #166)
• Updated documentation

Installation

On Kali Linux

git clone https://github.com/s0lst1c3/eaphammer.git
python setup.py

Usage

x.509 Certificate Generation

Eaphammer provides an easy-to-use wizard for generating x.509 certificates. To launch an eaphammer’s certificate wizard, just use the command shown below.

./eaphammer --cert-wizard

Stealing RADIUS Credentials From EAP Networks

To steal RADIUS credentials by executing an evil twin attack against an EAP network, use the –creds flag as shown below.

./eaphammer –bssid 1C:7E:E5:97:79:B1 –essid Example –channel 2 –interface wlan0 –auth ttls –creds

The flags shown above are self-explanatory. For more granular control over the attack, you can use the –wpa flag to specify WPA vs WPA2 and the –auth flag to specify the EAP type. Note that for cred reaping attacks, you should always specify an auth type manually since the –auth flag defaults to “open” when omitted.

./eaphammer –bssid 00:11:22:33:44:00 –essid h4x0r –channel 4 –wpa 2 –auth ttls –interface wlan0 –creds

Stealing AD Credentials Using Hostile Portal Attacks

Eaphammer can perform hostile portal attacks that can force LLMNR/NBT-NS enabled Windows clients into surrendering password hashes. The attack works by forcing associations using an evil twin attack, then forcing associated clients to attempt NetBIOS named resolution using a Redirect To SMB attack. While this occurs, eaphammer runs Responder in the background to perform a nearly instantaneous LLMNR/NBT-NS poisoning attack against the affected wireless clients. The result is an attack that causes affected devices to not only connect to the rogue access point but send NTLM hashes to the rogue access point as well.

The –hostile-portal flag can be used to execute a hostile portal attack, as shown in the examples below.

./eaphammer –interface wlan0 –bssid 1C:7E:E5:97:79:B1 –essid EvilC0rp –channel 6 –auth peap –wpa 2 –hostile-portal

./eaphammer –interface wlan0 –essid TotallyLegit –channel 1 –auth open –hostile-portal

Performing Indirect Wireless Pivots Using Hostile Portal Attacks

The hostile portal attack described in Stealing AD Credentials Using Hostile Portal Attacks can be used to perform an SMB relay attack against the affected devices. An attacker can use the hostile portal attack to perform an SMB relay attack that places the timed reverse shell on an authorized wireless device. The attacker can then disengage the attack to allow the authorized device to reconnect to the targetted network. When the attacker receives the reverse shell, he or she will have the same level of authorization as the attacker.

Performing Captive Portal Attacks

To perform a captive portal attack using eaphammer, use the –captive-portal flag as shown below.

./eaphammer –bssid 1C:7E:E5:97:79:B1 –essid HappyMealz –channel 6 –interface wlan0 –captive-portal

This will cause eaphammer to execute an evil twin attack in which the HTTP(S) traffic of all affected wireless clients are redirected to a website you control. Eaphammer will leverage Apache2 to serve web content out of /var/www/html if used with the default Apache2 configuration. Future iterations of eaphammer will provide an integrated HTTP server and website cloner for attacks against captive portal login pages.

Tutorial

Copyright (C) 2017 s0lst1c3

Source: https://github.com/s0lst1c3/