We're sorry but this page doesn't work properly without JavaScript enabled. Please enable it to continue.
Feedback

Bypassing Captive Portals and Limited Networks

00:00

Formale Metadaten

Titel
Bypassing Captive Portals and Limited Networks
Serientitel
Anzahl der Teile
93
Autor
Lizenz
CC-Namensnennung 3.0 Unported:
Sie dürfen das Werk bzw. den Inhalt zu jedem legalen Zweck nutzen, verändern und in unveränderter oder veränderter Form vervielfältigen, verbreiten und öffentlich zugänglich machen, sofern Sie den Namen des Autors/Rechteinhabers in der von ihm festgelegten Weise nennen.
Identifikatoren
Herausgeber
Erscheinungsjahr
Sprache

Inhaltliche Metadaten

Fachgebiet
Genre
Abstract
Common hotspot software like Chilispot and Sputnik allow anyone to set up a restricted WiFi router or Ethernet network with a captive portal, asking for money, advertising, or personal information in exchange for access to the Internet. In this talk I take a look at how these and similar restrictive networks work, how they identify and restrict users, and how with a little preparation we can reach the Internet regardless of what barriers they throw up. Bio: Grant Bugher has been hacking and coding since the early 90’s and working professionally in information security for the last 12 years. He is currently a security engineer for a cloud service provider, and has previously been an architect, program manager and software engineer on a variety of online services, developer tools and platforms. Grant is a prior speaker at BlackHat and DEF CON and a regular DEF CON attendee since DEF CON 16. Most of his research and work is on cloud computing and storage platforms, application security, and detecting & investigating attacks against web-scale applications.
33
35
EreignisdatenanalysePhysikalischer EffektRuhmasseUnrundheitWeg <Topologie>DatenerfassungInklusion <Mathematik>Portal <Internet>Vorlesung/Konferenz
EDV-BeratungBitComputersicherheitWeb logMultiplikationsoperatorSoftwarePortal <Internet>
SoftwareTypentheoriePrimitive <Informatik>Portal <Internet>
SoftwareTelekommunikationReelle ZahlPay-TVFeuchteleitungOffene MengeWeb SiteSoftwareTelekommunikationMIDI <Musikelektronik>ProgrammierumgebungGatewayInverser LimesKonfigurationsraumInternetworkingComputersicherheitOffene MengeChiffrierungPrimitive <Informatik>Direkte numerische SimulationClientWeb SiteDynamic Host Configuration ProtocolPortal <Internet>Proxy ServerNichtlineares ZuordnungsproblemDienst <Informatik>
DatenverwaltungSoftwareRekursive FunktionGatewayTabelleReelle ZahlServerInternetworkingComputersicherheitPunktVarietät <Mathematik>AuthentifikationProtokoll <Datenverarbeitungssystem>RadiusDirekte numerische SimulationClientOpen SourceWeb SiteDifferentep-BlockProxy ServerRandwertSchreiben <Datenverarbeitung>BenutzerbeteiligungSoftwareVarietät <Mathematik>
ServerInternetworkingFreewareBenutzerbeteiligungFünfServerFirewallEuler-WinkelNeuroinformatikProxy ServerGamecontroller
CodeSoftwareKorrelationskoeffizientPublic-Key-KryptosystemAutomatische DifferentiationNetzadresseInstallation <Informatik>UmwandlungsenthalpiePasswortPortal <Internet>Proxy ServerDienst <Informatik>App <Programm>Googol
DatensatzGrenzschichtablösungServerInternetworkingCASE <Informatik>Wurzel <Mathematik>Installation <Informatik>Data MiningDirekte numerische SimulationPasswortDatensatzServerRoutingDirekte numerische SimulationPasswortDomain <Netzwerk>
SoftwareBildschirmfensterInternetworkingNotebook-ComputerProtokoll <Datenverarbeitungssystem>Portal <Internet>Proxy ServerFreewareBenutzerbeteiligungClientProxy Server
MathematikSoftwareBildschirmfensterTreiber <Programm>AdressraumPlastikkarteJensen-MaßSoftwareBildschirmfensterTreiber <Programm>InternetworkingNabel <Mathematik>Notebook-ComputerDirekte numerische SimulationClientOrakel <Informatik>Proxy ServerVirtualisierung
SoftwareBildschirmfensterGatewayStellenringZahlenbereichKonfigurationsraumServerCASE <Informatik>ProgrammfehlerUltraviolett-PhotoelektronenspektroskopieRoutingOffene MengeBrowserDirekte numerische SimulationNeuroinformatikProxy ServerSoftwareschwachstelleDienst <Informatik>DefaultApp <Programm>ClientExploit
TabelleRoutingPunktPasswortNeuroinformatikProxy ServerDemo <Programm>DefaultRothe-VerfahrenGatewayKonfigurationsraumServerRoutingPunktBrowserDirekte numerische SimulationPasswortProxy Server
DatenverwaltungMathematikSoftwareFilter <Stochastik>BildschirmfensterEinfach zusammenhängender RaumWechselsprungAnpassung <Mathematik>AdressraumMultiplikationsoperatorDemo <Programm>
FrequenzAggregatzustandInverser LimesPersonenkennzeichenPlastikkarteMobiles InternetBaum <Mathematik>InformationFrequenzInverser LimesZahlenbereichAdressraumMobiles InternetComputeranimation
MAPErwartungswertGatewayKonfigurationsraumTropfenGatewayLoopRadikal <Mathematik>TabelleVerschlingungBroadcastingverfahrenFehlermeldungRoutingKernel <Informatik>RahmenproblemVerdeckungsrechnungFahne <Mathematik>Freier LadungsträgerComputeranimationProgramm/Quellcode
ServerProxy ServerApp <Programm>TropfenAggregatzustandGatewayMetrisches SystemRadikal <Mathematik>TabelleFehlermeldungRoutingKernel <Informatik>RahmenproblemVerkehrsinformationAdressraumFahne <Mathematik>Freier LadungsträgerDienst <Informatik>TelnetProgramm/Quellcode
Konfiguration <Informatik>COMEinfach zusammenhängender RaumPasswortDomain <Netzwerk>UmfangVerknüpfungsgliedRoutingBitrateVerdeckungsrechnungeCosTelnet
KonfigurationsraumDemo <Programm>Funktion <Mathematik>AggregatzustandEinfach zusammenhängender RaumMaßerweiterungRadikal <Mathematik>VerschlingungVersionsverwaltungServerATMÄußere Algebra eines ModulsOffene MengeProtokoll <Datenverarbeitungssystem>VerkehrsinformationAdressraumDirekte numerische SimulationDomain <Netzwerk>LoginUDP <Protokoll>SocketCodecDienst <Informatik>TelnetProgramm/Quellcode
SoftwarePhysikalischer EffektServerTropfenLoopMetrisches SystemRadikal <Mathematik>VerschlingungBroadcastingverfahrenFehlermeldungInelastischer StoßRahmenproblemVerdeckungsrechnungFreier LadungsträgerProgramm/Quellcode
ServerTropfenLoopRadikal <Mathematik>VerschlingungBroadcastingverfahrenFehlermeldungRahmenproblemVerdeckungsrechnungFreier LadungsträgerProgramm/Quellcode
StellenringServerBrowserDirekte numerische Simulationsinc-FunktionProxy ServerGraphInformationHalbleiterspeicherFrequenzPhysikalisches SystemRadikal <Mathematik>ZahlenbereichFormation <Mathematik>SummierbarkeitAdressraumPunktwolkeLoginDienst <Informatik>Mobiles InternetJSONComputeranimationProgramm/Quellcode
KonfigurationsraumProxy ServerDatenverwaltungSoftwareEinfach zusammenhängender RaumInhalt <Mathematik>MereologieMenütechnikInternetworkingPasswortCachingProgramm/Quellcode
FrequenzLastZahlenbereichWeb-SeiteAdressraumMobiles Internet
BildschirmfensterTreiber <Programm>Computeranimation
SoftwareEinfach zusammenhängender RaumATMAdressraumDrahtloses lokales NetzDatenverwaltungPetri-NetzFrequenzInverser LimesLeistung <Physik>MaßerweiterungVerschlingungATMChiffrierungSchlüsselverwaltungProgramm/Quellcode
SoftwareFlächeninhaltAdressraumClientDatenverwaltungSoftwareFrequenzPhysikalischer EffektExakte SequenzIntelInverser LimesTreiber <Programm>ATMHauptidealringChiffrierungRahmenproblemWorkstation <Musikinstrument>BitrateSchlüsselverwaltungInterface <Schaltung>Programm/Quellcode
FaserbündelEinfach zusammenhängender RaumAdressraumClientInterface <Schaltung>
Einfach zusammenhängender RaumGraphische BenutzeroberflächeAdressraumZweiAutomorphismusMachsches PrinzipOffene MengeRahmenproblemWorkstation <Musikinstrument>BitrateProgramm/Quellcode
LESComputeranimation
Rechter WinkelRechenschieberToken-RingLESGradientComputeranimation
Transkript: Englisch(automatisch erzeugt)
So, if you've been hanging around in Track 1 all day like I have, um, so far we've learned how to overthrow a government and cause mass anarchy. Um, then we learned how to create survival tools after you've created the anarchy. But, just speaking more generally, I think we're going to learn something here that is practical, which is, um,
bypassing captive portals, which very clearly people have some interest in. So, let's give a big round of applause and our laptop loner.
Alright, uh, hello everybody. I'm gonna have to go pretty quickly cause I've only got about fifteen minutes here. So, um, first of all, a bit about myself, but not very much. Uh, I've been hacking and coding for a long time and I like giving talks at Def Con. I'm a generalist in security. I've done various programming, infrastructure, etc. Um, I also
have Perimeter Grid, which is my security blog and personal consulting. Uh, a few disclaimers, um, this is my own research. I have an employer, this talk has nothing to do with them. Uh, also this talk was submitted to Def Con 101. They put me in the big room because they thought a lot of people would be interested and looking at this room it seems they were right. Uh, but nevertheless, if you're a professional pen tester,
you're going to be bored. This is not dropping great new attacks, this is showing you how to use some existing tools. And finally, in the United States, doing any of this stuff on a network you are not authorized to access is super illegal. Uh, so captive portals. Uh, captive portals are a very primitive type of network access protection. And they consist of an open network, either Ethernet, DOCSIS, or open Wi-Fi, usually open
Wi-Fi. And on initial join, you can only go to one website, the captive portal, and it doesn't let you into anything else. And then that limited website can authorize access to more. So, you've seen these everywhere. Uh, every store, office, restaurant, Wi-Fi, hotel and airline internet, uh, guest networks at corporations, and even
some telecom networks like subscription hotspots. Uh, these are not real network access protection. They're not using 802.1X, they're not using real cryptography, um, they are attempting to put a small barrier in front of you that they hope you don't know the way around. And as a result, they don't have a real security boundary. And they're
pretty easy to circumvent. They rely on obedient network clients. Network clients that are going to, uh, going to behave the way network clients normally do. Um, they, uh, use, they're either an authenticated proxy or MAC filtering on the gateway. Usually MAC filtering on the gateway governed with IP tables, tables rules. There's very little variety in these. They may look all different, um, but there's a piece of open source
software called Chili Spot. It's built into open WRT. It's available in most Linux's package managers. Um, it requires you to have a web server and a radius server if you want to authenticate users. Uh, it's fairly easy to set up and, uh, basically everything's just Chili Spot. Uh, worldspot.net, hotspot systems, sputnik, hotspot express, wifi
soft, skyrove, um, they're all just Chili Spot. Uh, if they're not Chili Spot, they're for all intents and purposes a Chili Spot clone to the point where I can't tell the difference just looking at the software from outside. Um, in addition, even if it isn't Chili Spot, it basically still is. It's still a website writing IP tables rules.
So, if you want to be able to get around this, you actually need to do some advanced preparation. You need to have an endpoint that you can tunnel your traffic to. And, so, tunneling is just moving one protocol via another. Uh, usually you use an encrypted protocol, but you wouldn't have to. You can, you can use a completely clear text tunnel. Um, but you need some server to act as the other end of your tunnel. And
that means you need a port or protocol that the captive portal isn't blocking. So, sometimes HTTPS and SSH are unblocked on specific ports. Uh, in addition, DNS is basically always unblocked because of DNS recursion. You can reach the local DNS and it will then proxy your DNS queries out to the internet. So, we need to set up a server.
Any internet accessible server, any cheap VPS that lets you control all ports will use. So, it will work. So, you can't use like a, uh, shared web host account because you usually only get 80 and 443. Uh, you could even use your own home PC if you want to open these ports to the internet on it, which I don't think is a great idea, because you can get a cheap or free AWS or Azure node from, and just let Amazon or
Microsoft provide you your endpoint. Um, so, some endpoints we want to set up. HTTPS proxy, uh, SSH and, uh, iodine, which we'll talk a little more about. And also be sure you open the ports you set up on your server's firewall. So, any decent VPS will come with SSH enabled. So, uh, go ahead and add port 3128 to that, as well as
any other ports you might think is useful to connect to. Uh, depending on the specific captive portals you're after, the ports available may be different. Uh, while you're at it, disable insecure logons on SSH, just because you should do that anyway. And ensure you have a public key available so you're not doing password login. Um, so, Google App Engine. Google uses a front door service. All Google services are behind the same
IPs. So, if a captive portal allows access to Google, it also allows access to Google App Engine, which means you can run your proxy behind Google's front door. And the same, uh, um, the same access the captive portal's using to download ads will also let you get to your tunnel. So, you just get your App Engine account, install Python in
the App Engine SDK and, uh, you can find code online, uh, like there's a piece of software called Mirror with 3 R's that is an App Engine compatible Python proxy. Uh, just go ahead and put that in there and you can now browse to yourappid.appspot.com and get to your own proxy. Um, then there's a piece of software called Iodine. Iodine is IP
over DNS and there are several IP over DNS packages. I like Iodine because it's actually still supported and it works on Windows, which is not the case for most of them. Um, so, on your VPS, you install Iodine and then you run it as root with, uh, password you make up and a subdomain that's gonna be used to forward DNS queries to you.
On your DNS server, um, you need to create a custom record for the subdomain and for the name server. So, like, mine is t.perimetergrid.com. So, I create a DNS record for NS, the name server, dot t.perimetergrid.com and then I create a name server record, uh, pointing back there. So, now, DNS queries on the internet to t.perimetergrid.com will go
to my Iodine install. And if you don't have a DNS server, Namecheap Free DNS is free. Amazon Route 53 isn't free but is also configurable so you can use those. Um, finally, you may want to set up an HTTPS proxy. It's kind of low value. Most captive portals are too smart for, to fall for this. But, um, if you have a network that allows web
traffic and not other traffic, this can be useful as a way to tunnel other protocols. So, then you need to prepare your client, the laptop you're gonna actually use when you're wanting to do a bypass. So, on a hostile network, you're not gonna have internet. So, that means you have to set all this stuff up before you're on a restricted network. Uh, ideally, you're gonna use Linux or Kali, um, but Windows will
actually work fine for most of these. The only thing it won't is potentially Mac changing. Uh, most Windows drivers don't support changing the Mac address of your card. Um, but there's some USB network cards with great support for Windows, like the alpha networks cards with Realtek and Athros chipsets, which, by the way, you can get down in the Defcon vendor room. I, I bought a lot of them there. Um, and you can
always run Linux or Kali in Hyper-V or VirtualBox and make use of your, uh, of, of it that way. Um, pre-install tools. You need an SSH client. Linux has it built in if you're on Windows. I like MOBA Xterm, but you can use PuTTY or whatever you want. Uh, a copy of iodine, uh, Wireshark on Windows or AirCrackNG if you're on Linux, Nmap and an
HTTP debugging proxy would be nice. None of the, uh, bypasses I go through in this talk use that, but, uh, sometimes you can actually take advantage of the, the captive portal itself. They have bugs in them. Um, so, then we get to, uh, okay, what do we do when we want to, uh, actually exploit this? So, you're, you're on a network with a
captive portal. First thing you want to do is use ipconfig or ifconfig on Linux, see your current IP and find out what the gateway is. So, once you know what the gateway is, uh, go ahead and use Nmap to see what's on your local subnet, see what's on the gateway. Um, you're looking on the gateway for, uh, proxies. Uh, TCP 3128, which is the default
port for squid, is always promising. Um, but there are, it could be on any port, really. They could have it to whatever they want. Also, look to see if there's DNS. Um, there almost certainly is. Uh, and any other unknown ports that you might want to try sending traffic to in case they're a proxy. So, try connecting to possible proxy ports. Try connecting to your server through them, uh, over port numbers open on the gateway. Now,
admittedly, that should never work. Just because the port's open on the gateway doesn't mean it should be open to anything else. Um, but sometimes it does work. Uh, it was well known for a while that this worked on GoGo in flight. Um, they have fixed that. But, um, that, that was a vulnerability in a well known hotspot service. So, then try
setting your proxy to your app engine endpoint. Um, if the captive portal is ad supported, this will probably work. If it's not ad supported though, um, this doesn't always work. So, then try DNS look ups. Um, this is the most reliable method. And if a DNS look up works, then try looking up your iodine domain. Um, so, if you have a route to a working
proxy, whether app engine or your server or the gateways, you're done. Configure your browser and you're out. Otherwise, if you can SSH to your server through any of those ports, do that and then do an SSH dash D which creates a local SOX proxy on your computer that routes through that tunnel and configure your browser to go through there. Uh, if you can look up your iodine DNS, then you just run iodine with the
appropriate password and subdomain and now you've got a tunnel out. And through that tunnel, you SSH and do the proxy. So, you're using your own tunnel to get out. And I'll demo this one. Um, and then finally, you need to fix your routing to point through the new tunnel. Um, if you're using SSH dash D, that's actually the easiest way to do it. Just
point to the SOX proxy and do it that way. Um, alternately though, you can actually edit the route table on your computer to make your new default route go through the tunnel. And at that point, everything works through it. Um, alright. If nothing else fails, or nothing else works rather, um, Chili Spot is just configuring MAC filters. So,
our last ditch way through is use AeroDumpNG to, uh, watch the traffic and look for a MAC address that is in use for a while then stops being used. That's probably someone who accessed the captive portal and then shut their laptop off. So, you just clone your MAC address to that MAC address and jump on the network and you're already allowed through
the IP filters. Um, you wanna look for a network someone stopped using because if you and someone else are both using the same MAC address, every time one of you transmits, you'll de-off the other and so your network connectivity will be absolutely horrible. Um, it can work, but it's gonna be really slow. Um, on Windows you can use Wireshark instead of AeroDumpNG. Um, and you can look in device manager and try to
change MAC addresses. As I mentioned earlier, most Windows adapters don't support that. Um, so, I'm gonna give quick demos of these and hopefully have at least a couple minutes for questions. So, I hope that this will play. It will, okay. So, I get on my WiFi at the super expensive hotel and I want to go and Google for food. But, the
super expensive hotel has state of the art blistering fast 256 kilobit 802.11b for only $29.95 per 24 hour period limit 2 devices. Just give them my mobile phone, date of birth, mother's maiden name, credit card number, social security number. Now, I don't think I wanna do that. So, uh, I'm gonna go over to my command prompt, uh, do an
config and I see I'm on a 10 dot network. And check the routing table, gateways 10.0.0.1 just like I'd expect. So, I'm gonna end map 10.0.0.1 and see what's on the gateway. Uh, they've got 22, 23, 53, 80, 52, 80. So, I would try SSHing or, uh, just set, or HTTPSing to my
local server or my app engine through those various ports first. That's the easiest way. Um, for the sake of the demo, we're gonna say those failed. Uh, the proxy is not configured that badly. Um, so, since we can't get through it that way, uh, our next option is running iodine. So, we're doing IP over DNS. So, I run iodine, I use the password I
specified earlier and I specify a, uh, DNS packet size just because it makes it run faster. And I give my domain T perimeter grid com. Now, it will attempt to, uh, connect. Normally, you wouldn't use that dash M, I just used it to make the demo run faster. It will autoguess the size, but it takes it a couple minutes to do it. So, that speeds it
along. And I do an IF config and I now have this new interface, DNS0, which is point, pointing to 172.16.0.2. So, I'm gonna ping 172.16.0.1. That is actually my server being accessed through the tunnel. Cause remember, I'm on a 10 dot network. I
shouldn't be able to get to 172.16. So, I'm gonna do an SSH dash D, uh, set up port 5000. And I'm going to log into my own server using the tunnel address, 172.16.0.1. And now I'm on my server. Um, going over, completely over DNS. So, since I've got that SOX proxy
setup, the next thing I want to do is reconfigure my local web browser. And I'm gonna tell it manual proxy config. Give it, give it SOX V4 proxy 127.0.0.1 port 5000. And now,
when I go back here, and I back out of this captive portal, and I look for food, I have found food. So, thank you. Now, if that hadn't worked, we do have one other option and
that is MAC spoofing. Uh, I'm running this one on a Kali VM because, uh, my Windows driver will not let me get away with these tricks. So, uh, got this one, I've got this one using a, uh, USB wireless adapter on Kali. So, WLAN 1, I'm gonna grab the, uh,
MAC address of the access point. This is the hotspot network that I'm connected to. And I run airmon-ng and turn on monitor mode on my, uh, wifi card. Monitor mode's now on, so I will run, uh, aerodump-ng and I will pass it in, wlan1mon, and I will pass in the MAC address of the hotspot. That just makes it not show me any other networks in the
area and only show me the network I want. And I look, oh look, their client just connected. Uh, 98 5F D3, etc. Um, normally I would wait, see other clients connect, see if one of them drops off. In this case, once again, for speed, I'm gonna just break out of there. And, um, on Linux, it's really easy to change your MAC address. It's quite
trivial. You just down the interface and then run MAC changer dash M and, uh, specify the new MAC address. And then we're gonna up the interface again. And now we give it a
good 30 seconds because this seems to confuse most of, uh, the Linux, uh, networking GUI tools. Um, try connecting again. Okay, now it thinks it's connected. So, we're gonna go back here. And we're out. Alright, uh, I'm at one minute left, so I can take, like, a
question, but otherwise I will be in the hallway on the right to answer any other questions people have. So, uh, anyone? Okay, thank you.