So if you've been hanging around in track one all day like I have, um so far we
have learnt how to overthrow a government and cause mass anarchy, umm then we learnt how
to create survival tools after you've created the anarchy but just speaking more generally I
think we're gonna learn something here that is practical which is umm, bypassing captive
portals [audience applaud] which very clearly people have some interest in. So let's give Grant
a big round of applause and our laptop loaner. [audience applaud and indistinct dialogue]
Alright, uh hello everybody. I'm going to have to go pretty quickly because I've only got
about 15 mins here so um, first of all a bit about myself but not very much. I've been hacking
and coding for a long time and I like giving talks at Defcon and I'm a generalist in security;
I've done various programming, infrastructure etc. Um, I also have Perimeter Grid which is my
security blog and personal consultant. Uh, a few disclaimers. Um, this is my own
research, I have an employer, this talk has nothing to do with him. Uh, also this talk was
submitted to Defcon 101. They put me in the big room because they thought a lot of people
would be interested and looking at this room, it seems they were right. Uh but nevertheless
unless you're a professional ping tester you're going to be bored. This is not dropping
great new attacks, this is showing how to you can use some existing tools. And finally, in
the United States, doing any of this stuff on a network you are not authorised access is super
illegal. Uh, so captive portals. Uh captive portals are a very primitive type of network access
protection and they consist of an open network either Ethernet, [indistinct] docsis or open
wifi, usually open wifi and on initial join you can only go to one website, the captive portal
and it doesn't let you in to anything else and then that limited website can authorise
access to more. So you've seen these everywhere, uh every store, office, restaurant, wifi,
hotel and airline internet, uh guest networks at corporations and even some telecom networks
like subscriptions hotspots. Uh, these are not real network access protection, they're not
using 802.1x, they're not using real cryptography, um they are attempting to put a small
barrier in front of you that they hope you don't know the way around and as a result they
don't have a real security boundary and they're pretty easy to circumvent. They rely on
obedient network clients, network clients that are going to uh, that are going to behave
the way network clients normally do. Um they uh usu- they're either an authenticated proxy or
mac filtering on the gateway, usually mac filtering on the gateway, governed with IP tape
rules, tables rules. There's very little variety in these, they may look all different um
but there is a piece of open source software called Chillispot that's built into
open WRT it's available in most Linux package managers; um it requires you to have a web
server and a RADIUS server, if you want to authenticate users. Uh it's fairly easy to set up
and uh basically everything's just Chillispot – Worldspot.net, Hotspot Systems, Sputnik, Hot
Spot Express, Wifi Soft, SkyRove, ...uh they're all just Chillispot. Uh if they not
Chillispot, they are for all intents and purposes a Chillispot clone, to the point
that I can't tell the difference just looking at the software from the outside. Um in addition
even if it isn't Chillispot, it basically still is. It's still a website writing IPtables rules.
So if you want to be able to get around this you actually need to do some advanced preparation,
you need to have an end point that you can tunnel your traffic to and so tunnelling is just
moving one protocol via another, uh usually you'd use an encrypted protocol but you
wouldn't have. You can, you can use a completely clear text tunnel um but you'd need some
server to act as the other end of your tunnel. And that means you needs a port, a protocol
that the captive portal isn't blocking. So sometimes HTTPS and SSH are unblocked on specific
the ports; uh in addition DNS is basically always unblocked because of DNS recursion. You
can reach the local DNS and it would then proxy your DNS queries out to the internet. So
we need to set up a server, any internet accessible server, any cheap VPS that lets you control
all ports, we'll use, uh will work. So you can't use a like uh uh shared web host account cos
you usually get 80 and 443. Uh you can even use your home pc if you wanna open these ports to
the internet on it which I don't think is a great idea because you can get a cheap or free AWS
or Azure node from and just let Amazon or Microsoft provide you your end point. Um so some end
points you wanna set up HTTPS proxy, SSH and Iodine which we'll talk a little more about
and also be sure you open the ports you set up on your server cyber wall. So any decent VPS
will come with SSH enabled so uh go ahead and add port 3128 to that as well as any other ports
you might think is useful to connect to. Uh depending on the specific captive portals you are
after the ports available may be different. Uh while you're at it, disable insecure logons on
SSH just because you should do that anyway and ensure you have a public key available so you're
not doing password log in. Um so Google app engine, Google uses a front door service. All Google
services are behind the same IP, so if the captive portal allows access to Google it also allows
access to Google app engine which means you can run your proxy behind Google's front door
and the same um uh the same access the captive portal is using to download ads will also
let you get to your tunnel. So you just get your app engine account, install Python and the
app engine SDK and uh you can find code online uh like the peace offer called Mirrorrr,
with 3 R's, that is an app engine compatible Python proxy, uh just go ahead and put that in
there and you can now browse to your app-id.appspot.com and get to your own proxy. Uh then
there's this peace offer called Iodine. Iodine is IP over DNS and there are several IP over
DNS packages. I like Iodine because it is actually still supported and it works on
Windows which is not the case for most of them. Um, so on your VPS you install Iodine and you
then you run it as route with uh password you make up and a subdomain that is going to be
used to forward DNS queries to you. On your DNS server uh you need to create a custom record
for the sub domain and look for the name server. It's like mine is t.perimetergrid.com so I
created a DNS record for NS, the name server t.perimetergrid.com and then I create a name server
record uh pointing back there so now DNS queries on the Internet to t.perimetrgrid.com will go to
my Iodine install. And if you don't have an DNS server, Namecheap free DNS is free,
Amazon Route 53 isn't free but is also configurable so you can use those. Uh finally you may
wanna set up a HTTPS proxy, it's kinda low value, most captive portals are too smart for, to
fall for this but um if you have a network that allows web traffic and not other traffic,
this can be useful as a way to tunnel other protocols. So then you need to prepare your client,
the laptop you're gonna actually use when you're wanting to do a bypass so on a hustle network
you're not going to have Internet so that means you're going to have to set all this up
before you're on a restricted network. Uh ideally you're gonna use Linux or Kali, um but
Windows will actually work fine for most of these, the only thing it won't is potentially
MAC changing. Uh most Windows drivers don't support changing the MAC address of your card uh
but there are some USB network cards with great support for windows like the Alpha networks
card with Realtek and Atheros chip sets which by the way you can get down in the Defcon
vendor room, I, I, uh bought a lot of them there. Um and you can always run Linux or Kali in
HyperV or VirtualBox and make use of your uh, of it that way. Um preinstalled tools, you need
an SSH client. Linux has it built in. If you're on Windows, I like moba x term, you can use
putty or whatever you want, uh a copy of Iodine, uh Wireshark on Windows or Aircrack-NG if you're
on Linux, nmap and an HTTP [indistinct] proxy would be nice. Uh none of the bypasses I
go through in this talk use that but uh sometimes you can actually take advantage of thee
the captive portal itself, they have bugs in them. Uh so then we get to uh ok uh what do we do
when we want to uh actually exploit this. So you're on a network with a captive portal.
First thing you wanna do is, use ipconfig or ifconfig on Linux, see your current IP and find out
what the gateway is, so once you know what the gateway is, uh go ahead and use a MAC to see
what's on your local subnet, see what's on the gateway. Um, you're looking on the gateway
for uh proxies uh TCP to 3128 which is the default port for Squid is always
promising um but there are uh, it could be on any port really, they can tap into whatever they
want. Also look to see if there is DNS um there almost certainly is, uh and any other unknown
ports that you might wanna try sending traffic to in case they're a proxy. So try
connecting to possible proxy ports, try connecting to your server through them uh over port
numbers open on the gateway. Now admittedly that should never work just cos the ports open on
the gateway doesn't mean it should be open to anything else, uh but sometimes it does work.
Uh it was well known for a while that this worked on GoGo Inflight, um they have fixed
that but, um that, that was a vulnerability in a well-known hotspot service. So then try
setting your proxy to your app engine end point, um, if the captive portal is app supported
this would probably work. If it's not app supported though umm, then uh this doesn't always
work. So then try DNS lookups. Umm, this is the most reliable method and if a DNS lookup
works, then try looking up your Iodine domain um so if you have a route to a working proxy
whether an app engine or your server or the gateways, you're done. Configure your browser and
you're out. Otherwise you can sshd your server through any of those ports, do that and then do
an ssh -d which creates a local SOCKS proxy on your computer that routes through that tunnel
and configure your browser to go through there. Uh if you can look up your Iodine DNS then
just run Iodine with the appropriate password and subdomain and now you got a
tunnel out and through that tunnel you SSH and do the proxy so you're using your own tunnel
to get out. And I'll demo this one, uh and then finally you need to fix your routing to
point through the new tunnel. Um, if you're using ssh -d, that's actually the easiest way
to do it, just point to the SOCKS proxy and do it that way. Alternately though you can
actually edit the route table on your proxy to make your new default route go through the
tunnel and at that point, everything works through it. Um... alright if nothing else
fails or nothing else works rather, um Chillispot is just configuring MAC filters so our
last ditch way through is using Airodump NG to uh watch the traffic and look for a MAC
address that is in use for a while and then stops being used. That's probably someone who
accessed the captive portal and then shut their laptop off. So you just clone your MAC address
to that MAC address and jump on the network and you're already allowed through the IP filters.
Um, you wanna look for a network someone stopped using because if you and someone else are both
using the same MAC address, everytime one of you transmits, you'll deauth the other and so
your network kinda activity will be absolutely horrible. Um, it can work but it's going to be
really slow. Um on Windows you can use Wireshark instead of Airodump NG, um, and you can
look in device manager and try to change mac addresses. As I mentioned earlier, most Windows
adapters don't support that. Um so I'm gonna give quick demos of these and hopefully have at
least a couple of minutes for questions. So, hopefully this will play... it will. Ok, so I
get on my Wifi at my super expensive hotel and I want to go and google for food but the
super expensive hotel has state-of-the-art, blistering fast 256 kilobit 802.11B for
only $29.95 per 24 hour period limit 2 devices, just give them my mobile phone, date of birth,
my mother's maiden name, credit card number, social security number and uh uh I don't think I
wanna do that so uh I'm gonna go over to my command prompt and do an ifconfig and I see I'm on a
on a 10. network and check the routing cable and the gateway is 10.0.0.1, just like I'd expect
so I'm going to nmap 10.0.0.1 and see what's on the gateway. Uh they've got 22 23 53 80 52 80
so I would try SSH-ing or uh just or HTTPS-ing to my local server or my app engine through
those various ports first. That's the easiest way. Umm, for the sake of the demo we are
going to say those failed, uh the the proxy is not configured that badly. Um so since we can't
get through it that way our next option is running Iodine; so we do IP over DNS so I run Iodine,
I use the password I specified earlier and I specify a DNS packet-size just because it
makes it run faster and I get my domain t.perimetergrid.com now it will attempt to uh connect.
Normally we wouldn't use that dash m, just used it to make the demo run faster. It will auto
guess the size but it takes it a couple of minutes to do it so that speeds it along. And I do
an ifconfig and I now have this new interface DNS zero which is, it's pointing to 172.16.02 so I
ping 172.16.01. That is actually my server being accessed through the tunnel cos remember I'm on a
10. network; I shouldn't be able to get to 172.16 so I'm going to an SSH dash D uh set up for port
5000 and I'm going to login to my own server using the tunnel address 172.16.01. And now I'm
on my server. I'm going over, completely over DNS so since I've got that SOCKS proxy set
up, the next thing I want to do is reconfigure my local web browser and I'm going to tell it
manually proxy config, give it SOCKS v4 proxy 127.0.0.1 port 5000 and now when I go back here
and I back out of this captive portal, and I look for food, I have found food!! So...
[audience applauds] Thank you. Now if that hadn't worked we do have one other option and that
is MAC spoofing. I'm running this one on a Kali VM, uh, because my Windows driver will
not let me get away with these tricks. So uh I got, I got this one using a USB wireless adapter
on Kali so wlan1, I'm going to grab the uh MAC address of the access point, this is the
hotspot network that I'm connected to and I'm going to Airomon-NG and turn on monitor
mode on my uh wifi card. Monitor mode's now on so I will run Airodump-NG and I will pass it
in, wlan one on and it will pass in the MAC address of the hotspot. That just makes it not
show me any other networks in the area and only show me the network I want. And I look, ah
look their client just connected 985FD3 etcetera. Um, normally I would wait and see other clients
connect, see if one of them drops off in this case, once again for speed I'm going to
just break out of there and uh on Linux it's really easy to change your MAC address; it's
quite trivial, you just down the interface and then run MAC change or dash m and uh specify
the new MAC address and then we're gonna up the interface again and now we give it a good
30 seconds, because this seems to confuse most of the uh most of the Linux networking GUI
tools. [quietly to self] Um, try connecting again. Ok now it thinks it's connected so we're
gonna go back here and we're out. So... [audience applauds] Alright I'm at one minute left
so I can take like a question but otherwise I'm going to be in the hallway on the right to
answer any other questions people have. So... got, anyone? [pause] OK. Thank you. [audience
applauds]