0

I want to set up a MITM-scenario as an exercise for myself. My setup looks like this:

Internet <--------> Laptop <----------> Client

At this stage I just want to route the traffic from my AP to the internet, without monitoring it.

I use an Alfa-Network-Card in monitor-mode to create an AP with no encryption:

sudo airbase-ng -e demo wlan0mon

My next step was to set the networkinterface at0 up and assign an IP-address:

sudo ip link set at0 up
sudo ip addr add 192.133.1.1/24 dev at0

I allowed ip-forwarding like this

sudo sysctl -w net.ipv4.ip_forward=1

My dhcpd.config file is shown here:

subnet 192.133.1.0 netmask 255.255.255.0 {
default-lease-time 600;
max-lease-time 7200;
option routers 192.133.1.1;
option broadcast-address 192.133.1.255;
option domain-name "demo";
range 192.133.1.10 192.133.1.50;
}

To specify the interface my dhcp-server should listen on I added this line to /etc/default/isc-dhcp-server file:

INTERFACESv4="at0"

To start the dhcp-server ran this:

sudo dhcpd -cf /etc/dhcp/dhcpd.conf -pf /var/run/dhcpd.pid at0
sudo bash /etc/init.d/isc-dhcp-server start

If I connect now to the AP I get an IP-address and everything looks fine. To route the traffic to my internal laptop wlan interface (wlp5s0) i used iptables:

sudo iptables -A FORWARD --in-interface at0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -out-interface wlp5s0 -j MASQUERADE
sudo iptables -t nat -A PREROUTING -j DNAT --to-destination 192.133.1.1
sudo iptables -P FORWARD ACCEPT

After that my nat-table looks like this:

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DNAT       udp  --  any    any     anywhere             anywhere             to:192.133.1.1

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 438 packets, 36016 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 188 packets, 15827 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 1874  147K MASQUERADE  all  --  any    wlp5s0  anywhere             anywhere   

My problem is, that I cannot connect to the internet from a client. I think my iptabes-setup is wrong but I have no clue what to do about it. I guess I need a little help here...

  • Does the client get an IP address from DHCP? – multithr3at3d Nov 28 '19 at 3:31
  • Yes I get an IP address from the DHCP server. For example: if I connect to the AP with my IPhone my IP address is 192.133.1.13. – leonardo Nov 28 '19 at 11:07
  • what is the prerouting dnat rule for? – multithr3at3d Nov 29 '19 at 4:04
  • It changes the destination to the routers IP (192.133.1.1) before routing the packet. I thought It would be necessary, so the packets are send to my laptop (the router). But I just realized, that we told my computer to listen for packages on at0 anyway (sudo iptables -A FORWARD --in-interface at0 -j ACCEPT). I guess this rule is wrong here and "destroys" the information about the packages receiver. Do you know what my set of rules should look like? – leonardo Nov 29 '19 at 8:38
  • I tried things a little bit different now. I basically removed the DNAT-rule. I took a second laptop and connected it to the AP. By running ip address show wlp8s0 I verified, that the client gets an valid IP address (inet 192.133.1.17/24). I also checked the default gateway: currently 192.133.1.1. Last I tried sudo traceroute 216.58.213.195 to see, if the routing works (216.58.213.195 belongs to a google server). As a result I can see the 9 steps to the destination! I thought this was a good sign but I still cant access websites from my browser. – leonardo Nov 29 '19 at 11:36
0

With multithr3at3d's help I finally figured out how to do this. Here are two mistakes I made above:

  1. The DNAT rule in the NAT configuration changed the receiver to my laptop. This rule was misleading and should be removed. That's what the configuration should look like:
     sudo iptables -A FORWARD --in-interface at0 -j ACCEPT
     sudo iptables -P FORWARD -j ACCEPT
     sudo iptables -t nat -A POSTROUTING --out-interface enp4s0 -j MASQUERADE
  1. There was no DNS server available for the clients. By adding option domain-name-servers 93.104.209.27 to the dhcpd.conf file clients can access websites:
    subnet 192.133.1.0 netmask 255.255.255.0 {
        default-lease-time 600;
        max-lease-time 7200;
        option routers 192.133.1.1;
        option broadcast-address 192.133.1.255;
        option domain-name-servers 93.104.209.27;
        range 192.133.1.10 192.133.1.50;
    }

The IP address here is a random DNS server in Europe.

Although this is not the most elegant solution it works for me! Thanks!

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.