802.11evil

#!/usr/bin/env bash
#
# 802.11evil
#
# Create evil WiFi access point.
#
# Author: Emanuel Duss
#

set -o nounset

_red="$(tput setaf 1)"
_green="$(tput setaf 2)"
_reset="$(tput sgr0)"

echo_info(){ echo "${_green}[*] ${*}${_reset}" >&2; }
echo_error(){ echo "${_red}[#] ${*}${_reset}" >&2; }

print_usage(){
cat << EOI
Usage: 802.11evil [OPTION ...]

Program:
  Create evil WiFi access point.

Options:
  -l    LAN interface           (default: eth0)
  -a    Access Point interface  (default: wlan0)
  -i    Access Point IP address (default: 192.168.42.1)
  -s    Access Point SSID       (default: 802.11evil)
  -p    Access Point password   (default: password)
  -r    Redirect on/off         (default: off)
  -f    Redirect ports from     (default: 80,443)
  -t    Redirect ports to       (default: 8080)
EOI
}

check_dependencies(){
  local fail=0
  for command in "$@"
  do
    if ! hash "$command" &> /dev/null
    then
      echo_error "Command \"$command\" not found."
      fail=1
    fi
  done
  [[ "$fail" == 1 ]] && exit 1
}

parse_arguments(){
  LAN_INTERFACE="eth0"
  AP_INTERFACE="wlan0"
  AP_ADDRESS="192.168.42.1"
  SSID="802.11evil"
  PASSWORD="password"
  REDIRECT="off"
  REDIRECTPORTS="80,443"
  REDIRECTTO="8080"

  while getopts l:i:a:s:p:rf:t:h name
  do
    case $name
    in
      l)
        LAN_INTERFACE="$OPTARG"
      ;;
      a)
        AP_INTERFACE="$OPTARG"
      ;;
      i)
        AP_ADDRESS="$OPTARG"
      ;;
      s)
        SSID="$OPTARG"
      ;;
      p)
        PASSWORD="$OPTARG"
      ;;
      r)
        REDIRECT="on"
      ;;
      f)
        REDIRECTPORTS="$OPTARG"
      ;;
      t)
        REDIRECTTO="$OPTARG"
      ;;
      h)
        print_usage
        exit
      ;;
      ?)
        print_usage >&2
        exit 1
      ;;
    esac
  done
}

# Always run exit_trap; only run exit_cleanup when set to 1
CLEANUP="0"
enable_cleanup(){ CLEANUP="1"; }

exit_trap(){
  echo
  echo_info "Stopping 802.11evil..."

  [[ "${CLEANUP}" == "1" ]] && exit_cleanup
}
trap exit_trap EXIT

exit_cleanup(){
  echo_info "Stopping dnsmasq..."
  pkill dnsmasq

  echo_info "Stopping hostapd..."
  pkill hostapd

  echo_info "Restoring network interface configuration..."
  ip address flush "${AP_INTERFACE}"
  base64 -d <<< "${INITIAL_AP_INTERFACE}" | ip address restore "${AP_INTERFACE}"
  sysctl -q net.ipv4.ip_forward="${INITIAL_IPFORWARD}"

  echo_info "Restoring iptables configuration..."
  iptables-restore <(echo "${INITIAL_IPTABLES}")

  echo_info "Stopped."
}

show_settings(){
  echo_info "Configured LAN interface: ${LAN_INTERFACE}"
  echo_info "Configured access point interface: ${AP_INTERFACE}"
  echo_info "Configured access point IP address: ${AP_ADDRESS}"
  echo_info "Configured SSID: ${SSID}"
  echo_info "Configured password: ${PASSWORD}"
  echo_info "Configured to redirect: ${REDIRECT}"
  echo_info "Configured port(s) to redirect: ${REDIRECTPORTS}"
  echo_info "Configured port to redirect to: ${REDIRECTTO}"
  echo
}

check_preconditions(){
  if [[ "$UID" != 0 ]]
  then
    echo_error "Program must be run as root."
    exit 1
  fi
}

save_initial_configuration(){
  INITIAL_AP_INTERFACE="$(ip address save "${AP_INTERFACE}" | base64 -w0)"
  INITIAL_IPFORWARD="$(sysctl -n net.ipv4.ip_forward)"
  INITIAL_IPTABLES="$(iptables-save)"
}

configure_network(){
  echo_info "Configure access point interface..."
  ip address flush "${AP_INTERFACE}"
  ip address add "${AP_ADDRESS}/24" dev "${AP_INTERFACE}"
  ip link set dev "${AP_INTERFACE}" up
  ip -br address list "${AP_INTERFACE}"

  if [[ "${REDIRECT}" == "on" ]]
  then
    echo_info "Configure port redirects..."
    for port in ${REDIRECTPORTS//,/ }
    do
      iptables -t nat -A PREROUTING -i "${AP_INTERFACE}" -p tcp --dport "$port" -j REDIRECT --to-port "${REDIRECTTO}"
    done
    iptables -nL -t nat | grep REDIRECT
  else
    echo_info "Not configured to redirect ports."
  fi
}

configure_ap(){
  echo_info "Starting hostapd..."
  hostapd <(cat << EOI
interface=${AP_INTERFACE}
driver=nl80211
ssid=${SSID}
hw_mode=g
channel=6
wpa_passphrase=${PASSWORD}
wpa=1
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP CCMP
wpa_ptk_rekey=600
macaddr_acl=0
EOI
) &
}

configure_dnsmasq(){
  echo_info "Starting dnsmasq..."
  local subnet
  subnet="$(cut -d . -f 1-3 <<< "${AP_ADDRESS}")"

  dnsmasq --no-daemon --interface "${AP_INTERFACE}" --bind-interfaces \
    --dhcp-range="${subnet}.50,${subnet}.150" \
    --log-dhcp --log-queries \
    -C /dev/null &
}

configure_nat(){
  echo_info "Configuring IP forwarding and NAT..."
  sysctl -q -w net.ipv4.ip_forward=1
  iptables -t nat -A POSTROUTING -o "${LAN_INTERFACE}" -j MASQUERADE
  iptables -P FORWARD ACCEPT
}

main(){
  check_dependencies hostapd dnsmasq

  parse_arguments "$@"
  shift $((OPTIND - 1))

  show_settings
  check_preconditions
  save_initial_configuration

  enable_cleanup

  configure_network
  configure_ap
  configure_dnsmasq
  configure_nat

  echo_info "Successfully set up 802.11evil."
  echo_info "Press ^C (Ctrl-C) to stop 802.11evil."
  read -r -d '' # Wait for ^C
}

main "$@"