Rogue Access Point Detection/Mitigation

#MAC address~SSID
#00:12:17:DA:09:2G~linksys

#192.168.88.1~user1~user1

#duraction to run the scan for in seconds
15
#IP of server to pull the rogue page from
192.168.1.2
#path to the rogue file /index.html
/rogue.html
#email address to send alerts to.  Some smtp servers require <> around email addresses.
[email protected]
#IP of mail server to relay through
127.0.0.1
#port of smtp server
25

#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_UseX64=n
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
#cs ----------------------------------------------------------------------------
 
 AutoIt Version: 3.3.6.1
 Author:         Greg Sowell
 
 Script Function:
	This script controls putty to connect to mikrotik APs and check for rogues on your network.
 
#ce ----------------------------------------------------------------------------
 
; Script Start - Add your code below here
;autioit includes
#include <file.au3>
#include <Array.au3>
 
;open the settings file
Dim $aSettings
If Not _FileReadToArray(@ScriptDir & "\settings.txt",$aSettings) Then
   MsgBox(4096,"Error", " Error reading log to Array     error:" & @error)
   Exit
EndIf
 
;set variables
$Duration = $aSettings[2];duration to do the scan
$serverIP = $aSettings[4];ip address of the webserver
$serverPathFile = $aSettings[6] & """";path to check file
$EmailAddress = $aSettings[8];email address variable
$szIPADDRESS = $aSettings[10];;email server IP address
$nPORT = $aSettings[12];25 ;email server port
$ClipContents = "" ;setup clipboard variable
$waiting = 0 ;variable for time checking
$HostIP = ""
$userN = ""
$passW = ""
$ssid = ""
$mac = ""
$puttyPID = ""
;#cs ----------------------------------------------------------------------------
 
;open hosts file
Dim $aHosts
If Not _FileReadToArray(@ScriptDir & "\probes.txt",$aHosts) Then
   MsgBox(4096,"Error", " Error reading log to Array     error:" & @error)
   Exit
EndIf
 
;main program loop.  Loop through each host.
for $h = 1 to $aHosts[0]
	if StringInStr("---" & $aHosts[$h],"#") < 1 Then
		;not a comment, lets go!!!
		;run the host processing function
		_RunHost()
	EndIf
Next
 
;host processing function
Func _RunHost()
$HostIP = StringLeft($aHosts[$h],StringInStr($aHosts[$h],"~") - 1);pull host IP
$userN = StringMid($aHosts[$h],StringInStr($aHosts[$h],"~") + 1,StringInStr($aHosts[$h],"~",0,2) - StringInStr($aHosts[$h],"~") - 1);Host username
$passW =StringMid($aHosts[$h],StringInStr($aHosts[$h],"~",0,2) + 1);host password
$puttyPID = run(@ScriptDir & "\putty.exe -ssh -l " & $userN & " -pw " & $passW & " " & $HostIP);open putty
 
;do a check cycle of 10 seconds for putty to start
while $waiting <> 10
	If ProcessExists("putty.exe") Then
		$waiting = 100
		ExitLoop
	EndIf
	sleep(1000)
WEnd
 
;check if putty process was found
if $waiting = 10 Then
	MsgBox(0,"putty didn't run", "Sorry, but putty didn't open")
	Exit
EndIf
 
_SleepTime(5,"putty");wait 5 seconds for putty to connect and settle
 
;activate putty
WinActivate($HostIP & " - PuTTY")
WinWaitActive($HostIP & " - PuTTY")
 
;send the command to start the scan
Send("/int wire scan wlan1 duration=" & $Duration & @CRLF)
 
_SleepTime($Duration + 2,"scan command") ;sleep for 2 seconds longer than duration
 
_CopyAll() ;copy everything to clipboard
 
;delete the existing temp file
FileDelete(@ScriptDir & "\cliptemp.txt")
;write clip contents to a temp file
$AClip = FileOpen(@ScriptDir & "\cliptemp.txt", 1)
 
; Check if file opened for writing OK
If $AClip = -1 Then
    MsgBox(0, "Error", "Unable to open file.")
    Exit
EndIf
FileWriteLine($AClip, $ClipContents)
 
FileClose($AClip)
;#ce ----------------------------------------------------------------------------
 
;read contents of temp file into an array
Dim $AClipCont
If Not _FileReadToArray(@ScriptDir & "\cliptemp.txt",$AClipCont) Then
   MsgBox(4096,"Error", " Error reading log to Array     error:" & @error)
   Exit
EndIf
 
local $aSSIDs[1];setup ssid array
$aSSIDs[0] = 0;set the counter to 0
$StartProc = 0 ;processing variable
;start processing the array
For $x = 1 to $AClipCont[0] - 2
	;check if the ssid section has been found
	if $StartProc == 1 Then
		; we need to process the lines here
		$BldStrng = StringLeft($AClipCont[$x],3) & "~"
		$BldStrng = $BldStrng & stringmid($AClipCont[$x],7,17) & "~"
		$BldStrng = $BldStrng & stringmid($AClipCont[$x],25,10)
		_ArrayAdd($aSSIDs,$BldStrng)
		$aSSIDs[0] = $aSSIDs[0] + 1
 
	EndIf
 
	;find the line just before scan starts
	if StringInStr($AClipCont[$x],"address") > 0 Then
		if StringInStr($AClipCont[$x],"ssid") > 0  Then
			;we have found the start - start processing after this
			$StartProc = 1
		EndIf
	EndIf
 
Next
 
;pull ignore list
Dim $aIgnores
If Not _FileReadToArray(@ScriptDir & "\ignore-list.txt",$aIgnores) Then
   MsgBox(4096,"Error", " Error reading log to Array     error:" & @error)
   Exit
EndIf
 
;start of ssid checking
for $x = 1 to $aSSIDs[0]
	$mode = StringLeft($aSSIDs[$x],4);section that has the AP mode
	$ssid = stringstripws(StringRight($aSSIDs[$x],10),2);sets ssid
	$mac = StringMid($aSSIDs[$x],5,17);sets mac
	$ignoreIt = 0;sets ignore variable
	for $y = 1 to $aIgnores[0];loops through ignore file seeinf if we have a match
		$Imac = StringLeft($aIgnores[$y],17);sets ignore mac
		$Issid = stringstripws(StringMid($aIgnores[$y],StringInStr($aIgnores[$y],"~") + 1),2);sets ignore ssid
		if $mac == $Imac and $ssid == $Issid Then;checks for ignore
			;this is an ignore match, set it to ignore
			$ignoreIt = 1
		EndIf
	Next
	if StringInStr($mode,"p") > 0 Then ;check if AP is protected
		;this is protected
	Elseif $ignoreIt == 0 Then
		;not protected and not ignored, try it out
		_ConnectToAP();connect to ap and test
	EndIf
Next
;kill putty process we started
ProcessClose($puttyPID)
EndFunc
 
 
;--------------------------begin functions
 
func _ConnectToAP()
	;connect to AP
	;activate putty
	WinActivate($HostIP & " - PuTTY")
	WinWaitActive($HostIP & " - PuTTY")
	send("/int wire set 0 ssid="  & StringStripWS($ssid,2) & @CRLF);set the ssid
	_SleepTime(15,"ssid command")
	Send("/ip dhcp-client release 0" & @CRLF);reset client dhcp
	_SleepTime(10,"dhcp client to pull ip")
	send('/tool fetch url="http://' & $serverIP & $serverPathFile & @CRLF);attempt to pull the rogue file
	_SleepTime(10,"rogue file to download")
 
	;check status of download
	send("q" & @CRLF);send a q for quit just in case the DL needs to be cancled
	sleep(1000)
	_CopyAll()
	if StringInStr($ClipContents,"status: finished") > 0 then
		;OMG, we found a rogue...PANIC!
		;send email and then ping
		ToolTip("Rogue detected and email/ping started",0,0)
		_SendEmail()
		Send("/ping " & $serverIP & @CRLF);start pinging our rogue server
		Exit;kill the program
	EndIf
 
EndFunc
 
Func _SendEmail()
    Local $ConnectedSocket, $szData
 
    ; Start The TCP Services
    ;==============================================
    TCPStartup()
 
    ; Initialize a variable to represent a connection
    ;==============================================
    $ConnectedSocket = -1
 
    ;Attempt to connect to SERVER at its IP and PORT 33891
    ;=======================================================
    $ConnectedSocket = TCPConnect($szIPADDRESS, $nPORT)
 
    ; If there is an error... show it
    If @error Then
        MsgBox(4112, "Error", "TCPConnect failed with WSA error: " & @error)
        ; If there is no error loop an inputbox for data
        ;   to send to the SERVER.
    Else
            TCPSend($ConnectedSocket, "ehlo rogue-check.com" & @crlf)
			sleep(1500)
            TCPSend($ConnectedSocket, "helo rogue-check.com" & @crlf)
			sleep(1500)
            TCPSend($ConnectedSocket, "mail from:[email protected]" & @crlf)
			sleep(1500)
            TCPSend($ConnectedSocket, "rcpt to:" & $EmailAddress & @crlf)
			sleep(1500)
            TCPSend($ConnectedSocket, "data" & @crlf)
			sleep(1500)
			TCPSend($ConnectedSocket, "Subject:Rogue Detected on " & $HostIP & @crlf & @crlf)
			sleep(1500)
            TCPSend($ConnectedSocket, "Rogue detected from "& $HostIP & ", SSID is " & $ssid & "and MAC of AP is " & $mac & ".  Getem!" & @crlf)
			sleep(1500)
            TCPSend($ConnectedSocket, "." & @crlf)
			sleep(1000)
			TCPCloseSocket($ConnectedSocket)
 
    EndIf
EndFunc
 
Func _CopyAll()
	$ClipContents = "";clear our variable
	;activate putty
	WinActivate($HostIP & " - PuTTY")
	WinWaitActive($HostIP & " - PuTTY")
	$PuttyPos = WinGetPos($HostIP & " - PuTTY") ;get current position of putty window
 
	;start the copy process
	MouseClick("left",$PuttyPos[0] + 15, $PuttyPos[1] + 15,1,0)
	Send("{DOWN}")
	Sleep(150)
	Send("{DOWN}")
	Sleep(150)
	Send("{DOWN}")
	Sleep(150)
	Send("{DOWN}")
	Sleep(150)
	Send("{DOWN}")
	Sleep(150)
	Send("{DOWN}")
	Sleep(150)
	Send("{DOWN}")
	Sleep(150)
	Send("{DOWN}")
	Sleep(150)
	Send("{DOWN}")
	Sleep(150)
	Send("{DOWN}")
	Sleep(150)
	Send("{DOWN}")
	Sleep(150)
	Send("{DOWN}")
	Sleep(150)
	Send("{DOWN}")
	Sleep(150)
	Send("{ENTER}")
 
	$ClipContents = clipget();populate our clip variable
EndFunc
 
Func _SleepTime($SleepTime,$DescMsg)
	;this function just does the sleep timer
	while $SleepTime <> 0
		ToolTip("Sleeping " & $SleepTime & " more seconds for " & $DescMsg,0,0)
		$SleepTime = $SleepTime - 1
		Sleep(1000)
	WEnd
EndFunc