{"id":3228,"date":"2011-10-14T14:00:39","date_gmt":"2011-10-14T20:00:39","guid":{"rendered":"http:\/\/gregsowell.com\/?p=3228"},"modified":"2011-10-20T08:49:33","modified_gmt":"2011-10-20T14:49:33","slug":"rogue-access-point-detectionmitigation","status":"publish","type":"post","link":"https:\/\/gregsowell.com\/?p=3228","title":{"rendered":"Rogue Access Point Detection\/Mitigation"},"content":{"rendered":"<p>This is the article relating to my 2011 MUM presentation.<\/p>\n<p>I was trying to think of something fun and different for this year&#8217;s MUM, so I came up with rogue access point detection\/mitigation.  The project surrounds having a Mikrotik probe connect to any open access points it can find.  It then trys to access a resource that exists only inside your LAN.  In this case the resource is a special web page.  It then alerts you and allows you to track them down.  Watch the video below for the full presentation:  This is an iframe from the <a href=\"http:\/\/www.tiktube.com\/?video=LmeD3jqocmnIpCHEnqKxDqEvmlnoEFoo=\">tiktube page<\/a>.<\/p>\n<p><iframe loading=\"lazy\" src=\"http:\/\/www.tiktube.com\/?video=LmeD3jqocmnIpCHEnqKxDqEvmlnoEFoo=\" width=\"600\" height=\"1350\"><\/iframe><\/p>\n<h2>Config Files<\/h2>\n<p><strong>ignore-list.txt<\/strong><\/p>\n<pre class=\"gs-code\"><code class=\"language-plaintext\">#MAC address~SSID\r\n#00:12:17:DA:09:2G~linksys<\/code><\/pre>\n<p>This file lists the MAC address followed by the ~ symbol and finally the SSID.<br \/>\nThis holds any APs that should be ignored from processing.<\/p>\n<p><strong>probes.txt<\/strong><\/p>\n<pre class=\"gs-code\"><code class=\"language-plaintext\">#192.168.88.1~user1~user1<\/code><\/pre>\n<p>This file holds the connection information for our Mikrotik probes we will be testing with.<br \/>\nIP address of probe, then ~, then username, then ~ and finally password.<\/p>\n<p><strong>settings.txt<\/strong><\/p>\n<pre class=\"gs-code\"><code class=\"language-plaintext\">#duraction to run the scan for in seconds\r\n15\r\n#IP of server to pull the rogue page from\r\n192.168.1.2\r\n#path to the rogue file \/index.html\r\n\/rogue.html\r\n#email address to send alerts to.  Some smtp servers require &lt;&gt; around email addresses.\r\nMyEmail@Address.com\r\n#IP of mail server to relay through\r\n127.0.0.1\r\n#port of smtp server\r\n25<\/code><\/pre>\n<p>This file holds the general settings for the program.<br \/>\nDuration is how long the probe will scan for open APs.<br \/>\n&#8220;IP of server to pull&#8221; is the IP address of the &#8220;internal only&#8221; web server we will be trying to get the HML page from.<br \/>\n&#8220;path&#8221; will be the full http path to append to the IP address listed above.<br \/>\nMyEmail@Address.com should be replaced by your email address.<br \/>\nRelay server IP should be that of your mail relay.<br \/>\nPort is the SMTP port to use.<\/p>\n<h2>Binary<\/h2>\n<p>Here&#8217;s the download of the compiled exe, source, and config files: <div class=\"wp-block-button\">\n<a  data-e-Disable-Page-Transition=\"true\" class=\"dlm-download-link dlm-download-default wp-block-button__link wp-element-button\" title=\"\" href=\"https:\/\/gregsowell.com?download=5707&amp;tmstv=1784648170\" rel=\"nofollow\" id=\"download-link-5707\" data-redirect=\"false\" >\n\tMTKRogue.zip\t(1712 downloads\t)\n<\/a>\n<\/div>\n<\/p>\n<h2>Source<\/h2>\n<p>Current Source code:<\/p>\n<pre class=\"gs-code\"><code class=\"language-plaintext\">#Region ;**** Directives created by AutoIt3Wrapper_GUI ****\r\n#AutoIt3Wrapper_UseX64=n\r\n#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****\r\n#cs ----------------------------------------------------------------------------\r\n\r\n AutoIt Version: 3.3.6.1\r\n Author:         Greg Sowell\r\n\r\n Script Function:\r\n\tThis script controls putty to connect to mikrotik APs and check for rogues on your network.\r\n\r\n#ce ----------------------------------------------------------------------------\r\n\r\n; Script Start - Add your code below here\r\n;autioit includes\r\n#include &lt;file.au3&gt;\r\n#include &lt;Array.au3&gt;\r\n\r\n;open the settings file\r\nDim $aSettings\r\nIf Not _FileReadToArray(@ScriptDir &amp; &quot;\\settings.txt&quot;,$aSettings) Then\r\n   MsgBox(4096,&quot;Error&quot;, &quot; Error reading log to Array     error:&quot; &amp; @error)\r\n   Exit\r\nEndIf\r\n\r\n;set variables\r\n$Duration = $aSettings[2];duration to do the scan\r\n$serverIP = $aSettings[4];ip address of the webserver\r\n$serverPathFile = $aSettings[6] &amp; &quot;&quot;&quot;&quot;;path to check file\r\n$EmailAddress = $aSettings[8];email address variable\r\n$szIPADDRESS = $aSettings[10];;email server IP address\r\n$nPORT = $aSettings[12];25 ;email server port\r\n$ClipContents = &quot;&quot; ;setup clipboard variable\r\n$waiting = 0 ;variable for time checking\r\n$HostIP = &quot;&quot;\r\n$userN = &quot;&quot;\r\n$passW = &quot;&quot;\r\n$ssid = &quot;&quot;\r\n$mac = &quot;&quot;\r\n$puttyPID = &quot;&quot;\r\n;#cs ----------------------------------------------------------------------------\r\n\r\n;open hosts file\r\nDim $aHosts\r\nIf Not _FileReadToArray(@ScriptDir &amp; &quot;\\probes.txt&quot;,$aHosts) Then\r\n   MsgBox(4096,&quot;Error&quot;, &quot; Error reading log to Array     error:&quot; &amp; @error)\r\n   Exit\r\nEndIf\r\n\r\n;main program loop.  Loop through each host.\r\nfor $h = 1 to $aHosts[0]\r\n\tif StringInStr(&quot;---&quot; &amp; $aHosts[$h],&quot;#&quot;) &lt; 1 Then\r\n\t\t;not a comment, lets go!!!\r\n\t\t;run the host processing function\r\n\t\t_RunHost()\r\n\tEndIf\r\nNext\r\n\r\n;host processing function\r\nFunc _RunHost()\r\n$HostIP = StringLeft($aHosts[$h],StringInStr($aHosts[$h],&quot;~&quot;) - 1);pull host IP\r\n$userN = StringMid($aHosts[$h],StringInStr($aHosts[$h],&quot;~&quot;) + 1,StringInStr($aHosts[$h],&quot;~&quot;,0,2) - StringInStr($aHosts[$h],&quot;~&quot;) - 1);Host username\r\n$passW =StringMid($aHosts[$h],StringInStr($aHosts[$h],&quot;~&quot;,0,2) + 1);host password\r\n$puttyPID = run(@ScriptDir &amp; &quot;\\putty.exe -ssh -l &quot; &amp; $userN &amp; &quot; -pw &quot; &amp; $passW &amp; &quot; &quot; &amp; $HostIP);open putty\r\n\r\n;do a check cycle of 10 seconds for putty to start\r\nwhile $waiting &lt;&gt; 10\r\n\tIf ProcessExists(&quot;putty.exe&quot;) Then\r\n\t\t$waiting = 100\r\n\t\tExitLoop\r\n\tEndIf\r\n\tsleep(1000)\r\nWEnd\r\n\r\n;check if putty process was found\r\nif $waiting = 10 Then\r\n\tMsgBox(0,&quot;putty didn&#039;t run&quot;, &quot;Sorry, but putty didn&#039;t open&quot;)\r\n\tExit\r\nEndIf\r\n\r\n_SleepTime(5,&quot;putty&quot;);wait 5 seconds for putty to connect and settle\r\n\r\n;activate putty\r\nWinActivate($HostIP &amp; &quot; - PuTTY&quot;)\r\nWinWaitActive($HostIP &amp; &quot; - PuTTY&quot;)\r\n\r\n;send the command to start the scan\r\nSend(&quot;\/int wire scan wlan1 duration=&quot; &amp; $Duration &amp; @CRLF)\r\n\r\n_SleepTime($Duration + 2,&quot;scan command&quot;) ;sleep for 2 seconds longer than duration\r\n\r\n_CopyAll() ;copy everything to clipboard\r\n\r\n;delete the existing temp file\r\nFileDelete(@ScriptDir &amp; &quot;\\cliptemp.txt&quot;)\r\n;write clip contents to a temp file\r\n$AClip = FileOpen(@ScriptDir &amp; &quot;\\cliptemp.txt&quot;, 1)\r\n\r\n; Check if file opened for writing OK\r\nIf $AClip = -1 Then\r\n    MsgBox(0, &quot;Error&quot;, &quot;Unable to open file.&quot;)\r\n    Exit\r\nEndIf\r\nFileWriteLine($AClip, $ClipContents)\r\n\r\nFileClose($AClip)\r\n;#ce ----------------------------------------------------------------------------\r\n\r\n;read contents of temp file into an array\r\nDim $AClipCont\r\nIf Not _FileReadToArray(@ScriptDir &amp; &quot;\\cliptemp.txt&quot;,$AClipCont) Then\r\n   MsgBox(4096,&quot;Error&quot;, &quot; Error reading log to Array     error:&quot; &amp; @error)\r\n   Exit\r\nEndIf\r\n\r\nlocal $aSSIDs[1];setup ssid array\r\n$aSSIDs[0] = 0;set the counter to 0\r\n$StartProc = 0 ;processing variable\r\n;start processing the array\r\nFor $x = 1 to $AClipCont[0] - 2\r\n\t;check if the ssid section has been found\r\n\tif $StartProc == 1 Then\r\n\t\t; we need to process the lines here\r\n\t\t$BldStrng = StringLeft($AClipCont[$x],3) &amp; &quot;~&quot;\r\n\t\t$BldStrng = $BldStrng &amp; stringmid($AClipCont[$x],7,17) &amp; &quot;~&quot;\r\n\t\t$BldStrng = $BldStrng &amp; stringmid($AClipCont[$x],25,10)\r\n\t\t_ArrayAdd($aSSIDs,$BldStrng)\r\n\t\t$aSSIDs[0] = $aSSIDs[0] + 1\r\n\r\n\tEndIf\r\n\r\n\t;find the line just before scan starts\r\n\tif StringInStr($AClipCont[$x],&quot;address&quot;) &gt; 0 Then\r\n\t\tif StringInStr($AClipCont[$x],&quot;ssid&quot;) &gt; 0  Then\r\n\t\t\t;we have found the start - start processing after this\r\n\t\t\t$StartProc = 1\r\n\t\tEndIf\r\n\tEndIf\r\n\r\nNext\r\n\r\n;pull ignore list\r\nDim $aIgnores\r\nIf Not _FileReadToArray(@ScriptDir &amp; &quot;\\ignore-list.txt&quot;,$aIgnores) Then\r\n   MsgBox(4096,&quot;Error&quot;, &quot; Error reading log to Array     error:&quot; &amp; @error)\r\n   Exit\r\nEndIf\r\n\r\n;start of ssid checking\r\nfor $x = 1 to $aSSIDs[0]\r\n\t$mode = StringLeft($aSSIDs[$x],4);section that has the AP mode\r\n\t$ssid = stringstripws(StringRight($aSSIDs[$x],10),2);sets ssid\r\n\t$mac = StringMid($aSSIDs[$x],5,17);sets mac\r\n\t$ignoreIt = 0;sets ignore variable\r\n\tfor $y = 1 to $aIgnores[0];loops through ignore file seeinf if we have a match\r\n\t\t$Imac = StringLeft($aIgnores[$y],17);sets ignore mac\r\n\t\t$Issid = stringstripws(StringMid($aIgnores[$y],StringInStr($aIgnores[$y],&quot;~&quot;) + 1),2);sets ignore ssid\r\n\t\tif $mac == $Imac and $ssid == $Issid Then;checks for ignore\r\n\t\t\t;this is an ignore match, set it to ignore\r\n\t\t\t$ignoreIt = 1\r\n\t\tEndIf\r\n\tNext\r\n\tif StringInStr($mode,&quot;p&quot;) &gt; 0 Then ;check if AP is protected\r\n\t\t;this is protected\r\n\tElseif $ignoreIt == 0 Then\r\n\t\t;not protected and not ignored, try it out\r\n\t\t_ConnectToAP();connect to ap and test\r\n\tEndIf\r\nNext\r\n;kill putty process we started\r\nProcessClose($puttyPID)\r\nEndFunc\r\n\r\n\r\n;--------------------------begin functions\r\n\r\nfunc _ConnectToAP()\r\n\t;connect to AP\r\n\t;activate putty\r\n\tWinActivate($HostIP &amp; &quot; - PuTTY&quot;)\r\n\tWinWaitActive($HostIP &amp; &quot; - PuTTY&quot;)\r\n\tsend(&quot;\/int wire set 0 ssid=&quot;  &amp; StringStripWS($ssid,2) &amp; @CRLF);set the ssid\r\n\t_SleepTime(15,&quot;ssid command&quot;)\r\n\tSend(&quot;\/ip dhcp-client release 0&quot; &amp; @CRLF);reset client dhcp\r\n\t_SleepTime(10,&quot;dhcp client to pull ip&quot;)\r\n\tsend(&#039;\/tool fetch url=&quot;http:\/\/&#039; &amp; $serverIP &amp; $serverPathFile &amp; @CRLF);attempt to pull the rogue file\r\n\t_SleepTime(10,&quot;rogue file to download&quot;)\r\n\r\n\t;check status of download\r\n\tsend(&quot;q&quot; &amp; @CRLF);send a q for quit just in case the DL needs to be cancled\r\n\tsleep(1000)\r\n\t_CopyAll()\r\n\tif StringInStr($ClipContents,&quot;status: finished&quot;) &gt; 0 then\r\n\t\t;OMG, we found a rogue...PANIC!\r\n\t\t;send email and then ping\r\n\t\tToolTip(&quot;Rogue detected and email\/ping started&quot;,0,0)\r\n\t\t_SendEmail()\r\n\t\tSend(&quot;\/ping &quot; &amp; $serverIP &amp; @CRLF);start pinging our rogue server\r\n\t\tExit;kill the program\r\n\tEndIf\r\n\r\nEndFunc\r\n\r\nFunc _SendEmail()\r\n    Local $ConnectedSocket, $szData\r\n\r\n    ; Start The TCP Services\r\n    ;==============================================\r\n    TCPStartup()\r\n\r\n    ; Initialize a variable to represent a connection\r\n    ;==============================================\r\n    $ConnectedSocket = -1\r\n\r\n    ;Attempt to connect to SERVER at its IP and PORT 33891\r\n    ;=======================================================\r\n    $ConnectedSocket = TCPConnect($szIPADDRESS, $nPORT)\r\n\r\n    ; If there is an error... show it\r\n    If @error Then\r\n        MsgBox(4112, &quot;Error&quot;, &quot;TCPConnect failed with WSA error: &quot; &amp; @error)\r\n        ; If there is no error loop an inputbox for data\r\n        ;   to send to the SERVER.\r\n    Else\r\n            TCPSend($ConnectedSocket, &quot;ehlo rogue-check.com&quot; &amp; @crlf)\r\n\t\t\tsleep(1500)\r\n            TCPSend($ConnectedSocket, &quot;helo rogue-check.com&quot; &amp; @crlf)\r\n\t\t\tsleep(1500)\r\n            TCPSend($ConnectedSocket, &quot;mail from:ISeeYou@rogue-check.com&quot; &amp; @crlf)\r\n\t\t\tsleep(1500)\r\n            TCPSend($ConnectedSocket, &quot;rcpt to:&quot; &amp; $EmailAddress &amp; @crlf)\r\n\t\t\tsleep(1500)\r\n            TCPSend($ConnectedSocket, &quot;data&quot; &amp; @crlf)\r\n\t\t\tsleep(1500)\r\n\t\t\tTCPSend($ConnectedSocket, &quot;Subject:Rogue Detected on &quot; &amp; $HostIP &amp; @crlf &amp; @crlf)\r\n\t\t\tsleep(1500)\r\n            TCPSend($ConnectedSocket, &quot;Rogue detected from &quot;&amp; $HostIP &amp; &quot;, SSID is &quot; &amp; $ssid &amp; &quot;and MAC of AP is &quot; &amp; $mac &amp; &quot;.  Getem!&quot; &amp; @crlf)\r\n\t\t\tsleep(1500)\r\n            TCPSend($ConnectedSocket, &quot;.&quot; &amp; @crlf)\r\n\t\t\tsleep(1000)\r\n\t\t\tTCPCloseSocket($ConnectedSocket)\r\n\r\n    EndIf\r\nEndFunc\r\n\r\nFunc _CopyAll()\r\n\t$ClipContents = &quot;&quot;;clear our variable\r\n\t;activate putty\r\n\tWinActivate($HostIP &amp; &quot; - PuTTY&quot;)\r\n\tWinWaitActive($HostIP &amp; &quot; - PuTTY&quot;)\r\n\t$PuttyPos = WinGetPos($HostIP &amp; &quot; - PuTTY&quot;) ;get current position of putty window\r\n\r\n\t;start the copy process\r\n\tMouseClick(&quot;left&quot;,$PuttyPos[0] + 15, $PuttyPos[1] + 15,1,0)\r\n\tSend(&quot;{DOWN}&quot;)\r\n\tSleep(150)\r\n\tSend(&quot;{DOWN}&quot;)\r\n\tSleep(150)\r\n\tSend(&quot;{DOWN}&quot;)\r\n\tSleep(150)\r\n\tSend(&quot;{DOWN}&quot;)\r\n\tSleep(150)\r\n\tSend(&quot;{DOWN}&quot;)\r\n\tSleep(150)\r\n\tSend(&quot;{DOWN}&quot;)\r\n\tSleep(150)\r\n\tSend(&quot;{DOWN}&quot;)\r\n\tSleep(150)\r\n\tSend(&quot;{DOWN}&quot;)\r\n\tSleep(150)\r\n\tSend(&quot;{DOWN}&quot;)\r\n\tSleep(150)\r\n\tSend(&quot;{DOWN}&quot;)\r\n\tSleep(150)\r\n\tSend(&quot;{DOWN}&quot;)\r\n\tSleep(150)\r\n\tSend(&quot;{DOWN}&quot;)\r\n\tSleep(150)\r\n\tSend(&quot;{DOWN}&quot;)\r\n\tSleep(150)\r\n\tSend(&quot;{ENTER}&quot;)\r\n\r\n\t$ClipContents = clipget();populate our clip variable\r\nEndFunc\r\n\r\nFunc _SleepTime($SleepTime,$DescMsg)\r\n\t;this function just does the sleep timer\r\n\twhile $SleepTime &lt;&gt; 0\r\n\t\tToolTip(&quot;Sleeping &quot; &amp; $SleepTime &amp; &quot; more seconds for &quot; &amp; $DescMsg,0,0)\r\n\t\t$SleepTime = $SleepTime - 1\r\n\t\tSleep(1000)\r\n\tWEnd\r\nEndFunc<\/code><\/pre>\n<p>*********************************************************<br \/>\nUPDATE<br \/>\n*********************************************************<br \/>\nI&#8217;ve always wanted to be on <a href=\"http:\/\/en.wikipedia.org\/wiki\/Rogue_access_point#External_links\">wikipedia<\/a>&#8230;so I took this opportunity to add myself.<br \/>\n<a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2011\/10\/wikipedia.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2011\/10\/wikipedia.png\" alt=\"\" title=\"wikipedia\" width=\"704\" height=\"145\" class=\"aligncenter size-full wp-image-3260\" srcset=\"https:\/\/gregsowell.com\/wp-content\/uploads\/2011\/10\/wikipedia.png 704w, https:\/\/gregsowell.com\/wp-content\/uploads\/2011\/10\/wikipedia-300x61.png 300w\" sizes=\"auto, (max-width: 704px) 100vw, 704px\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This is the article relating to my 2011 MUM presentation. I was trying to think of something fun and different for this year&#8217;s MUM,\u2026<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[28,6,8,24,13,15],"tags":[],"class_list":["post-3228","post","type-post","status-publish","format-standard","hentry","category-fun","category-mikrotik","category-networking","category-security","category-server","category-windows"],"_links":{"self":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/3228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3228"}],"version-history":[{"count":26,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/3228\/revisions"}],"predecessor-version":[{"id":3241,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/3228\/revisions\/3241"}],"wp:attachment":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}