Vault7: CIA Hacking Tools Revealed

Navigation: » Latest version

Captive Portal

Summary

The following is the setup for a DNSDomain Name System server designed to trick a device to launch its captive portal window. The idea is that we want the DNSDomain Name System server to forward requests for captive.apple.com/hotspot-detect.html to mdbtest.devlan.net/captive.html. Captive.html can then forward the the device to our machine running Hamr.

Set Up

The wireless router configured for captive portal is CaptivationStation. The device can be accessed at 192.168.1.1:81 (if port 81 isn't getting you to the configuration page, try 192:168.1.1. This means that some settings have been reset and need to be fixed). The admin user name for the device is "Captive" (Note: the password is not the same as the wireless password). The router forwards all requests for captive.apple.com/hotspot-detect.html to a local hotspot-detect.html file.

Apple devices try to connect to the hotspot-detect.html file. We use this file to forward users to captive.html also on the router. Both html files are located at:

/jffs

Adding Your Machine to Captive.html

Connect to CaptivationStation and SSHSecure Shell into the router
1. ```
ssh root@192.168.1.1
```
2. password is the same one used for logging into the web configuration
vi /jffs/captive.html

add a line like the following:

<h2><a href="http://[Your IP]:8080/?id=myt">[Your Name]</a></h2>

Connecting to CaptivationStation

Connect to CaptivationStation with the password
The device should connect and launch the captive portal
Click on your machine
To get out hit "cancel" and then "Use Other Network"

** If captive portal does not open on subsequent tries, tell the device to forget the network. This is a known issue if you selected "Use Without Internet" **

Creating New Captive Portal Routers

Browse to 192.168.1.1, log into your router, and go to Administration/Backup. For a factory reset router, these are the default configurations:
1. SSID: dd-wrt (no password)
2. Configuration page username/password: admin/admin
Navigate to Administration/Backup and restore the router with this back up file: nvrambak.bin
Once the router restarts, connect to TestivationStation (the new SSIDService Set Identifier (Wireless Network) of your router)
1. Note: all passwords are the same as CaptivationStation
Browse to 192.168.1.1:81 using the username Captive and its password
Verify that the startup script in Administration/Commands is the following:
```
killall httpd
sleep 1
httpd -p 80 -h /jffs
httpd -p 81
```
1. Line 2 allows the files in /jffs to be served to the browser on port 80 (ex. 192.168.1.1/captive.html)
2. Line 3 enables you to be able to configure the router using port 81. You MUST use 192.168.1.1:81 to access the router configuration page.
Verify that the new settings have been restored by going to Services/Services and make sure DNSMasq has the following entry:
```
address=/captive.apple.com/192.168.1.1
```
In Administration/Management, enable JFFS2 (do not enable Clean JFFS2). Click Save and then Apply Settings (the page will take a few seconds to reload)
SCP hotspot-detect.html and captive.html over to /jffs on the router
```
ex. scp ~/Desktop/captive.html root@192.168.1.1:/jffs
```
Browse to 192.168.1.1/hotspot-detect.html. It should redirect you to 192.168.1.1/captive.html. If it doesn't, ssh into the router and run the 3 commands from step 5
To SSHSecure Shell into the router
1. ```
ssh root@192.168.1.1
```
2. password is the same one used for logging into the web configuration

Contact

Tor

Tails

Tips

1. Contact us if you have specific problems

2. What computer to use

3. Do not talk about your submission to others

After

1. Do not talk about your submission to others

2. Act normal

3. Remove traces of your submission

4. If you face legal action

Submit documents to WikiLeaks