Bypass 802.1x Port Security w/ Openwrt
Background
During an internal and wireless penetration I was unprepared for the port security in the environment. I had to travel internationally and the Statement of Work and Rules of Engagement did not detail the extent of the internal testing and what was to be tested. Penetration Testers know what it is like to conduct a “Penetration Test” when sales staff and client management setup the engagement. Needless to say I was upset at the delay only due to the time it would take to configure a device to bypass the port security when I only had a week onsite to conduct the testing. Luckily I had brought along my PCEngines Alix 62f (used previously in my Custom Power Pwn). I had brought it for the wireless testing as it was configured for wireless client attacks. Using the work done by Alva Lease ‘Skip’ Duckwall IV and presented at DEFCON 19 in 2011. I reconfigured the Alix to show the client how easy it is to bypass port security. Well I never want to encounter a similar situation again but I also don’t want to carry yet another device with me when traveling. Having the device be as small as possible while service multiple purposes would be ideal. That is why I’m using the GL-iNet with the Openwrt operating system for this project.
Version 2 of this tutorial builds off of version 1 but additional work is done to help you build an image that will allow you to bypass 802.1x port security without any post install customization (as shown in this previous post). Also some network recon tools are included as well.
UPDATE: 8/2/2016 – Sweet baby Jesus (I like the baby Jesus) they fixed the segmentation fault for arptables! The trunk version of Chaos Calmer has a patch that fixes it. Look for a new tutorial soon.
Obtaining Openwrt
*Note: Everything is done from the latest version of Ubuntu LTS (14.04).
For this tutorial we will work out of your home directory. We will download the latest code for Openwrt Attitude Adjustment 12.09 (AA) and a patch from the GL-iNet website. We will also need to modify two files so that we can compile the 16mb image of AA for the GL-iNet. The two files we will modify are ar71xx/image/Makefile and firmware-utils/src/mktplinkfw.c.
But first we will apply the AA patch provided by GL-iNet using the utility quilt.
Make sure your environment has the software required, including quilt.
$ sudo apt-get update
$ sudo apt-get install git-core build-essential libssl-dev subversion libncurses5-dev zlib1g-dev gawk gcc-multilib flex gettext quilt xsltproc libxml-parser-perl mercurial bzr ecj cvs unzip
To setup quilt you want a file called .quiltrc in your home directory with the following lines:
QUILT_DIFF_ARGS="--no-timestamps --no-index -pab --color=auto"
QUILT_REFRESH_ARGS="--no-timestamps --no-index -pab"
QUILT_PATCH_OPTS="--unified"
QUILT_DIFF_OPTS="-p"
EDITOR="nano"
How you accomplish this is up to you. Open gedit and paste, open vim and paste, or do the following from the command line.
$ echo -e QUILT_DIFF_ARGS="--no-timestamps --no-index -pab --color=auto"'\n'QUILT_REFRESH_ARGS="--no-timestamps --no-index -pab"'\n'QUILT_PATCH_OPTS="--unified"'\n'QUILT_DIFF_OPTS="-p"'\n'EDITOR="nano" > ~/.quiltrc
Move to your home directory obtain AA, update and download the package source files, and patch it using quilt.
$ cd ~/
$ git clone git://git.openwrt.org/12.09/openwrt.git attitude_adjustment
$ cd attitude_adjustment
~/attitude_adjustment$ mkdir patches
~/attitude_adjustment$ echo 01-gl-inetAA16MiB.patch > patches/series
~/attitude_adjustment$ git clone https://github.com/smrx86/gl-inet.git smrx86
~/attitude_adjustment$ cp smrx86/patches/01-gl-inetAA16MiB.patch patches
~/attitude_adjustment$ echo 01-gl-inetAA16MiB.patch >> patches/series
~/attitude_adjustment$ quilt push -a
Download and install all available “feeds”, create our configuration file to build what we need.
$ cd ~/attitude_adjustment
~/attitude_adjustment$ ./scripts/feeds update -a
~/attitude_adjustment$ ./scripts/feeds install -a
~/attitude_adjustment$ cd package
~/attitude_adjustment/package$ git clone git://git.openwrt.org/12.09/packages.git
~/attitude_adjustment/package$ cd ..
~/attitude_adjustment$ make menuconfig
Go forth and select all of these packages to be included in the image and not as a modules (asterisk (*) instead of (M)).
Network —> (mii-tool & tcpdump)
Network —>Firewall (arptables & ebtables)
Network —>Firewall—>iptables (iptables-mod-conntrack-extra, iptables-mod-extra, iptables-mod-filter, iptables-mod-iface, iptables-mod-ipopt, iptables-mod-ipset, iptables-mod-ipv4options, iptables-mod-nat-extra, iptables-mod-rawnat, iptables-mod-tee)
Kernel modules —>Netfilter Extensions (kmod-arptables, kmod-ebtables, kmod-ebtables-ipv4, kmod-ebtables-ipv6)
Kernel modules —>Network Support (kmod-bridge, kmod-llc, kmod-stp)
Libraries —>(libpcap,wireless-tools)
Base system —>busybox Networking Utilities —>arp
Kernel modules —>Filesystems (kmod-fs-ext4, kmod-fs-ntfs & kmod-fs-vfat)
Kernel modules —>USB Support (kmod-usb-ohci, kmod-usb-uhci, kmod-usb2, kmod-usb-storage, kmod-usb-storage-extras)
Kernel modules —>Native Language Support (kmod-nls-cp437, kmod-nls-base & kmod-nls-iso8859-1)
“Hacker” Tools
Network —>NMAP Suite (ncat-ssl,ndiff,nmap-ssl,nping)
Network —>wireless (aircrack-ng,aircrack-ptw,kismet-client,kismet-server,reaver)
Libraries —>(libcap,libncurses,libnl,libpcre,terminfo,uclibcxx,zlib)
Libraries —>SSL (libopenssl)
Base system —>(libstdcpp)
Custom Files
The best place to learn about adding custom files to your image build is the OpenWrt Wiki, specifically here.
Create Directories to Store Out Custom Files
$ mkdir -p ~/attitude_adjustment/files/etc/init.d
$ mkdir -p ~/attitude_adjustment/files/etc/config
$ mkdir -p ~/attitude_adjustment/files/etc/rc.d
Custom Wireless Configuration Files
$ vim ~/attitude_adjustment/files/etc/config/wireless
config wifi-device radio0
option type mac80211
option channel 11
option hwmode 11ng
option path 'platform/ar933x_wmac'
option htmode HT20
list ht_capab SHORT-GI-20
list ht_capab SHORT-GI-40
list ht_capab RX-STBC1
list ht_capab DSSS_CCK-40config wifi-iface
option device radio0
option network lan
option mode ap
option ssid att-wifi #or whatever you want to call it
option encryption psk2
option key ‘mysupersecretPassWord’
option hidden 1
Custom Network Configuration Files
$ vim ~/attitude_adjustment/files/etc/config/network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
Custom System Configuration Files
$ vim ~/attitude_adjustment/files/etc/config/system
config system
option hostname GLiNet #or whatever you want to call it
option timezone UTC
Custom System Control Configuration File
$ vim ~/attitude_adjustment/files/etc/sysctl.conf
kernel.panic=3
net.ipv4.conf.default.arp_ignore=1
net.ipv4.conf.all.arp_ignore=1
net.ipv4.ip_forward=1
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.icmp_ignore_bogus_error_responses=1
net.ipv4.tcp_ecn=0
net.ipv4.tcp_fin_timeout=30
net.ipv4.tcp_keepalive_time=120
net.ipv4.tcp_syncookies=1
net.ipv4.tcp_timestamps=1
net.ipv4.tcp_sack=1
net.ipv4.tcp_dsack=1net.ipv6.conf.default.forwarding=1
net.ipv6.conf.all.forwarding=1
net.netfilter.nf_conntrack_acct=1
net.netfilter.nf_conntrack_checksum=0
net.netfilter.nf_conntrack_max=16384
net.netfilter.nf_conntrack_tcp_timeout_established=3600
net.netfilter.nf_conntrack_udp_timeout=60
net.netfilter.nf_conntrack_udp_timeout_stream=180
There are four files in the tarball and it is just easier to provide the files then figure out how to disable some of this shit in OpenWrt. Included in the tarball is the bridge script you will need to create the transparent bridge. But also included are dnsmasq, firewall, sysntpd, dropbear, and telnet files with permissions where execution is removed. Best way to disable them without removing them.
$ cd ~/attitude_adjustment/files/etc/
~/attitude_adjustment/files/etc$ wget http://www.jedge.com/code/glinet.openwrt.init.d.build.tar.gz
tar xzvf glinet.openwrt.init.d.build.tar.gz
Create a symlink for the bridge script so it will start when the device boots.
$ cd ~/attitude_adjustment/files/etc/rc.d
~/attitude_adjustment/files/etc/rc.d$ ln -s ../init.d/bridge S90bridge
~/attitude_adjustment/files/etc/rc.d$ ln -s ../init.d/bridge K95bridge
Why set your root password after the first boot? Why not set it in your image before you install it?
echo "yoursecret" | makepasswd --clearfrom=- --crypt-md5 |awk '{print $2}'
$1$uZ9fJ7OE$A8KGOGcOR4fP3/XEsxQaa0$ vim ~/attitude_adjustment/files/etc/shadow
root:$1$uZ9fJ7OE$A8KGOGcOR4fP3/XEsxQaa0:0:0:99999:7:::
daemon:*:0:0:99999:7:::
ftp:*:0:0:99999:7:::
network:*:0:0:99999:7:::
nobody:*:0:0:99999:7:::
Now we can compile our image. Once complete your image will be find in ~/attitude_adjustment/bin/ar71xx called openwrt-ar71xx-generic-gl-inet-6416A-v1-squashfs-factory.bin
cd ~/attitude_adjustment
~/attitude_adjustment$ makeDocumenting how to upgrade (or downgrade) the firmware of your GL-iNet is tricky as I don’t know the state of your device so we are going to use a method I’m sure you haven’t messed with. We are going to use the U-boot Web Method of upgrading. You will need to pry open your GL-iNet and connect a serial to USB adapter as documented from the GL-iNet website. Visit the two links below.
http://www.gl-inet.com/docs/smartrouter/?diy_hardware.html
http://www.gl-inet.com/docs/smartrouter/?diy_serial.html
Then boot your device and enter the web failsafe mode following the directions also found on the GL-iNet website.
http://www.gl-inet.com/docs/smartrouter/?diy_flashing.html
Connect to your USB serial device and then plug in your GL-iNet. Immediately hit the “F” key to enter the U-boot mode and enter httpd to start the failsafe web server. We will need to connect to the WAN port and assign an IP address in the 192.168.1.0/24 range, open a web browser, and go to http://192.168.1.1
From the web interface upload the firmware you compiled. It should be called openwrt-ar71xx-generic-gl-inet-6416A-v1-squashfs-factory.bin.
References
A Bridge Too Far Defeating Wired 802.1X with a Transparent Bridge Using Linux by Alva Lease ‘Skip’ Duckwall IV
Presentation Slides: https://www.defcon.org/images/defcon-19/dc-19-presentations/Duckwall/DEFCON-19-Duckwall-Bridge-Too-Far.pdf
Presentation (Youtube): http://youtu.be/u3T3lUxKm18
Issue discussing the use of ebtables and packets not being forwarded up the IP chain. The reason we had to re-enable bridged firewalling in Openwrt. http://stackoverflow.com/questions/17116126/iptables-ebtables-bridge-utils-prerouting-forward-to-another-server-via-single
Also mentioned in getting SSLStrip to work in a hak5.org forum. https://forums.hak5.org/index.php?/topic/26780-guide-for-installing-sslstrip-on-openwrt/
