Merge branch 'master' of https://github.com/krebscode/painload

15 files changed, 264 insertions, 0 deletions

diff --git a/minikrebs/profiles/rickroller/custom_make b/minikrebs/profiles/rickroller/custom_make
new file mode 100755
index 00000000..c22348b1
--- /dev/null
+++ b/minikrebs/profiles/rickroller/custom_make
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+#HTTPD="mini-httpd"
+HTTPD="uhttpd"
+make image PROFILE=TLWR703 PACKAGES="$HTTPD dnsmasq wireless-tools -radvd -kmod-ppp -kmod-pppoe -kmod-pppox -ppp -ppp-mod-pppoe" FILES=customfiles/
diff --git a/minikrebs/profiles/rickroller/customfiles/etc/config/dhcp b/minikrebs/profiles/rickroller/customfiles/etc/config/dhcp
new file mode 100644
index 00000000..b058f08f
--- /dev/null
+++ b/minikrebs/profiles/rickroller/customfiles/etc/config/dhcp
@@ -0,0 +1,25 @@
+config dnsmasq
+    option domainneeded 1
+    option boguspriv    1
+    option filterwin2k  0  # enable for dial on demand
+    option localise_queries 1
+    option rebind_protection 1  # disable if upstream must serve RFC191
+8 addresses
+    option rebind_localhost 1  # enable for RBL checking and similar se
+rvices
+    #list rebind_domain example.lan  # whitelist RFC1918 responses for 
+domains
+    option local    '/lan/'
+    option domain   'lan'
+    option expandhosts  1
+    option nonegcache   0
+    option authoritative    1
+    option readethers   1
+    option leasefile    '/tmp/dhcp.leases'
+    option resolvfile   '/tmp/resolv.conf.auto'
+
+config dhcp wlan
+    option interface    lan
+    option start    100
+    option limit    150
+    option leasetime    12h
diff --git a/minikrebs/profiles/rickroller/customfiles/etc/config/firewall b/minikrebs/profiles/rickroller/customfiles/etc/config/firewall
new file mode 100644
index 00000000..6e95b5cd
--- /dev/null
+++ b/minikrebs/profiles/rickroller/customfiles/etc/config/firewall
@@ -0,0 +1,110 @@
+config defaults
+    option syn_flood    1
+    option input        ACCEPT
+    option output       ACCEPT
+    option forward      REJECT
+
+config zone
+    option name     lan
+    option network      'lan'
+    option input        ACCEPT
+    option output       ACCEPT
+    option forward      REJECT
+
+config zone
+    option name     wan
+    option network      'wan'
+    option input        ACCEPT
+    option output       ACCEPT
+    option forward      REJECT
+    option masq     1
+    option mtu_fix      1
+
+config forwarding
+    option src      lan
+    option dest     wan
+
+# We need to accept udp packets on port 68,
+# see https://dev.openwrt.org/ticket/4108
+config rule
+    option name     Allow-DHCP-Renew
+    option src      wan
+    option proto        udp
+    option dest_port    68
+    option target       ACCEPT
+    option family       ipv4
+
+# Allow IPv4 ping
+config rule
+    option name     Allow-Ping
+    option src      wan
+    option proto        icmp
+    option icmp_type    echo-request
+    option family       ipv4
+    option target       ACCEPT
+
+# Allow DHCPv6 replies
+# see https://dev.openwrt.org/ticket/10381
+config rule
+    option name     Allow-DHCPv6
+    option src      wan
+    option proto        udp
+    option src_ip       fe80::/10
+    option src_port     547
+    option dest_ip      fe80::/10
+    option dest_port    546
+    option family       ipv6
+    option target       ACCEPT
+
+# Allow essential incoming IPv6 ICMP traffic
+config rule
+    option name     Allow-ICMPv6-Input
+    option src      wan
+    option proto    icmp
+    list icmp_type      echo-request
+    list icmp_type      echo-reply
+    list icmp_type      destination-unreachable
+    list icmp_type      packet-too-big
+    list icmp_type      time-exceeded
+    list icmp_type      bad-header
+    list icmp_type      unknown-header-type
+    list icmp_type      router-solicitation
+    list icmp_type      neighbour-solicitation
+    list icmp_type      router-advertisement
+    list icmp_type      neighbour-advertisement
+    option limit        1000/sec
+    option family       ipv6
+    option target       ACCEPT
+
+# Allow essential forwarded IPv6 ICMP traffic
+config rule
+    option name     Allow-ICMPv6-Forward
+    option src      wan
+    option dest     *
+    option proto        icmp
+    list icmp_type      echo-request
+    list icmp_type      echo-reply
+    list icmp_type      destination-unreachable
+    list icmp_type      packet-too-big
+    list icmp_type      time-exceeded
+    list icmp_type      bad-header
+    list icmp_type      unknown-header-type
+    option limit        1000/sec
+    option family       ipv6
+    option target       ACCEPT
+    
+# does not seem to work for some reason:    
+#config redirect
+#    option src      lan
+#    option proto        tcp
+#    option src_dport    80
+#    option dest_port    80
+
+config redirect
+    option src      lan
+    option proto        tcp
+    option src_dport    80
+    option src_ip           !192.168.23.1
+    option dest_port    80
+    option dest_ip      192.168.23.1
+    option target       DNAT
diff --git a/minikrebs/profiles/rickroller/customfiles/etc/config/network b/minikrebs/profiles/rickroller/customfiles/etc/config/network
new file mode 100644
index 00000000..7ac322a7
--- /dev/null
+++ b/minikrebs/profiles/rickroller/customfiles/etc/config/network
@@ -0,0 +1,15 @@
+config interface 'loopback'
+	option ifname 'lo'
+	option proto 'static'
+	option ipaddr '127.0.0.1'
+	option netmask '255.0.0.0'
+
+config interface 'wan'
+	option ifname 'eth0'
+	option proto 'dhcp'
+
+config interface 'lan'
+    option ifname 'wlan0'
+    option proto 'static'
+    option ipaddr 192.168.23.1
+    option netmask 255.255.255.0
diff --git a/minikrebs/profiles/rickroller/customfiles/etc/config/system b/minikrebs/profiles/rickroller/customfiles/etc/config/system
new file mode 100644
index 00000000..55aeb7aa
--- /dev/null
+++ b/minikrebs/profiles/rickroller/customfiles/etc/config/system
@@ -0,0 +1,11 @@
+config system
+        option hostname rickroller
+        option timezone UTC
+
+config 'led' 'lan_led' 
+    option 'name' 'LAN' 
+    option 'sysfs' 'tp-link:blue:system' 
+    option 'trigger' 'netdev' 
+    option 'dev' 'eth0' 
+    option 'mode' 'link tx rx'
+
diff --git a/minikrebs/profiles/rickroller/customfiles/etc/config/uhttpd b/minikrebs/profiles/rickroller/customfiles/etc/config/uhttpd
new file mode 100644
index 00000000..0767269b
--- /dev/null
+++ b/minikrebs/profiles/rickroller/customfiles/etc/config/uhttpd
@@ -0,0 +1,26 @@
+config uhttpd main
+    list listen_http    0.0.0.0:80
+    list listen_https   0.0.0.0:443
+    option home     /www
+    option rfc1918_filter 1
+    option max_requests 3
+    option cert     /etc/uhttpd.crt
+    option key      /etc/uhttpd.key
+    option cgi_prefix   /cgi-bin
+    option script_timeout   60
+    option network_timeout  30
+    option tcp_keepalive    1
+    option error_page   /index.html
+
+# Certificate defaults for px5g key generator
+config cert px5g
+
+    option days     730
+
+    option bits     1024
+
+    option country      DE
+    option state        shackspace
+    option location     shackspace
+
+    option commonname   krebs-rickroller
diff --git a/minikrebs/profiles/rickroller/customfiles/etc/config/wireless b/minikrebs/profiles/rickroller/customfiles/etc/config/wireless
new file mode 100644
index 00000000..bce01a9e
--- /dev/null
+++ b/minikrebs/profiles/rickroller/customfiles/etc/config/wireless
@@ -0,0 +1,19 @@
+config wifi-device  radio0
+    option type     mac80211
+    option channel  11
+    option macaddr  14:e6:e4:e6:e4:e0
+    option hwmode   11ng
+    option htmode   HT20
+    list ht_capab   SHORT-GI-20
+    list ht_capab   SHORT-GI-40
+    list ht_capab   RX-STBC1
+    list ht_capab   DSSS_CCK-40
+    # REMOVE THIS LINE TO ENABLE WIFI:
+    option disabled 0
+
+config wifi-iface
+    option device   radio0
+    option network  lan
+    option mode     ap
+    option ssid     default
+    option encryption none
diff --git a/minikrebs/profiles/rickroller/customfiles/etc/dropbear/authorized_keys b/minikrebs/profiles/rickroller/customfiles/etc/dropbear/authorized_keys
new file mode 120000
index 00000000..9c87fc52
--- /dev/null
+++ b/minikrebs/profiles/rickroller/customfiles/etc/dropbear/authorized_keys
@@ -0,0 +1 @@
+/root/.ssh/authorized_keys
\ No newline at end of file
diff --git a/minikrebs/profiles/rickroller/customfiles/etc/shadow b/minikrebs/profiles/rickroller/customfiles/etc/shadow
new file mode 100644
index 00000000..251abaf5
--- /dev/null
+++ b/minikrebs/profiles/rickroller/customfiles/etc/shadow
@@ -0,0 +1,5 @@
+root:$1$spkPLKf6$KEM1l1DgouvYjeBfkT2wW1:0:0:99999:7:::
+daemon:*:0:0:99999:7:::
+ftp:*:0:0:99999:7:::
+network:*:0:0:99999:7:::
+nobody:*:0:0:99999:7:::
diff --git a/minikrebs/profiles/rickroller/customfiles/www/1x1.gif b/minikrebs/profiles/rickroller/customfiles/www/1x1.gif
new file mode 100644
index 00000000..8e91660f
--- /dev/null
+++ b/minikrebs/profiles/rickroller/customfiles/www/1x1.gif
diff --git a/minikrebs/profiles/rickroller/customfiles/www/cgi-bin/rrhelper b/minikrebs/profiles/rickroller/customfiles/www/cgi-bin/rrhelper
new file mode 100755
index 00000000..ec328a3b
--- /dev/null
+++ b/minikrebs/profiles/rickroller/customfiles/www/cgi-bin/rrhelper
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+RRLOG="/tmp/rrlog"
+
+if [ -n "$RRLOG" ]; then
+  echo `awk '{print $1}' /proc/uptime` $REMOTE_ADDR:$REMOTE_PORT \'$HTTP_REFERER\' \'$HTTP_USER_AGENT\' >>"$RRLOG"
+fi
+
+# To signal a rickroll, blink for 15 seconds
+(echo timer > /sys/devices/platform/leds-gpio/leds/tp-link:blue:system/trigger ;sleep 15;echo none > /sys/devices/platform/leds-gpio/leds/tp-link:blue:system/trigger) &
+
+
+echo "Content-type: image/gif"
+echo ""
+cat /www/1x1.gif
diff --git a/minikrebs/profiles/rickroller/customfiles/www/flvplayer.swf b/minikrebs/profiles/rickroller/customfiles/www/flvplayer.swf
new file mode 100644
index 00000000..a5ec0fa5
--- /dev/null
+++ b/minikrebs/profiles/rickroller/customfiles/www/flvplayer.swf
diff --git a/minikrebs/profiles/rickroller/customfiles/www/index.html b/minikrebs/profiles/rickroller/customfiles/www/index.html
new file mode 100644
index 00000000..4c4a9d9f
--- /dev/null
+++ b/minikrebs/profiles/rickroller/customfiles/www/index.html
@@ -0,0 +1,24 @@
+<html>
+<head>
+<title>RickRoll'D</title>
+</head>
+<body >
+<img src="/cgi-bin/rrhelper">
+<center>
+<h1>RickRoll'D</h1>
+<!-- start of flv player -->
+<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=8" width="80%" height="98%" id="theMediaPlayer">
+<param name=movie value="flvplayer.swf">
+<param name=quality value="high">
+<param name=bgcolor value="#FFFFFF">
+<param name=allowFullScreen value="true">
+<param name=swLiveConnect value="true">
+<param name=allowScriptAccess value="sameDomain">
+<param name="FlashVars" value="file=/rickroll.flv&overstretch=true&autostart=true">
+<embed type="application/x-shockwave-flash" pluginspage="http://www.macromedia.com/go/getflashplayer" width="80%" height="98%" bgcolor="#000000" name="theMediaPlayer" src="/flvplayer.swf" flashvars="file=/rickroll.flv&overstretch=true&autostart=true">
+</embed>
+</object>
+</center>
+<!-- end of flv player -->
+</body>
+</html>
diff --git a/minikrebs/profiles/rickroller/customfiles/www/rickroll.flv b/minikrebs/profiles/rickroller/customfiles/www/rickroll.flv
new file mode 100644
index 00000000..1ad37ee1
--- /dev/null
+++ b/minikrebs/profiles/rickroller/customfiles/www/rickroll.flv
diff --git a/minikrebs/profiles/rickroller/doc/README.md b/minikrebs/profiles/rickroller/doc/README.md
new file mode 100644
index 00000000..6f75c0b2
--- /dev/null
+++ b/minikrebs/profiles/rickroller/doc/README.md
@@ -0,0 +1,8 @@
+# Rickroller Profile
+
+The purpose of the profile is to create an access point where every connection
+is rewritten to rickroll.
+
+First step will be to get a working image without usb-stick.
+
+The next step is to faciliate the power of airbase-ng for even more pwnage.