Feature Request: Clone cert details from target networks

[thesle3p]

Would it be possible to add functionality to eaphammer to enumerate Certificate information from the network we wish to impersonate and automatically feed that into the cert-wizard? It would speed up the process of deploying eaphammer.

[s0lst1c3]

Awesome idea. We'll definitely get this added within the next couple of releases.

[kmackinley]

@s0lst1c3 how do you envision this working? I've got a few ideas, but want to see what you had in mind.

[thesle3p]

You give it the essid of a in proximity network and it would request and parse it's ssl cert info from that network and automatically pass it to the cert wizzard.

On Mar 12, 2018 4:38 PM, "kmackinley" [email protected] wrote:

@s0lst1c3 https://github.com/s0lst1c3 how do you envision this working? I've got a few ideas, but want to see what you had in mind.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/s0lst1c3/eaphammer/issues/32#issuecomment-372454240, or mute the thread https://github.com/notifications/unsubscribe-auth/AIqhyNr1HlNJyxuO9V49YFXm-I-PnNuFks5tdtyvgaJpZM4R4uRX .

[kmackinley]

Thats what I thought, just wanted to clarify, thanks for the info.

[s0lst1c3]

At a high level, you'd want to use the following steps:

1. Accept target ESSID and interface from user
2. Begin sniffing for SSL/TLS Server Hello packets on provided interface (using Scapy or similar)
3. Initiate an authentication attempt against target ESSID using call to wpa_supplicant or similar
4. When SSL/TLS Server Hello packet is detected, bail out of the authentication attempt
5. Extract the SSL certificate from the Server Hello packet and parse it for metadata
6. Generate new snakeoil certificates

If you check out packet 125 in the this pcap file you'll see what I mean:

https://mrncciew.files.wordpress.com/2014/08/eap-peap-7921.zip

Feel free to take a whack at this yourselves if you're up for it. I'm currently in the process of adding 802.11n/802.11ac support, which is forcing me to do some minor refactoring due to design decisions I made a year ago. No big deal, but it means I probably won't have time to start on this for a couple of weeks.

[thesle3p]

You may want to borrow code from eapeak instead https://github.com/securestate/eapeak/blob/master/eapeak

[s0lst1c3]

Would be awesome if we could integrate eaphammer with https://github.com/sensepost/apostille or implement similar functionality as a module.

[tyrells]

Hi all. I had written a python script, with similar functionality to apostille, that could be adapted for this feature: https://gist.github.com/tyrells/4667515e4d54ab1c01a48aa323a30ce5.

This script will take an input directory/file, parse all exported certificates and attempt to clone a selected certificate chain.

[s0lst1c3]

That is baddass. I will attempt to incorporate this in the near future and make sure to credit you.