III. Stealing AD Credentials Using Hostile Portal Attacks

Note: you will need to generate a certificate in order to perform this attack against most EAP networks. Please refer to I. x.509 Certificate Generation for instructions on how to do this.

Note: you will need RADIUS creds in order to perform this attack against EAP implementations that use mutual authentication protocols such as MS-CHAPv2 for inner authentication. Please refer to VIII.1 - Considerations When Attacking WPA2-EAP Networks for additional information.

Hostile Portal Attacks are a weaponization of the captive portals typically used to restrict access to open networks in environments such as hotels and coffee shops. Instead of redirecting HTTP traffic to a login page, as with a captive portal, the hostile portal redirects HTTP traffic to an SMB share located on the attacker's machine. The result is that after the victim is forced to associate with the attacker using a rogue access point attack, any HTTP traffic generated by the victim will cause the victim's device to attempt NTLM authentication with the attacker. This is, in essence, an assisted Redirect To SMB attack. The attacker also performs LLMNR/NBT-NS poisoning against the victim.

This attack gets you lots and lots of Active Directory credentials, simply by forcing clients to connect and authenticate with you. The results are similar to what you'd get using a tool such as Responder, with some distinct advantages:

• Stealthy: This is a rogue AP attack, so no direct network is required
• Large Area of Effect: This is an attack that works across multiple subnets -- you can pwn everything that is connected to the wireless network.
• Efficient: This is an active attack in which the attacker forces clients to authenticate. There is no waiting for a network event to occur, as with LLMNR/NBT-NS poisoning.

The --hostile-portal flag can be used to execute a hostile portal attack, as shown in the examples below.

./eaphammer --interface wlan0 \
    --bssid 1C:7E:E5:97:79:B1 \
    --essid EvilC0rp \
    --channel 6 \
    --auth wpa-eap \
    --hostile-portal

./eaphammer --interface wlan0 \
    --essid TotallyLegit \
    --hw-mode n \
    --channel 36 \
    --auth open \
    --hostile-portal