About

These programs work together to copy network traffic and back them up to a remote server. They are intended to be run on a Raspberry Pi posing as an open wireless access point.

The code present in this repo was part of work done for a university security course. It is intended for learning and research purposes. Don't use these programs on other people without getting informed consent. It may be illegal to do so in your country.

Part List

This tutorial has only been tested on this specific hardware + software. Presumably you can apply this tutorial to similarlly speced hardware with a bit of technical know-how.

• Raspberry Pi 4B
  • 4GB RAM
  • Raspberry Pi OS Bullseye
• TP-Link Wireless USB Adapter
  • TL-WN821N
• Computer with SD card reader

Preparation

Part 1 - Creating a wifi access point

Many tutorials I encountered while working on this project took the easy route of using the in-built wifi card of the Rasberry Pi as the access point and providing an internet connection to the Pi through an ethernet cable. This project differs by using two wifi cards so that the Pi can connect to the internet wirelessly.

1.1 Setting up the Pi

If the Raspberry Pi being used has never been set up, visit https://www.raspberrypi.com/software/ to download Raspberry Pi OS (formerly referred to as Raspbian). This tutorial was last verified as working on Raspberry Pi OS Bullseye (11).

Start the Pi and go through the normal set up prompts. If the update that occurs during the set up fails, make sure to run

sudo apt update

and

sudo apt upgrade

from the terminal to ensure all system packages are up to date. Depending on internet connection speeds, this step may take a long time to complete.

1.2 Sourcing wifi drivers

The TP-Link Wireless Adapter doesn't work out of the box with the Raspberry Pi. As a result, it is neccessary to install the required drivers manually. If you are following this tutorial with a different adapter you will need to find any neccessary linux drivers on your own. Either way, make sure to insert the USB into the Raspberry Pi if you have not already done so.

If you are using a TL-WN821N, you can visit the following repo and follow the installtion guide before moving on to step 1.3: https://github.com/Mange/rtl8192eu-linux-driver

Regardless of what device you are using, you can check an adapter is detected and functioning by running

iwconfig

and checking the output.

For example:

The USB is inserted, but without the driver it is not recognised by the Raspberry Pi

The USB is inserted, since the driver is installed it is recognised by the Raspberry Pi

1.3 wlan0, wlan1 and AP mode

If you read the source code for packet_sniffer.c you will notice that all the sniffing occurs on wlan1. wlan1 is the wireless adapter I chose to configure as a wireless access point. It is the adapter to which other devices (like phones or laptops) will connect to once the Pi.neapple is complete.

You can use either you in-built or external wireless adapter as the access point, provided your external adapter support AP mode (the in-built adapter on the Rasberry Pi 4B definitely supports AP mode).

If you need to check AP mode support follow these steps:

1. Run iwconfig to figure out which wlan corresponds to your external adapter.
2. Run iw dev and figure out which phy#X corresponds to your external adapter by referencing their wlan value.
3. Run iw phy phyX info where X is substituted for the number found in step 2 (Don't include the # - e.g. iw phy phy1 info)
4. Check if AP is listed under Supported interface modes (located near the top of output). If it is, the adapter supports AP mode.

It is worth noting that the titles wlan0 and wlan1 are not directly linked to the hardware of each adapter and is instead just the order in which the operating system detected each adapter. For example, if I start my Raspberry Pi with the USB adapter inserted, it is recognised as wlan0 and the inbuilt adapter is recognised as wlan1.

On the other hand, if I start my Raspberry Pi without the USB adapter inserted, the inbuilt adapter is recognised as wlan0 and (once inserted) the USB is recognised as wlan1.

This tutorial (and the source code) assumes you use the adapter listed as wlan1 as your access point, and the adapter listed as wlan0 as a means of connecting to the internet. If your system requires the inverse assumption, make sure to substitute all instances of wlan0 for wlan1 (and vice-versa) for the remainder of this tutorial and be sure to change line 34 of packet_sniffer.c

1.4 Resolving auto-connect

Currently, both wlan0 and wlan1 are connecting to the same access point. This will cause problems down the line as wlan1 needs to be configured to accept incoming traffic.

This can be addressed by creating seperate wpa_supplicant.conf files for each adapter.

From the home directory, run:

cat /etc/wpa_supplicant/wpa_supplicant.conf

The output will look something like this:

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1

country=SOME_COUNTRY_CODE

network={
        ssid="YOUR_WIFI_NAME"
        psk="YOUR_WIFI_PASSWORD"
}

Copy this output and create the first file wpa_supplicant-wlan0.conf by running the following command:

sudo nano /etc/wpa_supplicant/wpa_supplicant-wlan0.conf

Paste the output you just copied into this file and save it.

Now create the second file wpa_supplicant-wlan1.conf by running the following command:

sudo nano /etc/wpa_supplicant/wpa_supplicant-wlan1.conf

Paste the copied output once again, but before saving, make sure to delete the contents of the network field such that your file will look something like this:

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1

country=SOME_COUNTRY_CODE

network={
}

1.5 Setting up DHCP

Run sudo nano /etc/dhcpcd.conf and append the following lines to the opened file:

interface wlan1
static ip_address=192.168.220.1/24
static routers=192.168.220.0

Now restart DHCPCD by running:

sudo service dhcpcd restart

1.5 Setting up hostapd

hostapd allows your network interface card (NIC) to act as an access point for other devices. Install it by running:

sudo apt-get install hostapd

Once installed, run sudo nano /etc/hostapd/hostapd.conf and copy the following into the opened file:

interface=wlan1
hw_mode=g
ssid=pineapple
channel=1

After saving and exiting, now run sudo nano /etc/network/interfaces and append the following to the opened file:

iface wlan1 inet static
         hostapd /etc/hostapd/hostapd.conf

The final part of this step is to enable hostapd. Run the following two commands:

sudo systemctl unmask hostapd.service
sudo systemctl enable hostapd.service

1.6 Setting up dnsmasq

dnsmasq allows for dns forwarding. Install it by running:

sudo apt-get install dnsmasq

Backup and rename the default config file by running:

sudo mv /etc/dnsmasq.conf /etc/dnsmasq.conf.orig

Open a new config file by running sudo nano /etc/dnsmasq.conf. Replace the contents of the file with the below:

interface=wlan1
listen-address=192.168.220.1
server=8.8.8.8
domain-needed
bogus-priv
dhcp-range=192.168.220.80,192.168.220.90,12h

1.7 Enabling packet forwarding

It is also necessary to enable packet forwarding. To do so, run:

sudo nano /etc/sysctl.conf

and uncomment this line: net.ipv4.ip_forward=1

1.8 Iptables config

The final step is to configure a NAT between wlan0 and wlan1. Do so by running the following commands:

sudo iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
sudo iptables -A FORWARD -i wlan0 -o wlan1 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i wlan1 -o wlan0 -j ACCEPT
sudo sh -c "iptables-save > /etc/iptables.ipv4.nat"

To ensure the iptables are loaded on reboot, run sudo nano /etc/rc.local and add the line iptables-restore < /etc/iptables.ipv4.nat:

1.9 Reboot and run

Restart your Raspberry Pi by running:

systemctl reboot -i

Once rebooted, run these two commands (in this order) and you should now be able to see your pineapple wifi network and access the internet through it:

sudo service hostapd start
sudo service dnsmasq start

Remember to insert your USB adapter after rebooting if you want it to show up as wlan1

To turn the access point off, just run:

sudo service dnsmasq stop
sudo service hostapd stop

Part 2 - Setting up remote storage

While my repository contains the python script necessary for uploading files to google drive, it requires a token unique to your own google account to work.

2.1 Creating account

If you don't have a google account, make one now at https://accounts.google.com/signup/v2/webcreateaccount?flowName=GlifWebSignIn&flowEntry=SignUp

2.2 Creating google cloud project

Once you are logged into google navigate to https://console.cloud.google.com/projectcreate and create a new project named Pineapple.

Once the project is created (this may take a few minutes) navigate to its dashboard. You can do so via the top left menu bar:

2.3 Enabling google drive api

Navigate to the api and services section of you project dashboard:

and then select enable apis and services:

From here, search for and enable the google drive api:

2.4 Creating oauth consent screen

The cloud project requires an oauth consent screen. From the apis and services sidebar navigate to oauth consent screen:

For user type, choose external:

Set the app name and support email to whatever you like and move on to the scopes page. Under add or remove scopes search for google drive and select /auth/drive:

For test users, you just need to add your google account:

2.5 Creating oauth credentials

Navigate to the credentials window of api and services and create a new oauth client id:

Set the application type as web application:

Make sure to add an authorised redirect URI for http://localhost/:

Creat the credential and download the json file.

Once downloaded move it into the project directory (so that drive_uploader.py can read from it) and rename the file to credentials.json

Part 3 - Preparing files for running

With the Raspberry Pi and Google Cloud set up, the final piece of preparation involves getting the provided source code ready to be run.

3.1 Installing libpcap

packet_sniffer.c requires the libpcap library. Install it by running:

sudo apt-get install libpcap-dev

3.2 Compiling packet_sniffer.c

From within the project directory run make. This will compile packet_sniffer.c into an executable.

3.3 Installing python google api

drive_uploader.py requires the google api package. Install it by running:

pip install --upgrade google-api-python-client google-auth-httplib2 google-auth-oauthlib

You will get warnings that the package is not installed in a directory on PATH. Address this by running the following command:

echo "export PATH=\$PATH:/home/$USER/.local/bin >> ~/.bashrc

Now any new terminal you open will add the location of the google api package to your path

3.4 First time authentication flow

From the project directory, open a new terminal window and run python3 drive_uploader.py. Since this is the first time connecting to the api you need to complete the authentication flow you set up earlier. A window should automatically open. If not follow the URL that appears in the terminal. Once complete the program will crash since the expected directories are not yet present. This is expected behaviour.

Running

With all the set up complete, activating the Pi.neapple is a simple as running a few commands from the project directory.

1. Enable hostapd and dnsmasq

sudo service hostapd start
sudo service dnsmasq start

2. Activate packet sniffing on wlan1:

sudo ./packet_sniffer

3. Activate packet uploading to google drive

python3 upload_manager.py

As network traffic passes through the Raspberry Pi.neapple, the packets being captured by packet_sniffer will be uploaded by drive_uploader.py