My Stuff @IDSECCONF-2015 & CODEBALI-2015

Photo by @smrx86

download material:

White Paper
IDSECCONF 2015 Presentation
CODEBALI 2015 Presentation

firmware 
Demo 1. Flashing
Demo 2. Trapcookies
Demo 3. Sslstrip 

Read more »

Smart Controll MR3020 Wps Led via Android App

Filename: kankun_at_mr3020.bin
Size:  2884 KB
Description: Controlling mr3020 WPS led via android app.
Distribution : freeware
Md5checksum: cf31caded64044138fea25af0ff16db7

 Download link: click here 

 preview

isuue:

• router ip address is : 192.168.10.253
• ssh password: kankunhack
• Android App can be downloaded at http://kk.huafeng.com:8081/android/Smartwifi.apk 
• This firmware has no Luci, so if u want to revert to prefer f/w u should flash thru ssh access.

Read more »

My Stuff @Seminar Riset Nasional Id-SIRTII/CC vol. V

Photo by @smrx86

[generally this things is RE-TALK about wispi]

download:

White Paper

firmware 
Demo 1. Flashing
Demo 2. spoofhost for phising

Password (still): idsecconf2014

related post: http://semaraks.blogspot.com/2014/11/my-stuff-idsecconf2014-blog-post-no100.html

Read more »

Wispi for Various Type TP-link Router

WISPI

 WisPi ver. 1.1, openwrt f/w for various type tp-link router. This firmware have karma, spoofhost and wifi jammer capability.

Distribution : freeware

 Download link:
TP-link MR3020 click here
TP-link MR3040 Ver. 1 click here
TP-link MR3040 Ver. 2 click here
TP-link MR3220 Ver. 1 click here
TP-link MR3220 Ver. 2 click here
TP-link MR3420 Ver. 1 click here
TP-link MR3420 Ver. 2 click here
TP-link WR703N click here

Changelog

• Version 1.1 (25/3/2015)
  
  • Build for various kind router, such as: TP-link WR703N,TP-link MR3040V1, TP-link MR3040v2, TP-link MR3220V1, TP-link MR3220V2, TP-link MR3240V1, TP-link MR3240V2.
• Version 1.1 (2/12/2014)
  
  • Adding ugrade page; make easy to change, revert or update the router f/w.
  • Adding phising page to improve spoofthost capability.
  • Bug fix in Karma trigger.
  • Adding encoder/decoder page; simple script to encode/decode html, base64 and hex string.
  • Autossh for automate login system.
  • Admin page : http://192.168.1.1:1471, username: root password: idsecconf2014
    
• ver1.0 (2/11/2014)
  
  • First Wispi version released @idsecconf2014.

Further Reading

• White Paper (Indonesian)
• Presentation (Indonesian)

Overview

pict 1. Index adm page

pict 2. Upgrade adm page

pict 3. Endec adm  page

pict 4. Phising adm page

Read more »

Instacampro on GL-inet (attitude adjustment 12.09)

Filename: instacampro-AA-gl-inet-v1-squashfs factory.bin

Size:   15.8 MB (16,515,072 Bytes).
Description: This firmware is a porting from my previous instacampro builds. It have many package install on it like mjpeg-streamer, modswitch for 3g modem support, DDNS and Extroot packages. The main idea is origanally comes from minikrebs project.
Distribution : freeware.
Md5checksum: 6d1470d3e75c57d442b148628c35421a
Download link: click here

Main issue:  

• 
  
• Your webcam must be support V4L and UVC category.
• only ext4 partition can use to be an exroot.
• enjoy  ^^

Overview:

pict1. terminal

pict2. Luci frontend

pict3. They are more space left.

related source:
- http://wiki.openwrt.org/doc/howto/obtain.firmware.generate
- http://shackspace.de/wiki/doku.php?id=project:minikrebs

Read more »

GL-inet Buildroot ver. Attitude Adjustment 12.09

Filename: trunk.tar.bz2
Size:   9.1 MB (9,550,844 Bytes)
Description: Openwrt buildroot version attitude adjustment that support to developing GL-inet firmware.
Distribution : freeware
Md5checksum: e3e6d4d9a0c0c8b8d77ce9023eb6de46
Manual / Howto : http://wiki.openwrt.org/doc/howto/buildroot.exigence
Download link: click here

Read more »

Patches 16 MiB for GL-inet AA (ver 12.09)

Filename: 01-gl-inetAA16MiB.patch
Size:   8.0 KB (8,190 Bytes)
Description: If you get trouble cooking 16 MiB firmware for gl-inet, then maybe this patches.
Distribution : freeware
Md5checksum: b1011d2270f8729b76e2ead80e7bf080
Download link: click here 

Read more »

Bitcoin mining with MR3020

Filename: bfgminerwrt-ar71xx-generic-tl-mr3020-v1-ads-b.bin
Size:   3.8 MB (3,932,160 Bytes)
Description: openwrt firmware for tplink MR3020 that intended for bitcoin mining.
Distribution : freeware
Md5checksum: b1011d2270f8729b76e2ead80e7bf080

 Download link: click here 

Issue:  

• Before use this f/w, make sure u already enough read and try using openwrt without Luci gui. 
• Support Antminer, ZeusMiner, GridSeed, DualMiner, and SHA2 ASICs.
• Get started by entering into terminal : connect ur dongle >> turn on the router>> connect ur notebook with lan/cat cable >> telnet 192.168.1.1 >> type bfgminer and then set up ur pool setting and pool password. After that make a route connection ur router to internet (LAN mode). 
• If u want to connect through wireless connection, assign to SSID "BFGminer" with key "bfgminer01".
• happy mining.... ^^

Read more »

WiSpi ver 1.1 for TP-link MR3020 (Mini Karma Router)

File name: wisp-tl-mr3020-v1-squashfs-factory.bin
Size:   3,75 MB (3.932.160 bytes)
Description: WisPi ver. 1.1, openwrt f/w for tplink MR3020 with karma, spoofhost and wifi jammer capability.
Distribution : freeware
Md5checksum: 9421a99a9e4f67305968863c70bd0e01

 Download link: click here 

Changelog 

Version 1.1 (2/12/2014)

-  Adding ugrade page; make easy to change, revert or update the router f/w.

- Adding phising page to improve spoofthost capability.

- Bug fix in Karma trigger.

- Adding encoder/decoder page; simple script to encode/decode html, base64 and hex string.

- Autossh for automate login system.

- Admin page : http://192.168.1.1:1471,  username: root  password: idsecconf2014

ver1.0 (2/11/2014)

- First Wispi version released @idsecconf2014.

Preview

pict 1. Index adm page

pict 2. Upgrade adm page

pict 3. Endec adm  page

pict 4. Phising adm page

Read more »

My Stuff @Idsecconf2014 (blog post no.100)

Photo courtesy by K-159

download:

Paper

Presentation

firmware

Password: idsecconf2014

Read more »

WR1043ND v 1, an Angels n Demons Router Box

Read more »

Vid about infusions and apps in Pineapple MK V clone ( TL-MR3020 )

1. PinAP n Karma

2. RTLSDR streamer

3. .... (in progress)

Read more »

Pineapple Mark V clone ( TP-Link mr3020 )

Read more »

Fix The SSID Karma Log (end)

I realized it's something different with my pineapple clone (see previous post), there is no SSID log being generated after karma start. Not just that ...the 'enabled' indicator also doesn't appear under dhcp leasess index (not the karma indicator in the left side).

But now it's already fixed.... hehhehe


i think am ready to write the full tutorial...ok c'ya in d next post. ^^

Read more »

Pineapple clone on MR3040

for tutorial : http://penturalabs.wordpress.com/2013/04/25/blue-for-the-pineapple/

Read more »

Mark II: Instacampro for TL-MR3040 V1

Filename: openwrt-ar71xx-tl-mr3040-v1-instacampro-markII.bin
Size:   3.75 MB (3,932,160 bytes)
Description: an upgraded of instacampro firmware for tplink MR3040 V 1. This f/w allow you to use mjpg-streamer (webcam video stream over web browser/app) for most of usb webcam china product without extroot or usb hub. So u can attach it with ur router everywhere or even mount it on RC car.
Distribution : freeware
Md5checksum: cbe36e891dff1dd5a965c3db514c0794

 Download link: click here 

Main issue:

• Make sure to changes mjpg-streamer configuration to enabled first before u use it ( vi /etc/config/mjpg-streamer and change option enabled '0' to option enabled '1' ) *under ssh terminal
• Check first ur web cam is recognized as 'video0' on device list by type ls /dev.
• U can start mjpg-streamer by using mjpg-streamer -i "input_uvc.so"  -o "output_http.so -p 8080" or using /etc/init.d/mjpg_streamer start .
• Go to http://192.168.3.1:8085/?action=stream  to watch under internet browser.
• To access mjpg stream under android device u can use MJpegViewer app.
• Get try... ^^

Overview

This is d output from my old webcam ZC0350 (very low res)...look's terrible but it's work & no need extroot or usb hub.

Read more »

ADS-B on MR3020

File name: openwrt-ar71xx-generic-tl-mr3020-v1-ads-b.bin
Size:   3.75 MB (3,932,160 bytes)
Description: openwrt firmware for tplink MR3020 that support rtl-sdr dongle and have dump1090 to decode ads-b signal
Distribution : freeware
Md5checksum: 87b86e1f456c10d66c54845440358c3b

 Download link: click here 

Preview

Need help

# dump1090 -h
Unknown or not enough arguments for option '-h'.
--device-index Select RTL device (default: 0).
--gain Set gain (default: max gain. Use -100 for auto-gain).
--enable-agc Enable the Automatic Gain Control (default: off).
--freq Set frequency (default: 1090 Mhz).
--ifile Read data from file (use '-' for stdin).
--interactive Interactive mode refreshing data on screen.
--interactive-rows Max number of rows in interactive mode (default: 15).
--interactive-ttl Remove from list if idle for (default: 60).
--raw Show only messages hex values.
--net Enable networking.
--net-only Enable just networking, no RTL device or file used.
--net-ro-port TCP listening port for raw output (default: 30002).
--net-ri-port TCP listening port for raw input (default: 30001).
--net-http-port HTTP server port (default: 8080).
--net-sbs-port TCP listening port for BaseStation format output (default: 30003).
--no-fix Disable single-bits error correction using CRC.
--no-crc-check Disable messages with broken CRC (discouraged).
--aggressive More CPU for more messages (two bits fixes, ...).
--stats With --ifile print stats at exit. No other output.
--onlyaddr Show only ICAO addresses (testing purposes).
--metric Use metric units (meters, km/h, ...).
--snip Strip IQ file removing samples < level.
--debug Debug mode (verbose), see README for details.
--help Show this help.
Debug mode flags: d = Log frames decoded with errors
D = Log frames decoded with zero errors
c = Log frames with bad CRC
C = Log frames with good CRC
p = Log frames with bad preamble
n = Log network debugging info
j = Log frames to frames.js, loadable by debug.html.

Simple execution: # dump1090 --interactive

get try...

Read more »

rickroll on mr3040

File name: openwrt-ar71xx-generic-tl-mr3040-v1 rickroll.bin
Size:   3.75 MB (3,932,160 bytes)
Description: openwrt firmware for tplink MR3040 ver 1 with with auto rickroller feature (every link that users wants to connect will leads into local index in ur openwrt).
Distribution : freeware
Md5checksum: 22c63099bd192db5a46a07ee02b02531

 Download link: click here

main issue:

• Pretty same function with mr3020 auto rickroll, but this one used for TP-LINK MR3040 ver 1. this f/w also get several changes in package and the landing point.... :P 

• Right after u flashing the router u will get "free@wifi.id" as ur SSID (Always think like a fish, no matter how weird it gets).
• There is a lot of chance if u want to inject ur own payloads on it (just edit the index.html or make something new).
• This firmware only contain some basic packages, there is no Luci there. So i remind u again...don't try if not familiar with flashing thru ssh terminal/putty or else. 

related source: 

-  http://hak5.org/hack/auto-rickrolling-wifi-pineapple

-  http://shackspace.de/wiki/doku.php?id=project:minikrebs#profilerick-roller
-  http://wiki.openwrt.org/doc/howto/obtain.firmware.generate

Read more »

Grey 4 Pineapple ( Pineapple on mr3020 with 8/16 MB ROM Flash )

File : openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin
Size:   7.75 MB (8,126,464 bytes)
Description: pineapple mod firmware for TP link mr3020 with 8/16 MB Rom Flash
Distribution : freeware
Md5checksum: 398178cb78ef22f9e21b65a7d0885bfb

 Download link: click here 

issue: 

- it would be better if u have 16 MB than 8 MB rom flash in ur router... ^^

- pointing ur internet browser to http://172.16.42.1:1471

reference:

-  http://penturalabs.wordpress.com/2013/04/25/blue-for-the-pineapple/

- http://wiki.openwrt.org/doc/howto/obtain.firmware.generate

Read more »

mr 3020 run pineapple jasanger ...but karma not

 find tut in: http://penturalabs.wordpress.com/2013/04/25/blue-for-the-pineapple/

main issue; 
- U need dsniff to perform dnspoof and urlsnarf
- To install dsniff u need to take it on minipwner repository, do this :

opkg update

opkg install  libpcap libnids libnet0 libopenssl libgdbm librpc

cd /tmp

wget http://www.minipwner.com/20120514/downloads.openwrt.org/snapshots/trunk/ar71xx/packages/dsniff_2.4b1-2_ar71xx.ipk

opkg install dsniff_2.4b1-2_ar71xx.ipk

- U also need autossh n other packages whose in pineapple mark4 but didn't bring on pentura tutorial...here they are :
at  autossh  chat  comgt  crda  empty  ettercap  hostapd-utils  hostapd  iptables-mod-ipopt  iptables-mod-nat-extra  kmod-ath9k-htc  kmod-button-hotplug  kmod-crypto-hash  kmod-crypto-manager  kmod-eeprom-93cx6  kmod-fs-nfs-common  kmod-fs-nfs  kmod-input-core  kmod-input-gpio-keys-polled  kmod-input-polldev  kmod-ipt-ipopt  kmod-ipt-nat-extra  kmod-lib-crc-itu-t  kmod-nls-utf8  kmod-rt2800-lib  kmod-rt2800-usb  kmod-rt2x00-lib  kmod-rt2x00-usb  kmod-rt73-usb  kmod-rtl8180  kmod-rtl8187  kmod-scsi-generic  kmod-tun  kmod-usb-net-cdc-ether  kmod-usb-net-rndis  kmod-usb-net  kmod-usb-serial  kmod-usb-uhci  libcom_err  libcurl  libelf1  libext2fs  libltdl  libnet1  libsqlite3  libusb-1.0  libusb-compat  macchanger  php4-cgi  php4  procd  sdparm  usb-modeswitch-data  usb-modeswitch  usbreset  usbutils  zoneinfo-core

- So sad...although with this all  i still can't runs karma on.... -_-' , if u can make its work please message me to this email.

Read more »