109 lines
3.8 KiB
Markdown
109 lines
3.8 KiB
Markdown
Reverse engineering the protocols and default apps/APIs requires some patience and work. I've found using a Kali Linux VM that hosts an access point with MitMProxy works well. I followed a number of articles in order to get started, which helped in creating the below VM setup and scripts.
|
|
|
|
> References:
|
|
>
|
|
> - https://blog.heckel.xyz/2013/07/01/how-to-use-mitmproxy-to-read-and-modify-https-traffic-of-your-phone/
|
|
> - https://docs.mitmproxy.org/stable/howto-wireshark-tls/
|
|
> - https://www.yeahhub.com/create-fake-ap-dnsmasq-hostapd-kali-linux/
|
|
> - http://www.geekmind.net/2011/01/linux-wifi-operation-not-possible-due.html
|
|
|
|
# VM Setup
|
|
|
|
**Requirements**
|
|
|
|
- Kali Linux VM
|
|
- Bridge mode network
|
|
- USB Wifi Dongle (used a Ralink variant)
|
|
|
|
Create three files in the same directory (/root/accesspoint):
|
|
|
|
**Start_Sniff.sh**
|
|
|
|
```bash
|
|
#!/bin/bash
|
|
sysctl -w net.ipv4.ip_forward=1
|
|
iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 80 -j REDIRECT --to-port 8080
|
|
iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 443 -j REDIRECT --to-port 8080
|
|
iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 8883 -j REDIRECT --to-port 8080
|
|
sudo nmcli radio wifi off
|
|
sudo rfkill unblock wlan
|
|
ifconfig wlan0 up 192.168.1.1 netmask 255.255.255.0
|
|
route add -net 192.168.1.0 netmask 255.255.255.0 gw 192.168.1.1
|
|
|
|
#Open in new tabs
|
|
gnome-terminal -x sh -c "SSLKEYLOGFILE="/root/sslmitmkeylog.txt" mitmweb -m transparent -w "/root/mitmout_new.txt" --tcp-hosts 192.168.1.\d+ --ssl-insecure --raw; bash"
|
|
gnome-terminal -x sh -c "dnsmasq -C /root/accesspoint/dnsmasq.conf -d; bash"
|
|
gnome-terminal -x sh -c "hostapd /root/accesspoint/hostapd.conf; bash"
|
|
```
|
|
|
|
**dnsmasq.conf**
|
|
|
|
```bash
|
|
interface=wlan0
|
|
dhcp-range=192.168.1.2,192.168.1.30,255.255.255.0,12h
|
|
dhcp-option=3,192.168.1.1
|
|
dhcp-option=6,192.168.1.1
|
|
server=8.8.8.8
|
|
log-queries
|
|
log-dhcp
|
|
listen-address=127.0.0.1
|
|
# Set DNS settings per Bumper documentation as needed below
|
|
#address=/msg-na.ecouser.net/192.168.1.1
|
|
#address=/mq-ww.ecouser.net/192.168.1.1
|
|
```
|
|
|
|
**hostapd.conf**
|
|
|
|
```bash
|
|
interface=wlan0
|
|
driver=nl80211
|
|
ssid=bumper_mitm
|
|
hw_mode=g
|
|
channel=11
|
|
macaddr_acl=0
|
|
ignore_broadcast_ssid=0
|
|
auth_algs=1
|
|
wpa=2
|
|
wpa_passphrase=IAmNotSafe
|
|
wpa_key_mgmt=WPA-PSK
|
|
wpa_pairwise=CCMP
|
|
wpa_group_rekey=86400
|
|
ieee80211n=1
|
|
wme_enabled=1
|
|
```
|
|
|
|
# Sniffing
|
|
|
|
Run Start_Sniff.sh to begin. Ensure the bot and apps connect via the Wifi network being sniffed.
|
|
|
|
- For API/App Interactions you should see the details in the mitmproxy window.
|
|
- For XMPP/MQTT you will need to use WireShark.
|
|
- Ensure you point WireShark at the sslmitmkeylog file in order to decrypt any encrypted communications.
|
|
|
|
|
|
This documentation won't go into the details of reviewing the logs/traffic. The reader will need to identify how to use WireShark etc for this.
|
|
|
|
|
|
## XMPPPeek - MITM XMPP traffic between the Android or iOS App and the Ecovacs server
|
|
|
|
###### *Stolen from the [Sucks Documentation](https://github.com/wpietri/sucks/blob/master/developing.md#mitm-xmpp-traffic-between-the-android-or-ios-app-and-the-ecovacs-server)*
|
|
|
|
XMPPPeek can also be used to man in the middle the traffic between the Android/iOS App and the Ecovacs server.
|
|
|
|
1. Download [xmpppeek](https://www.beneaththewaves.net/Software/XMPPPeek.html)
|
|
1. Create a self-signed certificate with the following command
|
|
|
|
`openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes`
|
|
|
|
1. Edit xmpppeek.py and change port to 5223
|
|
|
|
1. Look at the [DNS docs](DNS_Setup.md) for information on which Ecovacs XMPP server is the right one for your Country. For example, a US user will be using `msg-na.ecouser.net`. Find and note the IP address for the server.
|
|
|
|
1. Make sure the mobile App talks to your machine instead of the server. This can be
|
|
accomplished modifying your router's DNS configuration to have the Ecovacs domain
|
|
name point to your IP.
|
|
|
|
1. Run xmppeek as follows.
|
|
|
|
`python ./xmpppeek.py <ECOVACS XMPP SERVER IP> cert.pem key.pem`
|
|
|