[Music]
okay
oh
all right everybody welcome to building
an unlicensed 802.11 particle
accelerator
my name is travis
on social media i can be found as w9hax
a bit about me i'm from the madison area
just north of up in waunakee
i live with my wife my three kids so my
hobbies include fitness i like barbell
lifting i like cardio
in the grilling so smoking meats but
also recently i got a blackstone griddle
so if you you know i do kabachi's and
smash burgers and breakfast on that so
those are some things i like
and also
into an amateur radio so ham radio i
just recently got a general class
license so i like dabbling in the hf
bands so they'll hang them up there
awesome
for my day-to-day job i do penetration
testing with a firm called trusted sec
uh that was a recent change but i really
like the cut the company the culture and
kind of focus on
internal
internal penetration tests external
wireless assessments web applications
kind of anything they throw at me but
that's the world i live in more of the
trajectory domains
also help co-sponsor a madsec meetup and
before i move on we are hosting one
tonight at the rock bottom brewery not
to pull you away from the con but if
you're interested in a drink and some
dinner hit rock bottom there's going to
be a milsek 920sec and madsec all kinds
of
conglomerate thing that's going to
happen pretty much right after this talk
into the evening hours whenever
and then lastly i'm an avid ghostbusters
fan and you know kind of growing up in
the mid 80s ghostbusters was my thing
star wars happened before my time i grew
up with the original movie and then also
the real ghostbusters cartoon had a
kenner
toy proton pack when i was a kid so
ghostbusters was my what's right up my
alley
fast forward 37 years later here now um
the ghostbusters afterlife film got
released now who here's seen after life
anybody
that's all
this whole nobody's seen afterlife okay
well your homework tonight or soon is
the go see ghostbusters afterlife
anyway for christmas this past year my
in-laws presented me with an awesome
gift it was a replica proton pack as you
see here
not quite as you see here but um
that was the gift and i was thrilled i
mean ghostbusters was my thing again and
with the movie coming out my nostalgia
was hitting a fever pitch
that said you know we have our christmas
dinner we um
we finish things up and i i take my kids
i'm like hey guys let's go downstairs so
we leave the lights off we go down into
the basement
and i'm like all right we're gonna test
this pack out we're gonna go bust some
ghosts and you know we kind of use our
imagination to blast some spooks
inspectors and whatnot and uh yeah fast
forward like you know five minutes if
they lasted even that long my kid my son
passes the backpack back to me and
underwhelmingly asks he's like dad
does this thing actually do anything
and
being kind of like the infosec hacker
mindset i had i'm like well no not
really but we certainly can make it do
something and that's kind of what
presented this talk
so
introducing the newest incarnation of
wi-fi testing technology the pump time
pack so what is it really it's a replica
contact that's outfitted with a bunch of
wireless attack arsenals and why did i
do this well a code that didn't have a
whole lot going on winter months not a
whole lot going on in that time frame
and also i had a bin full of electronic
devices things like arduinos raspberry
pi's
things that were just laying around also
like i had a 200 piece
arduino circuit kit you know with servos
and leds and
resistors that i always wanted to do
something with never really had the time
to do so also i walk around at hacker
conferences whether it's this one or a
black hat definitely i see these
hardware hacking villages i've always
been intrigued by them i'm like well you
know okay they're making their hat light
up say some cool text
and i was like well this would be a
great way for me to do something similar
to that
also wireless attack arsenal that was
collecting dust i haven't been on site
nearly two three years i want to say and
i was kind of losing my edge or my
my edge with the the wireless side much
all these tool sets that i wasn't really
using at the time like well let's start
integrating some of this into the proton
pack
and lastly this talk is kind of to
inspire some newcomers whether you
you're new to infosec whether you did a
hardware hacking i was i learned a
little bit so i thought this would be a
great way to kind of showcase that and
uh
be like a conversation piece so at
conferences you wear this thing around
it's bound to ask you know get some
attention and ask some questions
so what are the features of this pack
well it does have a uh the ability to
derogate access points so that's going
to do to it based on the beacon
impersonation attack so
as your device is connected to your
preferred network in the past and your
preferred network list it's going to
listen for those beacons
that your your phones and your laptops
are always weakening out and this pack
will on the fly spin up those networks
and say hey you're looking for free
coffee wi-fi i'm free coffee wi-fi
you're looking for in-play gogo i'm
going to play gogo so it's using the
wi-fi pineapple technology to
handle those attacks also the evil twin
wpa enterprise attacks so if you've got
a network that employs an organization
like radius authentication you can clone
that network you can
get clients to associate to you and
potentially grab credentials and or
handshakes
it does spectrum analysis this is kind
of cool a cool thing on the pack so it
supports both the 2.4 and 5 gigahertz
spectrum and actually we'll go over it a
little bit more in depth but on the
neutron line there's a microcontroller
that has an oled display that will
actually read out
different channels the strengths the
activity the targets the clients all
within that little display so as you're
going there you can you can kind of get
a real readout and really feel like
you're doing something with it when
you're holding the lawn
it does wpa attacks so it's going to
look for your partial and full handshake
so there's e-pull packets if clients are
out associating networks it's going to
find those handshakes capture them you
can take them offline for key recovery
and also the pmk-id attacks so that's
going to be if your network is
clientless you can attack the access
point and if you find these pmk-id
association frames you can take those
and potentially crack them offline based
on a weak algorithm that's often
employed with those
and then lastly the authentication
attacks again through the wand and also
through a few of these other antennas at
the top it's constantly monitoring
looking for networks and you can go
selectively target
certain networks and our clients can
knock offline and that's kind of cool
with the blaster this whole concept you
kind of point with the directional yagi
antenna where you want to go you blast
it and knocks it offline you capture the
handshakes on these antennas at the top
so looking from the exterior so we got
at the top here
two roll base antennas that's option
number one and those are again for your
rogue aps you got a pony gotcha that i
implemented in here really that was
because i wanted to get familiar with
opponent actually
i know i see ryan in the crowd he's done
a lot of work with that i want to kind
of get familiar with the project i've
never really touched it before
so it's got a built-in portage it's got
a 3.8 inch or a 3x8 led matrix display
again something i wanted to kind of get
familiar with never really done it so
i'm like well let's throw a led matrix
on there and that's again to advertise
information about the pack and the tones
now
there go figure when you're traveling
maybe you're not going to wire this but
that led display should be lighting up
um number four it's got a uh management
radio interface and this is to
administer the pac via wi-fi interface
via am a web interface so you can manage
the campaigns you can manage it in scope
networks do a bunch of stuff to kind of
control and how the packs operating
number five at the top this antenna up
here should be moving right now it
should be panning in 180 degree motion
and
that's not happening right now either i
apologize number six did neutron on at
the very end it's got a microcontroller
at the end we'll go cover that a little
bit more that's where you're attacking
and also the spectrum analysis and then
lastly that microcontroller routes
through a 2.4 gigahertz
yagi antenna again to kind of point
where you want to go when you want to
attack
hardware wise what's running under the
hood so we do have a pi 4 in here
the reason i went with the pi 4 like a
lot of people like why don't you use a
pi zero a you can't find a pi zero in
stock right now you just can't source
one so i have a pi 4 laying around i
figured let's go ahead and use it one
advantage of the pi 4 allowed me to use
external
wireless adapters that supported 5
gigahertz spectrums so a little bit more
power i could look up an external
adapter and get that point of gaucher at
the top reading five gigahertz so
it does dual band support
feedback being the 2.13 inch ink display
and again that's going to be for your
wpa handshakes and pmk id attacks it's
also got the mark 7 pineapple so the
newer pineapple that's doing all your
beacon and uh beacon impersonations
rogue attacks
enterprise evil twin attacks so on and
so forth neat thing with that uh
pineapple is you can it's modular in
design so you can do more
um like man in the middle once you get a
few clients connected you can you know
tcp down url snark whatever you need to
do
you control that traffic
i'm sorry i jump back one side here
at the very top of this pack too you'll
see the arduino up there at the very top
that's again controlling the led matrix
display and the
and the servo and then at the very
bottom here all these wires is the uh
the light and sound kit so there's a
microcontroller in here that supports
lighting sounds for movie movie accurate
effects
it's also got a soundtrack mode here so
you can cycle through certain you know
key songs to post with this franchise
which will go over here
the pornogaji again that's more of a
user interface than uh
augment or
artificial intelligence it's just a
front end for better cap is what it's
using under the hood does anyone use
better cap here in the room a few on
quite a few so it's a great way to kind
of automate some of these wireless
attacks it's again that's the main job
is to monitor for e-pull frames and pmk
id frames
um
and also i modified mine to a support
the 5-day great spectrum but also throw
some key ghostbuster movie quotes in
there so you say like don't cross the
streams are you the key master things i
kind of created this theme i really
wanted to update the face on the
ponegatchee there's a little outside of
my web ui know-how but maybe they'll be
coming for a future presentation
microcontrollers it's got a few of them
in here and again that was kind of the
main concept of doing this whole talk is
figuring out how these microcontrollers
work hey look there's the led matrix
doing its thing when it's supposed to be
doing this thing
um so i have three of them i have an
arduino nano that's using the matrix
display and also controlling the servo
motor at the top to make that antenna
back and forth
it's got a proprietary light and sound
kit
again that's for the freaking geek movie
accurate effects so
this led and the cyclotron that goes
around goes in a certain order and a lot
of ghostbusters are very specific to how
that should look that's what that
microcontrollers are
doing
then also got in the neutron launch that
you pull up uh proprietary esp-07
microcontroller
and the neat thing about that controller
is it's got an external wi-fi interface
and that's how i link into the um the
2.4 gigahertz yeah the antenna there
one neat call out here that i really
want to hammer home is um the bottom
left image is from a website called wkwi
and it's a virtual environment that
allows you to piece together these
components so before i even picked up my
soldering iron or any electronic
components i could say i have an arduino
i have a matrix display i have a servo i
can wire it virtually i get real-time
feedback push code to it troubleshoot it
figure out how it's all working so this
is really kind of a sticking point to
help me get past like all right see this
project from the concept to actually
have it do something so i would really
highly recommend the tiny tinyurl.com
black ponytail pack that'll take you to
the wokwey site and uh you can actually
see the same code that i used to push it
it's a neat site definitely check it out
it's kind of like legos for adults
really
do neutron so here you see the
microcontroller in action so again the
the wand actually has three circuits on
it the three circuits are going to power
on the lawn you get kind of light and
sound sequence from the movie accurate
effects
the top toggle here will actually power
down into our soundtrack mode and with
the soundtrack mode that's going to
cycle through like the ghostbusters
theme song
bobby browns tune all the ones that are
very unique to the ghostbusters
franchise
and then the third toggle switch will
activate the attack mode which should
turn again turn on the
oh you know what
i just wasn't thinking
there it is i have the wrong switch so
the third toggle will power on the um
led matrix display that in the same
camera yeah
all right
need to say the uh the microcontroller
has the
oled display and as you can see on the
video that allows you to cycle through
you can actually get a real-time
spectrum reading of you know what final
channel is it only a few packets or is
it loaded hundreds of packages you know
that channel is the one you want to go
after it's really neat to have that
blonde but actually be able to toggle
through what you're looking at from then
you there you can select certain target
networks you want to go after clients
that are connected to that target you
can then point it out shoot it and send
the authentication frames to knock them
offline hoping to get instant responses
on your your receiving antennas
oh wait i'll step back on this here
um the references down below are the
software that microcontroller is using i
didn't write that that was written by
space hunting tech and it's um
esp8266 the author project again i
hardly even flash these things in the
past so just learning how to
interoperate with these micro micro
controllers and wire them up was a
learning curve for me but i took a lot
out of it
lastly the dsi hardware he did this
proprietary
microcontroller there's a lot of these
controllers out there i found using his
this like 14 shift from china to get to
my doorstep was a lot easier than trying
to kind of like create my own and
and do what i needed to do so definitely
check out his project it was really cool
because again this microcontroller
allowed me to link up an external yaging
antenna which i think was pretty neat
power management so this was one of the
struggles i ran into with this pack is
there's a lot going on we have arduino
support i found that this light and
sound kit has a speaker that requires a
12 volt source so i had a 12 volt 5 volt
i was kind of splicing wires here and
there and everywhere and really landed
on two separate batteries so i got a
lipo that has a 12 volt and 5 volt
output that powers a sound board lights
an arduino device and then a separate uh
38 000 lamp battery that powers the
pineapple in the pi
and at the bottom here you'll actually
see two switches here those are gonna
independently control each of the
pineapples in the pie so again
when you turn on the pack it doesn't
just draw the battery because those two
devices will drop them down so you can
toggle them on as you need to and i
thought that's kind of a neat little ad
to say okay i want the pineapple i want
the pie now i can taco doesn't control
this
let's see this is all managed again by
connecting to the
management web interface of the
pineapple and then really all i'm using
is the
the pony keys are the piney piece
software that's provided by the wi-fi
pineapple i just skated to throw some
ghostbuster stuff on there i thought it
looked kind of cool but i
haven't really done a whole lot to the
software because everything they do
works really well i'm really happy with
it but yeah just threw some ghostbuster
stuff on there i thought it looked kind
of neat
here's a demo of the pack in action
so you powered it on
that initiates the power on sequence the
cycle trying to start going the lights
start going
the blaster effect
next is the soundtrack sequence
so some ghostbusters specific songs and
beans
[Music]
use the blaster button to cycle between
the sound songs
[Music]
and then lastly the attack mode toggle
that on turns on your led matrix
turns on the
the panel antenna
and that's kind of it
so that's that that's my talk about the
time pack the build why i built such a
thing
follow me on social media w90 checks if
you're into growing if you're the
ghostbusters or anything of that nature
give me a shout and a reminder that mad
second little second 92 are meeting at
the rock bottom shortly after this talk
but no rushing over there so that's all
i have thanks for joining
[Applause]
[Music]
you