Eduroam siphon

internet2.sh

#!/bin/bash
PATH=/home/aaron/bin:/home/aaron/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin

WPA_CONF="/etc/wpa_supplicant/wpa_supplicant.conf"

wlan="wlp1s0"
en="enp2s0"

# hash passwd with
# echo -n "passwd" | iconv -t utf16le | openssl md4

users=()
users+=("name,netid,macaddr,md4hash")
users+=("name,netid,macaddr,md4hash")
#... etc

nusers=${#users[@]}
userid=$RANDOM%nusers
user=${users[$userid]}

IFS=',' read -ra conf <<< "$user"
name=${conf[0]}
netid=${conf[1]}
mac=${conf[2]}
hash=${conf[3]}

echo "Using user: $name"

#Disconnect
wpa_cli terminate
#killall -HUP wpa_supplicant

#flush rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

echo "Restarting WLAN interface..."

# Bring down interface
ip link set dev "$wlan" down

# Spoof mac
macchanger -m "$mac" "$wlan"

# Bring back up
ip link set dev "$wlan" up

# Do it again to be safe
ifconfig "$wlan" down

# Create new config and save
wpa_config="
ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=0
update_config=1
ap_scan=1

network={
        disabled=0
        auth_alg=OPEN
        ssid=\"eduroam\"

        key_mgmt=WPA-EAP
        proto=WPA RSN
        pairwise=CCMP TKIP
        eap=PEAP
        identity=\"$netid@cornell.edu\"
        password=hash:$hash
        phase1=\"peaplabel=0\"
        phase2=\"auth=MSCHAPV2\"
}
"
echo "$wpa_config" >> "$WPA_CONF"

# Restart wpa_supplicant
wpa_supplicant -B -i "$wlan" -c "$WPA_CONF"
#killall -HUP wpa_supplicant
#wpa_cli reconfigure

# Use antenna 0 in 1x1
#iw phy phy0 set antenna 3 3

# Bring interface back up
ifconfig "$wlan" up


# get new dhcp lease
echo "Requesting DHCP lease..."

dhclient "$wlan"

# Share interface
sysctl -w net.ipv4.ip_forward=1


echo "Configuring NAT..."
# Enable NAT to rewrite srcaddr and destaddt
iptables -t nat -A POSTROUTING -o $wlan -j MASQUERADE
# Allow incoming forwarded packets
iptables -A FORWARD -i $en -o $wlan -m state --state RELATED,ESTABLISHED -j ACCEPT
#iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# Allow outgoing forwarded packets
iptables -A FORWARD -i $en -o $wlan -j ACCEPT

iptables -A INPUT -i $wlan -j ACCEPT


D=$(date '+%Y/%m/%d %H:%M')
echo "At $D, loaded user: $name"