xkou

The below instructions describe the process for MITM'ing a target device over HTTPS using nginx. It tries to go over every aspect of intercepting traffic, including hosting a Wifi access point.

Overview

The goal is to get a target device (such as an iPhone, Wii U, or another computer) to trust our local nginx server instead of the remote trusted server. This is going to be done by importing a custom CA root certificate on the target that corresponds with the nginx server's certificate.

Client (Trusted Device) <--> MITM Server (nginx) <--> Remote (Trusted) Server

Requirements

These instructions are being performed on a PureOS machine, which is Debian based. They should also work in other environments with slight modifications

xkou

import asyncio

import tornado.concurrent
import tornado.ioloop
import tornado.web
import tornado.platform.asyncio
import tornado.httpclient

class ReqHandler(tornado.web.RequestHandler):
  async def get(self):

xkou

#Install a 4.3+ kernel from http://kernel.ubuntu.com/~kernel-ppa/mainline, for example:

VER=4.5.1-040501
PREFIX=http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.5.1-wily/
REL=201604121331
wget ${PREFIX}/linux-headers-${VER}-generic_${VER}.${REL}_amd64.deb
wget ${PREFIX}/linux-headers-${VER}_${VER}.${REL}_all.deb
wget ${PREFIX}/linux-image-${VER}-generic_${VER}.${REL}_amd64.deb
sudo dpkg -i linux-*${VER}.${REL}*.deb
# reboot

xkou

# =============== #
# Unity generated #
# =============== #
Temp/
Library/
 
# ===================================== #
# Visual Studio / MonoDevelop generated #
# ===================================== #

xkou

acl all src -n all
http_port 8111 transparent
cache_dir ufs /var/cache/squid 512 16 256
access_log /tmp/1.log squid
pid_filename /tmp/8111.pid

acl breakwall dstdomain .fancyguo.com
acl breakwall dstdomain .external.out

never_direct allow all

xkou

# Kernel sysctl configuration file for Red Hat Linux
#
# For binary values, 0 is disabled, 1 is enabled.  See sysctl(8) and
# sysctl.conf(5) for more details.

# Controls IP packet forwarding
net.ipv4.ip_forward = 0

# Controls source route verification
net.ipv4.conf.default.rp_filter = 1

xkou

#!/bin/sh

if [ "$METHOD" = loopback ]; then
    exit 0
fi

# Only run from ifup.
if [ "$MODE" != start ]; then
    exit 0
fi

xkou

_setip(){
        eth=eth0
        id=$1
        ip link add link $eth name vlan$id address 00:aa:bb:cc:dd:0$id type macvlan
        ifconfig vlan$id 10.1.1.8$id up
        ip route add default dev vlan$id table tab$id

        ip rule add from 10.1.1.8$id lookup tab$id
#       route del -net 0.0.0.0 netmask 0.0.0.0 dev vlan$id
        route del -net 1.0.0.0 netmask 255.0.0.0 dev vlan$id

xkou

import sys
from gevent import server
from gevent.baseserver import _tcp_listener
from gevent import pywsgi
from gevent.monkey import patch_all; patch_all()
from multiprocessing import Process, current_process, cpu_count

def hello_world(env, start_response):
    if env['PATH_INFO'] == '/':
        start_response('200 OK', [('Content-Type', 'text/html')])

xkou

# git clone https://github.com/simpl/ngx_devel_kit.git

cd tengine-2.0.0/

# tell nginx's build system where to find LuaJIT 2.0:
export LUAJIT_LIB=/usr/local/lib
export LUAJIT_INC=/usr/local/include/luajit-2.0/


# Here we assume Nginx is to be installed under /opt/nginx/.