From 2fe19675fc5752ae40a98314942afc8afbefb020 Mon Sep 17 00:00:00 2001 From: Cory Kennedy Date: Tue, 26 Sep 2017 11:55:35 -0500 Subject: [PATCH 1/5] Dev-OLED Branch Initial Commit --- README.md | 29 ++++++++- src/seckcESP.ino | 165 +++++++++++++++++++++++++++++++++++++++++++++-- www/Success.html | 4 ++ www/index.htm | 1 - 4 files changed, 188 insertions(+), 11 deletions(-) create mode 100644 www/Success.html diff --git a/README.md b/README.md index bad2bfc..9bdce36 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,20 @@ +#_________ ____________________________ ___ ___ _____ ________ _______________ ____ +#\_ ___ \ \_____ \__ ___/\_ ___ \ / | \ / _ \ \______ \ \_ _____/\ \ / / +#/ \ \/ / | \| | / \ \// ~ \/ /_\ \ | | \ | __)_ \ Y / +#\ \____/ | \ | \ \___\ Y / | \ | ` \| \ \ / +# \______ /\_______ /____| \______ /\___|_ /\____|__ / /_______ /_______ / \___/ +# \/ \/ \/ \/ \/ \/ \/ + +#________________ +#< I like cotchas > +#---------------- +# \ ^__^ +# \ (oo)\_______ +# (__)\ )\/\ +# ||---23 | +# || || +#You are on the Dev-OLED Branch of this repository. This code may use different HTML, libraries and settings. Please review before uploading to your cotcha! + # SecKC ESP8266 Captive Portal and Hacking Challenge > The purpose of this project was to create a small and cheap device that helps market and promote SecKC at industry events. The original concept was a device running a form of Wifi Karma, that would respond to all wifi requests and then once connected would serve a "Guerrilla Marketing" page about SecKC. In its first iteration I used a RaspberryPi Zero, running a series of scripts. However the price of the components needed made this a difficult project to "give to the people". That is where the ESP8266 Came in. For about $5, anyone can make and deploy this device. ![logo](http://i.imgur.com/MSpAXfE.jpg) @@ -12,6 +29,7 @@ ## Table of Contents +- [Libraries](#libraries) - [Parts List](#parts-list) - [Building Hardware](#hardware-construction) - [Firmware](#firmware) @@ -19,6 +37,11 @@ - [References](#references) +## Libraries +Note: Add these to your .piolibdeps directory before you try to build the source. + +* Adafruit_GFX [[Link]](https://github.com/adafruit/Adafruit-GFX-Library) +* Adafruit_SSD1306 [[Link]](https://github.com/adafruit/Adafruit_SSD1306) ## Parts List * ESP8266 Module with 4MB of flash (I used the WeMos D1 Mini) [[Link]](https://www.aliexpress.com/item/D1-mini-Mini-NodeMcu-4M-bytes-Lua-WIFI-Internet-of-Things-development-board-based-ESP8266-by/32642350275.html?spm=a2g0s.9042311.0.0.3Ae9zT) @@ -73,19 +96,19 @@ You can add/edit the files in the "www" folder to your liking. (Files in the "ww This section is for the hackers. Yep, I fucked mine up a couple times too. Here is how you fix all the fuck ups. Change to the included ./esptool/ directory. Don't worry, you can the esptool.py tool to completely erase the ESP8266 and start all over. The steps would be: 1. Connect the D1 Mini to your computer via the Micro-USB port and discover the serial port that is used. [Sparkfun](https://learn.sparkfun.com/tutorials/terminal-basics/connecting-to-your-device) has an excellent write-up on how to do this if you dont know already. -2. Open your terminal and change to the included ./esptool/ directory and run: +2. Open your terminal and change to the included ./esptool/ directory and run: ```sh $ ./esptool.py erase_flash` ``` -*Note 1: This assumes you are using OSX or *nix based operating system. If you are running Windows, esptool runs fine but you will need python installed. There are several windows tools available, and a lot of people reference [this page](http://www.pratikpanda.com/completely-format-erase-esp8266-flash-memory/) as a good walk through, but I have not tested it.* +*Note 1: This assumes you are using OSX or *nix based operating system. If you are running Windows, esptool runs fine but you will need python installed. There are several windows tools available, and a lot of people reference [this page](http://www.pratikpanda.com/completely-format-erase-esp8266-flash-memory/) as a good walk through, but I have not tested it.* *Note 1: Depending on your setup, you may have to provide the serial port to esptool. That would look like: `./esptool.py --port /dev/tty.wchusbserial1420 erase_flash` (Assuming that /dev/tty.wchusbserial1420 is your serial port. This will be dependant on your system)* 3. Re-Upload the Firmware and SPIFFS content -4. High-five yourself for being super awesome +4. High-five yourself for being super awesome ## Game Completion: If you complete the game, you will get access to the SecKC-ESP8266 Console. ". diff --git a/src/seckcESP.ino b/src/seckcESP.ino index 235d417..a3fd23b 100644 --- a/src/seckcESP.ino +++ b/src/seckcESP.ino @@ -4,6 +4,10 @@ // - And will get the SecKC Branded Captive Portal, which // - has a small hacking challenge embedded in it. +#include +#include +#include +#include #include #include #include @@ -19,6 +23,81 @@ #include #include "DNSServer.h" +#define OLED_RESET LED_BUILTIN //4 +Adafruit_SSD1306 display(OLED_RESET); + +static const unsigned char PROGMEM SecKC[] ={ +0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xe0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0xf8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3f, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xff, 0xff, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0xff, 0xff, 0xf0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1f, 0xff, 0xff, 0xfc, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x7f, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xff, 0xff, 0xff, 0xff, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xff, 0xff, 0xff, 0xff, 0xe0, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x3f, 0xff, 0xff, 0xff, 0xff, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0x00, 0xff, 0xff, 0xff, 0x80, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x01, 0xff, 0xfe, 0x00, 0x07, 0xff, 0xff, 0xc0, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x07, 0xff, 0xfe, 0x00, 0x00, 0x1f, 0xff, 0xf0, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xfc, 0x00, 0x00, 0x1f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xfc, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xfc, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xf0, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xf0, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xf0, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xe0, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xfc, 0x00, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xfc, 0x00, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xc0, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xe0, 0x00, 0x00, 0x03, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xe0, 0x00, 0x00, 0x00, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xe0, 0x00, 0x00, 0x00, 0x1f, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xf0, 0x00, 0x00, 0x06, 0x0f, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xf0, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xf0, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xfc, 0xf0, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xfc, 0x20, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xfc, 0x00, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xfc, 0x00, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xf8, 0x00, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xf0, 0x00, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xe0, 0x00, 0x00, 0x00, 0x3f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0xc0, 0x00, 0x00, 0x00, 0x3f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0x80, 0x00, 0x00, 0x00, 0x3f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x3f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0e, 0x00, 0x00, 0x00, 0x00, 0x7f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x7f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe0, 0x7f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x79, 0xff, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3f, 0xff, 0xff, 0xe0, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xff, 0x80, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0xff, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xff, 0xff, 0xfc, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xff, 0xff, 0xf0, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0xff, 0xff, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xff, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xff, 0xe0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xff, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xfc, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 +}; + + +#if (SSD1306_LCDHEIGHT != 64) +#error("Height incorrect, please fix Adafruit_SSD1306.h!"); +#endif + extern "C" { #include "user_interface.h" @@ -362,6 +441,44 @@ int frequency ( char note ) //*************************************************************************** void setup ( void ) { + display.begin(SSD1306_SWITCHCAPVCC, 0x3C); +// Clear the buffer. + display.clearDisplay(); + display.drawBitmap(0, 0, SecKC, 128, 64, 1); + display.display(); + delay(5000); + + // Clear the buffer. + // draw scrolling text + // Clear the buffer. + display.clearDisplay(); + display.display(); + // Clear the buffer. + display.setTextSize(1); + display.setTextColor(WHITE); + display.setCursor(32, 16); + display.println("Cotcha'd|"); + + display.setTextSize(1); + display.setCursor(48, 8); + display.println (rrtotal); + display.display(); + + display.setTextSize(1); + display.setCursor(32, 24); + display.println("-----------"); + display.display(); + + display.setTextSize(1); + display.setCursor(32, 32); + display.println ("Game|Active"); + display.display(); + + display.setTextSize(2); + display.setCursor(34, 48); + display.println ("SecKC"); + display.display(); + uint8_t mac[6]; char mdnsDomain[] = ""; @@ -375,6 +492,8 @@ void setup ( void ) pinMode ( LED_BUILTIN, OUTPUT ); // initialize onboard LED as output digitalWrite ( LED_BUILTIN, HIGH ); // Turn the LED off by making the voltage HIGH + + // Startup Banner dbg_printf ( "-------------------->>>\n" @@ -428,6 +547,7 @@ void setup ( void ) setupDNSServer(); + sprintf ( mdnsDomain, "%s.local", appid ); dbg_printf ( "Starting mDNS Responder" ); @@ -541,6 +661,7 @@ void setupSPIFFS() void setupDNSServer() { + // Setup DNS Server // if DNS Server is started with "*" for domain name, // it will reply with provided IP to all DNS request @@ -549,14 +670,21 @@ void setupDNSServer() { dbg_printf ( "DNS Query [%d]: %s -> %s", remoteIP[3], domain, ipToString ( resolvedIP ).c_str() ); - /* // connectivitycheck.android.com -> 74.125.21.113 - if ( strstr(domain, "connectivitycheck.android.com") ) - dnsd.overrideIP = IPAddress(74, 125, 21, 113); + // connectivitycheck.android.com -> 74.125.21.113 + if ( strstr(domain, "captive.apple.com") ) + dnsd.overrideIP = IPAddress(1, 3, 3, 7); + + + // connectivitycheck.android.com -> 74.125.21.113 + //if ( strstr(domain, "connectivitycheck.android.com") ) + // dnsd.overrideIP = IPAddress(74, 125, 21, 113); // dns.msftncsi.com -> 131.107.255.255 - if ( strstr(domain, "msftncsi.com") ) - dnsd.overrideIP = IPAddress(131, 107, 255, 255); - */ + //if ( strstr(domain, "msftncsi.com") ) + // dnsd.overrideIP = IPAddress(131, 107, 255, 255); + + + } ); dnsd.onOverride ( [] ( const IPAddress & remoteIP, const char *domain, const IPAddress & overrideIP ) { @@ -574,6 +702,7 @@ void setupHTTPServer() // Handle requests httpd.on ( "/generate_204", onRequest ); //Android captive portal. Maybe not needed. Might be handled by notFound handler. + httpd.on ( "/Success.html", onRequest ); //Apple captive portal. Maybe not needed. Might be handled by notFound handler. httpd.on ( "/fwlink", onRequest ); //Microsoft captive portal. Maybe not needed. Might be handled by notFound handler. httpd.onNotFound ( onRequest ); @@ -586,6 +715,10 @@ void setupHTTPServer() { request->redirect ( "http://1.3.3.7/console.htm" ); } ); + httpd.on ( "/Success.html", HTTP_GET, [] ( AsyncWebServerRequest * request ) + { + request->redirect ( "http://1.3.3.7/Success.html" ); + } ); httpd.on ( "/console.htm", HTTP_GET, [] ( AsyncWebServerRequest * request ) { if ( strlen ( username ) > 0 && strlen ( password ) > 0 ) @@ -859,6 +992,19 @@ void onTimer () chan_selected = 0; state = statemachine::ap_change; } +void testscrolltext(void) +{ + display.setTextSize(3); + display.setTextColor(WHITE); + display.setCursor(10,0); + display.clearDisplay(); + display.println("Hacking in Progress * * * * * CONNECTED "); + display.display(); + + display.startscrollright(0x00, 0x0F); + delay(3000); + display.stopscroll(); +} void eepromLoad() { @@ -1807,8 +1953,13 @@ void client_status ( AsyncWebSocketClient *client ) struct ip_addr *ip; client->printf_P ( PSTR ( "[[b;yellow;]Connected Client(s)]: %d" ), client_count + ); - int i = 0; + display.setCursor(110, 0); + display.println(client_count); + display.display(); + + int i = 0; while ( station != NULL ) { diff --git a/www/Success.html b/www/Success.html new file mode 100644 index 0000000..0f58a24 --- /dev/null +++ b/www/Success.html @@ -0,0 +1,4 @@ + + +SuccessSuccess + \ No newline at end of file diff --git a/www/index.htm b/www/index.htm index b56683a..4463e61 100755 --- a/www/index.htm +++ b/www/index.htm @@ -103,7 +103,6 @@ 

-