hevnsnt · NoDataFound · Sep 26, 2017 · Sep 26, 2017 · Sep 26, 2017 · Sep 26, 2017
diff --git a/README.md b/README.md
@@ -1,3 +1,17 @@
+
+
+________________
+< I like cotchas >
+----------------
+       \   ^__^
+        \  (23)\_______
+           (__)\       )\/\
+               ||--DEV |
+               ||     ||
+You are on the Dev-OLED Branch of this repository.  This code may use different HTML, libraries and  settings.  Please review before uploading to your cotcha!
+
+![logo](https://i.imgur.com/Hx9rfYm.jpg)
+
 # SecKC ESP8266 Captive Portal and Hacking Challenge
 > The purpose of this project was to create a small and cheap device that helps market and promote SecKC at industry events. The original concept was a device running a form of Wifi Karma, that would respond to all wifi requests and then once connected would serve a "Guerrilla Marketing" page about SecKC. In its first iteration I used a RaspberryPi Zero, running a series of scripts. However the price of the components needed made this a difficult project to "give to the people".  That is where the ESP8266 Came in. For about $5, anyone can make and deploy this device.
 ![logo](http://i.imgur.com/MSpAXfE.jpg)
@@ -12,13 +26,19 @@
 
 ## Table of Contents
 
+- [Libraries](#libraries)
 - [Parts List](#parts-list)
 - [Building Hardware](#hardware-construction)
 - [Firmware](#firmware)
 - [OH SHIT I FUCKED IT UP](#oh-shit-i-fucked-it-up)
 - [References](#references)
 
 
+## Libraries
+Note: Add these to your .piolibdeps directory before you try to build the source.
+
+* Adafruit_GFX [[Link]](https://github.com/adafruit/Adafruit-GFX-Library)
+* Adafruit_SSD1306 [[Link]](https://github.com/adafruit/Adafruit_SSD1306)
 
 ## Parts List
 * ESP8266 Module with 4MB of flash (I used the WeMos D1 Mini) [[Link]](https://www.aliexpress.com/item/D1-mini-Mini-NodeMcu-4M-bytes-Lua-WIFI-Internet-of-Things-development-board-based-ESP8266-by/32642350275.html?spm=a2g0s.9042311.0.0.3Ae9zT)
@@ -73,19 +93,19 @@ You can add/edit the files in the "www" folder to your liking. (Files in the "ww
 This section is for the hackers.  Yep, I fucked mine up a couple times too.  Here is how you fix all the fuck ups. Change to the included ./esptool/ directory.  Don't worry, you can the esptool.py tool to completely erase the ESP8266 and start all over.  The steps would be:
 
 1. Connect the D1 Mini to your computer via the Micro-USB port and discover the serial port that is used. [Sparkfun](https://learn.sparkfun.com/tutorials/terminal-basics/connecting-to-your-device) has an excellent write-up on how to do this if you dont know already.
-2. Open your terminal and change to the included ./esptool/ directory and run: 
+2. Open your terminal and change to the included ./esptool/ directory and run:
 ```sh
 $ ./esptool.py erase_flash`
 ```
 
 
-*Note 1: This assumes you are using OSX or *nix based operating system. If you are running Windows, esptool runs fine but you will need python installed. There are several windows tools available, and a lot of people reference [this page](http://www.pratikpanda.com/completely-format-erase-esp8266-flash-memory/) as a good walk through, but I have not tested it.* 
+*Note 1: This assumes you are using OSX or *nix based operating system. If you are running Windows, esptool runs fine but you will need python installed. There are several windows tools available, and a lot of people reference [this page](http://www.pratikpanda.com/completely-format-erase-esp8266-flash-memory/) as a good walk through, but I have not tested it.*
 
 
 *Note 1: Depending on your setup, you may have to provide the serial port to esptool.  That would look like: `./esptool.py --port /dev/tty.wchusbserial1420 erase_flash`  (Assuming that /dev/tty.wchusbserial1420 is your serial port.  This will be dependant on your system)*
 
 3. Re-Upload the Firmware and SPIFFS content  
-4. High-five yourself for being super awesome 
+4. High-five yourself for being super awesome
 
 ## Game Completion:
 If you complete the game, you will get access to the SecKC-ESP8266 Console. ".

diff --git a/src/seckcESP.ino b/src/seckcESP.ino
@@ -4,6 +4,10 @@
 // - And will get the SecKC Branded Captive Portal, which
 // - has a small hacking challenge embedded in it.
 
+#include <Adafruit_SSD1306.h>
+#include <Adafruit_GFX.h>
+#include <SPI.h>
+#include <Wire.h>
 #include <stdio.h>
 #include <string.h>
 #include <Arduino.h>
@@ -19,6 +23,81 @@
 #include <Ticker.h>
 #include "DNSServer.h"
 
+#define OLED_RESET LED_BUILTIN  //4
+Adafruit_SSD1306 display(OLED_RESET);
+
+static const unsigned char PROGMEM SecKC[] ={
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xe0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0xf8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3f, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xff, 0xff, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0xff, 0xff, 0xf0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1f, 0xff, 0xff, 0xfc, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x7f, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xff, 0xff, 0xff, 0xff, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xff, 0xff, 0xff, 0xff, 0xe0, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x3f, 0xff, 0xff, 0xff, 0xff, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0x00, 0xff, 0xff, 0xff, 0x80, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x01, 0xff, 0xfe, 0x00, 0x07, 0xff, 0xff, 0xc0, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x07, 0xff, 0xfe, 0x00, 0x00, 0x1f, 0xff, 0xf0, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xfc, 0x00, 0x00, 0x1f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xfc, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xfc, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xf0, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xf0, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xf0, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xe0, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xfc, 0x00, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xfc, 0x00, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xc0, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xe0, 0x00, 0x00, 0x03, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xe0, 0x00, 0x00, 0x00, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xe0, 0x00, 0x00, 0x00, 0x1f, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xf0, 0x00, 0x00, 0x06, 0x0f, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xf0, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xf0, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xfc, 0xf0, 0x00, 0x00, 0x0f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xfc, 0x20, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xfc, 0x00, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xfc, 0x00, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xf8, 0x00, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xf0, 0x00, 0x00, 0x00, 0x07, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xe0, 0x00, 0x00, 0x00, 0x3f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0xc0, 0x00, 0x00, 0x00, 0x3f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0x80, 0x00, 0x00, 0x00, 0x3f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x3f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0e, 0x00, 0x00, 0x00, 0x00, 0x7f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x7f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe0, 0x7f, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x79, 0xff, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3f, 0xff, 0xff, 0xe0, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0xff, 0xff, 0x80, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0xff, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xff, 0xff, 0xfc, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xff, 0xff, 0xf0, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0xff, 0xff, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xff, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xff, 0xf8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xff, 0xe0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xff, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xfc, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+};
+
+
+#if (SSD1306_LCDHEIGHT != 64)
+#error("Height incorrect, please fix Adafruit_SSD1306.h!");
+#endif
+
 extern "C"
 {
 #include "user_interface.h"
@@ -362,6 +441,44 @@ int frequency ( char note )
 //***************************************************************************
 void setup ( void )
 {
+  display.begin(SSD1306_SWITCHCAPVCC, 0x3C);
+// Clear the buffer.
+  display.clearDisplay();
+  display.drawBitmap(0, 0,  SecKC, 128, 64, 1);
+  display.display();
+    delay(5000);
+
+  // Clear the buffer.
+  // draw scrolling text
+  // Clear the buffer.
+  display.clearDisplay();
+  display.display();
+  // Clear the buffer.
+  display.setTextSize(1);
+  display.setTextColor(WHITE);
+  display.setCursor(32, 16);
+  display.println("Cotcha'd|");
+
+  display.setTextSize(1);
+  display.setCursor(48, 8);
+  display.println (rrtotal);
+  display.display();
+
+  display.setTextSize(1);
+  display.setCursor(32, 24);
+  display.println("-----------");
+  display.display();
+
+  display.setTextSize(1);
+  display.setCursor(32, 32);
+  display.println ("Game|Active");
+  display.display();
+
+  display.setTextSize(2);
+  display.setCursor(34, 48);
+  display.println ("SecKC");
+  display.display();
+
     uint8_t mac[6];
     char mdnsDomain[] = "";
 
@@ -375,6 +492,8 @@ void setup ( void )
     pinMode ( LED_BUILTIN, OUTPUT );                                        // initialize onboard LED as output
     digitalWrite ( LED_BUILTIN, HIGH );                                     // Turn the LED off by making the voltage HIGH
 
+
+
     // Startup Banner
     dbg_printf (
         "-------------------->>>\n"
@@ -428,6 +547,7 @@ void setup ( void )
 
     setupDNSServer();
 
+
     sprintf ( mdnsDomain, "%s.local", appid );
     dbg_printf ( "Starting mDNS Responder" );
 
@@ -541,6 +661,7 @@ void setupSPIFFS()
 
 void setupDNSServer()
 {
+
     // Setup DNS Server
     // if DNS Server is started with "*" for domain name,
     // it will reply with provided IP to all DNS request
@@ -549,14 +670,21 @@ void setupDNSServer()
     {
         dbg_printf ( "DNS Query [%d]: %s -> %s", remoteIP[3], domain, ipToString ( resolvedIP ).c_str() );
 
-        /*        // connectivitycheck.android.com -> 74.125.21.113
-                if ( strstr(domain, "connectivitycheck.android.com") )
-                    dnsd.overrideIP =  IPAddress(74, 125, 21, 113);
+                // connectivitycheck.android.com -> 74.125.21.113
+                if ( strstr(domain, "captive.apple.com") )
+                dnsd.overrideIP =  IPAddress(1, 3, 3, 7);
+
+
+                // connectivitycheck.android.com -> 74.125.21.113
+                //if ( strstr(domain, "connectivitycheck.android.com") )
+                  //  dnsd.overrideIP =  IPAddress(74, 125, 21, 113);
 
                 // dns.msftncsi.com -> 131.107.255.255
-                if ( strstr(domain, "msftncsi.com") )
-                    dnsd.overrideIP =  IPAddress(131, 107, 255, 255);
-         */
+                //if ( strstr(domain, "msftncsi.com") )
+                  //  dnsd.overrideIP =  IPAddress(131, 107, 255, 255);
+
+
+
     } );
     dnsd.onOverride ( [] ( const IPAddress & remoteIP, const char *domain, const IPAddress & overrideIP )
     {
@@ -574,6 +702,7 @@ void setupHTTPServer()
 
     // Handle requests
     httpd.on ( "/generate_204", onRequest );  //Android captive portal. Maybe not needed. Might be handled by notFound handler.
+    httpd.on ( "/Success.html", onRequest );  //Apple captive portal. Maybe not needed. Might be handled by notFound handler.
     httpd.on ( "/fwlink", onRequest );  //Microsoft captive portal. Maybe not needed. Might be handled by notFound handler.
     httpd.onNotFound ( onRequest );
 
@@ -586,6 +715,10 @@ void setupHTTPServer()
     {
         request->redirect ( "http://1.3.3.7/console.htm" );
     } );
+    httpd.on ( "/Success.html", HTTP_GET, [] ( AsyncWebServerRequest * request )
+    {
+        request->redirect ( "http://1.3.3.7/Success.html" );
+    } );
     httpd.on ( "/console.htm", HTTP_GET, [] ( AsyncWebServerRequest * request )
     {
         if ( strlen ( username ) > 0 && strlen ( password ) > 0 )
@@ -859,6 +992,19 @@ void onTimer ()
     chan_selected = 0;
     state = statemachine::ap_change;
 }
+void testscrolltext(void)
+{
+    display.setTextSize(3);
+    display.setTextColor(WHITE);
+    display.setCursor(10,0);
+    display.clearDisplay();
+    display.println("Hacking in Progress * * * * * CONNECTED ");
+    display.display();
+
+    display.startscrollright(0x00, 0x0F);
+    delay(3000);
+    display.stopscroll();
+}
 
 void eepromLoad()
 {
@@ -1807,8 +1953,13 @@ void client_status ( AsyncWebSocketClient *client )
     struct ip_addr *ip;
     client->printf_P ( PSTR ( "[[b;yellow;]Connected Client(s)]: %d" ),
                        client_count
+
                      );
-    int i = 0;
+	display.setCursor(110, 0);
+	display.println(client_count);
+	display.display();
+
+	  int i = 0;
 
     while ( station != NULL )
     {

diff --git a/www/Success.html b/www/Success.html
@@ -0,0 +1,4 @@
+
+<!-- saved from url=(0025)http://captive.apple.com/ -->
+<html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>Success</title></head><body style="">Success
+</body></html>
diff --git a/www/index.htm b/www/index.htm
@@ -103,7 +103,6 @@
 </head>
 <body onload="trigger()">
 <pre id="descramble"></pre>
-
 <script type="text/javascript">
 // Descramble JavaScript was written by @archwisp
 // Next time you see him, tell him that this is DOPEaf