WebSVN – nexmon – Blame – Rev 1 – /utilities/mdk3/src/mdk3

1

office

1

/*

2

* mdk3, a 802.11 wireless network security testing tool

3

* Just like John the ripper or nmap, now part of most distros,

4

* it is important that the defender of a network can test it using

5

* aggressive tools.... before somebody else does.

6

*

7

* This file contains parts from 'aircrack' project by Cristophe Devine.

*

*

* This program is free software; you can redistribute it and/or modify

12

* it under the terms of the GNU General Public License as published by

13

* the Free Software Foundation; version 2 of the License.

14

*

15

* This program is distributed in the hope that it will be useful,

16

* but WITHOUT ANY WARRANTY; without even the implied warranty of

17

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

18

* GNU General Public License for more details.

19

*

20

* You should have received a copy of the GNU General Public License along

21

* with this program; if not, write to the Free Software Foundation, Inc.,

22

* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

23

*/

24

25

//Using GNU Extension getline(), not ANSI C

26

#define _GNU_SOURCE

27

28

#include <stdio.h>

29

#include <string.h>

30

#include <stdlib.h>

31

#include <errno.h>

32

#include <pthread.h>

33

#include <sys/time.h>

#include <pcap.h>

#include "osdep.h"

#include "debug.h"

#include "helpers.h"

39

#include "mac_addr.h"

40

41

42

#define MAX_APS_TRACKED 100

43

#define MAX_APS_TESTED 100

44

45

# define TIMEVAL_TO_TIMESPEC(tv, ts) { \

46

(ts)->tv_sec = (tv)->tv_sec; \

47

(ts)->tv_nsec = (tv)->tv_usec * 1000; \

48

}

49

50

unsigned char tmpbuf[MAX_PACKET_LENGTH]; // Temp buffer for packet manipulation in send/read_packet

51

unsigned char pkt[MAX_PACKET_LENGTH]; // Space to save generated packet

52

unsigned char pkt_sniff[MAX_PACKET_LENGTH]; // Space to save sniffed packets

53

unsigned char pkt_check[MAX_PACKET_LENGTH]; // Space to save sniffed packets to check success

54

unsigned char aps_known[MAX_APS_TRACKED][ETHER_ADDR_LEN]; // Array to save MACs of known APs

55

int aps_known_count = 0; // Number of known APs

56

unsigned char auth[MAX_APS_TESTED][ETHER_ADDR_LEN]; // Array to save MACs of APs currently under test

57

int auths[MAX_APS_TESTED][4]; // Array to save status of APs under test

58

unsigned char *pkt_amok = NULL; // Pointer to packet for deauth mode

59

unsigned char *target = NULL; // Target for SSID Bruteforce / Intelligent Auth DoS

60

int exit_now = 0; // Tells main thread to exit

61

int ssid_len = 0; // Length of SSID used in Bruteforce mode

62

int ssid_eof = 0; // Tell other threads, SSID file has reached EOF

63

char brute_mode; // Which ASCII-characters should be used

64

char *brute_ssid; // SSID in Bruteforce mode

65

unsigned int end = 0; // Has Bruteforce mode tried all possibilities?

66

unsigned int turns = 0; // Number of tried SSIDs

67

unsigned int max_permutations = 1; // Number of SSIDs possible

68

int real_brute = 0; // use Bruteforce mode?

69

int init_intelligent = 0; // Is intelligent_auth_dos initialized?

70

int init_intelligent_data = 0; // Is its data list initialized?

71

int we_got_data = 0; // Sniffer thread tells generator thread if there is any data

72

struct ether_addr mac_base; // First three bytes of adress given for bruteforcing MAC filter

73

struct ether_addr mac_lower; // Last three bytes of adress for Bruteforcing MAC filter

74

int mac_b_init = 0; // Initializer for MAC bruteforcer

75

static pthread_mutex_t has_packet_mutex; // Used for condition below

76

static pthread_cond_t has_packet; // Pthread Condition "Packet ready"

77

int has_packet_really = 0;                   // Since the above condition has a timeout we want to use, we need another int here

78

static pthread_mutex_t clear_packet_mutex; // Used for condition below

79

static pthread_cond_t clear_packet; // Pthread Condition "Buffer cleared, get next packet"

80

struct timeval tv_dyntimeout; // Dynamic timeout for MAC bruteforcer

81

int mac_brute_speed = 0; // MAC Bruteforcer Speed-o-meter

82

int mac_brute_timeouts = 0; // Timeout counter for MAC Bruteforcer

83

int hopper_seconds = 1; // Default time for channel hopper to stay on one channel

84

int wpad_cycles = 0, wpad_auth = 0;          // Counters for WPA downgrade: completed deauth cycles, sniffed 802.1x auth packets

85

int wpad_wep = 0, wpad_beacons = 0;          // Counters for WPA downgrade: sniffed WEP/open packets, sniffed beacons/sec

"TEST MODES:\n"

"f - MAC filter bruteforce mode\n"

92

" This test uses a list of known client MAC Adresses and tries to\n"

93

" authenticate them to the given AP while dynamically changing\n"

94

" its response timeout for best performance. It currently works only\n"

95

" on APs who deny an open authentication request properly\n"

96

"g - WPA Downgrade test\n"

97

" deauthenticates Stations and APs sending WPA encrypted packets.\n"

98

" With this test you can check if the sysadmin will try setting his\n"

99

" network to WEP or disable encryption. More effective in\n"

100

" combination with social engineering.\n";

101

102

char use_macb[]="f - MAC filter bruteforce mode\n"

103

" This test uses a list of known client MAC Adresses and tries to\n"

104

" authenticate them to the given AP while dynamically changing\n"

105

" its response timeout for best performance. It currently works only\n"

106

" on APs who deny an open authentication request properly\n"

" -t <bssid>\n"

" Target BSSID\n"

" -m <mac>\n"

" Set the MAC adress range to use (3 bytes, i.e. 00:12:34)\n"

111

" Without -m, the internal database will be used\n"

112

" -f <mac>\n"

113

" Set the MAC adress to begin bruteforcing with\n"

114

" (Note: You can't use -f and -m at the same time)\n";

115

116

char use_wpad[]="g - WPA Downgrade test\n"

117

" deauthenticates Stations and APs sending WPA encrypted packets.\n"

118

" With this test you can check if the sysadmin will try setting his\n"

119

" network to WEP or disable encryption. mdk3 will let WEP and unencrypted\n"

120

" clients work, so if the sysadmin simply thinks \"WPA is broken\" he\n"

121

" sure isn't the right one for this job.\n"

122

" (this can/should be combined with social engineering)\n"

123

" -t <bssid>\n"

124

" Target network\n";

125

126

127

/* Sniffing Functions */

128

129

//ATTACK MAC filter bruteforce

130

void mac_bruteforce_sniffer()

131

{

132

int plen = 0;

133

int interesting_packet;

134

static unsigned char last_mac[6] = "\x00\x00\x00\x00\x00\x00";

135

// static unsigned char ack[10] = "\xd4\x00\x00\x00\x00\x00\x00\x00\x00\x00";

while(1) {

do {

interesting_packet = 1;

140

//Read packet

141

plen = osdep_read_packet(pkt_sniff, MAX_PACKET_LENGTH);

142

//is this an auth response packet?

143

if (pkt_sniff[0] != 0xb0) interesting_packet = 0;

144

//is it from our target

145

if (! is_from_target_ap(target, pkt_sniff)) interesting_packet = 0;

146

//is it a retry?

147

if (! memcmp(last_mac, pkt_sniff+4, 6)) interesting_packet = 0;

148

} while (! interesting_packet);

149

//Buffering MAC to drop retry frames later

150

memcpy(last_mac, pkt_sniff+4, 6);

151

152

//SPEEDUP: (Doesn't work??) Send ACK frame to prevent AP from blocking the channel with retries

153

/* memcpy(ack+4, target, 6);

154

osdep_send_packet(ack, 10);

*/

//Set has_packet

has_packet_really = 1;

159

//Send condition

160

pthread_cond_signal(&has_packet);

161

//Wait for packet to be cleared

162

pthread_cond_wait (&clear_packet, &clear_packet_mutex);

}

}

/* ZERO_CHAOS says: if you want to make the WIDS vendors hate you

169