Compare commits
9 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
5e204686fa | ||
|
|
838ea43a73 | ||
|
|
13e51576d5 | ||
|
|
0f8b6d6a66 | ||
|
|
467f40d68a | ||
|
|
7309dfcce6 | ||
|
|
d7c51461f6 | ||
|
|
5d77cb63a3 | ||
|
|
e30a8cad07 |
59
README.md
59
README.md
@@ -5,32 +5,30 @@ This repo is a complete re-write of [`wifite`](https://github.com/derv82/wifite)
|
|||||||
|
|
||||||
Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches!
|
Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches!
|
||||||
|
|
||||||
Wifite is compatible with both `python2` and `python3`.
|
|
||||||
|
|
||||||
Wifite is designed to use all known methods for retrieving the password of a wireless access point (router). These methods include:
|
Wifite is designed to use all known methods for retrieving the password of a wireless access point (router). These methods include:
|
||||||
1. WPS: The [WPS Pixie-Dust attack](https://nakedsecurity.sophos.com/2014/09/02/using-wps-may-be-even-more-dangerous/)
|
1. WPS: The [Offline Pixie-Dust attack](https://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup#Offline_brute-force_attack)
|
||||||
2. WPA: The [WPA Handshake Capture](https://hashcat.net/forum/thread-7717.html) and offline crack.
|
1. WPS: The [Online Brute-Force PIN attack](https://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup#Online_brute-force_attack)
|
||||||
3. WPA: The [PMKID Hash Capture](https://hashcat.net/forum/thread-7717.html) and offline crack.
|
2. WPA: The [WPA Handshake Capture](https://hashcat.net/forum/thread-7717.html) + offline crack.
|
||||||
|
3. WPA: The [PMKID Hash Capture](https://hashcat.net/forum/thread-7717.html) + offline crack.
|
||||||
4. WEP: Various known attacks against WEP, including *fragmentation*, *chop-chop*, *aireplay*, etc.
|
4. WEP: Various known attacks against WEP, including *fragmentation*, *chop-chop*, *aireplay*, etc.
|
||||||
|
|
||||||
Run wifite, select your targets, and Wifite will automatically start trying to capture or crack the password.
|
Run wifite, select your targets, and Wifite will automatically start trying to capture or crack the password.
|
||||||
|
|
||||||
Supported Operating Systems
|
Supported Operating Systems
|
||||||
---------------------------
|
---------------------------
|
||||||
|
|
||||||
Wifite is designed specifically for the latest version of [**Kali** Linux](https://www.kali.org/). [ParrotSec](https://www.parrotsec.org/) is also supported.
|
Wifite is designed specifically for the latest version of [**Kali** Linux](https://www.kali.org/). [ParrotSec](https://www.parrotsec.org/) is also supported.
|
||||||
|
|
||||||
Other pen-testing distributions (such as BackBox) have outdated versions of the tools used by Wifite. Do not expect support unless you are using the latest versions of the *Required Tools*.
|
Other pen-testing distributions (such as BackBox or Ubuntu) have outdated versions of the tools used by Wifite. Do not expect support unless you are using the latest versions of the *Required Tools*, and also [patched wireless drivers that support injection]().
|
||||||
|
|
||||||
Required Tools
|
Required Tools
|
||||||
--------------
|
--------------
|
||||||
|
First and foremost, you will need a wireless card capable of "Monitor Mode" and packet injection (see [this tutorial for checking if your wireless card is compatible](http://www.aircrack-ng.org/doku.php?id=compatible_cards) and also [this guide](https://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup#Offline_brute-force_attack)). There are many cheap wireless cards that plug into USB available from online stores.
|
||||||
First and foremost, you will need a wireless card capable of "Monitor Mode" and packet injection (see [this tutorial for checking if your wireless card is compatible](http://www.aircrack-ng.org/doku.php?id=compatible_cards)). There are many cheap wireless cards that plug into USB available from online stores.
|
|
||||||
|
|
||||||
Second, only the latest versions of these programs are supported and must be installed for Wifite to work properly:
|
Second, only the latest versions of these programs are supported and must be installed for Wifite to work properly:
|
||||||
|
|
||||||
**Required:**
|
**Required:**
|
||||||
|
|
||||||
|
* `python`: Wifite is compatible with both `python2` and `python3`.
|
||||||
* [`iwconfig`](https://wiki.debian.org/iwconfig): For identifying wireless devices already in Monitor Mode.
|
* [`iwconfig`](https://wiki.debian.org/iwconfig): For identifying wireless devices already in Monitor Mode.
|
||||||
* [`ifconfig`](https://en.wikipedia.org/wiki/Ifconfig): For starting/stopping wireless devices.
|
* [`ifconfig`](https://en.wikipedia.org/wiki/Ifconfig): For starting/stopping wireless devices.
|
||||||
* [`Aircrack-ng`](http://aircrack-ng.org/) suite, includes:
|
* [`Aircrack-ng`](http://aircrack-ng.org/) suite, includes:
|
||||||
@@ -43,9 +41,9 @@ Second, only the latest versions of these programs are supported and must be ins
|
|||||||
**Optional, but Recommended:**
|
**Optional, but Recommended:**
|
||||||
|
|
||||||
* [`tshark`](https://www.wireshark.org/docs/man-pages/tshark.html): For detecting WPS networks and inspecting handshake capture files.
|
* [`tshark`](https://www.wireshark.org/docs/man-pages/tshark.html): For detecting WPS networks and inspecting handshake capture files.
|
||||||
* [`reaver`](https://github.com/t6x/reaver-wps-fork-t6x): For WPS Pixie-Dust attacks.
|
* [`reaver`](https://github.com/t6x/reaver-wps-fork-t6x): For WPS Pixie-Dust & brute-force attacks.
|
||||||
* Note: Reaver's `wash` tool can be used to detect WPS networks if `tshark` is not found.
|
* Note: Reaver's `wash` tool can be used to detect WPS networks if `tshark` is not found.
|
||||||
* [`bully`](https://github.com/aanarchyy/bully): For WPS Pixie-Dust attacks.
|
* [`bully`](https://github.com/aanarchyy/bully): For WPS Pixie-Dust & brute-force attacks.
|
||||||
* Alternative to Reaver. Specify `--bully` to use Bully instead of Reaver.
|
* Alternative to Reaver. Specify `--bully` to use Bully instead of Reaver.
|
||||||
* Bully is also used to fetch PSK if `reaver` cannot after cracking WPS PIN.
|
* Bully is also used to fetch PSK if `reaver` cannot after cracking WPS PIN.
|
||||||
* [`coWPAtty`](https://tools.kali.org/wireless-attacks/cowpatty): For detecting handshake captures.
|
* [`coWPAtty`](https://tools.kali.org/wireless-attacks/cowpatty): For detecting handshake captures.
|
||||||
@@ -54,18 +52,17 @@ Second, only the latest versions of these programs are supported and must be ins
|
|||||||
* [`hcxdumptool`](https://github.com/ZerBea/hcxdumptool): For capturing PMKID hashes.
|
* [`hcxdumptool`](https://github.com/ZerBea/hcxdumptool): For capturing PMKID hashes.
|
||||||
* [`hcxpcaptool`](https://github.com/ZerBea/hcxtools): For converting PMKID packet captures into `hashcat`'s format.
|
* [`hcxpcaptool`](https://github.com/ZerBea/hcxtools): For converting PMKID packet captures into `hashcat`'s format.
|
||||||
|
|
||||||
|
|
||||||
Run Wifite
|
Run Wifite
|
||||||
----------
|
----------
|
||||||
|
|
||||||
```
|
```
|
||||||
git clone https://github.com/derv82/wifite2.git
|
git clone https://github.com/derv82/wifite2.git
|
||||||
cd wifite2
|
cd wifite2
|
||||||
python -m wifite
|
sudo ./Wifite.py
|
||||||
```
|
```
|
||||||
|
|
||||||
Install Wifite
|
Install Wifite
|
||||||
--------------
|
--------------
|
||||||
|
|
||||||
To install onto your computer (so you can just run `wifite` from any terminal), run:
|
To install onto your computer (so you can just run `wifite` from any terminal), run:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
@@ -84,24 +81,23 @@ sudo python setup.py install --record files.txt \
|
|||||||
|
|
||||||
Brief Feature List
|
Brief Feature List
|
||||||
------------------
|
------------------
|
||||||
|
|
||||||
* [PMKID hash capture](https://hashcat.net/forum/thread-7717.html) (enabled by-default, force with: `--pmkid`)
|
* [PMKID hash capture](https://hashcat.net/forum/thread-7717.html) (enabled by-default, force with: `--pmkid`)
|
||||||
* Reaver (or `-bully`) WPS Pixie-Dust attack (enabled by-default, force with: `--wps-only`)
|
* WPS Offline Brute-Force Attack aka "Pixie-Dust". (enabled by-default, force with: `--wps-only --pixie`)
|
||||||
* WPA handshake capture (enabled by-default, force with: `--no-wps`)
|
* WPS Online Brute-Force Attack aka "PIN attack". (enabled by-default, force with: `--wps-only --no-pixie`)
|
||||||
|
* WPA/2 Offline Brute-Force Attack via 4-Way Handshake capture (enabled by-default, force with: `--no-wps`)
|
||||||
* Validates handshakes against `pyrit`, `tshark`, `cowpatty`, and `aircrack-ng` (when available)
|
* Validates handshakes against `pyrit`, `tshark`, `cowpatty`, and `aircrack-ng` (when available)
|
||||||
* Various WEP attacks (replay, chopchop, fragment, hirte, p0841, caffe-latte)
|
* Various WEP attacks (replay, chopchop, fragment, hirte, p0841, caffe-latte)
|
||||||
* Automatically decloaks hidden access points while scanning or attacking.
|
* Automatically decloaks hidden access points while scanning or attacking.
|
||||||
* Note: Only works when channel is fixed. Use the `-c <channel>` switch.
|
* Note: Only works when channel is fixed. Use `-c <channel>`
|
||||||
* Disable this via `--no-deauths` switch
|
* Disable this using `--no-deauths`
|
||||||
* 5Ghz support for some wireless cards (via `-5` switch).
|
* 5Ghz support for some wireless cards (via `-5` switch).
|
||||||
* Note: Some tools don't play well on 5GHz channels (e.g. `aireplay-ng`)
|
* Note: Some tools don't play well on 5GHz channels (e.g. `aireplay-ng`)
|
||||||
* Stores cracked passwords and handshakes to the current directory (`--cracked`)
|
* Stores cracked passwords and handshakes to the current directory (`--cracked`)
|
||||||
* Includes metadata about the access point.
|
* Includes information about the cracked access point (Name, BSSID, Date, etc).
|
||||||
* Easy to try to crack handshakes or PMKID hashes against a wordlist (`--crack`)
|
* Easy to try to crack handshakes or PMKID hashes against a wordlist (`--crack`)
|
||||||
|
|
||||||
What's new?
|
What's new?
|
||||||
-----------
|
-----------
|
||||||
|
|
||||||
Comparing this repo to the "old wifite" @ https://github.com/derv82/wifite
|
Comparing this repo to the "old wifite" @ https://github.com/derv82/wifite
|
||||||
|
|
||||||
* **Less bugs**
|
* **Less bugs**
|
||||||
@@ -121,36 +117,35 @@ Comparing this repo to the "old wifite" @ https://github.com/derv82/wifite
|
|||||||
|
|
||||||
What's gone?
|
What's gone?
|
||||||
------------
|
------------
|
||||||
|
|
||||||
* No more WPS PIN attack, because it can take days on-average.
|
|
||||||
* However, this feature may be added back into Wiite2 (See [#90](https://github.com/derv82/wifite2/issues/90))
|
|
||||||
* And the Pixie-Dust attack is still an option.
|
|
||||||
* Some command-line arguments (`--wept`, `--wpst`, and other confusing switches).
|
* Some command-line arguments (`--wept`, `--wpst`, and other confusing switches).
|
||||||
* You can still access some of these obscure options, try `wifite -h -v`
|
* You can still access some of these obscure options, try `wifite -h -v`
|
||||||
|
|
||||||
What's not new?
|
What's not new?
|
||||||
---------------
|
---------------
|
||||||
|
|
||||||
* (Mostly) Backwards compatible with the original `wifite`'s arguments.
|
* (Mostly) Backwards compatible with the original `wifite`'s arguments.
|
||||||
* Same text-based interface everyone knows and loves.
|
* Same text-based interface everyone knows and loves.
|
||||||
|
|
||||||
Screenshots
|
Screenshots
|
||||||
-----------
|
-----------
|
||||||
|
Cracking WPS PIN using `reaver`'s Pixie-Dust attack, then fetching WPA key using `bully`:
|
||||||
|

|
||||||
|
|
||||||
Cracking WPS PIN using `reaver`'s Pixie-Dust attack, then retrieving WPA PSK using `bully`:
|
-------------
|
||||||

|
|
||||||
|
Cracking WPA key using PMKID attack:
|
||||||
|

|
||||||
|
|
||||||
-------------
|
-------------
|
||||||
|
|
||||||
Decloaking & cracking a hidden access point (via the WPA Handshake attack):
|
Decloaking & cracking a hidden access point (via the WPA Handshake attack):
|
||||||

|

|
||||||
|
|
||||||
-------------
|
-------------
|
||||||
|
|
||||||
Cracking a weak WEP password (using the WEP Replay attack):
|
Cracking a weak WEP password (using the WEP Replay attack):
|
||||||

|

|
||||||
|
|
||||||
-------------
|
-------------
|
||||||
|
|
||||||
Various cracking options (using `--crack` option):
|
Cracking a pre-captured handshake using John The Ripper (via the `--crack` option):
|
||||||

|

|
||||||
|
|||||||
@@ -301,11 +301,13 @@ class Arguments(object):
|
|||||||
wpa.add_argument('-pmkid', action='store_true', dest='use_pmkid_only',
|
wpa.add_argument('-pmkid', action='store_true', dest='use_pmkid_only',
|
||||||
help=argparse.SUPPRESS)
|
help=argparse.SUPPRESS)
|
||||||
|
|
||||||
wpa.add_argument('--new-hs',
|
wpa.add_argument('--pmkid-timeout',
|
||||||
action='store_true',
|
action='store',
|
||||||
dest='ignore_old_handshakes',
|
dest='pmkid_timeout',
|
||||||
help=Color.s('Captures new handshakes, ignores existing handshakes ' +
|
metavar='[sec]',
|
||||||
'in ./hs (default: {G}off{W})'))
|
type=int,
|
||||||
|
help=self._verbose('Time to wait for PMKID capture ' +
|
||||||
|
'(default: {G}%d{W} seconds)' % self.config.pmkid_timeout))
|
||||||
|
|
||||||
wpa.add_argument('--hs-dir',
|
wpa.add_argument('--hs-dir',
|
||||||
action='store',
|
action='store',
|
||||||
@@ -317,6 +319,12 @@ class Arguments(object):
|
|||||||
wpa.add_argument('-hs-dir', help=argparse.SUPPRESS, action='store',
|
wpa.add_argument('-hs-dir', help=argparse.SUPPRESS, action='store',
|
||||||
dest='wpa_handshake_dir', type=str)
|
dest='wpa_handshake_dir', type=str)
|
||||||
|
|
||||||
|
wpa.add_argument('--new-hs',
|
||||||
|
action='store_true',
|
||||||
|
dest='ignore_old_handshakes',
|
||||||
|
help=Color.s('Captures new handshakes, ignores existing handshakes ' +
|
||||||
|
'in {C}%s{W} (default: {G}off{W})' % self.config.wpa_handshake_dir))
|
||||||
|
|
||||||
wpa.add_argument('--dict',
|
wpa.add_argument('--dict',
|
||||||
action='store',
|
action='store',
|
||||||
dest='wordlist',
|
dest='wordlist',
|
||||||
|
|||||||
@@ -1,6 +1,10 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
# -*- coding: utf-8 -*-
|
# -*- coding: utf-8 -*-
|
||||||
|
|
||||||
|
from .wep import AttackWEP
|
||||||
|
from .wpa import AttackWPA
|
||||||
|
from .wps import AttackWPS
|
||||||
|
from .pmkid import AttackPMKID
|
||||||
from ..config import Configuration
|
from ..config import Configuration
|
||||||
from ..util.color import Color
|
from ..util.color import Color
|
||||||
|
|
||||||
@@ -12,6 +16,10 @@ class AttackAll(object):
|
|||||||
Attacks all given `targets` (list[wifite.model.target]) until user interruption.
|
Attacks all given `targets` (list[wifite.model.target]) until user interruption.
|
||||||
Returns: Number of targets that were attacked (int)
|
Returns: Number of targets that were attacked (int)
|
||||||
'''
|
'''
|
||||||
|
if any(t.wps for t in targets) and not AttackWPS.can_attack_wps():
|
||||||
|
# Warn that WPS attacks are not available.
|
||||||
|
Color.pl('{!} {O}Note: WPS attacks are not possible because you do not have {C}reaver{O} nor {C}bully{W}')
|
||||||
|
|
||||||
attacked_targets = 0
|
attacked_targets = 0
|
||||||
targets_remaining = len(targets)
|
targets_remaining = len(targets)
|
||||||
for index, target in enumerate(targets, start=1):
|
for index, target in enumerate(targets, start=1):
|
||||||
@@ -36,10 +44,6 @@ class AttackAll(object):
|
|||||||
Attacks a single `target` (wifite.model.target).
|
Attacks a single `target` (wifite.model.target).
|
||||||
Returns: True if attacks should continue, False otherwise.
|
Returns: True if attacks should continue, False otherwise.
|
||||||
'''
|
'''
|
||||||
from .wep import AttackWEP
|
|
||||||
from .wpa import AttackWPA
|
|
||||||
from .wps import AttackWPS
|
|
||||||
from .pmkid import AttackPMKID
|
|
||||||
|
|
||||||
attacks = []
|
attacks = []
|
||||||
|
|
||||||
@@ -54,21 +58,27 @@ class AttackAll(object):
|
|||||||
# WPA can have multiple attack vectors:
|
# WPA can have multiple attack vectors:
|
||||||
|
|
||||||
# WPS
|
# WPS
|
||||||
if target.wps != False:
|
if not Configuration.use_pmkid_only:
|
||||||
|
if target.wps != False and AttackWPS.can_attack_wps():
|
||||||
|
# Pixie-Dust
|
||||||
if Configuration.wps_pixie:
|
if Configuration.wps_pixie:
|
||||||
attacks.append(AttackWPS(target, pixie_dust=True))
|
attacks.append(AttackWPS(target, pixie_dust=True))
|
||||||
|
|
||||||
|
# PIN attack
|
||||||
if Configuration.wps_pin:
|
if Configuration.wps_pin:
|
||||||
attacks.append(AttackWPS(target, pixie_dust=False))
|
attacks.append(AttackWPS(target, pixie_dust=False))
|
||||||
|
|
||||||
|
if not Configuration.wps_only:
|
||||||
# PMKID
|
# PMKID
|
||||||
attacks.append(AttackPMKID(target))
|
attacks.append(AttackPMKID(target))
|
||||||
|
|
||||||
# Handshake capture
|
# Handshake capture
|
||||||
|
if not Configuration.use_pmkid_only:
|
||||||
attacks.append(AttackWPA(target))
|
attacks.append(AttackWPA(target))
|
||||||
|
|
||||||
if len(attacks) == 0:
|
if len(attacks) == 0:
|
||||||
Color.pl('{!} {R}Error: {O}Unable to attack: encryption not WEP or WPA')
|
Color.pl('{!} {R}Error: {O}Unable to attack: no attacks available')
|
||||||
return
|
return True # Keep attacking other targets (skip)
|
||||||
|
|
||||||
while len(attacks) > 0:
|
while len(attacks) > 0:
|
||||||
attack = attacks.pop(0)
|
attack = attacks.pop(0)
|
||||||
@@ -81,8 +91,13 @@ class AttackAll(object):
|
|||||||
continue
|
continue
|
||||||
except KeyboardInterrupt:
|
except KeyboardInterrupt:
|
||||||
Color.pl('\n{!} {O}Interrupted{W}\n')
|
Color.pl('\n{!} {O}Interrupted{W}\n')
|
||||||
if not cls.user_wants_to_continue(targets_remaining, len(attacks)):
|
answer = cls.user_wants_to_continue(targets_remaining, len(attacks))
|
||||||
return False # Stop attacking other targets
|
if answer is True:
|
||||||
|
continue # Keep attacking the same target (continue)
|
||||||
|
elif answer is None:
|
||||||
|
return True # Keep attacking other targets (skip)
|
||||||
|
else:
|
||||||
|
return False # Stop all attacks (exit)
|
||||||
|
|
||||||
if attack.success:
|
if attack.success:
|
||||||
attack.crack_result.save()
|
attack.crack_result.save()
|
||||||
@@ -105,15 +120,30 @@ class AttackAll(object):
|
|||||||
prompt_list.append(Color.s('{C}%d{W} attack(s)' % attacks_remaining))
|
prompt_list.append(Color.s('{C}%d{W} attack(s)' % attacks_remaining))
|
||||||
if targets_remaining > 0:
|
if targets_remaining > 0:
|
||||||
prompt_list.append(Color.s('{C}%d{W} target(s)' % targets_remaining))
|
prompt_list.append(Color.s('{C}%d{W} target(s)' % targets_remaining))
|
||||||
prompt = ' and '.join(prompt_list)
|
prompt = ' and '.join(prompt_list) + ' remain'
|
||||||
Color.pl('{+} %s remain, Do you want to continue?' % prompt)
|
Color.pl('{+} %s' % prompt)
|
||||||
|
|
||||||
prompt = Color.s('{+} Type {G}c{W} to {G}continue{W}' +
|
prompt = '{+} Do you want to'
|
||||||
' or {R}s{W} to {R}stop{W}: ')
|
options = '('
|
||||||
|
|
||||||
|
if attacks_remaining > 0:
|
||||||
|
prompt += ' {G}continue{W} attacking,'
|
||||||
|
options += '{G}C{W}{D}, {W}'
|
||||||
|
|
||||||
|
if targets_remaining > 0:
|
||||||
|
prompt += ' {O}skip{W} to the next target,'
|
||||||
|
options += '{O}s{W}{D}, {W}'
|
||||||
|
|
||||||
|
options += '{R}e{W})'
|
||||||
|
prompt += ' or {R}exit{W} %s? {C}' % options
|
||||||
|
|
||||||
from ..util.input import raw_input
|
from ..util.input import raw_input
|
||||||
if raw_input(prompt).lower().startswith('s'):
|
answer = raw_input(Color.s(prompt)).lower()
|
||||||
return False
|
|
||||||
else:
|
if answer.startswith('s'):
|
||||||
return True
|
return None # Skip
|
||||||
|
elif answer.startswith('e'):
|
||||||
|
return False # Exit
|
||||||
|
else:
|
||||||
|
return True # Continue
|
||||||
|
|
||||||
|
|||||||
@@ -62,12 +62,6 @@ class AttackPMKID(Attack):
|
|||||||
Returns:
|
Returns:
|
||||||
True if handshake is captured. False otherwise.
|
True if handshake is captured. False otherwise.
|
||||||
'''
|
'''
|
||||||
# Skip if user only wants to attack WPS targets
|
|
||||||
if Configuration.wps_only and self.target.wps == False:
|
|
||||||
Color.pl('\r{!} {O}Skipping PMKID attack on {R}%s{O} because {R}--wps-only{O} is set{W}' % self.target.essid)
|
|
||||||
self.success = False
|
|
||||||
return False
|
|
||||||
|
|
||||||
from ..util.process import Process
|
from ..util.process import Process
|
||||||
# Check that we have all hashcat programs
|
# Check that we have all hashcat programs
|
||||||
dependencies = [
|
dependencies = [
|
||||||
@@ -114,7 +108,7 @@ class AttackPMKID(Attack):
|
|||||||
The PMKID hash (str) if found, otherwise None.
|
The PMKID hash (str) if found, otherwise None.
|
||||||
'''
|
'''
|
||||||
self.keep_capturing = True
|
self.keep_capturing = True
|
||||||
self.timer = Timer(15)
|
self.timer = Timer(Configuration.pmkid_timeout)
|
||||||
|
|
||||||
# Start hcxdumptool
|
# Start hcxdumptool
|
||||||
t = Thread(target=self.dumptool_thread)
|
t = Thread(target=self.dumptool_thread)
|
||||||
@@ -174,7 +168,6 @@ class AttackPMKID(Attack):
|
|||||||
Color.clear_entire_line()
|
Color.clear_entire_line()
|
||||||
Color.pattack('PMKID', self.target, '{R}CRACK',
|
Color.pattack('PMKID', self.target, '{R}CRACK',
|
||||||
'{R}Failed {O}Passphrase not found in dictionary.\n')
|
'{R}Failed {O}Passphrase not found in dictionary.\n')
|
||||||
Color.pl('')
|
|
||||||
return False
|
return False
|
||||||
else:
|
else:
|
||||||
# Successfully cracked.
|
# Successfully cracked.
|
||||||
|
|||||||
@@ -3,9 +3,17 @@
|
|||||||
|
|
||||||
from ..model.attack import Attack
|
from ..model.attack import Attack
|
||||||
from ..util.color import Color
|
from ..util.color import Color
|
||||||
|
from ..util.process import Process
|
||||||
from ..config import Configuration
|
from ..config import Configuration
|
||||||
|
from ..tools.bully import Bully
|
||||||
|
from ..tools.reaver import Reaver
|
||||||
|
|
||||||
class AttackWPS(Attack):
|
class AttackWPS(Attack):
|
||||||
|
|
||||||
|
@staticmethod
|
||||||
|
def can_attack_wps():
|
||||||
|
return Reaver.exists() or Bully.exists()
|
||||||
|
|
||||||
def __init__(self, target, pixie_dust=False):
|
def __init__(self, target, pixie_dust=False):
|
||||||
super(AttackWPS, self).__init__(target)
|
super(AttackWPS, self).__init__(target)
|
||||||
self.success = False
|
self.success = False
|
||||||
@@ -36,16 +44,31 @@ class AttackWPS(Attack):
|
|||||||
self.success = False
|
self.success = False
|
||||||
return False
|
return False
|
||||||
|
|
||||||
if Configuration.use_bully:
|
if not Reaver.exists() and Bully.exists():
|
||||||
|
# Use bully if reaver isn't available
|
||||||
return self.run_bully()
|
return self.run_bully()
|
||||||
|
elif self.pixie_dust and not Reaver.is_pixiedust_supported() and Bully.exists():
|
||||||
|
# Use bully if reaver can't do pixie-dust
|
||||||
|
return self.run_bully()
|
||||||
|
elif Configuration.use_bully:
|
||||||
|
# Use bully if asked by user
|
||||||
|
return self.run_bully()
|
||||||
|
elif not Reaver.exists():
|
||||||
|
# Print error if reaver isn't found (bully not available)
|
||||||
|
if self.pixie_dust:
|
||||||
|
Color.pl('\r{!} {R}Skipping WPS Pixie-Dust attack: {O}reaver{R} not found.{W}')
|
||||||
|
else:
|
||||||
|
Color.pl('\r{!} {R}Skipping WPS PIN attack: {O}reaver{R} not found.{W}')
|
||||||
|
return False
|
||||||
|
elif self.pixie_dust and not Reaver.is_pixiedust_supported():
|
||||||
|
# Print error if reaver can't support pixie-dust (bully not available)
|
||||||
|
Color.pl('\r{!} {R}Skipping WPS attack: {O}reaver{R} does not support {O}--pixie-dust{W}')
|
||||||
|
return False
|
||||||
else:
|
else:
|
||||||
return self.run_reaver()
|
return self.run_reaver()
|
||||||
|
|
||||||
return False
|
|
||||||
|
|
||||||
|
|
||||||
def run_bully(self):
|
def run_bully(self):
|
||||||
from ..tools.bully import Bully
|
|
||||||
bully = Bully(self.target, pixie_dust=self.pixie_dust)
|
bully = Bully(self.target, pixie_dust=self.pixie_dust)
|
||||||
bully.run()
|
bully.run()
|
||||||
bully.stop()
|
bully.stop()
|
||||||
@@ -55,8 +78,6 @@ class AttackWPS(Attack):
|
|||||||
|
|
||||||
|
|
||||||
def run_reaver(self):
|
def run_reaver(self):
|
||||||
from ..tools.reaver import Reaver
|
|
||||||
|
|
||||||
reaver = Reaver(self.target, pixie_dust=self.pixie_dust)
|
reaver = Reaver(self.target, pixie_dust=self.pixie_dust)
|
||||||
reaver.run()
|
reaver.run()
|
||||||
self.crack_result = reaver.crack_result
|
self.crack_result = reaver.crack_result
|
||||||
|
|||||||
@@ -8,7 +8,7 @@ from .tools.macchanger import Macchanger
|
|||||||
|
|
||||||
class Configuration(object):
|
class Configuration(object):
|
||||||
''' Stores configuration variables and functions for Wifite. '''
|
''' Stores configuration variables and functions for Wifite. '''
|
||||||
version = '2.2.3'
|
version = '2.2.5'
|
||||||
|
|
||||||
initialized = False # Flag indicating config has been initialized
|
initialized = False # Flag indicating config has been initialized
|
||||||
temp_dir = None # Temporary directory
|
temp_dir = None # Temporary directory
|
||||||
@@ -79,6 +79,7 @@ class Configuration(object):
|
|||||||
cls.wpa_strip_handshake = False # Strip non-handshake packets
|
cls.wpa_strip_handshake = False # Strip non-handshake packets
|
||||||
cls.ignore_old_handshakes = False # Always fetch a new handshake
|
cls.ignore_old_handshakes = False # Always fetch a new handshake
|
||||||
cls.use_pmkid_only = False # Only use PMKID Capture+Crack attack
|
cls.use_pmkid_only = False # Only use PMKID Capture+Crack attack
|
||||||
|
cls.pmkid_timeout = 30 # Time to wait for PMKID capture
|
||||||
|
|
||||||
# Default dictionary for cracking
|
# Default dictionary for cracking
|
||||||
cls.wordlist = None
|
cls.wordlist = None
|
||||||
@@ -148,15 +149,23 @@ class Configuration(object):
|
|||||||
Color.pl('{+} {C}option:{W} using {G}eviltwin attacks{W} against all targets')
|
Color.pl('{+} {C}option:{W} using {G}eviltwin attacks{W} against all targets')
|
||||||
'''
|
'''
|
||||||
|
|
||||||
# Adjust WEP attack list
|
|
||||||
cls.parse_wep_attacks()
|
cls.parse_wep_attacks()
|
||||||
|
|
||||||
|
cls.validate()
|
||||||
|
|
||||||
# Commands
|
# Commands
|
||||||
if args.cracked: cls.show_cracked = True
|
if args.cracked: cls.show_cracked = True
|
||||||
if args.check_handshake: cls.check_handshake = args.check_handshake
|
if args.check_handshake: cls.check_handshake = args.check_handshake
|
||||||
if args.crack_handshake: cls.crack_handshake = True
|
if args.crack_handshake: cls.crack_handshake = True
|
||||||
|
|
||||||
|
|
||||||
|
@classmethod
|
||||||
|
def validate(cls):
|
||||||
|
if cls.use_pmkid_only and cls.wps_only:
|
||||||
|
Color.pl('{!} {R}Bad Configuration:{O} --pmkid and --wps-only are not compatible')
|
||||||
|
raise RuntimeError('Unable to attack networks: --pmkid and --wps-only are not compatible together')
|
||||||
|
|
||||||
|
|
||||||
@classmethod
|
@classmethod
|
||||||
def parse_settings_args(cls, args):
|
def parse_settings_args(cls, args):
|
||||||
'''Parses basic settings/configurations from arguments.'''
|
'''Parses basic settings/configurations from arguments.'''
|
||||||
@@ -299,6 +308,10 @@ class Configuration(object):
|
|||||||
cls.use_pmkid_only = True
|
cls.use_pmkid_only = True
|
||||||
Color.pl('{+} {C}option:{W} will ONLY use {C}PMKID{W} attack on WPA networks')
|
Color.pl('{+} {C}option:{W} will ONLY use {C}PMKID{W} attack on WPA networks')
|
||||||
|
|
||||||
|
if args.pmkid_timeout:
|
||||||
|
cls.pmkid_timeout = args.pmkid_timeout
|
||||||
|
Color.pl('{+} {C}option:{W} will wait {G}%d{W} seconds during {C}PMKID{W} capture')
|
||||||
|
|
||||||
if args.wpa_handshake_dir:
|
if args.wpa_handshake_dir:
|
||||||
cls.wpa_handshake_dir = args.wpa_handshake_dir
|
cls.wpa_handshake_dir = args.wpa_handshake_dir
|
||||||
Color.pl('{+} {C}option:{W} will store handshakes to ' +
|
Color.pl('{+} {C}option:{W} will store handshakes to ' +
|
||||||
@@ -343,6 +356,11 @@ class Configuration(object):
|
|||||||
'(no {O}Pixie-Dust{W}) on targets')
|
'(no {O}Pixie-Dust{W}) on targets')
|
||||||
|
|
||||||
if args.use_bully:
|
if args.use_bully:
|
||||||
|
from tools.bully import Bully
|
||||||
|
if not Bully.exists():
|
||||||
|
Color.pl('{!} {R}Bully not found. Defaulting to {O}reaver{W}')
|
||||||
|
cls.use_bully = False
|
||||||
|
else:
|
||||||
cls.use_bully = args.use_bully
|
cls.use_bully = args.use_bully
|
||||||
Color.pl('{+} {C}option:{W} use {C}bully{W} instead of {C}reaver{W} ' +
|
Color.pl('{+} {C}option:{W} use {C}bully{W} instead of {C}reaver{W} ' +
|
||||||
'for WPS Attacks')
|
'for WPS Attacks')
|
||||||
|
|||||||
@@ -204,7 +204,7 @@ class Airmon(Dependency):
|
|||||||
'''Find the interface put into monitor mode (if any)'''
|
'''Find the interface put into monitor mode (if any)'''
|
||||||
|
|
||||||
# airmon-ng output: (mac80211 monitor mode vif enabled for [phy10]wlan0 on [phy10]wlan0mon)
|
# airmon-ng output: (mac80211 monitor mode vif enabled for [phy10]wlan0 on [phy10]wlan0mon)
|
||||||
enabled_re = re.compile(r'\s*\(mac80211 monitor mode (?:vif )?enabled for [^ ]+ on (?:\[\w+\])?(\w+)\)\s*')
|
enabled_re = re.compile(r'.*\(mac80211 monitor mode (?:vif )?enabled (?:for [^ ]+ )?on (?:\[\w+\])?(\w+)\)?.*')
|
||||||
|
|
||||||
for line in airmon_output.split('\n'):
|
for line in airmon_output.split('\n'):
|
||||||
matches = enabled_re.match(line)
|
matches = enabled_re.match(line)
|
||||||
@@ -359,6 +359,10 @@ class Airmon(Dependency):
|
|||||||
# Can't just pkill network manager; it's a service
|
# Can't just pkill network manager; it's a service
|
||||||
Process(['service', 'network-manager', 'stop']).wait()
|
Process(['service', 'network-manager', 'stop']).wait()
|
||||||
Airmon.killed_network_manager = True
|
Airmon.killed_network_manager = True
|
||||||
|
elif pname == 'avahi-daemon' and Process.exists('service'):
|
||||||
|
Color.pl('{!} {O}stopping avahi-daemon ({R}service avahi-daemon stop{O})')
|
||||||
|
# Can't just pkill avahi-daemon; it's a service
|
||||||
|
Process(['service', 'avahi-daemon', 'stop']).wait()
|
||||||
else:
|
else:
|
||||||
Color.pl('{!} {R}Terminating {O}conflicting process {R}%s{O} (PID {R}%s{O})' % (pname, pid))
|
Color.pl('{!} {R}Terminating {O}conflicting process {R}%s{O} (PID {R}%s{O})' % (pname, pid))
|
||||||
try:
|
try:
|
||||||
@@ -408,7 +412,27 @@ class Airmon(Dependency):
|
|||||||
Color.pl(' {R}cannot restart NetworkManager: {O}systemctl{R} or {O}service{R} not found{W}')
|
Color.pl(' {R}cannot restart NetworkManager: {O}systemctl{R} or {O}service{R} not found{W}')
|
||||||
|
|
||||||
if __name__ == '__main__':
|
if __name__ == '__main__':
|
||||||
Airmon.terminate_conflicting_processes()
|
stdout = '''
|
||||||
|
Found 2 processes that could cause trouble.
|
||||||
|
If airodump-ng, aireplay-ng or airtun-ng stops working after
|
||||||
|
a short period of time, you may want to run 'airmon-ng check kill'
|
||||||
|
|
||||||
|
PID Name
|
||||||
|
5563 avahi-daemon
|
||||||
|
5564 avahi-daemon
|
||||||
|
|
||||||
|
PHY Interface Driver Chipset
|
||||||
|
|
||||||
|
phy0 wlx00c0ca4ecae0 rtl8187 Realtek Semiconductor Corp. RTL8187
|
||||||
|
Interface 15mon is too long for linux so it will be renamed to the old style (wlan#) name.
|
||||||
|
|
||||||
|
(mac80211 monitor mode vif enabled on [phy0]wlan0mon
|
||||||
|
(mac80211 station mode vif disabled for [phy0]wlx00c0ca4ecae0)
|
||||||
|
'''
|
||||||
|
start_iface = Airmon._parse_airmon_start(stdout)
|
||||||
|
print('start_iface from stdout:', start_iface)
|
||||||
|
|
||||||
|
Configuration.initialize(False)
|
||||||
iface = Airmon.ask()
|
iface = Airmon.ask()
|
||||||
(disabled_iface, enabled_iface) = Airmon.stop(iface)
|
(disabled_iface, enabled_iface) = Airmon.stop(iface)
|
||||||
print('Disabled:', disabled_iface)
|
print('Disabled:', disabled_iface)
|
||||||
|
|||||||
@@ -49,7 +49,12 @@ class Bully(Attack, Dependency):
|
|||||||
'--bssid', target.bssid,
|
'--bssid', target.bssid,
|
||||||
'--channel', target.channel,
|
'--channel', target.channel,
|
||||||
#'--detectlock', # Detect WPS lockouts unreported by AP
|
#'--detectlock', # Detect WPS lockouts unreported by AP
|
||||||
#'--force',
|
|
||||||
|
# Restoring session from '/root/.bully/34210901927c.run'
|
||||||
|
# WARNING: WPS checksum was bruteforced in prior session, now autogenerated
|
||||||
|
# Use --force to ignore above warning(s) and continue anyway
|
||||||
|
'--force',
|
||||||
|
|
||||||
'-v', '4',
|
'-v', '4',
|
||||||
Configuration.interface
|
Configuration.interface
|
||||||
])
|
])
|
||||||
|
|||||||
@@ -14,6 +14,12 @@ class Dependency(object):
|
|||||||
)
|
)
|
||||||
|
|
||||||
|
|
||||||
|
@classmethod
|
||||||
|
def exists(cls):
|
||||||
|
from ..util.process import Process
|
||||||
|
return Process.exists(cls.dependency_name)
|
||||||
|
|
||||||
|
|
||||||
@classmethod
|
@classmethod
|
||||||
def run_dependency_check(cls):
|
def run_dependency_check(cls):
|
||||||
from ..util.color import Color
|
from ..util.color import Color
|
||||||
|
|||||||
@@ -8,11 +8,6 @@ class Iwconfig(Dependency):
|
|||||||
dependency_name = 'iwconfig'
|
dependency_name = 'iwconfig'
|
||||||
dependency_url = 'apt-get install wireless-tools'
|
dependency_url = 'apt-get install wireless-tools'
|
||||||
|
|
||||||
@classmethod
|
|
||||||
def exists(cls):
|
|
||||||
from ..util.process import Process
|
|
||||||
return Process.exists('iwconfig')
|
|
||||||
|
|
||||||
|
|
||||||
@classmethod
|
@classmethod
|
||||||
def mode(cls, iface, mode_name):
|
def mode(cls, iface, mode_name):
|
||||||
|
|||||||
@@ -14,9 +14,6 @@ class Pyrit(Dependency):
|
|||||||
def __init__(self):
|
def __init__(self):
|
||||||
pass
|
pass
|
||||||
|
|
||||||
@staticmethod
|
|
||||||
def exists():
|
|
||||||
return Process.exists('pyrit')
|
|
||||||
|
|
||||||
@staticmethod
|
@staticmethod
|
||||||
def bssid_essid_with_handshakes(capfile, bssid=None, essid=None):
|
def bssid_essid_with_handshakes(capfile, bssid=None, essid=None):
|
||||||
|
|||||||
@@ -14,9 +14,6 @@ class Tshark(Dependency):
|
|||||||
def __init__(self):
|
def __init__(self):
|
||||||
pass
|
pass
|
||||||
|
|
||||||
@staticmethod
|
|
||||||
def exists():
|
|
||||||
return Process.exists('tshark')
|
|
||||||
|
|
||||||
@staticmethod
|
@staticmethod
|
||||||
def _extract_src_dst_index_total(line):
|
def _extract_src_dst_index_total(line):
|
||||||
@@ -29,6 +26,7 @@ class Tshark(Dependency):
|
|||||||
(src, dst, index, total) = match.groups()
|
(src, dst, index, total) = match.groups()
|
||||||
return src, dst, index, total
|
return src, dst, index, total
|
||||||
|
|
||||||
|
|
||||||
@staticmethod
|
@staticmethod
|
||||||
def _build_target_client_handshake_map(output, bssid=None):
|
def _build_target_client_handshake_map(output, bssid=None):
|
||||||
# Map of target_ssid,client_ssid -> handshake #s
|
# Map of target_ssid,client_ssid -> handshake #s
|
||||||
|
|||||||
@@ -14,9 +14,6 @@ class Wash(Dependency):
|
|||||||
def __init__(self):
|
def __init__(self):
|
||||||
pass
|
pass
|
||||||
|
|
||||||
@staticmethod
|
|
||||||
def exists():
|
|
||||||
return Process.exists('wash')
|
|
||||||
|
|
||||||
@staticmethod
|
@staticmethod
|
||||||
def check_for_wps_and_update_targets(capfile, targets):
|
def check_for_wps_and_update_targets(capfile, targets):
|
||||||
@@ -62,6 +59,7 @@ class Wash(Dependency):
|
|||||||
else:
|
else:
|
||||||
t.wps = False
|
t.wps = False
|
||||||
|
|
||||||
|
|
||||||
if __name__ == '__main__':
|
if __name__ == '__main__':
|
||||||
test_file = './tests/files/contains_wps_network.cap'
|
test_file = './tests/files/contains_wps_network.cap'
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user