Compare commits
9 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
5e204686fa | ||
|
|
838ea43a73 | ||
|
|
13e51576d5 | ||
|
|
0f8b6d6a66 | ||
|
|
467f40d68a | ||
|
|
7309dfcce6 | ||
|
|
d7c51461f6 | ||
|
|
5d77cb63a3 | ||
|
|
e30a8cad07 |
59
README.md
59
README.md
@@ -5,32 +5,30 @@ This repo is a complete re-write of [`wifite`](https://github.com/derv82/wifite)
|
||||
|
||||
Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches!
|
||||
|
||||
Wifite is compatible with both `python2` and `python3`.
|
||||
|
||||
Wifite is designed to use all known methods for retrieving the password of a wireless access point (router). These methods include:
|
||||
1. WPS: The [WPS Pixie-Dust attack](https://nakedsecurity.sophos.com/2014/09/02/using-wps-may-be-even-more-dangerous/)
|
||||
2. WPA: The [WPA Handshake Capture](https://hashcat.net/forum/thread-7717.html) and offline crack.
|
||||
3. WPA: The [PMKID Hash Capture](https://hashcat.net/forum/thread-7717.html) and offline crack.
|
||||
1. WPS: The [Offline Pixie-Dust attack](https://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup#Offline_brute-force_attack)
|
||||
1. WPS: The [Online Brute-Force PIN attack](https://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup#Online_brute-force_attack)
|
||||
2. WPA: The [WPA Handshake Capture](https://hashcat.net/forum/thread-7717.html) + offline crack.
|
||||
3. WPA: The [PMKID Hash Capture](https://hashcat.net/forum/thread-7717.html) + offline crack.
|
||||
4. WEP: Various known attacks against WEP, including *fragmentation*, *chop-chop*, *aireplay*, etc.
|
||||
|
||||
Run wifite, select your targets, and Wifite will automatically start trying to capture or crack the password.
|
||||
|
||||
Supported Operating Systems
|
||||
---------------------------
|
||||
|
||||
Wifite is designed specifically for the latest version of [**Kali** Linux](https://www.kali.org/). [ParrotSec](https://www.parrotsec.org/) is also supported.
|
||||
|
||||
Other pen-testing distributions (such as BackBox) have outdated versions of the tools used by Wifite. Do not expect support unless you are using the latest versions of the *Required Tools*.
|
||||
Other pen-testing distributions (such as BackBox or Ubuntu) have outdated versions of the tools used by Wifite. Do not expect support unless you are using the latest versions of the *Required Tools*, and also [patched wireless drivers that support injection]().
|
||||
|
||||
Required Tools
|
||||
--------------
|
||||
|
||||
First and foremost, you will need a wireless card capable of "Monitor Mode" and packet injection (see [this tutorial for checking if your wireless card is compatible](http://www.aircrack-ng.org/doku.php?id=compatible_cards)). There are many cheap wireless cards that plug into USB available from online stores.
|
||||
First and foremost, you will need a wireless card capable of "Monitor Mode" and packet injection (see [this tutorial for checking if your wireless card is compatible](http://www.aircrack-ng.org/doku.php?id=compatible_cards) and also [this guide](https://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup#Offline_brute-force_attack)). There are many cheap wireless cards that plug into USB available from online stores.
|
||||
|
||||
Second, only the latest versions of these programs are supported and must be installed for Wifite to work properly:
|
||||
|
||||
**Required:**
|
||||
|
||||
* `python`: Wifite is compatible with both `python2` and `python3`.
|
||||
* [`iwconfig`](https://wiki.debian.org/iwconfig): For identifying wireless devices already in Monitor Mode.
|
||||
* [`ifconfig`](https://en.wikipedia.org/wiki/Ifconfig): For starting/stopping wireless devices.
|
||||
* [`Aircrack-ng`](http://aircrack-ng.org/) suite, includes:
|
||||
@@ -43,9 +41,9 @@ Second, only the latest versions of these programs are supported and must be ins
|
||||
**Optional, but Recommended:**
|
||||
|
||||
* [`tshark`](https://www.wireshark.org/docs/man-pages/tshark.html): For detecting WPS networks and inspecting handshake capture files.
|
||||
* [`reaver`](https://github.com/t6x/reaver-wps-fork-t6x): For WPS Pixie-Dust attacks.
|
||||
* [`reaver`](https://github.com/t6x/reaver-wps-fork-t6x): For WPS Pixie-Dust & brute-force attacks.
|
||||
* Note: Reaver's `wash` tool can be used to detect WPS networks if `tshark` is not found.
|
||||
* [`bully`](https://github.com/aanarchyy/bully): For WPS Pixie-Dust attacks.
|
||||
* [`bully`](https://github.com/aanarchyy/bully): For WPS Pixie-Dust & brute-force attacks.
|
||||
* Alternative to Reaver. Specify `--bully` to use Bully instead of Reaver.
|
||||
* Bully is also used to fetch PSK if `reaver` cannot after cracking WPS PIN.
|
||||
* [`coWPAtty`](https://tools.kali.org/wireless-attacks/cowpatty): For detecting handshake captures.
|
||||
@@ -54,18 +52,17 @@ Second, only the latest versions of these programs are supported and must be ins
|
||||
* [`hcxdumptool`](https://github.com/ZerBea/hcxdumptool): For capturing PMKID hashes.
|
||||
* [`hcxpcaptool`](https://github.com/ZerBea/hcxtools): For converting PMKID packet captures into `hashcat`'s format.
|
||||
|
||||
|
||||
Run Wifite
|
||||
----------
|
||||
|
||||
```
|
||||
git clone https://github.com/derv82/wifite2.git
|
||||
cd wifite2
|
||||
python -m wifite
|
||||
sudo ./Wifite.py
|
||||
```
|
||||
|
||||
Install Wifite
|
||||
--------------
|
||||
|
||||
To install onto your computer (so you can just run `wifite` from any terminal), run:
|
||||
|
||||
```bash
|
||||
@@ -84,24 +81,23 @@ sudo python setup.py install --record files.txt \
|
||||
|
||||
Brief Feature List
|
||||
------------------
|
||||
|
||||
* [PMKID hash capture](https://hashcat.net/forum/thread-7717.html) (enabled by-default, force with: `--pmkid`)
|
||||
* Reaver (or `-bully`) WPS Pixie-Dust attack (enabled by-default, force with: `--wps-only`)
|
||||
* WPA handshake capture (enabled by-default, force with: `--no-wps`)
|
||||
* WPS Offline Brute-Force Attack aka "Pixie-Dust". (enabled by-default, force with: `--wps-only --pixie`)
|
||||
* WPS Online Brute-Force Attack aka "PIN attack". (enabled by-default, force with: `--wps-only --no-pixie`)
|
||||
* WPA/2 Offline Brute-Force Attack via 4-Way Handshake capture (enabled by-default, force with: `--no-wps`)
|
||||
* Validates handshakes against `pyrit`, `tshark`, `cowpatty`, and `aircrack-ng` (when available)
|
||||
* Various WEP attacks (replay, chopchop, fragment, hirte, p0841, caffe-latte)
|
||||
* Automatically decloaks hidden access points while scanning or attacking.
|
||||
* Note: Only works when channel is fixed. Use the `-c <channel>` switch.
|
||||
* Disable this via `--no-deauths` switch
|
||||
* Note: Only works when channel is fixed. Use `-c <channel>`
|
||||
* Disable this using `--no-deauths`
|
||||
* 5Ghz support for some wireless cards (via `-5` switch).
|
||||
* Note: Some tools don't play well on 5GHz channels (e.g. `aireplay-ng`)
|
||||
* Stores cracked passwords and handshakes to the current directory (`--cracked`)
|
||||
* Includes metadata about the access point.
|
||||
* Includes information about the cracked access point (Name, BSSID, Date, etc).
|
||||
* Easy to try to crack handshakes or PMKID hashes against a wordlist (`--crack`)
|
||||
|
||||
What's new?
|
||||
-----------
|
||||
|
||||
Comparing this repo to the "old wifite" @ https://github.com/derv82/wifite
|
||||
|
||||
* **Less bugs**
|
||||
@@ -121,36 +117,35 @@ Comparing this repo to the "old wifite" @ https://github.com/derv82/wifite
|
||||
|
||||
What's gone?
|
||||
------------
|
||||
|
||||
* No more WPS PIN attack, because it can take days on-average.
|
||||
* However, this feature may be added back into Wiite2 (See [#90](https://github.com/derv82/wifite2/issues/90))
|
||||
* And the Pixie-Dust attack is still an option.
|
||||
* Some command-line arguments (`--wept`, `--wpst`, and other confusing switches).
|
||||
* You can still access some of these obscure options, try `wifite -h -v`
|
||||
|
||||
What's not new?
|
||||
---------------
|
||||
|
||||
* (Mostly) Backwards compatible with the original `wifite`'s arguments.
|
||||
* Same text-based interface everyone knows and loves.
|
||||
|
||||
Screenshots
|
||||
-----------
|
||||
Cracking WPS PIN using `reaver`'s Pixie-Dust attack, then fetching WPA key using `bully`:
|
||||

|
||||
|
||||
Cracking WPS PIN using `reaver`'s Pixie-Dust attack, then retrieving WPA PSK using `bully`:
|
||||

|
||||
-------------
|
||||
|
||||
Cracking WPA key using PMKID attack:
|
||||

|
||||
|
||||
-------------
|
||||
|
||||
Decloaking & cracking a hidden access point (via the WPA Handshake attack):
|
||||

|
||||

|
||||
|
||||
-------------
|
||||
|
||||
Cracking a weak WEP password (using the WEP Replay attack):
|
||||

|
||||

|
||||
|
||||
-------------
|
||||
|
||||
Various cracking options (using `--crack` option):
|
||||

|
||||
Cracking a pre-captured handshake using John The Ripper (via the `--crack` option):
|
||||

|
||||
|
||||
@@ -301,11 +301,13 @@ class Arguments(object):
|
||||
wpa.add_argument('-pmkid', action='store_true', dest='use_pmkid_only',
|
||||
help=argparse.SUPPRESS)
|
||||
|
||||
wpa.add_argument('--new-hs',
|
||||
action='store_true',
|
||||
dest='ignore_old_handshakes',
|
||||
help=Color.s('Captures new handshakes, ignores existing handshakes ' +
|
||||
'in ./hs (default: {G}off{W})'))
|
||||
wpa.add_argument('--pmkid-timeout',
|
||||
action='store',
|
||||
dest='pmkid_timeout',
|
||||
metavar='[sec]',
|
||||
type=int,
|
||||
help=self._verbose('Time to wait for PMKID capture ' +
|
||||
'(default: {G}%d{W} seconds)' % self.config.pmkid_timeout))
|
||||
|
||||
wpa.add_argument('--hs-dir',
|
||||
action='store',
|
||||
@@ -317,6 +319,12 @@ class Arguments(object):
|
||||
wpa.add_argument('-hs-dir', help=argparse.SUPPRESS, action='store',
|
||||
dest='wpa_handshake_dir', type=str)
|
||||
|
||||
wpa.add_argument('--new-hs',
|
||||
action='store_true',
|
||||
dest='ignore_old_handshakes',
|
||||
help=Color.s('Captures new handshakes, ignores existing handshakes ' +
|
||||
'in {C}%s{W} (default: {G}off{W})' % self.config.wpa_handshake_dir))
|
||||
|
||||
wpa.add_argument('--dict',
|
||||
action='store',
|
||||
dest='wordlist',
|
||||
|
||||
@@ -1,6 +1,10 @@
|
||||
#!/usr/bin/env python
|
||||
# -*- coding: utf-8 -*-
|
||||
|
||||
from .wep import AttackWEP
|
||||
from .wpa import AttackWPA
|
||||
from .wps import AttackWPS
|
||||
from .pmkid import AttackPMKID
|
||||
from ..config import Configuration
|
||||
from ..util.color import Color
|
||||
|
||||
@@ -12,6 +16,10 @@ class AttackAll(object):
|
||||
Attacks all given `targets` (list[wifite.model.target]) until user interruption.
|
||||
Returns: Number of targets that were attacked (int)
|
||||
'''
|
||||
if any(t.wps for t in targets) and not AttackWPS.can_attack_wps():
|
||||
# Warn that WPS attacks are not available.
|
||||
Color.pl('{!} {O}Note: WPS attacks are not possible because you do not have {C}reaver{O} nor {C}bully{W}')
|
||||
|
||||
attacked_targets = 0
|
||||
targets_remaining = len(targets)
|
||||
for index, target in enumerate(targets, start=1):
|
||||
@@ -36,10 +44,6 @@ class AttackAll(object):
|
||||
Attacks a single `target` (wifite.model.target).
|
||||
Returns: True if attacks should continue, False otherwise.
|
||||
'''
|
||||
from .wep import AttackWEP
|
||||
from .wpa import AttackWPA
|
||||
from .wps import AttackWPS
|
||||
from .pmkid import AttackPMKID
|
||||
|
||||
attacks = []
|
||||
|
||||
@@ -54,21 +58,27 @@ class AttackAll(object):
|
||||
# WPA can have multiple attack vectors:
|
||||
|
||||
# WPS
|
||||
if target.wps != False:
|
||||
if Configuration.wps_pixie:
|
||||
attacks.append(AttackWPS(target, pixie_dust=True))
|
||||
if Configuration.wps_pin:
|
||||
attacks.append(AttackWPS(target, pixie_dust=False))
|
||||
if not Configuration.use_pmkid_only:
|
||||
if target.wps != False and AttackWPS.can_attack_wps():
|
||||
# Pixie-Dust
|
||||
if Configuration.wps_pixie:
|
||||
attacks.append(AttackWPS(target, pixie_dust=True))
|
||||
|
||||
# PMKID
|
||||
attacks.append(AttackPMKID(target))
|
||||
# PIN attack
|
||||
if Configuration.wps_pin:
|
||||
attacks.append(AttackWPS(target, pixie_dust=False))
|
||||
|
||||
# Handshake capture
|
||||
attacks.append(AttackWPA(target))
|
||||
if not Configuration.wps_only:
|
||||
# PMKID
|
||||
attacks.append(AttackPMKID(target))
|
||||
|
||||
# Handshake capture
|
||||
if not Configuration.use_pmkid_only:
|
||||
attacks.append(AttackWPA(target))
|
||||
|
||||
if len(attacks) == 0:
|
||||
Color.pl('{!} {R}Error: {O}Unable to attack: encryption not WEP or WPA')
|
||||
return
|
||||
Color.pl('{!} {R}Error: {O}Unable to attack: no attacks available')
|
||||
return True # Keep attacking other targets (skip)
|
||||
|
||||
while len(attacks) > 0:
|
||||
attack = attacks.pop(0)
|
||||
@@ -81,8 +91,13 @@ class AttackAll(object):
|
||||
continue
|
||||
except KeyboardInterrupt:
|
||||
Color.pl('\n{!} {O}Interrupted{W}\n')
|
||||
if not cls.user_wants_to_continue(targets_remaining, len(attacks)):
|
||||
return False # Stop attacking other targets
|
||||
answer = cls.user_wants_to_continue(targets_remaining, len(attacks))
|
||||
if answer is True:
|
||||
continue # Keep attacking the same target (continue)
|
||||
elif answer is None:
|
||||
return True # Keep attacking other targets (skip)
|
||||
else:
|
||||
return False # Stop all attacks (exit)
|
||||
|
||||
if attack.success:
|
||||
attack.crack_result.save()
|
||||
@@ -105,15 +120,30 @@ class AttackAll(object):
|
||||
prompt_list.append(Color.s('{C}%d{W} attack(s)' % attacks_remaining))
|
||||
if targets_remaining > 0:
|
||||
prompt_list.append(Color.s('{C}%d{W} target(s)' % targets_remaining))
|
||||
prompt = ' and '.join(prompt_list)
|
||||
Color.pl('{+} %s remain, Do you want to continue?' % prompt)
|
||||
prompt = ' and '.join(prompt_list) + ' remain'
|
||||
Color.pl('{+} %s' % prompt)
|
||||
|
||||
prompt = Color.s('{+} Type {G}c{W} to {G}continue{W}' +
|
||||
' or {R}s{W} to {R}stop{W}: ')
|
||||
prompt = '{+} Do you want to'
|
||||
options = '('
|
||||
|
||||
if attacks_remaining > 0:
|
||||
prompt += ' {G}continue{W} attacking,'
|
||||
options += '{G}C{W}{D}, {W}'
|
||||
|
||||
if targets_remaining > 0:
|
||||
prompt += ' {O}skip{W} to the next target,'
|
||||
options += '{O}s{W}{D}, {W}'
|
||||
|
||||
options += '{R}e{W})'
|
||||
prompt += ' or {R}exit{W} %s? {C}' % options
|
||||
|
||||
from ..util.input import raw_input
|
||||
if raw_input(prompt).lower().startswith('s'):
|
||||
return False
|
||||
else:
|
||||
return True
|
||||
answer = raw_input(Color.s(prompt)).lower()
|
||||
|
||||
if answer.startswith('s'):
|
||||
return None # Skip
|
||||
elif answer.startswith('e'):
|
||||
return False # Exit
|
||||
else:
|
||||
return True # Continue
|
||||
|
||||
|
||||
@@ -62,12 +62,6 @@ class AttackPMKID(Attack):
|
||||
Returns:
|
||||
True if handshake is captured. False otherwise.
|
||||
'''
|
||||
# Skip if user only wants to attack WPS targets
|
||||
if Configuration.wps_only and self.target.wps == False:
|
||||
Color.pl('\r{!} {O}Skipping PMKID attack on {R}%s{O} because {R}--wps-only{O} is set{W}' % self.target.essid)
|
||||
self.success = False
|
||||
return False
|
||||
|
||||
from ..util.process import Process
|
||||
# Check that we have all hashcat programs
|
||||
dependencies = [
|
||||
@@ -114,7 +108,7 @@ class AttackPMKID(Attack):
|
||||
The PMKID hash (str) if found, otherwise None.
|
||||
'''
|
||||
self.keep_capturing = True
|
||||
self.timer = Timer(15)
|
||||
self.timer = Timer(Configuration.pmkid_timeout)
|
||||
|
||||
# Start hcxdumptool
|
||||
t = Thread(target=self.dumptool_thread)
|
||||
@@ -174,7 +168,6 @@ class AttackPMKID(Attack):
|
||||
Color.clear_entire_line()
|
||||
Color.pattack('PMKID', self.target, '{R}CRACK',
|
||||
'{R}Failed {O}Passphrase not found in dictionary.\n')
|
||||
Color.pl('')
|
||||
return False
|
||||
else:
|
||||
# Successfully cracked.
|
||||
|
||||
@@ -3,9 +3,17 @@
|
||||
|
||||
from ..model.attack import Attack
|
||||
from ..util.color import Color
|
||||
from ..util.process import Process
|
||||
from ..config import Configuration
|
||||
from ..tools.bully import Bully
|
||||
from ..tools.reaver import Reaver
|
||||
|
||||
class AttackWPS(Attack):
|
||||
|
||||
@staticmethod
|
||||
def can_attack_wps():
|
||||
return Reaver.exists() or Bully.exists()
|
||||
|
||||
def __init__(self, target, pixie_dust=False):
|
||||
super(AttackWPS, self).__init__(target)
|
||||
self.success = False
|
||||
@@ -36,16 +44,31 @@ class AttackWPS(Attack):
|
||||
self.success = False
|
||||
return False
|
||||
|
||||
if Configuration.use_bully:
|
||||
if not Reaver.exists() and Bully.exists():
|
||||
# Use bully if reaver isn't available
|
||||
return self.run_bully()
|
||||
elif self.pixie_dust and not Reaver.is_pixiedust_supported() and Bully.exists():
|
||||
# Use bully if reaver can't do pixie-dust
|
||||
return self.run_bully()
|
||||
elif Configuration.use_bully:
|
||||
# Use bully if asked by user
|
||||
return self.run_bully()
|
||||
elif not Reaver.exists():
|
||||
# Print error if reaver isn't found (bully not available)
|
||||
if self.pixie_dust:
|
||||
Color.pl('\r{!} {R}Skipping WPS Pixie-Dust attack: {O}reaver{R} not found.{W}')
|
||||
else:
|
||||
Color.pl('\r{!} {R}Skipping WPS PIN attack: {O}reaver{R} not found.{W}')
|
||||
return False
|
||||
elif self.pixie_dust and not Reaver.is_pixiedust_supported():
|
||||
# Print error if reaver can't support pixie-dust (bully not available)
|
||||
Color.pl('\r{!} {R}Skipping WPS attack: {O}reaver{R} does not support {O}--pixie-dust{W}')
|
||||
return False
|
||||
else:
|
||||
return self.run_reaver()
|
||||
|
||||
return False
|
||||
|
||||
|
||||
def run_bully(self):
|
||||
from ..tools.bully import Bully
|
||||
bully = Bully(self.target, pixie_dust=self.pixie_dust)
|
||||
bully.run()
|
||||
bully.stop()
|
||||
@@ -55,8 +78,6 @@ class AttackWPS(Attack):
|
||||
|
||||
|
||||
def run_reaver(self):
|
||||
from ..tools.reaver import Reaver
|
||||
|
||||
reaver = Reaver(self.target, pixie_dust=self.pixie_dust)
|
||||
reaver.run()
|
||||
self.crack_result = reaver.crack_result
|
||||
|
||||
@@ -8,7 +8,7 @@ from .tools.macchanger import Macchanger
|
||||
|
||||
class Configuration(object):
|
||||
''' Stores configuration variables and functions for Wifite. '''
|
||||
version = '2.2.3'
|
||||
version = '2.2.5'
|
||||
|
||||
initialized = False # Flag indicating config has been initialized
|
||||
temp_dir = None # Temporary directory
|
||||
@@ -79,6 +79,7 @@ class Configuration(object):
|
||||
cls.wpa_strip_handshake = False # Strip non-handshake packets
|
||||
cls.ignore_old_handshakes = False # Always fetch a new handshake
|
||||
cls.use_pmkid_only = False # Only use PMKID Capture+Crack attack
|
||||
cls.pmkid_timeout = 30 # Time to wait for PMKID capture
|
||||
|
||||
# Default dictionary for cracking
|
||||
cls.wordlist = None
|
||||
@@ -148,15 +149,23 @@ class Configuration(object):
|
||||
Color.pl('{+} {C}option:{W} using {G}eviltwin attacks{W} against all targets')
|
||||
'''
|
||||
|
||||
# Adjust WEP attack list
|
||||
cls.parse_wep_attacks()
|
||||
|
||||
cls.validate()
|
||||
|
||||
# Commands
|
||||
if args.cracked: cls.show_cracked = True
|
||||
if args.check_handshake: cls.check_handshake = args.check_handshake
|
||||
if args.crack_handshake: cls.crack_handshake = True
|
||||
|
||||
|
||||
@classmethod
|
||||
def validate(cls):
|
||||
if cls.use_pmkid_only and cls.wps_only:
|
||||
Color.pl('{!} {R}Bad Configuration:{O} --pmkid and --wps-only are not compatible')
|
||||
raise RuntimeError('Unable to attack networks: --pmkid and --wps-only are not compatible together')
|
||||
|
||||
|
||||
@classmethod
|
||||
def parse_settings_args(cls, args):
|
||||
'''Parses basic settings/configurations from arguments.'''
|
||||
@@ -299,6 +308,10 @@ class Configuration(object):
|
||||
cls.use_pmkid_only = True
|
||||
Color.pl('{+} {C}option:{W} will ONLY use {C}PMKID{W} attack on WPA networks')
|
||||
|
||||
if args.pmkid_timeout:
|
||||
cls.pmkid_timeout = args.pmkid_timeout
|
||||
Color.pl('{+} {C}option:{W} will wait {G}%d{W} seconds during {C}PMKID{W} capture')
|
||||
|
||||
if args.wpa_handshake_dir:
|
||||
cls.wpa_handshake_dir = args.wpa_handshake_dir
|
||||
Color.pl('{+} {C}option:{W} will store handshakes to ' +
|
||||
@@ -343,9 +356,14 @@ class Configuration(object):
|
||||
'(no {O}Pixie-Dust{W}) on targets')
|
||||
|
||||
if args.use_bully:
|
||||
cls.use_bully = args.use_bully
|
||||
Color.pl('{+} {C}option:{W} use {C}bully{W} instead of {C}reaver{W} ' +
|
||||
'for WPS Attacks')
|
||||
from tools.bully import Bully
|
||||
if not Bully.exists():
|
||||
Color.pl('{!} {R}Bully not found. Defaulting to {O}reaver{W}')
|
||||
cls.use_bully = False
|
||||
else:
|
||||
cls.use_bully = args.use_bully
|
||||
Color.pl('{+} {C}option:{W} use {C}bully{W} instead of {C}reaver{W} ' +
|
||||
'for WPS Attacks')
|
||||
|
||||
if args.wps_pixie_timeout:
|
||||
cls.wps_pixie_timeout = args.wps_pixie_timeout
|
||||
|
||||
@@ -204,7 +204,7 @@ class Airmon(Dependency):
|
||||
'''Find the interface put into monitor mode (if any)'''
|
||||
|
||||
# airmon-ng output: (mac80211 monitor mode vif enabled for [phy10]wlan0 on [phy10]wlan0mon)
|
||||
enabled_re = re.compile(r'\s*\(mac80211 monitor mode (?:vif )?enabled for [^ ]+ on (?:\[\w+\])?(\w+)\)\s*')
|
||||
enabled_re = re.compile(r'.*\(mac80211 monitor mode (?:vif )?enabled (?:for [^ ]+ )?on (?:\[\w+\])?(\w+)\)?.*')
|
||||
|
||||
for line in airmon_output.split('\n'):
|
||||
matches = enabled_re.match(line)
|
||||
@@ -359,6 +359,10 @@ class Airmon(Dependency):
|
||||
# Can't just pkill network manager; it's a service
|
||||
Process(['service', 'network-manager', 'stop']).wait()
|
||||
Airmon.killed_network_manager = True
|
||||
elif pname == 'avahi-daemon' and Process.exists('service'):
|
||||
Color.pl('{!} {O}stopping avahi-daemon ({R}service avahi-daemon stop{O})')
|
||||
# Can't just pkill avahi-daemon; it's a service
|
||||
Process(['service', 'avahi-daemon', 'stop']).wait()
|
||||
else:
|
||||
Color.pl('{!} {R}Terminating {O}conflicting process {R}%s{O} (PID {R}%s{O})' % (pname, pid))
|
||||
try:
|
||||
@@ -408,7 +412,27 @@ class Airmon(Dependency):
|
||||
Color.pl(' {R}cannot restart NetworkManager: {O}systemctl{R} or {O}service{R} not found{W}')
|
||||
|
||||
if __name__ == '__main__':
|
||||
Airmon.terminate_conflicting_processes()
|
||||
stdout = '''
|
||||
Found 2 processes that could cause trouble.
|
||||
If airodump-ng, aireplay-ng or airtun-ng stops working after
|
||||
a short period of time, you may want to run 'airmon-ng check kill'
|
||||
|
||||
PID Name
|
||||
5563 avahi-daemon
|
||||
5564 avahi-daemon
|
||||
|
||||
PHY Interface Driver Chipset
|
||||
|
||||
phy0 wlx00c0ca4ecae0 rtl8187 Realtek Semiconductor Corp. RTL8187
|
||||
Interface 15mon is too long for linux so it will be renamed to the old style (wlan#) name.
|
||||
|
||||
(mac80211 monitor mode vif enabled on [phy0]wlan0mon
|
||||
(mac80211 station mode vif disabled for [phy0]wlx00c0ca4ecae0)
|
||||
'''
|
||||
start_iface = Airmon._parse_airmon_start(stdout)
|
||||
print('start_iface from stdout:', start_iface)
|
||||
|
||||
Configuration.initialize(False)
|
||||
iface = Airmon.ask()
|
||||
(disabled_iface, enabled_iface) = Airmon.stop(iface)
|
||||
print('Disabled:', disabled_iface)
|
||||
|
||||
@@ -49,7 +49,12 @@ class Bully(Attack, Dependency):
|
||||
'--bssid', target.bssid,
|
||||
'--channel', target.channel,
|
||||
#'--detectlock', # Detect WPS lockouts unreported by AP
|
||||
#'--force',
|
||||
|
||||
# Restoring session from '/root/.bully/34210901927c.run'
|
||||
# WARNING: WPS checksum was bruteforced in prior session, now autogenerated
|
||||
# Use --force to ignore above warning(s) and continue anyway
|
||||
'--force',
|
||||
|
||||
'-v', '4',
|
||||
Configuration.interface
|
||||
])
|
||||
|
||||
@@ -14,6 +14,12 @@ class Dependency(object):
|
||||
)
|
||||
|
||||
|
||||
@classmethod
|
||||
def exists(cls):
|
||||
from ..util.process import Process
|
||||
return Process.exists(cls.dependency_name)
|
||||
|
||||
|
||||
@classmethod
|
||||
def run_dependency_check(cls):
|
||||
from ..util.color import Color
|
||||
|
||||
@@ -8,11 +8,6 @@ class Iwconfig(Dependency):
|
||||
dependency_name = 'iwconfig'
|
||||
dependency_url = 'apt-get install wireless-tools'
|
||||
|
||||
@classmethod
|
||||
def exists(cls):
|
||||
from ..util.process import Process
|
||||
return Process.exists('iwconfig')
|
||||
|
||||
|
||||
@classmethod
|
||||
def mode(cls, iface, mode_name):
|
||||
|
||||
@@ -14,9 +14,6 @@ class Pyrit(Dependency):
|
||||
def __init__(self):
|
||||
pass
|
||||
|
||||
@staticmethod
|
||||
def exists():
|
||||
return Process.exists('pyrit')
|
||||
|
||||
@staticmethod
|
||||
def bssid_essid_with_handshakes(capfile, bssid=None, essid=None):
|
||||
|
||||
@@ -14,9 +14,6 @@ class Tshark(Dependency):
|
||||
def __init__(self):
|
||||
pass
|
||||
|
||||
@staticmethod
|
||||
def exists():
|
||||
return Process.exists('tshark')
|
||||
|
||||
@staticmethod
|
||||
def _extract_src_dst_index_total(line):
|
||||
@@ -29,6 +26,7 @@ class Tshark(Dependency):
|
||||
(src, dst, index, total) = match.groups()
|
||||
return src, dst, index, total
|
||||
|
||||
|
||||
@staticmethod
|
||||
def _build_target_client_handshake_map(output, bssid=None):
|
||||
# Map of target_ssid,client_ssid -> handshake #s
|
||||
|
||||
@@ -14,9 +14,6 @@ class Wash(Dependency):
|
||||
def __init__(self):
|
||||
pass
|
||||
|
||||
@staticmethod
|
||||
def exists():
|
||||
return Process.exists('wash')
|
||||
|
||||
@staticmethod
|
||||
def check_for_wps_and_update_targets(capfile, targets):
|
||||
@@ -62,6 +59,7 @@ class Wash(Dependency):
|
||||
else:
|
||||
t.wps = False
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
test_file = './tests/files/contains_wps_network.cap'
|
||||
|
||||
|
||||
Reference in New Issue
Block a user