Merge pull request #1059 from justcallmekoko/develop

Capture and parse SAE commit frames

esp32_marauder/CommandLine.cpp

@@ -240,7 +240,6 @@ void CommandLine::runCommand(String input) {
     Serial.println(HELP_SNIFF_ESP_CMD);
     Serial.println(HELP_SNIFF_DEAUTH_CMD);
     Serial.println(HELP_SNIFF_PMKID_CMD);
-    Serial.println(HELP_SNIFF_SAE_CMD);
     Serial.println(HELP_STOPSCAN_CMD);
     #ifdef HAS_GPS
       Serial.println(HELP_WARDRIVE_CMD);
@@ -325,8 +324,7 @@ void CommandLine::runCommand(String input) {
   else if (cmd_args.get(0) == GPS_DATA_CMD) {
     #ifdef HAS_GPS
       if (gps_obj.getGpsModuleStatus()) {
-        Serial.print(F("Getting GPS Data. Stop with "));
-        Serial.println((String)STOPSCAN_CMD);
+        Serial.println("Getting GPS Data. Stop with " + (String)STOPSCAN_CMD);
         wifi_scan_obj.currentScanMode = WIFI_SCAN_GPS_DATA;
         #ifdef HAS_SCREEN
           menu_function_obj.changeMenu(&menu_function_obj.gpsInfoMenu);
@@ -391,8 +389,7 @@ void CommandLine::runCommand(String input) {
                 nmea_type="beidou_bd";
             }
             gps_obj.setType(nmea_type);
-            Serial.print(F("GPS Output Type Set To: "));
-            Serial.println(nmea_type);
+            Serial.println("GPS Output Type Set To: " + nmea_type);
           }
           else
             Serial.println(F("You did not provide a valid argument"));
@@ -470,14 +467,12 @@ void CommandLine::runCommand(String input) {
     int ch_set = this->argSearch(&cmd_args, "-s");
     
     if (cmd_args.size() == 1) {
-      Serial.print(F("Current channel: "));
-      Serial.println(wifi_scan_obj.set_channel);
+      Serial.println("Current channel: " + (String)wifi_scan_obj.set_channel);
     }
     else if (ch_set != -1) {
       wifi_scan_obj.set_channel = cmd_args.get(ch_set + 1).toInt();
       wifi_scan_obj.changeChannel();
-      Serial.print(F("Set channel: "));
-      Serial.println(wifi_scan_obj.set_channel);
+      Serial.println("Set channel: " + (String)wifi_scan_obj.set_channel);
     }
   }
   // Clear APs
@@ -535,8 +530,7 @@ void CommandLine::runCommand(String input) {
       }
 
       if (!result) {
-        Serial.print(F("Could not successfully update setting \""));
-        Serial.println(setting_name + "\"");
+        Serial.println("Could not successfully update setting \"" + setting_name + "\"");
         return;
       }
     }
@@ -554,8 +548,7 @@ void CommandLine::runCommand(String input) {
 
     // Signal strength scan
     if (cmd_args.get(0) == SIGSTREN_CMD) {
-      Serial.print(F("Starting Signal Strength Scan. Stop with "));
-      Serial.println(STOPSCAN_CMD);
+      Serial.println("Starting Signal Strength Scan. Stop with " + (String)STOPSCAN_CMD);
       #ifdef HAS_SCREEN
         display_obj.clearScreen();
         menu_function_obj.drawStatusBar();
@@ -565,8 +558,7 @@ void CommandLine::runCommand(String input) {
     }
     // Packet count
     else if (cmd_args.get(0) == PACKET_COUNT_CMD) {
-      Serial.print(F("Starting Packet Count Scan. Stop with "));
-      Serial.println(STOPSCAN_CMD);
+      Serial.println("Starting Packet Count Scan. Stop with " + (String)STOPSCAN_CMD);
       #ifdef HAS_SCREEN
         display_obj.clearScreen();
         menu_function_obj.drawStatusBar();
@@ -581,8 +573,7 @@ void CommandLine::runCommand(String input) {
           int flk_sw = this->argSearch(&cmd_args, "-f");
 
           if (flk_sw != -1) {
-            Serial.print(F("Starting Flock Wardrive. Stop with "));
-            Serial.println(STOPSCAN_CMD);
+            Serial.println("Starting Flock Wardrive. Stop with " + (String)STOPSCAN_CMD);
             #ifdef HAS_SCREEN
               display_obj.clearScreen();
               menu_function_obj.drawStatusBar();
@@ -590,8 +581,7 @@ void CommandLine::runCommand(String input) {
             wifi_scan_obj.StartScan(BT_SCAN_FLOCK_WARDRIVE, TFT_GREEN);
           }
           else if (sta_sw != -1) {
-            Serial.print(F("Starting Station Wardrive. Stop with "));
-            Serial.println(STOPSCAN_CMD);
+            Serial.println("Starting Station Wardrive. Stop with " + (String)STOPSCAN_CMD);
             #ifdef HAS_SCREEN
               display_obj.clearScreen();
               menu_function_obj.drawStatusBar();
@@ -746,15 +736,6 @@ void CommandLine::runCommand(String input) {
       #endif
       wifi_scan_obj.StartScan(WIFI_SCAN_AP, TFT_MAGENTA);
     }
-    // SAE sniff
-    else if (cmd_args.get(0) == SNIFF_SAE_CMD) {
-      Serial.println("Starting SAE Commit sniff. Stop with " + (String)STOPSCAN_CMD);
-      #ifdef HAS_SCREEN
-        display_obj.clearScreen();
-        menu_function_obj.drawStatusBar();
-      #endif
-      wifi_scan_obj.StartScan(WIFI_SCAN_SAE_COMMIT, TFT_MAGENTA);
-    }
     // Probe sniff
     else if (cmd_args.get(0) == SNIFF_PROBE_CMD) {
       Serial.println("Starting Probe sniff. Stop with " + (String)STOPSCAN_CMD);
@@ -1104,14 +1085,6 @@ void CommandLine::runCommand(String input) {
           #endif
           wifi_scan_obj.StartScan(WIFI_ATTACK_FUNNY_BEACON, TFT_CYAN);
         }
-        else if (attack_type == ATTACK_TYPE_SAE) {
-          Serial.println("Starting SAE Commit spam. Stop with " + (String)STOPSCAN_CMD);
-          #ifdef HAS_SCREEN
-            display_obj.clearScreen();
-            menu_function_obj.drawStatusBar();
-          #endif
-          wifi_scan_obj.StartScan(WIFI_ATTACK_SAE_COMMIT, TFT_CYAN);
-        }
         else {
           Serial.println(F("Attack type not properly defined"));
           return;

esp32_marauder/CommandLine.h

@@ -79,7 +79,6 @@ const char PROGMEM PING_CMD[] = "pingscan";
 const char PROGMEM PORT_SCAN_CMD[] = "portscan";
 const char PROGMEM ARP_SCAN_CMD[] = "arpscan";
 const char PROGMEM MAC_TRACK_CMD[] = "mactrack";
-const char PROGMEM SNIFF_SAE_CMD[] = "sniffsae";
 
 // WiFi attack
 const char PROGMEM ATTACK_CMD[] = "attack";
@@ -90,7 +89,6 @@ const char PROGMEM ATTACK_TYPE_FUNNY[] = "funny";
 const char PROGMEM ATTACK_TYPE_RR[] = "rickroll";
 const char PROGMEM ATTACK_TYPE_BM[] = "badmsg";
 const char PROGMEM ATTACK_TYPE_S[] = "sleep";
-const char PROGMEM ATTACK_TYPE_SAE[] = "sae";
 
 // WiFi Aux
 const char PROGMEM LIST_AP_CMD[] = "list";
@@ -156,10 +154,9 @@ const char PROGMEM HELP_PING_CMD[] = "pingscan";
 const char PROGMEM HELP_PORT_SCAN_CMD[] = "portscan [-a -t <ip index>]/[-s <ssh/telnet/dns/http/smtp/https/rdp>]";
 const char PROGMEM HELP_ARP_SCAN_CMD[] = "arpscan [-f]";
 const char PROGMEM HELP_MAC_TRACK_CMD[] = "mactrack";
-const char PROGMEM HELP_SNIFF_SAE_CMD[] = "sniffsae";
 
 // WiFi attack
-const char PROGMEM HELP_ATTACK_CMD[] = "attack -t <sae/beacon [-l/-r/-a]/deauth [-c]/[-s <src mac>] [-d <dst mac>]/probe/rickroll/badmsg [-c]/sleep [-c]>";
+const char PROGMEM HELP_ATTACK_CMD[] = "attack -t <beacon [-l/-r/-a]/deauth [-c]/[-s <src mac>] [-d <dst mac>]/probe/rickroll/badmsg [-c]/sleep [-c]>";
 
 // WiFi Aux
 const char PROGMEM HELP_LIST_AP_CMD_A[] = "list -s";

esp32_marauder/GpsInterface.cpp

@@ -16,12 +16,28 @@ static const uint32_t PROBE_MS = 1200;
 
 void GpsInterface::begin() {
 
+  /*#ifdef MARAUDER_MINI
+    pinMode(26, OUTPUT);
+
+    delay(1);
+
+    analogWrite(26, 243);
+    delay(1);
+
+    Serial.println("Activated GPS");
+    delay(100);
+  #endif*/
+
   
   Serial2.begin(9600, SERIAL_8N1, GPS_TX, GPS_RX);
 
   uint32_t gps_baud = this->initGpsBaudAndForce115200();
 
-  if ((gps_baud != 9600) && (gps_baud != 115200))
+  if (gps_baud == 9600)
+    Serial.println("GPS running at 9600");
+  else if (gps_baud == 115200)
+    Serial.println("GPS running at 115200");
+  else
     Serial.println("Could not detect GPS baudrate");
 
   delay(1000);
@@ -34,6 +50,7 @@ void GpsInterface::begin() {
   delay(1000);
 
   if (Serial2.available()) {
+    Serial.println("GPS Attached Successfully");
     this->gps_enabled = true;
     while (Serial2.available()) {
       //Fetch the character one by one

esp32_marauder/MenuFunctions.cpp

@@ -239,7 +239,6 @@ void MenuFunctions::main(uint32_t currentTime)
           (wifi_scan_obj.currentScanMode == WIFI_ATTACK_BAD_MSG) ||
           (wifi_scan_obj.currentScanMode == WIFI_ATTACK_SLEEP) ||
           (wifi_scan_obj.currentScanMode == WIFI_ATTACK_SLEEP_TARGETED) ||
-          (wifi_scan_obj.currentScanMode == WIFI_ATTACK_SAE_COMMIT) ||
           (wifi_scan_obj.currentScanMode == WIFI_ATTACK_MIMIC) ||
 		      (wifi_scan_obj.currentScanMode == WIFI_ATTACK_FUNNY_BEACON) ||
           (wifi_scan_obj.currentScanMode == WIFI_ATTACK_RICK_ROLL) ||
@@ -341,7 +340,6 @@ void MenuFunctions::main(uint32_t currentTime)
             (wifi_scan_obj.currentScanMode == WIFI_ATTACK_BAD_MSG) ||
             (wifi_scan_obj.currentScanMode == WIFI_ATTACK_SLEEP) ||
             (wifi_scan_obj.currentScanMode == WIFI_ATTACK_SLEEP_TARGETED) ||
-            (wifi_scan_obj.currentScanMode == WIFI_ATTACK_SAE_COMMIT) ||
             (wifi_scan_obj.currentScanMode == WIFI_ATTACK_MIMIC) ||
 			      (wifi_scan_obj.currentScanMode == WIFI_ATTACK_FUNNY_BEACON) ||
             (wifi_scan_obj.currentScanMode == WIFI_ATTACK_RICK_ROLL) ||
@@ -407,7 +405,6 @@ void MenuFunctions::main(uint32_t currentTime)
         (wifi_scan_obj.currentScanMode != WIFI_ATTACK_BAD_MSG) &&
         (wifi_scan_obj.currentScanMode != WIFI_ATTACK_SLEEP) &&
         (wifi_scan_obj.currentScanMode != WIFI_ATTACK_SLEEP_TARGETED) &&
-        (wifi_scan_obj.currentScanMode != WIFI_ATTACK_SAE_COMMIT) &&
         (wifi_scan_obj.currentScanMode != WIFI_ATTACK_MIMIC) &&
         (wifi_scan_obj.currentScanMode != WIFI_SCAN_PACKET_RATE) &&
         (wifi_scan_obj.currentScanMode != WIFI_SCAN_RAW_CAPTURE) &&
@@ -1852,11 +1849,6 @@ void MenuFunctions::RunSetup()
     this->drawStatusBar();
     wifi_scan_obj.StartScan(WIFI_ATTACK_SLEEP_TARGETED, TFT_MAGENTA);
   });
-  this->addNodes(&wifiAttackMenu, "SAE Commit Flood", TFTLIME, NULL, EAPOL, [this]() {
-    display_obj.clearScreen();
-    this->drawStatusBar();
-    wifi_scan_obj.StartScan(WIFI_ATTACK_SAE_COMMIT, TFT_GREEN);
-  });
 
   evilPortalMenu.parentMenu = &wifiAttackMenu;
   this->addNodes(&evilPortalMenu, text09, TFTLIGHTGREY, NULL, 0, [this]() {

esp32_marauder/WiFiScan.h

@@ -28,10 +28,6 @@
 #include "esp_wifi.h"
 #include "esp_wifi_types.h"
 #include <esp_timer.h>
-#include "mbedtls/entropy.h"
-#include "mbedtls/bignum.h"
-#include "mbedtls/ctr_drbg.h"
-#include "mbedtls/ecp.h"
 #ifndef HAS_DUAL_BAND
   #include <lwip/etharp.h>
   #include <lwip/ip_addr.h>
@@ -151,7 +147,6 @@
 #define BT_SCAN_FLOCK_WARDRIVE 75
 #define WIFI_SCAN_DETECT_FOLLOW 76
 #define WIFI_SCAN_SAE_COMMIT 77
-#define WIFI_ATTACK_SAE_COMMIT 78
 
 #define WIFI_ATTACK_FUNNY_BEACON 99 
 
@@ -279,8 +274,6 @@ class WiFiScan
       struct mac_addr mac_history[mac_history_len];
     #endif
 
-    int current_act_len = 0;
-
     uint32_t chanActTime = 0;
 
     uint8_t ap_mac[6] = {0xDE, 0xAD, 0xBE, 0xEF, 0xFE, 0xED};
@@ -443,15 +436,6 @@ class WiFiScan
     LinkedList<ConfirmedMultiSSID>* confirmed_multissid;
     bool multissid_list_full_reported;
 
-    uint8_t sae_commit[32] = {
-      0xb0, 0x00, 0x00, 0x00,                     // Type/Subtype, Duration
-      0xBB, 0xBB, 0xBB, 0xBB, 0xBB, 0xBB,         // Destination
-      0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA,         // Source
-      0xBB, 0xBB, 0xBB, 0xBB, 0xBB, 0xBB,         // BSSID (Destination)
-      0x00, 0x00,                                 // Frag num
-      0x03, 0x00, 0x01, 0x00, 0x00, 0x00, 0x13, 0x00  // Auth alg (SAE), SAE sequence, group 19
-    };
-
     // barebones packet
     uint8_t packet[128] = { 0x80, 0x00, 0x00, 0x00, //Frame Control, Duration
                     /*4*/   0xff, 0xff, 0xff, 0xff, 0xff, 0xff, //Destination address 
@@ -582,7 +566,7 @@ class WiFiScan
     bool isHostAlive(IPAddress ip);
     bool checkHostPort(IPAddress ip, uint16_t port, uint16_t timeout = 100);
     String extractManufacturer(const uint8_t* payload);
-    int checkMatchAP(char addr[], bool update_ap = true);
+    int checkMatchAP(char addr[]);
     bool beaconHasWPS(const uint8_t* payload, int len);
     uint8_t getSecurityType(const uint8_t* beacon, uint16_t len);
     void addAnalyzerValue(int16_t value, int rssi_avg, int16_t target_array[], int array_size);
@@ -594,7 +578,6 @@ class WiFiScan
     void executeSpoofAirtag();
     void executeSwiftpairSpam(EBLEPayloadType type);
     void startWardriverWiFi();
-    void saeAttackLoop(uint32_t currentTime);
     //void generateRandomMac(uint8_t* mac);
     //void generateRandomName(char *name, size_t length);
     String processPwnagotchiBeacon(const uint8_t* frame, int length);
@@ -613,7 +596,6 @@ class WiFiScan
     void tftDrawChannelScaleButtons();
     void tftDrawColorKey();
     void tftDrawGraphObjects();
-    bool sendSAECommitFrame(uint8_t* targ_addr, uint8_t* src_addr) ;
     void sendProbeAttack(uint32_t currentTime);
     void sendDeauthAttack(uint32_t currentTime, String dst_mac_str = "ff:ff:ff:ff:ff:ff");
     void sendBadMsgAttack(uint32_t currentTime, bool all = false);
@@ -820,7 +802,8 @@ class WiFiScan
     bool scanning();
     bool joinWiFi(String ssid, String password, bool gui = true);
     bool startWiFi(String ssid, String password, bool gui = true);
-    void getMAC(bool get_sta, uint8_t* mac);
+    String getStaMAC();
+    String getApMAC();
     String freeRAM();
     void changeChannel();
     void changeChannel(int chan);
@@ -854,14 +837,11 @@ class WiFiScan
     void startGPX(String file_name);
     //String macToString(const Station& station);
 
-    static bool initMbedtls();
-    static int mbedtls_entropy_source(void *data, unsigned char *output, size_t len);
-    static bool getSAEACT(const uint8_t *frame, size_t frame_len, uint16_t &group_out, size_t &act_len_out);
+    static bool parse_sae_commit_act(const uint8_t *frame, size_t frame_len, uint16_t &group_out, size_t &act_len_out, size_t & act_off_out);
     static bool sae_group_sizes(uint16_t group, size_t &scalar_len, size_t &element_len);
     static bool mac_cmp(const uint8_t *a, const uint8_t *b);
     static inline uint16_t le16(const uint8_t *p);
     static void getMAC(char *addr, uint8_t* data, uint16_t offset);
-    static void getMAC(uint8_t* mac, const uint8_t* data, uint16_t offset);
     static void pwnSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type);
     static void beaconSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type);
     //static void rawSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type);