From 7e2be86a81a183f86c4d332d7008c144f97c0f35 Mon Sep 17 00:00:00 2001 From: PrincessPi3 Date: Tue, 24 Sep 2024 16:40:03 -0600 Subject: [PATCH] added beacon fuzz --- dev/Pi4-ETH/scapy/wifi-beacon-fuzz.py | 79 +++++++++++++++++++ dev/Pi4-ETH/scapy/wifi-beacon-random-byte.py | 45 +++++++++++ dev/Pi4-ETH/scapy/wifi-beacon-scapy.py | 29 +++++++ .../scapy/wifi-beacon-scapy.py.orig.bak | 20 +++++ dev/Pi5-USB/zero-recreate-sd | 2 +- dev/maraduer-exploit-prose.txt | 2 +- 6 files changed, 175 insertions(+), 2 deletions(-) create mode 100644 dev/Pi4-ETH/scapy/wifi-beacon-fuzz.py create mode 100644 dev/Pi4-ETH/scapy/wifi-beacon-random-byte.py create mode 100644 dev/Pi4-ETH/scapy/wifi-beacon-scapy.py create mode 100644 dev/Pi4-ETH/scapy/wifi-beacon-scapy.py.orig.bak diff --git a/dev/Pi4-ETH/scapy/wifi-beacon-fuzz.py b/dev/Pi4-ETH/scapy/wifi-beacon-fuzz.py new file mode 100644 index 0000000..05db303 --- /dev/null +++ b/dev/Pi4-ETH/scapy/wifi-beacon-fuzz.py @@ -0,0 +1,79 @@ +from scapy.all import * +import urllib.parse +#from random import randbytes +import random + +iface = 'wlan1' +sender = 'ac:cb:12:ad:58:27' + +def sendProbe(SSID, repeat=3, interval=0.100): + dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', + addr2=sender, addr3=sender) + beacon = Dot11Beacon() + essid = Dot11Elt(ID='SSID',info=SSID, len=len(SSID)) + frame = RadioTap()/dot11/beacon/essid + sendp(frame, iface=iface, inter=interval, count=repeat) + +def sendProbeRaw(SSID, repeat=1, interval=0.200, listedLen=255): + dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', + addr2=sender, addr3=sender) + beacon = Dot11Beacon() + essid = Dot11Elt(ID='SSID',info=RawVal(SSID), len=listedLen) + frame = RadioTap()/dot11/beacon/essid + sendp(frame, iface=iface, inter=interval, count=repeat) + +def sendRandBytesBeacons(numOfBeacons=200, lenOfSSIDs=20, repeat=3, interval=0.100): + for i in range(numOfBeacons): + SSID = randbytes(lenOfSSIDs) + urlEncoded = urllib.parse.quote(SSID) + print(f"\n{i} of {numOfBeacons}\n\tRepeats: {repeat}\n\tLength: {lenOfSSIDs}\n\tSSID: {urlEncoded}\n") + sendProbe(SSID, repeat, interval) + +def sendProbeFuzz(repeat=1, interval=0.150): + randMAC = RandMAC() + randLen = RandNum(0, 255) + randSSIDLen = random.randint(0,255) + randSSIDBytes = random.randbytes(randSSIDLen) + urlEncoded = urllib.parse.quote(randSSIDBytes) + + dot11 = Dot11(type=0, + subtype=8, + addr1='ff:ff:ff:ff:ff:ff', # dst set to broadcast + addr2=randMAC, # random source + addr3=randMAC) # random bssid + + beacon = Dot11Beacon() + + essid = Dot11Elt(ID='SSID', + info=RawVal(randSSIDBytes), + len=RawVal(randLen)) + + frame = RadioTap()/dot11/beacon/essid + + print(f"src={randMAC}, dst=ff:ff:ff:ff:ff:ff, BSSID={randMAC}\n\tSSID Set Length: {randLen}\n\tActual SSID Length: {randSSIDLen}\n\tSSID: {urlEncoded}") + sendp(frame, iface=iface, inter=interval, count=repeat) + +def sendFuzzBeacons(numOfBeacons=200, + repeat=1, + interval=0.150): + + for i in range(numOfBeacons): + print(f"\n{i} of {numOfBeacons}") + sendProbeFuzz() + +def sendRandBytesBeaconsRaw( + numOfBeacons=200, + lenOfSSIDs=256, + listedLen=255, + repeat=1, + interval=0.2): + + for i in range(numOfBeacons): + SSID = random.randbytes(lenOfSSIDs) + urlEncoded = urllib.parse.quote(SSID) + print(f"\n{i} of {numOfBeacons}\n\tRepeats: {repeat}\n\tListed Length: {listedLen}\n\tReal Length: {lenOfSSIDs}\n\tInterval: {interval} Seconds\n\tSSID: {urlEncoded}") + sendProbeRaw(SSID, repeat, interval, listedLen) + +#sendRandBytesBeaconsRaw(numOfBeacons=100, lenOfSSIDs=1, listedLen=255, repeat=3, interval=0.15) +#sendRandBytesBeacons(100, 20, 5, 0.1) +sendFuzzBeacons() diff --git a/dev/Pi4-ETH/scapy/wifi-beacon-random-byte.py b/dev/Pi4-ETH/scapy/wifi-beacon-random-byte.py new file mode 100644 index 0000000..78a1bcb --- /dev/null +++ b/dev/Pi4-ETH/scapy/wifi-beacon-random-byte.py @@ -0,0 +1,45 @@ +from scapy.all import * +import urllib.parse +from random import randbytes + +iface = 'wlan1' +sender = 'ac:cb:12:ad:58:27' + +def sendProbe(SSID, repeat=3, interval=0.100): + dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', + addr2=sender, addr3=sender) + beacon = Dot11Beacon() + essid = Dot11Elt(ID='SSID',info=SSID, len=len(SSID)) + frame = RadioTap()/dot11/beacon/essid + sendp(frame, iface=iface, inter=interval, count=repeat) + +def sendProbeRaw(SSID, repeat=1, interval=0.200, listedLen=255): + dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', + addr2=sender, addr3=sender) + beacon = Dot11Beacon() + essid = Dot11Elt(ID='SSID',info=RawVal(SSID), len=listedLen) + frame = RadioTap()/dot11/beacon/essid + sendp(frame, iface=iface, inter=interval, count=repeat) + +def sendRandBytesBeacons(numOfBeacons=200, lenOfSSIDs=20, repeat=3, interval=0.100): + for i in range(numOfBeacons): + SSID = randbytes(lenOfSSIDs) + urlEncoded = urllib.parse.quote(SSID) + print(f"\n{i} of {numOfBeacons}\n\tRepeats: {repeat}\n\tLength: {lenOfSSIDs}\n\tSSID: {urlEncoded}\n") + sendProbe(SSID, repeat, interval) + +def sendRandBytesBeaconsRaw( + numOfBeacons=200, + lenOfSSIDs=256, + listedLen=255, + repeat=1, + interval=0.2): + + for i in range(numOfBeacons): + SSID = randbytes(lenOfSSIDs) + urlEncoded = urllib.parse.quote(SSID) + print(f"\n{i} of {numOfBeacons}\n\tRepeats: {repeat}\n\tListed Length: {listedLen}\n\tReal Length: {lenOfSSIDs}\n\tInterval: {interval} Seconds\n\tSSID: {urlEncoded}") + sendProbeRaw(SSID, repeat, interval, listedLen) + +sendRandBytesBeaconsRaw(numOfBeacons=100, lenOfSSIDs=1, listedLen=255, repeat=3, interval=0.15) +#sendRandBytesBeacons(100, 20, 5, 0.1) diff --git a/dev/Pi4-ETH/scapy/wifi-beacon-scapy.py b/dev/Pi4-ETH/scapy/wifi-beacon-scapy.py new file mode 100644 index 0000000..fcf571d --- /dev/null +++ b/dev/Pi4-ETH/scapy/wifi-beacon-scapy.py @@ -0,0 +1,29 @@ +from scapy.all import * + +# https://yasoob.me/2018/09/08/sending-sniffing-wlan-beacon-frames-using-scapy/ + +iface = 'wlan1' +sender = 'c2:13:37:c2:13:37' + +def beacon_raw(SSID, length=255): + dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', addr2=sender, addr3=sender) + beacon = Dot11Beacon() + essid = Dot11Elt(ID='SSID',info=RawVal(SSID), len=length) + frame = RadioTap()/dot11/beacon/essid + sendp(frame, iface=iface, inter=0.250, loop=1) +# sendp(frame, iface=iface, inter=0.100, count=256) + +def beacon_normie(SSID): + dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', addr2=sender, addr3=sender) + beacon = Dot11Beacon() + essid = Dot11Elt(ID='SSID',info=SSID, len=len(SSID)) + frame = RadioTap()/dot11/beacon/essid + print(SSID) + sendp(frame, iface=iface, inter=0.100, loop=1) +# sendp(frame, iface=iface, inter=0.100, count=256) + +#longgg = "\xFF"*800 +#longggg = f"\x00{longgg}\x00" +#beacon_raw(longggg) +SSID = b"YOU-SEEM-FUNDAMETALLY-FUN\x0AI-THINK-ID-LIKE-TO-KNOW-YOU\x0AI-FEEL-LIKE-BEING-YOUR-FRIEND\x0AI-AM-YOUR-PONY-WAIFU" +beacon_raw(SSID) diff --git a/dev/Pi4-ETH/scapy/wifi-beacon-scapy.py.orig.bak b/dev/Pi4-ETH/scapy/wifi-beacon-scapy.py.orig.bak new file mode 100644 index 0000000..4308874 --- /dev/null +++ b/dev/Pi4-ETH/scapy/wifi-beacon-scapy.py.orig.bak @@ -0,0 +1,20 @@ +from __future__ import print_function +from scapy.all import ( Dot11, + Dot11Beacon, + Dot11Elt, + RadioTap, + sendp, + hexdump) + +SSID = 'Test SSID' +iface = 'wlan1' +sender = 'ac:cb:12:ad:58:27' + +dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', +addr2=sender, addr3=sender) +beacon = Dot11Beacon() +essid = Dot11Elt(ID='SSID',info=SSID, len=len(SSID)) + +frame = RadioTap()/dot11/beacon/essid + +sendp(frame, iface=iface, inter=0.100, loop=1) diff --git a/dev/Pi5-USB/zero-recreate-sd b/dev/Pi5-USB/zero-recreate-sd index 40a9b4c..79d13a7 100644 --- a/dev/Pi5-USB/zero-recreate-sd +++ b/dev/Pi5-USB/zero-recreate-sd @@ -1,7 +1,7 @@ #!/bin/bash mountpoint=/mnt/MARAUDLABEL/ gb_to_zero=1 -full_wipe=True +# full_wipe=True copy_files=True echo "WILL WIPE DISK USE WITH CARE" diff --git a/dev/maraduer-exploit-prose.txt b/dev/maraduer-exploit-prose.txt index 7a9e095..19793dd 100644 --- a/dev/maraduer-exploit-prose.txt +++ b/dev/maraduer-exploit-prose.txt @@ -356,7 +356,7 @@ ffuf -input-cmd 'dd bs=1 count=1K if=/dev/urandom' -u "http://10.0.0.80/get.php? sudo mdk4 wlan1 b -a -w tawn -c 1 -s 50 scapy: -SSID = b"Test\x00SSID" +SSID = b"youSeemFundamentallyFun" iface = 'wlan1' sender = 'ac:cb:12:ad:58:27'