Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2025-02-26 13:49:35 -05:00
Code Issues Projects Releases Wiki Activity

fragattack: add --amsdu-ssp option

Browse Source
This commit is contained in:
Mathy Vanhoef 2020-08-05 07:17:59 +04:00
parent d3e11e9bc1
commit 303b9cbec8
3 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
research/fragattack.py
View File

@ -158,12 +158,12 @@ def args2ptype(args):
def args2msdu(args): def args2msdu(args):
# Only one of these should be given # Only one of these should be given
if args.amsdu + args.fake_amsdu > 1: if args.amsdu + args.amsdu_fake > 1:
log(STATUS, "You cannot combine --amsdu and --fake-amsdu. Please only supply one of them.") log(STATUS, "You cannot combine --amsdu and --amsdu-fake. Please only supply one of them.")
quit(1) quit(1)
if args.amsdu: return 1 if args.amsdu: return 1
if args.fake_amsdu: return 2 if args.amsdu_fake: return 2
return None return None
@ -183,7 +183,8 @@ if __name__ == "__main__":
parser.add_argument('--delay', type=float, default=0, help="Delay between fragments in certain tests.") parser.add_argument('--delay', type=float, default=0, help="Delay between fragments in certain tests.")
parser.add_argument('--inc-pn', type=int, help="To test non-sequential packet number in fragments.") parser.add_argument('--inc-pn', type=int, help="To test non-sequential packet number in fragments.")
parser.add_argument('--amsdu', default=False, action='store_true', help="Encapsulate pings in an A-MSDU frame.") parser.add_argument('--amsdu', default=False, action='store_true', help="Encapsulate pings in an A-MSDU frame.")
parser.add_argument('--fake-amsdu', default=False, action='store_true', help="Set A-MSDU flag but include normal payload.") parser.add_argument('--amsdu-fake', default=False, action='store_true', help="Set A-MSDU flag but include normal payload.")
parser.add_argument('--amsdu-ssp', default=False, action='store_true', help="Force authentication of QoS A-MSDU flag.")
parser.add_argument('--arp', default=False, action='store_true', help="Override default request with ARP request.") parser.add_argument('--arp', default=False, action='store_true', help="Override default request with ARP request.")
parser.add_argument('--dhcp', default=False, action='store_true', help="Override default request with DHCP discover.") parser.add_argument('--dhcp', default=False, action='store_true', help="Override default request with DHCP discover.")
parser.add_argument('--icmp', default=False, action='store_true', help="Override default request with ICMP ping request.") parser.add_argument('--icmp', default=False, action='store_true', help="Override default request with ICMP ping request.")

2
research/fraginternals.py
View File

@ -446,7 +446,7 @@ class Station():
# TODO: Implement and test this function # TODO: Implement and test this function
encrypted = encrypt_tkip(frame, key, self.pn[idx], keyid) encrypted = encrypt_tkip(frame, key, self.pn[idx], keyid)
elif len(key) == 16: elif len(key) == 16:
encrypted = encrypt_ccmp(frame, key, self.pn[idx], keyid) encrypted = encrypt_ccmp(frame, key, self.pn[idx], keyid, self.options.amsdu_ssp)
else: else:
encrypted = encrypt_wep(frame, key, self.pn[idx], keyid) encrypted = encrypt_wep(frame, key, self.pn[idx], keyid)

2
research/tests_common.py
View File

@ -155,7 +155,7 @@ class LinuxTest(Test):
# Fragment 2: make Linux update latest used crypto Packet Number. Use a dummy packet # Fragment 2: make Linux update latest used crypto Packet Number. Use a dummy packet
# that can't accidently aggregate with the first fragment in a corrrect packet. # that can't accidently aggregate with the first fragment in a corrrect packet.
p = station.get_header(prior=2)/LLC()/SNAP()/IP()/Raw(b"linux_plain decoy fragment") p = station.get_header(prior=2)/LLC()/SNAP()/IP()/Raw(b"linux-plain decoy fragment")
p.SC = frag2.SC ^ (1 << 4) p.SC = frag2.SC ^ (1 << 4)
# - In the attack against Linux, the decoy frame must have the same QoS TID. # - In the attack against Linux, the decoy frame must have the same QoS TID.