Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2024-11-24 16:28:23 -05:00
Code Issues Projects Releases Wiki Activity

fragattack: use set_amsdu and is_amsdu functions

Browse Source
This commit is contained in:
Mathy Vanhoef 2021-01-16 14:39:21 +04:00
parent 56a0d40b3b
commit d7718bc6f6
4 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
research/fraginternals.py
View File

@ -59,8 +59,7 @@ def freebsd_encap_eapolmsdu(p, src, dst, payload):
p.addr1 = "ff:ff:ff:ff:ff:ff"
# Encapsulate EAPOL in malformed EAPOL/A-MSDU fragment
p.A_MSDU_Present = 1
set_amsdu(p)
p = p/freebsd_create_eapolmsdu(src, dst, payload)
return p

2
research/libwifi

@ -1 +1 @@
Subproject commit efd0f0f571f286768d057d81731ca63bdb3eb75c
Subproject commit 424954db968be2ba47450db525b31bc2f60a7a2e

2
research/tests_attacks.py
View File

@ -42,7 +42,7 @@ class AmsduInject(Test):
p = header/LLC()/SNAP()/IP(dst="192.168.1.2", src="3.5.1.1")/TCP()/Raw(b"A" * 748)
p = p/create_msdu_subframe(src, dst, request, last=True)
p[Dot11QoS].A_MSDU_Present = 1
set_amsdu(p[Dot11QoS])
# Schedule transmission of frame
self.actions[0].frame = p

6
research/tests_common.py
View File

@ -58,12 +58,12 @@ class PingTest(Test):
if self.as_msdu == 1:
# Set the A-MSDU frame type flag in the QoS header
header.A_MSDU_Present = 1
set_amsdu(header)
# Encapsulate the request in an A-MSDU payload
request = create_msdu_subframe(station.mac, station.get_peermac(), request)
elif self.as_msdu == 2:
# Set A-MSDU flag but include a normal payload (fake A-MSDU)
header.A_MSDU_Present = 1
set_amsdu(header)
# Generate all the individual (fragmented) frames
num_frags = len(self.get_actions(Action.Inject))
@ -237,7 +237,7 @@ class EapolAmsduTest(Test):
# Generate the single frame
header, request, check_fn = generate_request(station, self.ptype, dport=self.dport)
# Set the A-MSDU frame type flag in the QoS header
header.A_MSDU_Present = 1
set_amsdu(header)
# We can automatically detect the result if the last fragment was sent after a connected event.
# Note we might get a reply during a rekey handshake, and this will be handled properly.