Skip to content

Commit

Permalink
PMKIDAttack v1.2
Browse files Browse the repository at this point in the history
  • Loading branch information
n3d-b0y authored Mar 9, 2019
1 parent 3448786 commit f43749b
Show file tree
Hide file tree
Showing 5 changed files with 103 additions and 59 deletions.
17 changes: 13 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@

The module automates PMKID attack

![alt text](https://i.ibb.co/GdDrdKd/PMKIDAttack.png)
![alt text](https://i.ibb.co/m6HjG7q/2019-03-09-14-54-09.png)

**Device:** Tetra
**Device:** Tetra / NANO

[![Demo video](https://i.ibb.co/wMf1BGg/PMKIDAttack-You-Tube.png)](https://youtu.be/AU2kAd3PUz8)

Expand All @@ -14,10 +14,19 @@ https://codeby.net/threads/6-wifi-pineapple-pmkidattack.66709
https://forums.hak5.org/topic/45365-module-pmkidattack/
```

**Module installation:**
**Module installation for Tetra:**
```
opkg update && opkg install git git-http
cd /pineapple/modules/
git clone https://github.com/n3d-b0y/PMKIDAttack.git PMKIDAttack
chmod +x -R /pineapple/modules/PMKIDAttack/scripts
```
```

**Module installation for NANO:**
```
# This module requires sd card
opkg update && opkg --dest sd install install git git-http
cd /sd/modules/
git clone https://github.com/n3d-b0y/PMKIDAttack.git PMKIDAttack
chmod +x -R /sd/modules/PMKIDAttack/scripts
```
94 changes: 58 additions & 36 deletions api/module.php
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,22 @@

namespace pineapple;

putenv('LD_LIBRARY_PATH='.getenv('LD_LIBRARY_PATH').':/sd/lib:/sd/usr/lib');
putenv('PATH='.getenv('PATH').':/sd/usr/bin:/sd/usr/sbin');

class PMKIDAttack extends Module
{
const PATH_MODULE = '/pineapple/modules/PMKIDAttack';
const PATH_LOG_FILE = '/var/log/pmkidattack.log';
const PATH_MODULE_SD = '/sd/modules/PMKIDAttack';

protected $logPath = '';

public function __construct($request, $moduleClass)
{
$this->logPath = $this->getPathModule() . '/pmkidattack.log';

parent::__construct($request, $moduleClass);
}

public function route()
{
Expand Down Expand Up @@ -56,30 +68,45 @@ public function route()
}
}

protected function getPathModule() {
$isAvailable = $this->isSDAvailable();

if ($isAvailable) {
return self::PATH_MODULE_SD;
}

return self::PATH_MODULE;
}

protected function clearLog()
{
if (!file_exists(self::PATH_LOG_FILE)) {
touch(self::PATH_LOG_FILE);
if (!file_exists($this->logPath)) {
touch($this->logPath);
}

exec('rm ' . self::PATH_LOG_FILE);
touch(self::PATH_LOG_FILE);
exec('rm ' . $this->logPath);
touch($this->logPath);
}

protected function getLog()
{
if (!file_exists(self::PATH_LOG_FILE)) {
touch(self::PATH_LOG_FILE);
if (!file_exists($this->logPath)) {
touch($this->logPath);
}

$file = file_get_contents(self::PATH_LOG_FILE);
$file = file_get_contents($this->logPath);

$this->response = array("pmkidlog" => $file);
}

protected function addLog($massage)
{
file_put_contents($this->logPath, $this->formatLog($massage), FILE_APPEND);
}

protected function formatLog($massage)
{
return '[' . date("Y-m-d H:i:s") . '] ' . $massage . PHP_EOL;
return '[' . date("Y-m-d H:i:s") . '] ' . $massage . PHP_EOL;
}

protected function getDependenciesStatus()
Expand Down Expand Up @@ -112,10 +139,10 @@ protected function checkDependency()
protected function managerDependencies()
{
if (!$this->checkDependency()) {
$this->execBackground(self::PATH_MODULE . "/scripts/dependencies.sh install");
$this->execBackground($this->getPathModule() . "/scripts/dependencies.sh install");
$this->response = array('success' => true);
} else {
$this->execBackground(self::PATH_MODULE . "/scripts/dependencies.sh remove");
$this->execBackground($this->getPathModule() . "/scripts/dependencies.sh remove");
$this->response = array('success' => true);
}
}
Expand All @@ -134,12 +161,10 @@ protected function startAttack()
$this->uciSet('pmkidattack.attack.bssid', $this->request->bssid);

$this->uciSet('pmkidattack.attack.run', '1');
exec("echo " . $this->getFormatBSSID() . " > " . self::PATH_MODULE . "/filter.txt");
exec(self::PATH_MODULE . "/scripts/PMKIDAttack.sh start " . $this->getFormatBSSID());
exec("echo " . $this->getFormatBSSID() . " > " . $this->getPathModule() . "/filter.txt");
exec($this->getPathModule() . "/scripts/PMKIDAttack.sh start " . $this->getFormatBSSID());

$massageLog = 'Start attack ' . $this->request->bssid;

file_put_contents(self::PATH_LOG_FILE, $this->formatLog($massageLog), FILE_APPEND);
$this->addLog('Start attack ' . $this->getBSSID());

$this->response = array('success' => true);
}
Expand All @@ -151,15 +176,13 @@ protected function stopAttack()
exec("pkill hcxdumptool");

if ($this->checkPMKID()) {
exec('cp /tmp/' . $this->getFormatBSSID() . '.pcapng ' . self::PATH_MODULE . '/pcapng/');
exec('cp /tmp/' . $this->getFormatBSSID() . '.pcapng ' . $this->getPathModule() . '/pcapng/');
}

exec("rm -rf /tmp/" . $this->getFormatBSSID() . '.pcapng');
exec("rm -rf " . self::PATH_MODULE . "/log/output.txt");

$massageLog = 'Stop attack ' . $this->getBSSID();
exec("rm -rf " . $this->getPathModule() . "/log/output.txt");

file_put_contents(self::PATH_LOG_FILE, $this->formatLog($massageLog), FILE_APPEND);
$this->addLog('Stop attack ' . $this->getBSSID());

$this->response = array('success' => true);
}
Expand All @@ -168,9 +191,8 @@ protected function stopAttack()
protected function catchPMKID()
{
if ($this->checkPMKID()) {
$massageLog = 'PMKID ' . $this->getBSSID() . ' intercepted!';
$this->addLog('PMKID ' . $this->getBSSID() . ' intercepted!');

file_put_contents(self::PATH_LOG_FILE, $this->formatLog($massageLog), FILE_APPEND);
$this->response = array('success' => true);
} else {
$this->response = array('success' => false);
Expand All @@ -194,8 +216,8 @@ protected function checkPMKID()
{
$searchLine = 'PMKIDs';

exec('hcxpcaptool -z /tmp/pmkid.txt /tmp/' . $this->getFormatBSSID() . '.pcapng &> ' . self::PATH_MODULE . '/log/output.txt');
$file = file_get_contents(self::PATH_MODULE . '/log/output.txt');
exec('hcxpcaptool -z /tmp/pmkid.txt /tmp/' . $this->getFormatBSSID() . '.pcapng &> ' . $this->getPathModule() . '/log/output.txt');
$file = file_get_contents($this->getPathModule() . '/log/output.txt');
exec('rm -r /tmp/pmkid.txt');

return strpos($file, $searchLine) !== false;
Expand All @@ -204,13 +226,13 @@ protected function checkPMKID()
protected function getPMKIDFiles()
{
$pmkids = [];
exec("find -L " . self::PATH_MODULE . "/pcapng/ -type f -name \"*.**pcapng\" 2>&1", $files);
exec("find -L " . $this->getPathModule() . "/pcapng/ -type f -name \"*.**pcapng\" 2>&1", $files);

if (strpos($files[0], 'find') !== false) {
$pmkids = [];
} else {
foreach ($files as $file) {
array_push($pmkids,[
array_push($pmkids, [
'path' => $file,
'name' => implode(str_split(basename($file, '.pcapng'), 2), ":")
]);
Expand All @@ -226,11 +248,11 @@ protected function downloadPMKID()

exec("mkdir /tmp/PMKIDAttack/");
exec("cp " . $this->request->file . " /tmp/PMKIDAttack/");
exec('hcxpcaptool -z /tmp/PMKIDAttack/pmkid.16800 ' . $this->request->file . ' &> ' . self::PATH_MODULE . '/log/output3.txt');
exec('rm -r ' . self::PATH_MODULE . '/log/output3.txt');
exec("cd /tmp/PMKIDAttack/ && tar -czf /tmp/". $fileName .".tar.gz *");
exec('hcxpcaptool -z /tmp/PMKIDAttack/pmkid.16800 ' . $this->request->file . ' &> ' . $this->getPathModule() . '/log/output3.txt');
exec('rm -r ' . $this->getPathModule() . '/log/output3.txt');
exec("cd /tmp/PMKIDAttack/ && tar -czf /tmp/" . $fileName . ".tar.gz *");
exec("rm -rf /tmp/PMKIDAttack/");
$this->response = array("download" => $this->downloadFile("/tmp/". $fileName .".tar.gz"));
$this->response = array("download" => $this->downloadFile("/tmp/" . $fileName . ".tar.gz"));
}

protected function deletePMKID()
Expand All @@ -241,11 +263,11 @@ protected function deletePMKID()
protected function getOutput()
{
if (!empty($this->request->pathPMKID)) {
exec('hcxpcaptool -z /tmp/pmkid.txt ' . $this->request->pathPMKID . ' &> ' . self::PATH_MODULE . '/log/output2.txt');
$output = file_get_contents(self::PATH_MODULE . '/log/output2.txt');
exec("rm -rf " . self::PATH_MODULE . "/log/output2.txt");
exec('hcxpcaptool -z /tmp/pmkid.txt ' . $this->request->pathPMKID . ' &> ' . $this->getPathModule() . '/log/output2.txt');
$output = file_get_contents($this->getPathModule() . '/log/output2.txt');
exec("rm -rf " . $this->getPathModule() . "/log/output2.txt");
} else {
$output = file_get_contents(self::PATH_MODULE . '/log/output.txt');
$output = file_get_contents($this->getPathModule() . '/log/output.txt');
}

$this->response = array("output" => $output);
Expand Down
3 changes: 2 additions & 1 deletion module.info
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,9 @@
"author": "n3d.b0y",
"description": "The module automates PMKID attack",
"devices": [
"nano",
"tetra"
],
"title": "PMKIDAttack",
"version": "1.1"
"version": "1.2"
}
3 changes: 3 additions & 0 deletions scripts/PMKIDAttack.sh
Original file line number Diff line number Diff line change
@@ -1,5 +1,8 @@
#!/bin/sh

export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/sd/lib:/sd/usr/lib
export PATH=$PATH:/sd/usr/bin:/sd/usr/sbin

if [[ "$1" = "start" ]]; then
hcxdumptool -o /tmp/$2.pcapng -i wlan1mon --filterlist=/pineapple/modules/PMKIDAttack/filter.txt --filtermode=2 --enable_status=1 &> /dev/null &
fi
45 changes: 27 additions & 18 deletions scripts/dependencies.sh
Original file line number Diff line number Diff line change
@@ -1,60 +1,69 @@
#!/bin/sh
#!/bin/bash

export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/sd/lib:/sd/usr/lib
export PATH=$PATH:/sd/usr/bin:/sd/usr/sbin

TIMESTAMP=`date "+[%Y-%m-%d %H:%M:%S]"`
LOGFILE="/var/log/pmkidattack.log"

if [[ -e /sd ]]; then
LOGFILE="/sd/modules/PMKIDAttack/pmkidattack.log"
else
LOGFILE="/pineapple/modules/PMKIDAttack/pmkidattack.log"
fi

function add_log {
echo $TIMESTAMP $1 >> $LOGFILE
}

if [[ "$1" == "" ]]; then
echo "$TIMESTAMP Argument to script missing! Run with \"dependencies.sh [install|remove]\"" >> $LOGFILE
add_log "Argument to script missing! Run with \"dependencies.sh [install|remove]\""
exit 1
fi

echo "$TIMESTAMP Starting dependencies script with argument:" $1 >> $LOGFILE
add_log "Starting dependencies script with argument: $1"

touch /tmp/PMKIDAttack.progress

if [[ "$1" = "install" ]]; then

echo "$TIMESTAMP Updating opkg" >> $LOGFILE
add_log "Updating opkg"

if [[ -e /sd ]]; then
echo "$TIMESTAMP Installing on sd" >> $LOGFILE
add_log "Installing on sd"

opkg --dest sd install /pineapple/modules/PMKIDAttack/scripts/ipk/hcxtools_5.1.3-1_ar71xx.ipk >> $LOGFILE

if [[ $? -ne 0 ]]; then
echo "$TIMESTAMP ERROR: opkg --dest sd install hcxtools_5.1.3-1_ar71xx.ipk failed" >> $LOGFILE
add_log "ERROR: opkg --dest sd install hcxtools_5.1.3-1_ar71xx.ipk failed"
exit 1
fi

opkg --dest sd install /pineapple/modules/PMKIDAttack/scripts/ipk/hcxdumptool_5.1.3-1_ar71xx.ipk >> $LOGFILE

if [[ $? -ne 0 ]]; then
echo "$TIMESTAMP ERROR: opkg --dest sd install hcxdumptool_5.1.3-1_ar71xx.ipk failed" >> $LOGFILE
add_log "ERROR: opkg --dest sd install hcxdumptool_5.1.3-1_ar71xx.ipk failed"
exit 1
fi
else
echo "$TIMESTAMP Installing on disk" >> $LOGFILE
add_log "Installing on disk"

opkg install /pineapple/modules/PMKIDAttack/scripts/ipk/hcxtools_5.1.3-1_ar71xx.ipk

if [[ $? -ne 0 ]]; then
echo "$TIMESTAMP ERROR: opkg install hcxtools_5.1.3-1_ar71xx.ipk failed" >> $LOGFILE
add_log "ERROR: opkg install hcxtools_5.1.3-1_ar71xx.ipk failed"
exit 1
fi

opkg install /pineapple/modules/PMKIDAttack/scripts/ipk/hcxdumptool_5.1.3-1_ar71xx.ipk

if [[ $? -ne 0 ]]; then
echo "$TIMESTAMP ERROR: opkg install hcxdumptool_5.1.3-1_ar71xx.ipk failed" >> $LOGFILE
add_log "ERROR: opkg install hcxdumptool_5.1.3-1_ar71xx.ipk failed"
exit 1
fi
fi

echo "$TIMESTAMP Installation complete!" >> $LOGFILE
add_log "Installation complete!"

touch /etc/config/pmkidattack

echo "config pmkidattack 'settings'" > /etc/config/pmkidattack
Expand All @@ -66,14 +75,14 @@ if [[ "$1" = "install" ]]; then
fi

if [[ "$1" = "remove" ]]; then
echo "$TIMESTAMP Removing PMKIDAttack module" >> $LOGFILE
add_log "Removing a module"

rm -rf /etc/config/PMKIDAttack
opkg remove hcxtools

opkg remove hcxtools
opkg remove hcxdumptool

echo "$TIMESTAMP Removing complete!" >> $LOGFILE
add_log "Removing complete!"
fi

rm /tmp/PMKIDAttack.progress

0 comments on commit f43749b

Please sign in to comment.