forked from aanarchyy/wifite-mod-pixiewps
-
Notifications
You must be signed in to change notification settings - Fork 0
/
wifite-ng
3302 lines (2745 loc) · 109 KB
/
wifite-ng
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/usr/bin/python
# -*- coding: utf-8 -*-
"""
wifite
author: derv82 at gmail
Licensed under the GNU General Public License Version 2 (GNU GPL v2),
available at: http://www.gnu.org/licenses/gpl-2.0.txt
(C) 2011 Derv Merkler
-----------------
TODO:
ignore root check when -cracked (afterward) (need root for -check?)
"cracked*" in list of AP's
Restore same command-line switch names from v1
If device already in monitor mode, check for and, if applicable, use macchanger
WPS
* Mention reaver automatically resumes sessions
* Warning about length of time required for WPS attack (*hours*)
* Show time since last successful attempt
* Percentage of tries/attempts ?
* Update code to work with reaver 1.4 ("x" sec/att)
WEP:
* ability to pause/skip/continue (done, not tested)
* Option to capture only IVS packets (uses --output-format ivs,csv)
- not compatible on older aircrack-ng's.
- Just run "airodump-ng --output-format ivs,csv", "No interface specified" = works
- would cut down on size of saved .caps
reaver:
MONITOR ACTIVITY!
- Enter ESSID when executing (?)
- Ensure WPS key attempts have begun.
- If no attempts can be made, stop attack
- During attack, if no attempts are made within X minutes, stop attack & Print
- Reaver's output when unable to associate:
[!] WARNING: Failed to associate with AA:BB:CC:DD:EE:FF (ESSID: ABCDEF)
- If failed to associate for x minutes, stop attack (same as no attempts?)
MIGHTDO:
* WPA - crack (pyrit/cowpatty) (not really important)
* Test injection at startup? (skippable via command-line switch)
"""
#############
# LIBRARIES #
#############
import os # File management
import time # Measuring attack intervals
import random # Generating a random MAC address.
import errno # Error numbers
import shutil
from sys import argv # Command-line arguments
from sys import stdout, stdin # Flushing
from shutil import copy # Copying .cap files
# Executing, communicating with, killing processes
from subprocess import Popen, call, PIPE
from signal import SIGINT, SIGTERM
import re # RegEx, Converting SSID to filename
import urllib # Check for new versions from the repo
import signal
import sys
from subprocess import Popen
from subprocess import call
################################
# GLOBAL VARIABLES IN ALL CAPS #
################################
REVISION = 112
# WPA variables
WPA_DISABLE = False # Flag to skip WPA handshake capture
WPA_STRIP_HANDSHAKE = True # Use pyrit or tshark (if applicable) to strip handshake
WPA_DEAUTH_TIMEOUT = 10 # Time to wait between deauthentication bursts (in seconds)
WPA_ATTACK_TIMEOUT = 500 # Total time to allow for a handshake attack (in seconds)
WPA_HANDSHAKE_DIR = 'hs' # Directory in which handshakes .cap files are stored
# Strip file path separator if needed
if WPA_HANDSHAKE_DIR != '' and WPA_HANDSHAKE_DIR[-1] == os.sep:
WPA_HANDSHAKE_DIR = WPA_HANDSHAKE_DIR[:-1]
WPA_FINDINGS = [] # List of strings containing info on successful WPA attacks
WPA_DONT_CRACK = False # Flag to skip cracking of handshakes
WPA_DICTIONARY = '/pentest/web/wfuzz/wordlist/fuzzdb/wordlists-user-passwd/passwds/phpbb.txt'
if not os.path.exists(WPA_DICTIONARY): WPA_DICTIONARY = ''
# Various programs to use when checking for a four-way handshake.
# True means the program must find a valid handshake in order for wifite to recognize a handshake.
# Not finding handshake short circuits result (ALL 'True' programs must find handshake)
WPA_HANDSHAKE_TSHARK = True # Checks for sequential 1,2,3 EAPOL msg packets (ignores 4th)
WPA_HANDSHAKE_PYRIT = False # Sometimes crashes on incomplete dumps, but accurate.
WPA_HANDSHAKE_AIRCRACK = True # Not 100% accurate, but fast.
WPA_HANDSHAKE_COWPATTY = False # Uses more lenient "nonstrict mode" (-2)
# WEP variables
WEP_DISABLE = False # Flag for ignoring WEP networks
WEP_PPS = 600 # packets per second (Tx rate)
WEP_TIMEOUT = 600 # Amount of time to give each attack
WEP_ARP_REPLAY = True # Various WEP-based attacks via aireplay-ng
WEP_CHOPCHOP = True #
WEP_FRAGMENT = True #
WEP_CAFFELATTE = True #
WEP_P0841 = True
WEP_HIRTE = True
WEP_CRACK_AT_IVS = 10000 # Number of IVS at which we start cracking
WEP_IGNORE_FAKEAUTH = True # When True, continues attack despite fake authentication failure
WEP_FINDINGS = [] # List of strings containing info on successful WEP attacks.
WEP_SAVE = False # Save packets.
# WPS variables
WPS_DISABLE = False # Flag to skip WPS scan and attacks
WPS_FINDINGS = [] # List of (successful) results of WPS attacks
WPS_TIMEOUT = 660 # Time to wait (in seconds) for successful PIN attempt
WPS_RATIO_THRESHOLD = 0.01 # Lowest percentage of tries/attempts allowed (where tries > 0)
WPS_MAX_RETRIES = 0 # Number of times to re-try the same pin before giving up completely.
# Program variables
WIRELESS_IFACE = '' # User-defined interface
TARGET_CHANNEL = 0 # User-defined channel to scan on
TARGET_ESSID = '' # User-defined ESSID of specific target to attack
TARGET_BSSID = '' # User-defined BSSID of specific target to attack
IFACE_TO_TAKE_DOWN = '' # Interface that wifite puts into monitor mode
# It's our job to put it out of monitor mode after the attacks
ORIGINAL_IFACE_MAC = ('', '') # Original interface name[0] and MAC address[1] (before spoofing)
DO_NOT_CHANGE_MAC = True # Flag for disabling MAC anonymizer
TARGETS_REMAINING = 0 # Number of access points remaining to attack
WPA_CAPS_TO_CRACK = [] # list of .cap files to crack (full of CapFile objects)
THIS_MAC = '' # The interfaces current MAC address.
SHOW_MAC_IN_SCAN = False # Display MACs of the SSIDs in the list of targets
CRACKED_TARGETS = [] # List of targets we have already cracked
ATTACK_ALL_TARGETS = False # Flag for when we want to attack *everyone*
ATTACK_MIN_POWER = 0 # Minimum power (dB) for access point to be considered a target
VERBOSE_APS = True # Print access points as they appear
ENDLESS = 1
TOTAL_RUNS = 0
#Pixie variables
PIXIE_TIMEOUT = 660 # timeout for pixiewps attack
PIXIE_NOPSK = False # do not run reaver using pin found by pixiewps if it is sucessful
PIXIE_ONLY = False # only use pixiewps, do not run reaver brute-force
PIXIE_ADD_TO = 30 # add n seconds to timeout
# Console colors
W = '\033[0m' # white (normal)
R = '\033[31m' # red
G = '\033[32m' # green
O = '\033[33m' # orange
B = '\033[34m' # blue
P = '\033[35m' # purple
C = '\033[36m' # cyan
GR = '\033[37m' # gray
if os.getuid() != 0:
print R+' [!]'+O+' ERROR:'+G+' wifite'+O+' must be run as '+R+'root'+W
print R+' [!]'+O+' login as root ('+W+'su root'+O+') or try '+W+'sudo ./wifite.py'+W
exit(1)
if not os.uname()[0].startswith("Linux") and not 'Darwin' in os.uname()[0]: # OSX support, 'cause why not?
print O+' [!]'+R+' WARNING:'+G+' wifite'+W+' must be run on '+O+'linux'+W
exit(1)
# Create temporary directory to work in
from tempfile import mkdtemp
temp = mkdtemp(prefix='wifite')
if not temp.endswith(os.sep):
temp += os.sep
# /dev/null, send output from programs so they don't print to screen.
DN = open(os.devnull, 'w')
###################
# DATA STRUCTURES #
###################
class CapFile:
"""
Holds data about an access point's .cap file, including AP's ESSID & BSSID.
"""
def __init__(self, filename, ssid, bssid):
self.filename = filename
self.ssid = ssid
self.bssid = bssid
class Target:
"""
Holds data for a Target (aka Access Point aka Router)
"""
def __init__(self, bssid, power, data, channel, encryption, ssid):
self.bssid = bssid
self.power = power
self.data = data
self.channel = channel
self.encryption = encryption
self.ssid = ssid
self.wps = False # Default to non-WPS-enabled router.
self.key = ''
class Client:
"""
Holds data for a Client (device connected to Access Point/Router)
"""
def __init__(self, bssid, station, power):
self.bssid = bssid
self.station = station
self.power = power
##################
# MAIN FUNCTIONS #
##################
def main():
"""
Where the magic happens.
"""
global TARGETS_REMAINING, THIS_MAC, CRACKED_TARGETS, TOTAL_RUNS
CRACKED_TARGETS = load_cracked() # Load previously-cracked APs from file
handle_args() # Parse args from command line, set global variables.
initial_check() # Ensure required programs are installed.
# The "get_iface" method anonymizes the MAC address (if needed)
# and puts the interface into monitor mode.
iface = get_iface()
THIS_MAC = get_mac_address(iface) # Store current MAC address
(targets, clients) = scan(iface=iface, channel=TARGET_CHANNEL)
auto_skip = False
try:
index = 0
while index < len(targets):
target = targets[index]
# Check if we have already cracked this target
for already in CRACKED_TARGETS:
if already.bssid == targets[index].bssid:
print R+'\n [!]'+O+' you have already cracked this access point\'s key!'+W
print R+' [!] %s' % (C+already.ssid+W+': "'+G+already.key+W+'"')
if auto_skip == True :
print R+'\n [!]'+O+' Automatically skipping!'+W
targets.pop(index)
index -= 1
else:
ri = raw_input(GR+' [+] '+W+'do you want to crack this access point again? ('+G+'y/'+O+'n'+W+'): ')
if ri.lower() == 'n':
targets.pop(index)
index -= 1
break
# Check if handshakes already exist, ask user whether to skip targets or save new handshakes
handshake_file = WPA_HANDSHAKE_DIR + os.sep + re.sub(r'[^a-zA-Z0-9]', '', target.ssid) \
+ '_' + target.bssid.replace(':', '-') + '.cap'
if os.path.exists(handshake_file):
print R+'\n [!] '+O+'you already have a handshake file for %s:' % (C+target.ssid+W)
print ' %s\n' % (G+handshake_file+W)
print GR+' [+]'+W+' do you want to '+G+'[s]kip'+W+', '+O+'[c]apture again'+W+', or '+R+'[o]verwrite'+W+'?'
ri = 'x'
while ri != 's' and ri != 'c' and ri != 'o':
ri = raw_input(GR+' [+] '+W+'enter '+G+'s'+W+', '+O+'c,'+W+' or '+R+'o'+W+': '+G).lower()
print W+"\b",
if ri == 's':
targets.pop(index)
index -= 1
elif ri == 'o':
remove_file(handshake_file)
continue
index += 1
except KeyboardInterrupt:
print '\n '+R+'(^C)'+O+' interrupted\n'
exit_gracefully(0)
wpa_success = 0
wep_success = 0
wpa_total = 0
wep_total = 0
TARGETS_REMAINING = len(targets)
try:
while not TOTAL_RUNS == ENDLESS or ENDLESS == 0:
print GR+' [+]'+W+' Run %s%d' % (G,TOTAL_RUNS + 1)
for t in targets:
TARGETS_REMAINING -= 1
# Build list of clients connected to target
ts_clients = []
for c in clients:
if c.station == t.bssid:
ts_clients.append(c)
print ''
if t.encryption.find('WPA') != -1:
need_handshake = True
if not WPS_DISABLE and t.wps:
need_handshake = not wps_attack(iface, t)
wpa_total += 1
if not need_handshake: wpa_success += 1
if TARGETS_REMAINING < 0: break
if not WPA_DISABLE and need_handshake:
wpa_total += 1
if wpa_get_handshake(iface, t, ts_clients):
wpa_success += 1
elif t.encryption.find('WEP') != -1:
wep_total += 1
if attack_wep(iface, t, ts_clients):
wep_success += 1
else: print R+' unknown encryption:',t.encryption,W
# If user wants to stop attacking
if TARGETS_REMAINING <= 0: break
TOTAL_RUNS += 1
TARGETS_REMAINING = len(targets)
except KeyboardInterrupt:
print R+'\n (^C)'+O+'attack interrupted'+W
print GR+' [+]'+W+'Total Runs %s%d' % (G,TOTAL_RUNS + 1)
print ''
exit_gracefully(0)
if wpa_total + wep_total > 0:
# Attacks are done! Show results to user
print ''
print GR+' [+] %s%d attack%s completed:%s' % (G, wpa_total + wep_total, '' if wpa_total+wep_total == 1 else 's', W)
print ''
if wpa_total > 0:
if wpa_success == 0: print GR+' [+]'+R,
elif wpa_success == wpa_total: print GR+' [+]'+G,
else: print GR+' [+]'+O,
print '%d/%d%s WPA attacks succeeded' % (wpa_success, wpa_total, W)
for finding in WPA_FINDINGS:
print ' ' + C+finding+W
if wep_total > 0:
if wep_success == 0: print GR+' [+]'+R,
elif wep_success == wep_total: print GR+' [+]'+G,
else: print GR+' [+]'+O,
print '%d/%d%s WEP attacks succeeded' % (wep_success, wep_total, W)
for finding in WEP_FINDINGS:
print ' ' + C+finding+W
caps = len(WPA_CAPS_TO_CRACK)
if caps > 0 and not WPA_DONT_CRACK:
print GR+' [+]'+W+' starting '+G+'WPA cracker'+W+' on %s%d handshake%s' % (G, caps, W if caps == 1 else 's'+W)
for cap in WPA_CAPS_TO_CRACK:
wpa_crack(cap)
print ''
exit_gracefully(0)
def rename(old, new):
"""
Renames file 'old' to 'new', works with separate partitions.
Thanks to hannan.sadar
"""
try:
os.rename(old, new)
except os.error, detail:
if detail.errno == errno.EXDEV:
try:
copy(old, new)
except:
os.unlink(new)
raise
os.unlink(old)
# if desired, deal with other errors
else:
raise
def initial_check():
"""
Ensures required programs are installed.
"""
global WPS_DISABLE
airs = ['aircrack-ng', 'airodump-ng', 'aireplay-ng', 'airmon-ng', 'packetforge-ng']
for air in airs:
if program_exists(air): continue
print R+' [!]'+O+' required program not found: %s' % (R+air+W)
print R+' [!]'+O+' this program is bundled with the aircrack-ng suite:'+W
print R+' [!]'+O+' '+C+'http://www.aircrack-ng.org/'+W
print R+' [!]'+O+' or: '+W+'sudo apt-get install aircrack-ng\n'+W
exit_gracefully(1)
if not program_exists('iw'):
print R+' [!]'+O+' airmon-ng requires the program %s\n' % (R+'iw'+W)
exit_gracefully(1)
printed = False
# Check reaver
if not program_exists('reaver'):
printed = True
print R+' [!]'+O+' the program '+R+'reaver'+O+' is required for WPS attacks'+W
print R+' '+O+' available at '+C+'http://code.google.com/p/reaver-wps'+W
WPS_DISABLE = True
elif not program_exists('walsh') and not program_exists('wash'):
printed = True
print R+' [!]'+O+' reaver\'s scanning tool '+R+'walsh'+O+' (or '+R+'wash'+O+') was not found'+W
print R+' [!]'+O+' please re-install reaver or install walsh/wash separately'+W
# Check handshake-checking apps
recs = ['tshark', 'pyrit', 'cowpatty', 'pixiewps']
for rec in recs:
if program_exists(rec): continue
printed = True
print R+' [!]'+O+' the program %s is not required, but is recommended%s' % (R+rec+O, W)
if printed: print ''
def handle_args():
"""
Handles command-line arguments, sets global variables.
"""
global WIRELESS_IFACE, TARGET_CHANNEL, DO_NOT_CHANGE_MAC, TARGET_ESSID, TARGET_BSSID
global WPA_DISABLE, WPA_STRIP_HANDSHAKE, WPA_DEAUTH_TIMEOUT, WPA_ATTACK_TIMEOUT
global WPA_DONT_CRACK, WPA_DICTIONARY, WPA_HANDSHAKE_TSHARK, WPA_HANDSHAKE_PYRIT
global WPA_HANDSHAKE_AIRCRACK, WPA_HANDSHAKE_COWPATTY
global WEP_DISABLE, WEP_PPS, WEP_TIMEOUT, WEP_ARP_REPLAY, WEP_CHOPCHOP, WEP_FRAGMENT
global WEP_CAFFELATTE, WEP_P0841, WEP_HIRTE, WEP_CRACK_AT_IVS, WEP_IGNORE_FAKEAUTH
global WEP_SAVE, SHOW_MAC_IN_SCAN, ATTACK_ALL_TARGETS, ATTACK_MIN_POWER
global WPS_DISABLE, WPS_TIMEOUT, WPS_RATIO_THRESHOLD, WPS_MAX_RETRIES
global VERBOSE_APS, PIXIE_TIMEOUT, PIXIE_ONLY, PIXIE_NOPSK, PIXIE_ADD_TO, ENDLESS
global TOTAL_RUNS
args = argv[1:]
if args.count('-h') + args.count('--help') + args.count('?') + args.count('-help') > 0:
help()
exit_gracefully(0)
set_encrypt = False
set_hscheck = False
set_wep = False
capfile = '' # Filename of .cap file to analyze for handshakes
try:
for i in xrange(0, len(args)):
if not set_encrypt and (args[i] == '-wpa' or args[i] == '-wep' or args[i] == '-wps'):
WPS_DISABLE = True
WPA_DISABLE = True
WEP_DISABLE = True
set_encrypt = True
if args[i] == '-wpa':
print GR+' [+]'+W+' targeting '+G+'WPA'+W+' encrypted networks (use '+G+'-wps'+W+' for WPS scan)'
WPA_DISABLE = False
elif args[i] == '-wep':
print GR+' [+]'+W+' targeting '+G+'WEP'+W+' encrypted networks'
WEP_DISABLE = False
elif args[i] == '-wps':
print GR+' [+]'+W+' targeting '+G+'WPS-enabled'+W+' networks'
WPS_DISABLE = False
elif args[i] == '-c':
i += 1
try: TARGET_CHANNEL = int(args[i])
except ValueError: print O+' [!]'+R+' invalid channel: '+O+args[i]+W
except IndexError: print O+' [!]'+R+' no channel given!'+W
else: print GR+' [+]'+W+' channel set to %s' % (G+args[i]+W)
elif args[i] == '-mac':
print GR+' [+]'+W+' mac address anonymizing '+G+'enabled'+W
DO_NOT_CHANGE_MAC = False
elif args[i] == '-i':
i += 1
WIRELESS_IFACE = args[i]
print GR+' [+]'+W+' set interface: %s' % (G+args[i]+W)
elif args[i] == '-e':
i += 1
try: TARGET_ESSID = args[i]
except ValueError: print R+' [!]'+O+' no ESSID given!'+W
else: print GR+' [+]'+W+' targeting ESSID "%s"' % (G+args[i]+W)
elif args[i] == '-b':
i += 1
try: TARGET_BSSID = args[i]
except ValueError: print R+' [!]'+O+' no BSSID given!'+W
else: print GR+' [+]'+W+' targeting BSSID "%s"' % (G+args[i]+W)
elif args[i] == '-showb' or args[i] == '-showbssid':
SHOW_MAC_IN_SCAN = True
print GR+' [+]'+W+' target MAC address viewing '+G+'enabled'+W
elif args[i] == '-all' or args[i] == '-hax0ritna0':
print GR+' [+]'+W+' targeting '+G+'all access points'+W
ATTACK_ALL_TARGETS = True
elif args[i] == '-pow' or args[i] == '-power':
i += 1
try:
ATTACK_MIN_POWER = int(args[i])
except ValueError: print R+' [!]'+O+' invalid power level: %s' % (R+args[i]+W)
except IndexError: print R+' [!]'+O+' no power level given!'+W
else: print GR+' [+]'+W+' minimum target power set to %s' % (G+args[i] + "dB"+W)
elif args[i] == '-endless':
ENDLESS = 0
print GR+' [+]'+W+' Looping through targets endlessly'
elif args[i] == '-q' or args[i] == '-quiet':
VERBOSE_APS = False
print GR+' [+]'+W+' list of APs during scan '+O+'disabled'+W
elif args[i] == '-check':
i += 1
try: capfile = args[i]
except IndexError:
print R+' [!]'+O+' unable to analyze capture file'+W
print R+' [!]'+O+' no cap file given!\n'+W
exit_gracefully(1)
else:
if not os.path.exists(capfile):
print R+' [!]'+O+' unable to analyze capture file!'+W
print R+' [!]'+O+' file not found: '+R+capfile+'\n'+W
exit_gracefully(1)
elif args[i] == '-upgrade' or args[i] == '-update':
upgrade()
exit(0)
elif args[i] == '-cracked':
if len(CRACKED_TARGETS) == 0:
print R+' [!]'+O+' there are not cracked access points saved to '+R+'cracked.txt\n'+W
exit_gracefully(1)
print GR+' [+]'+W+' '+W+'previously cracked access points'+W+':'
for victim in CRACKED_TARGETS:
print ' %s (%s) : "%s"' % (C+victim.ssid+W, C+victim.bssid+W, G+victim.key+W)
print ''
exit_gracefully(0)
# WPA
if not set_hscheck and (args[i] == '-tshark' or args[i] == '-cowpatty' or args[i] == '-aircrack' or args[i] == 'pyrit'):
WPA_HANDSHAKE_TSHARK = False
WPA_HANDSHAKE_PYRIT = False
WPA_HANDSHAKE_COWPATTY = False
WPA_HANDSHAKE_AIRCRACK = False
set_hscheck = True
elif args[i] == '-strip':
WPA_STRIP_HANDSHAKE = True
print GR+' [+]'+W+' handshake stripping '+G+'enabled'+W
elif args[i] == '-wpadt':
i += 1
WPA_DEAUTH_TIMEOUT = int(args[i])
print GR+' [+]'+W+' WPA deauth timeout set to %s' % (G+args[i]+' seconds'+W)
elif args[i] == '-wpat':
i += 1
WPA_ATTACK_TIMEOUT = int(args[i])
print GR+' [+]'+W+' WPA attack timeout set to %s' % (G+args[i]+' seconds'+W)
elif args[i] == '-crack':
WPA_DONT_CRACK = False
print GR+' [+]'+W+' WPA cracking '+G+'enabled'+W
elif args[i] == '-dict':
i += 1
try:
WPA_DICTIONARY = args[i]
except IndexError: print R+' [!]'+O+' no WPA dictionary given!'
else:
if os.path.exists(args[i]):
print GR+' [+]'+W+' WPA dictionary set to %s' % (G+args[i]+W)
else:
print R+' [!]'+O+' WPA dictionary file not found: %s' % (args[i])
if args[i] == '-tshark':
WPA_HANDSHAKE_TSHARK = True
print GR+' [+]'+W+' tshark handshake verification '+G+'enabled'+W
if args[i] == '-pyrit':
WPA_HANDSHAKE_PYRIT = True
print GR+' [+]'+W+' pyrit handshake verification '+G+'enabled'+W
if args[i] == '-aircrack':
WPA_HANDSHAKE_AIRCRACK = True
print GR+' [+]'+W+' aircrack handshake verification '+G+'enabled'+W
if args[i] == '-cowpatty':
WPA_HANDSHAKE_COWPATTY = True
print GR+' [+]'+W+' cowpatty handshake verification '+G+'enabled'+W
# WEP
if not set_wep and args[i] == '-chopchop' or args[i] == 'fragment' or \
args[i] == 'caffelatte' or args[i] == '-arpreplay' or \
args[i] == '-p0841' or args[i] == '-hirte':
WEP_CHOPCHOP = False
WEP_ARPREPLAY = False
WEP_CAFFELATTE = False
WEP_FRAGMENT = False
WEP_P0841 = False
WEP_HIRTE = False
if args[i] == '-chopchop':
print GR+' [+]'+W+' WEP chop-chop attack '+G+'enabled'+W
WEP_CHOPCHOP = True
if args[i] == '-fragment' or args[i] == '-frag' or args[i] == '-fragmentation':
print GR+' [+]'+W+' WEP fragmentation attack '+G+'enabled'+W
WEP_FRAGMENT = True
if args[i] == '-caffelatte':
print GR+' [+]'+W+' WEP caffe-latte attack '+G+'enabled'+W
WEP_CAFFELATTE = True
if args[i] == '-arpreplay':
print GR+' [+]'+W+' WEP arp-replay attack '+G+'enabled'+W
WEP_ARPREPLAY = True
if args[i] == '-p0841':
print GR+' [+]'+W+' WEP p0841 attack '+G+'enabled'+W
WEP_P0841 = True
if args[i] == '-hirte':
print GR+' [+]'+W+' WEP hirte attack '+G+'enabled'+W
WEP_HIRTE = True
if args[i] == '-nofake':
print GR+' [+]'+W+' ignoring failed fake-authentication '+R+'disabled'+W
WEP_IGNORE_FAKEAUTH = False
if args[i] == '-wept' or args[i] == '-weptime':
i += 1
try:
WEP_TIMEOUT = int(args[i])
except ValueError: print R+' [!]'+O+' invalid timeout: %s' % (R+args[i]+W)
except IndexError: print R+' [!]'+O+' no timeout given!'+W
else: print GR+' [+]'+W+' WEP attack timeout set to %s' % (G+args[i] + " seconds"+W)
if args[i] == '-pps':
i += 1
try:
WEP_PPS = int(args[i])
except ValueError: print R+' [!]'+O+' invalid value: %s' % (R+args[i]+W)
except IndexError: print R+' [!]'+O+' no value given!'+W
else: print GR+' [+]'+W+' packets-per-second rate set to %s' % (G+args[i] + " packets/sec"+W)
if args[i] == '-save' or args[i] == '-wepsave':
WEP_SAVE = True
print GR+' [+]'+W+' WEP .cap file saving '+G+'enabled'+W
# WPS
if args[i] == '-wpst' or args[i] == '-wpstime':
i += 1
try:
WPS_TIMEOUT = int(args[i])
except ValueError: print R+' [!]'+O+' invalid timeout: %s' % (R+args[i]+W)
except IndexError: print R+' [!]'+O+' no timeout given!'+W
else: print GR+' [+]'+W+' WPS attack timeout set to %s' % (G+args[i] + " seconds"+W)
if args[i] == '-wpsratio' or args[i] == 'wpsr':
i += 1
try:
WPS_RATIO_THRESHOLD = float(args[i])
except ValueError: print R+' [!]'+O+' invalid percentage: %s' % (R+args[i]+W)
except IndexError: print R+' [!]'+O+' no ratio given!'+W
else: print GR+' [+]'+W+' minimum WPS tries/attempts threshold set to %s' % (G+args[i] + ""+W)
if args[i] == '-wpsmaxr' or args[i] == '-wpsretry':
i += 1
try:
WPS_MAX_RETRIES = int(args[i])
except ValueError: print R+' [!]'+O+' invalid number: %s' % (R+args[i]+W)
except IndexError: print R+' [!]'+O+' no number given!'+W
else: print GR+' [+]'+W+' WPS maximum retries set to %s' % (G+args[i] + " retries"+W)
#Pixie
if args[i] == '-pixiet' or args[i] == '-pto':
i += 1
try:
PIXIE_TIMEOUT = int(args[i])
except ValueError: print R+' [!]'+O+' invalid timeout: %s' % (R+args[i]+W)
except IndexError: print R+' [!]'+O+' no timeout given!'+W
else: print GR+' [+]'+W+' pixie attack timeout set to %s' % (G+args[i] + " seconds"+W)
if args[i] == '-ponly':
print GR+' [+]'+W+' Pixiewps attack only '+G+'enabled'+W
PIXIE_ONLY = True
WPA_DISABLE = True
WEP_DISABLE = True
if args[i] == '-pixienopsk' or args[i] == '-pnopsk':
PIXIE_NOPSK = True
print GR+' [+]'+W+' Skip PSK retrieval on sucessful pixiewps attack'
if args[i] == '-paddto':
i += 1
try:
PIXIE_ADD_TO = int(args[i])
except ValueError: print R+' [!]'+O+' invalid timeout: %s' % (R+args[i]+W)
except IndexError: print R+' [!]'+O+' no timeout given!'+W
else: print GR+' [+]'+W+' Seconds to add on hash retrevial %s' % (G+args[i] + " seconds"+W)
except IndexError:
print '\nindexerror\n\n'
if capfile != '':
analyze_capfile(capfile)
print ''
def banner():
"""
Displays ASCII art of the highest caliber.
"""
global REVISION
print ''
print G+" .;' `;, "
print G+" .;' ,;' `;, `;, "+W+"WiFite v2 (r" + str(REVISION) + ")"
print G+".;' ,;' ,;' `;, `;, `;, "
print G+":: :: : "+GR+"( )"+G+" : :: :: "+GR+"automated wireless auditor"
print G+"':. ':. ':. "+GR+"/_\\"+G+" ,:' ,:' ,:' "
print G+" ':. ':. "+GR+"/___\\"+G+" ,:' ,:' "+GR+"designed for Linux"
print G+" ':. "+GR+"/_____\\"+G+" ,:' "
print G+" "+GR+"/ \\"+G+" "
print G+""
print G+"modified by aanarchyy(aanarchyy@gmail.com)"
print G+"Credits to wiire,DataHead,soxrok2212,nxxxu,nuroo"
print W
def upgrade():
"""
Checks for new version, prompts to upgrade, then
replaces this script with the latest from the repo
"""
global REVISION
# Download script, replace with this one
print GR+' [+] '+G+'downloading'+W+' update...'
try:
try:
sock = urllib.urlopen('https://github.com/aanarchyy/wifite-mod-pixiewps/archive/master.zip')
page = sock.read()
except IOError:
page = ''
if page == '':
print R+' [+] '+O+'unable to download latest version'+W
exit_gracefully(1)
f=open(temp + 'wifite-mod-pixiewps-master.zip','w')
f.write(page)
f.close()
returncode = call(['unzip', '-d', temp , temp + 'wifite-mod-pixiewps-master.zip'])
if returncode != 0:
print R+' [!]'+O+' unzip change returned unexpected code: '+str(returncode)+W
exit_gracefully(1)
# The filename of the running script
this_file = __file__
if this_file.startswith('./'):
this_file = this_file[2:]
#create/save a shell script that replaces this script with the new one
f = open('update_wifite.sh','w')
f.write('''#!/bin/sh\n
rm -rf ''' + this_file + '''\n
cp ''' + temp + '''wifite-mod-pixiewps-master/wifite-ng ''' + this_file + '''\n
rm -rf update_wifite.sh\n
rm -rf ''' + temp + '''wifite-mod-pixiewps-master/
chmod +x ''' + this_file + '''\n
''')
f.close()
# Change permissions on the script
returncode = call(['chmod','+x','update_wifite.sh'])
if returncode != 0:
print R+' [!]'+O+' permission change returned unexpected code: '+str(returncode)+W
exit_gracefully(1)
# Run the script
returncode = call(['sh','update_wifite.sh'])
if returncode != 0:
print R+' [!]'+O+' upgrade script returned unexpected code: '+str(returncode)+W
exit_gracefully(1)
print GR+' [+] '+G+'Updated'+W
except KeyboardInterrupt:
print R+'\n (^C)'+O+' wifite upgrade interrupted'+W
exit_gracefully(0)
def get_revision():
"""
Gets latest revision # from google code repository
Returns tuple: revision#, description of change, date changed
"""
irev =-1
desc =''
since=''
try:
sock = urllib.urlopen('http://code.google.com/p/wifite/source/list?path=/trunk/wifite.py')
page = sock.read()
except IOError:
return (-1, '', '')
# get the revision
start= page.find('href="detail?r=')
stop = page.find('&', start)
if start != -1 and stop != -1:
start += 15
rev=page[start:stop]
try:
irev=int(rev)
except ValueError:
rev=rev.split('\n')[0]
print R+'[+] invalid revision number: "'+rev+'"'
# get the description
start= page.find(' href="detail?r='+str(irev)+'', start + 3)
start= page.find('">',start)
stop = page.find('</a>', start)
if start != -1 and stop != -1:
start += 2
desc=page[start:stop].strip()
desc=desc.replace("'","'")
desc=desc.replace("<","<")
desc=desc.replace(">",">")
if '\n' in desc:
desc = desc.split('\n')[0]
# get the time last modified
start= page.find(' href="detail?r='+str(irev)+'', start + 3)
start= page.find('">',start)
stop = page.find('</a>', start)
if start != -1 and stop != -1:
start += 2
since=page[start:stop]
return (irev, desc, since)
def help():
"""
Prints help screen
"""
head = W
sw = G
var = GR
des = W
de = G
print head+' COMMANDS'+W
print sw+'\t-check '+var+'<file>\t'+des+'check capfile '+var+'<file>'+des+' for handshakes.'+W
print sw+'\t-cracked \t'+des+'display previously-cracked access points'+W
print ''
print head+' GLOBAL'+W
print sw+'\t-all \t'+des+'attack all targets. '+de+'[off]'+W
print sw+'\t-endless \t'+des+'attack all targets endlessly '+de+'[off]'+W
print sw+'\t-i '+var+'<iface> \t'+des+'wireless interface for capturing '+de+'[auto]'+W
print sw+'\t-mac \t'+des+'anonymize mac address '+de+'[off]'+W
print sw+'\t-c '+var+'<channel>\t'+des+'channel to scan for targets '+de+'[auto]'+W
print sw+'\t-e '+var+'<essid> \t'+des+'target a specific access point by ssid (name) '+de+'[ask]'+W
print sw+'\t-b '+var+'<bssid> \t'+des+'target a specific access point by bssid (mac) '+de+'[auto]'+W
print sw+'\t-showb \t'+des+'display target BSSIDs after scan '+de+'[off]'+W
print sw+'\t-pow '+var+'<db> \t'+des+'attacks any targets with signal strenghth > '+var+'db '+de+'[0]'+W
print sw+'\t-quiet \t'+des+'do not print list of APs during scan '+de+'[off]'+W
print sw+'\t-update \t'+des+'updates to most recent wifite-pixiewps-fork '+W
print ''
print head+'\n WPA'+W
print sw+'\t-wpa \t'+des+'only target WPA networks (works with -wps -wep) '+de+'[off]'+W
print sw+'\t-wpat '+var+'<sec> \t'+des+'time to wait for WPA attack to complete (seconds) '+de+'[500]'+W
print sw+'\t-wpadt '+var+'<sec> \t'+des+'time to wait between sending deauth packets (sec) '+de+'[10]'+W
print sw+'\t-strip \t'+des+'strip handshake using tshark or pyrit '+de+'[off]'+W
print sw+'\t-crack '+var+'<dic>\t'+des+'crack WPA handshakes using '+var+'<dic>'+des+' wordlist file '+de+'[off]'+W
print sw+'\t-dict '+var+'<file>\t'+des+'specify dictionary to use when cracking WPA '+de+'[phpbb.txt]'+W
print sw+'\t-aircrack \t'+des+'verify handshake using aircrack '+de+'[on]'+W
print sw+'\t-pyrit \t'+des+'verify handshake using pyrit '+de+'[off]'+W
print sw+'\t-tshark \t'+des+'verify handshake using tshark '+de+'[on]'+W
print sw+'\t-cowpatty \t'+des+'verify handshake using cowpatty '+de+'[off]'+W
print head+'\n WEP'+W
print sw+'\t-wep \t'+des+'only target WEP networks '+de+'[off]'+W
print sw+'\t-pps '+var+'<num> \t'+des+'set the number of packets per second to inject '+de+'[600]'+W
print sw+'\t-wept '+var+'<sec> \t'+des+'sec to wait for each attack, 0 implies endless '+de+'[600]'+W
print sw+'\t-chopchop \t'+des+'use chopchop attack '+de+'[on]'+W
print sw+'\t-arpreplay \t'+des+'use arpreplay attack '+de+'[on]'+W
print sw+'\t-fragment \t'+des+'use fragmentation attack '+de+'[on]'+W
print sw+'\t-caffelatte \t'+des+'use caffe-latte attack '+de+'[on]'+W
print sw+'\t-p0841 \t'+des+'use -p0841 attack '+de+'[on]'+W
print sw+'\t-hirte \t'+des+'use hirte (cfrag) attack '+de+'[on]'+W
print sw+'\t-nofakeauth \t'+des+'stop attack if fake authentication fails '+de+'[off]'+W
print sw+'\t-wepca '+GR+'<n> \t'+des+'start cracking when number of ivs surpass n '+de+'[10000]'+W
print sw+'\t-wepsave \t'+des+'save a copy of .cap files to this directory '+de+'[off]'+W
print head+'\n WPS'+W
print sw+'\t-wps \t'+des+'only target WPS networks '+de+'[off]'+W
print sw+'\t-wpst '+var+'<sec> \t'+des+'max wait for new retry before giving up (0: never) '+de+'[660]'+W
print sw+'\t-wpsratio '+var+'<per>\t'+des+'min ratio of successful PIN attempts/total tries '+de+'[0]'+W
print sw+'\t-wpsretry '+var+'<num>\t'+des+'max number of retries for same PIN before giving up '+de+'[0]'+W
print head+'\n PixieWPS'+W
print sw+'\t-ponly \t'+des+'only target WPS networks/only use pixiewps '+de+'[off]'+W
print sw+'\t-pto '+var+'<sec> \t'+des+'max wait pixiewps before giving up (0: never) '+de+'[660]'+W
print sw+'\t-pnopsk \t'+des+'Do not run reaver on successful pixiewps attack '+de+'[off]'+W
print sw+'\t-paddto '+var+'<sec> \t'+des+'add n seconds to timeout on each hash retrevial '+de+'[30]'+W
print head+'\n EXAMPLE'+W
print sw+'\t./wifite.py '+W+'-wps -wep -c 6 -pps 600'+W
print ''
###########################
# WIRELESS CARD FUNCTIONS #
###########################
def enable_monitor_mode(iface):
"""
Uses airmon-ng to put a device into Monitor Mode.
Then uses the get_iface() method to retrieve the new interface's name.
Sets global variable IFACE_TO_TAKE_DOWN as well.
Returns the name of the interface in monitor mode.
"""
global IFACE_TO_TAKE_DOWN
print GR+' [+]'+W+' enabling monitor mode on %s...' % (G+iface+W),
stdout.flush()
call(['airmon-ng', 'start', iface], stdout=DN, stderr=DN)
print 'done'
IFACE_TO_TAKE_DOWN = get_iface()
mac_anonymize(IFACE_TO_TAKE_DOWN)
return IFACE_TO_TAKE_DOWN
def disable_monitor_mode():
"""
The program may have enabled monitor mode on a wireless interface.
We want to disable this before we exit, so we will do that.
"""
if IFACE_TO_TAKE_DOWN == '': return
print GR+' [+]'+W+' disabling monitor mode on %s...' % (G+IFACE_TO_TAKE_DOWN+W),
stdout.flush()
call(['airmon-ng', 'stop', IFACE_TO_TAKE_DOWN], stdout=DN, stderr=DN)
print 'done'
PRINTED_SCANNING = False
def get_iface():
"""
Get the wireless interface in monitor mode.
Defaults to only device in monitor mode if found.
Otherwise, enumerates list of possible wifi devices
and asks user to select one to put into monitor mode (if multiple).
Uses airmon-ng to put device in monitor mode if needed.
Returns the name (string) of the interface chosen in monitor mode.
"""
global PRINTED_SCANNING
if not PRINTED_SCANNING:
print GR+' [+]'+W+' scanning for wireless devices...'
PRINTED_SCANNING = True
proc = Popen(['iwconfig'], stdout=PIPE, stderr=DN)
iface = ''
monitors = []
for line in proc.communicate()[0].split('\n'):
if len(line) == 0: continue
if ord(line[0]) != 32: # Doesn't start with space
iface = line[:line.find(' ')] # is the interface
if line.find('Mode:Monitor') != -1:
monitors.append(iface)
if WIRELESS_IFACE != '':