FrankenScript by Slim76 - It Attacks Access Points and .pcap files

[Quest]

ok, but I really liked the handshake routine in the previous version. I don't think that automating things to the point of not having Deauth packets option is the way to go. Let FS do most of the work, but let the user some room to try different things. 'Artificial intelligence' and automated functions are very tricky. As an example, just use MS Word with its auto-correct functions, and that thing is dumb as a stick and counter productive.

I would focus on the basic premise of FS "saving the user time" and "reducing user input errors", rather than automating attacks. They seem to be one and the same thing, but there is a big difference between both philosophy. One eliminate redundant tasks and human error, the other limits choices and may lead to failure. Big difference between the two.

Let me know if you want me to test anything, except the Pixiewps attack, which I don't understand, even when automated

[Quest]

I may be doing something wrong. This is what happened:

Script (reaver) displays different essid when attacking target on the (attack screen)........
Thru me off for a sec.

(reaver) displays different essid: Confirmed

@ nuroo

I'm not sure what the problem is at the moment, but i'll look into it asap.
Is "[2] = Reaver + Pin Generators (Fixed Arguments)" the only one that has that problem?, or does the essid change on other attack options too?.

No, I picked the first option, Pixiewps.

7: navar 64:66:B3:XX:XX:XX 00.dBm WPS-Locked-No Channel-6
8: Luis 20:AA:4B:XX:XX:XX 00.dBm WPS-Locked-No Channel-11<----my target.

Reaver.t6x + Pixiewps Fixed Attack Arguments:
reaver.t6x.rev51.64bit -i mon0 -c 11 -b 20:AA:4B:XX:XX:XX -a -P -K 1 -vv

Reaver v1.5.2 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <cheffner@tacnetsol.com>
mod by t6_x <t6_x@hotmail.com> & DataHead & Soxrok2212

[+] Switching mon0 to channel 11
[+] Waiting for beacon from 20:AA:4B:XX:XX:XX
[+] Associated with 20:AA:4B:XX:XX:XX (ESSID: navar)<---wrong essid!!
[+] Starting Cracking Session. Pin count: 0, Max pin attempts: 11000
[+] Trying pin 12345670.
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START req

[nuroo]

last thing I wanna do is give erroneous errors 4 u to chase, glad someone else confirmed this.

[Quest]

and thank you for picking up the slack! I might never have seen it. Too weird of a bug to be easily noticeable. Thanks!!

ps: if you have time nurroo, to test the Pixiewps option. I'm clueless about that attack and wouldn't know if it works or not. So if you had success with the original Pixie attack on a certain AP, could you test FrankenScript on that same AP to confirm that the Pixiewps option works?

[nuroo]

It would be my honor and pleasure. I'll do it tonight.

[Quest]

ok thx! Just wait for further word from the monster maker in case he wants you to test a new FS version. Don't want you to waist your time with a faulty version. Cheers!

@ Slim,

yep, the results are completely out-of-wak. Not just the essid.

Scan 1:

6: Luis C0:4A:00:XX:XX:XX 00.dBm WPS-Locked-No Channel-11

Scan2:

5: Luis 20:AA:4B:XX:XX:XX 00.dBm WPS-Locked-No Channel-11

When the truth is:

root@Linksys:~# wash -i mon0

Wash v1.5.2 WiFi Protected Setup Scan Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <cheffner@tacnetsol.com>
mod by t6_x <t6_x@hotmail.com> & DataHead & Soxrok2212

BSSID-----------------------------Channel----------------RSSI WPS Version WPS Locked ESSID


00:23:69:XX:XX:XX -----------6----------------00 1.0 No Luis

also you noticed that FS uses the Wash that is installed in Kali, and not the one in the FS folder? Maybe it's noting, just thought I'd point that out.

[slim76]

Ok, so just to confirm the outstanding errors are:

1) wash scan access point details are messed up?.
2) Reaver displays the wrong ESSID?.

Is this correct?, or did I miss something?.

[slim76]

I may be doing something wrong. This is what happened:

MAC address for wlan2:
Permanent MAC: xxxxxxxxxx (xxxxxxxxx, xxxxx.)
Current   MAC: xxxxxxxxx:c5:fc:f9 (unknown)

MAC address for mon0:
Permanent MAC: xxxxxxxxxx (xxxxxxxxx, xxxxx.)
Current   MAC: xxxxxxxxx:c5:fc:f9 (unknown)

Target Details: "HAR0000000" 00:00:00:7D:B6:D0

Possible WPS Pins: 82388003 57952154 82109011 65949474

[1] = Reaver.t6x + Pixiewps (Fixed Arguments)
[2] = Reaver + Pin Generators (Fixed Arguments)
[3] = Reaver (Fixed Arguments)
[4] = Reaver + Pin Generators (Custom Arguments)
[5] = Custom Attack
[p] = Proceed To Attack The Next Target

Please choose an option:

Picked 2

Reaver v1.4 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <cheffner@tacnetsol.com>

[+] Switching mon0 to channel 6
[+] Waiting for beacon from 00:00:00:7D:B6:D0
[+] Associated with 00:00:00:7D:B6:D0 (ESSID: We hear you 0000000000)
[+] Trying pin 82109011
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[P] E-Nonce: 77:58:36:c7:b0:f2:74:ee:23:21:f2:5e:a5:b1:b4:46
[P] PKE: 2f:5c:5b:e6:52:8d:63:09:e0:d3:20:0d:8f:e8:70:c5:a6:06:25:d9:15:bc:2f:63:6c:11:29:f4:28:e6:7d:8d:e8:f7:f0:d8:0a:96:f6:1e:ea:fd:b1:7b:05:a2:ff:eb:e7:5d:cd:05:c1:5d:5c:0f:2c:86:1b:76:d0:97:9d:f1:b2:bc:30:49:05:bb:77:8c:ff:d1:89:5b:3f:9c:71:a1:40:1b:7a:9a:69:87:fc:34:5a:9f:2c:48:9f:97:f3:e4:8c:c2:91:9f:a9:c5:3d:75:8a:28:ab:a4:51:76:6d:a3:e7:33:bc:8f:2e:9b:30:64:fe:9c:e1:e0:d8:f4:ac:48:88:e7:34:e7:87:f7:8d:ca:b6:18:b1:28:8e:20:8a:d7:77:9d:4b:05:e7:29:e4:06:0c:b8:81:af:8a:cc:11:be:72:be:ba:ee:1a:f5:58:eb:d4:ee:5b:52:e4:9a:7e:91:ce:7f:49:2f:46:9e:c3:86:bf:5c:75:34:1a:1b:74:f9
[P] WPS Manufacturer: Cisco
[P] WPS Model Number: 123456
[+] Received M1 message
[P] AuthKey: 9c:fa:0e:5c:e6:81:9f:8c:16:22:da:d9:38:4c:b1:8a:cd:62:b6:39:c7:5f:6f:dd:70:56:38:bd:99:dc:38:9d
[+] Sending M2 message
[P] E-Hash1: 1e:6d:d4:e6:57:03:57:05:a0:7a:73:7c:14:21:91:ea:a1:94:7f:d1:81:12:7e:3c:6e:cc:6f:4f:c7:a1:aa:56
[P] E-Hash2: 16:90:6b:e9:8b:ca:d8:c6:83:f1:34:fe:92:46:84:1b:35:c4:08:bb:39:a4:21:2c:c0:c5:1d:b2:97:9a:03:3c
[+] Received M3 message

Script (reaver) displays different essid when attacking target on the (attack screen)........
Thru me off for a sec.

Which set of details were correct, were the details reaver used correct?, or were the Target Details: "HAR0000000" 00:00:00:7D:B60 correct?.
Or were they both wrong?.
Oh and did you use the wash scan to get to those options?.

[Quest]

actually Slim I'm starting to wrap my brains around that problem. Confusing as ****.

It's not the wrong essid. It's the wrong AP all together. In other words, all the info in reaver is correct. It's the Scan Results that is messed up. So when you select an AP, it really chooses the one bellow. So when choosing 8 it's choosing 7. Exept that the names are mixedup in the Scan Results.

Do me a favour. Scan with Wash and copy paste the info from that scan. Then use FS to scan with Wash. Then compare the results from the first Wash scan to the Scan Results in FS.

[nuroo]

I asked script to attack:
Target Details: "HAR0000000" 00:00:00:7D:B6:00

It attacked:
[+] Associated with 00:00:00:7D:B6:00 (ESSID: We hear you 0000000000)

The bssid was the same, however the essid is wrong.

[Quest]

nuroo can you do the same as I asked Slim to do? Scan with Wash first > copy those results > FS > Scan results > compare both.

Thanks!

[nuroo]

Ok Done.... Quest is correct.

The scans from wash by command line and wash from frankenScript launched are both correct.
However how the script interprets the results is off by 1 line. So if you choose for instance 3, it attacks the next one instead.

[Quest]

great I won't have to sign up for the nut house just yet

So it's really the Scan Results in FS that are offset by 1 line.

[slim76]

Ok I'm fairly sure I can fix the wash scan issue, but the wrong ESSID in reaver beats the **** out of me.
The reaver issue is really strange cause FrankenScript doesn't supply reaver with an ESSID, reaver chooses the ESSID.
So there must be a problem with reaver (Possible it might have something to with the location its being executed from), or your kali installation.

I'm still adding things to FrankenScript, but I think I might upload what I have so far, that's after I fix the wash scan issue. LOL

[Quest]

Slim, forget about the wrong essid. That is not the problem as explained in previous posts.

Just run Wash by its self, leave that window open then > run FS and compare the Scan Results whit the Wash window. You will see for yourself what the problem is.

[slim76]

Here's the latest FrankenScript, Updated 29th April 2015

FrankenScript_Portable.29th.April.2015.tar.gz
https://www.mirrorcreator.com/files/...5.tar.gz_links

[slim76]

Slim, forget about the wrong essid. That is not the problem as explained in previous posts.

Just run Wash by its self, leave that window open then > run FS and compare the Scan Results whit the Wash window. You will see for yourself what the problem is.

I don't have the issue you're having, everything works perfect for me.
I think you really need to explain to me what the problem is with as much detail as possible.

Here's the latest FrankenScript, Updated 29th April 2015

FrankenScript_Portable.29th.April.2015.tar.gz
https://www.mirrorcreator.com/files/...5.tar.gz_links

[Quest]

The problem is the Scan Results is FS. Nothing else.

After the Wash scan in FS, the Scan Results are all messed up.

The wrong essid is shown with the rest of the information of the AP above it.

So when the user select 7 on the Scan Results list, FS really picks 6.

So it appears as though it's the wrong essid in reaver, but it is not. It is however the wrong AP.

[Quest]

and this is the direct download for FrankenScript_Portable.29th.April.2015.tar.gz
5,7MB (5,65MB)

http://rghost.net/download/8PTsj4Zlm...il.2015.tar.gz

[Quest]

exact same issue with FrankenScript_Portable.29th.April.2015

Here is a clue: The Scan Results window is way too large. It covers my monitor's wit. nuroo might confirm that.

Really Slim, try to reproduce it on your comp, or on another comp, because otherwise it's not possible to explain. Go to an Internet place with your USB pendrive and USB adapter > install FS, and run it. You will then see what we see.

[Quest]

Desk1.jpg

here is a screenshot. Compare the Wash window with the Scan Results.

[slim76]

Desk1.jpg

here is a screenshot. Compare the Wash window with the Scan Results.

Yeah I see what you mean now, I'll fix it and upload it later.

[Quest]

Thank you!!

It seems as though, the first AP result being messed up, it pushes the rest of the data offset.

So if you fix the first AP result, the rest will fall into place(?)

[Quest]

oh and there's a new reaver-wps-fork-t6x from 15hrs ago.

https://github.com/t6x/reaver-wps-fork-t6x

[slim76]

oh and there's a new reaver-wps-fork-t6x from 15hrs ago.

https://github.com/t6x/reaver-wps-fork-t6x

Already got it, I updated it using FrankenScript. :-) LOL

Can you do the following in FrankenScript.sh:

1) Change lines 1021,1022,1023.

FROM:

rm $DIR/TempFolder/SSIDList.txt &> /dev/null
rm $DIR/TempFolder/OtherDetailsList.txt &> /dev/null
rm $DIR/TempFolder/WashScan.txt &> /dev/null

TO:

# rm $DIR/TempFolder/SSIDList.txt &> /dev/null
# rm $DIR/TempFolder/OtherDetailsList.txt &> /dev/null
# rm $DIR/TempFolder/WashScan.txt &> /dev/null

2) Browse to FrankenScripts temp folder and compare the following 3 files against each other:
eg: the ESSID on line 1 in SSIDList.txt should match with the details on line 1 in OtherDetailsList.txt

SSIDList.txt
OtherDetailsList.txt
ScanResults.txt

Does the lines in files SSIDList.txt & OtherDetailsList.txt match?.
Are all the details correct in ScanResults.txt?.

[Quest]

Screenshot.jpg

1) I opened FrankenScript.sh and Copy/Paste lines 1021,1022,1023, as indicated above. Then saved.

ran FS, and opened the Temp folder. New files appeared there.

2) here are the results in the pic.

PS: all the XX you see in the pic are my edit.

[slim76]

Screenshot.jpg

1) I opened FrankenScript.sh and Copy/Paste lines 1021,1022,1023, as indicated above. Then saved.

ran FS, and opened the Temp folder. New files appeared there.

2) here are the results in the pic.

PS: all the XX you see in the pic are my edit.

Ok, so are the details in ScanResults.txt correct?, thats excluding the first and last lines.

[Quest]

no they are not. They are all offset by one line. The essid does not match the rest.

[Quest]

Screenshot from FSsh.jpg

and here is a pic of my FS.sh to remove all doubts.

[slim76]

Screenshot from FSsh.jpg

and here is a pic of my FS.sh to remove all doubts.

Ok try this one, if this one dont work for you I'm gonna go and hang myself. LOL

https://www.mirrorcreator.com/files/...2.tar.gz_links

Please let me know asap so I can update the first page.

[Quest]

what's your favourite color? White rope, black rope, blue rope?

now the attacks don't work and everything is way offset. Will post a pic later.

[Quest]

Screenshot-from-new.jpg

that is what I see. The bssid does correspond to the essid, but everything is messed up, and when selecting any target, the attacks don't work. It goes right back to the Scan Results, as seen in the pic. It's actually worst than before.

[Quest]

How can you get different results than this on your comp?? That's what I'd like to know.

[slim76]

How can you get different results than this on your comp?? That's what I'd like to know.

Have you modified your kali install in any way?.

Ok this is bugging me now??, try this one.

https://www.mirrorcreator.com/files/...tar_0.gz_links

Check the ScanResults.txt file in the TempFolder and let me know if the details and evrything is correct.

[Quest]

well maybe we better wait for more feedback before doing anything else?

Of course I have to modify my Kali install like everybody else. But I don't see what maybe causing this.

Is that good?
https://www.mirrorcreator.com/files/....April.2015.v3.tar_0.gz

what's that _0.gz ? Are you trying to make my comp explode at a distance?

[slim76]

well maybe we better wait for more feedback before doing anything else?

Of course I have to modify my Kali install like everybody else. But I don't see what maybe causing this.

Is that good?
https://www.mirrorcreator.com/files/....April.2015.v3.tar_0.gz

what's that _0.gz ? Are you trying to make my comp explode at a distance?

No thats not what I uploaded, I wouldn't open or run that if I was you. lol
The upload must have got corrupted some way

Here you go, try this one:
Click the big orange button at the top right of the page.
http://www67.zippyshare.com/v/iGUAkXKn/file.html

[Quest]

no it's just that you tared it twice, so I had to decompress it twice.

No difference with that version than the one before. Exactly the same problem.

Did you really upload the right version?

[slim76]

no it's just that you tared it twice, so I had to decompress it twice.

No difference with that version than the one before. Exactly the same problem.

Did you really upload the right version?

Just wanted to make sure were both using the same version. lol
Now check the ScanResults.txt file in the TempFolder, are all the details correct and is everything lined up correctly?.

[Quest]

and btw Slim, everything is perfect with the airodump Scan Results. So it's really a format problem with the Scan Results from wash only.

What is the big difference in format between the two in FS?

[Quest]

Just wanted to make sure were both using the same version. lol
Now check the ScanResults.txt file in the TempFolder, are all the details correct and is everything lined up correctly?.

Screenshot from nnn.jpg

no, and it's getting worst by the minute. I want my money back!.. oh wait

xD

[slim76]

Screenshot from nnn.jpg

no, and it's getting worst by the minute. I want my money back!.. oh wait

xD

I think i might be the paste command I used to merge the files side by side.

[Quest]

hmm? You lost me there.

[slim76]

hmm? You lost me there.

Can you compare the files Wash_Network_Scan-1.txt & Wash_Network_Scan-2.txt side by side to see if that information lines up correctly.

[Quest]

where are those files?

[Quest]

Slim, we should both see the same results. This is insane. Get someone else to confirm that bug or confirm that there is no bug. Then we can be fixed as to which machine tells the truth. Yours or mine.

Then, whoever has the faulty installation, will have to reformat and reinstall. Because right now, it's running round in circles.

If someone willing to try and give feedback please do so.

[slim76]

Slim, we should both see the same results. This is insane. Get someone else to confirm that bug or confirm that there is no bug. Then we can be fixed as to which machine tells the truth. Yours or mine.

Then, whoever has the faulty installation, will have to reformat and reinstall. Because right now, it's running round in circles.

If someone willing to try and give feedback please do so.

I've given up asking people for feedback cause nobody ever bothers too.

In FrankenScript change the following lines: 1021, 1022, 1023, 1024

FROM

# rm $DIR/TempFolder/Wash_Network_Scan.txt &> /dev/null
# rm $DIR/TempFolder/Wash_Network_Scan-1.txt &> /dev/null
# rm $DIR/TempFolder/Wash_Network_Scan-2.txt &> /dev/null
# rm $DIR/TempFolder/WashScan.txt &> /dev/null

TO

# rm $DIR/TempFolder/Wash_Network_Scan.txt &> /dev/null
# rm $DIR/TempFolder/Wash_Network_Scan-1.txt &> /dev/null
# rm $DIR/TempFolder/Wash_Network_Scan-2.txt &> /dev/null
# rm $DIR/TempFolder/WashScan.txt &> /dev/null

Then check the TempFolder for the files I mentioned.

[Quest]

all lines correspond between all three files Wash_Network_Scan.txt, Wash_Network_Scan-1.txt, Wash_Network_Scan-2.txt, and nothing seems offset.

[slim76]

all lines correspond between all three files Wash_Network_Scan.txt, Wash_Network_Scan-1.txt, Wash_Network_Scan-2.txt, and nothing seems offset.

Ok now were getting closer to the problem.
So those 3 files were ok but ScanResults.txt is still messed up, Is this correct?.

[Quest]

one thing does not line up, vertically. There is a space before the lines in Wash_Network_Scan-2

wash12.jpg

isn't that enough to trow the scrip off? These dotted lines appear twice in the Scan Results.

[Quest]

Ok now were getting closer to the problem.
So those 3 files were ok but ScanResults.txt is still messed up, Is this correct?.

Yes, nothing has changed from the last pic of the Scan Results.