FrankenScript by Slim76 - It Attacks Access Points and .pcap files

[soxrok2212]

I've already blacklisted the interfaces by adding them to /etc/network/interfaces.

The only problem I'm having at the moment is reaver keeps giving me the failed to associate error message, the strange thing is airodump-ng works fine.
I'm sure I'll solve the issue soon, I just need a clear head so I can focus properly.

Have you tried multiple targets? Or do you get the same timeout for all of them? Does Reaver work if you try from the command line?

[slim76]

Have you tried multiple targets? Or do you get the same timeout for all of them? Does Reaver work if you try from the command line?

Yeah I tried it with multiple targets and I get the same error with all of them, its the same problem when using the command line.
I did have this issue before but I cant remember what caused it and how I solved it. ;-( LOL

Update:
With the interfaces blacklisted in /etc/network/interfaces and in /etc/NetworkManager/NetworkManager.conf the following happens.

1) If I use airmon-ng check kill and don't change the mac address for the monitor interface reaver works fine.
2) If I change the mac address for the monitor interface or restart network manager reaver fails to associate.

[Quest]

You will need to tell Reaver about the new MAC address with the argument '-m' maybe?
reaver -i wlan1mon -b e1:g4:d3:8s:35:g2 -vv -m 00:01:02:03:04:05

[soxrok2212]

Hmmm, you are using Kali 2.0 I assume?

[Quest]

yes me and Slim are using 2.0

[soxrok2212]

Man, makes me really wanna go back to Backtrack 5 when everything worked :/

[Quest]

They should have come out with an 'ultimate' Kali 1.1.1 before all these changes. I wish I'd kept the image of my updated 1.1.0a. Now I can't update it even if I reinstall it, or install the SDR metapackage. There is no going back. We must plow trough and make it work.

[soxrok2212]

I may still have a Kali 1.1.0 ISO on my backup drive... 64-bit I think. Theres just too much incompatibility between a lot of the networking tools now.

[Quest]

I have the 1.1.0a ISO (aircrack-ng RC1, mon0), but we can't update (that might be good?) or the metapackages https://www.kali.org/news/kali-linux-metapackages/ won't work probly.

[slim76]

You will need to tell Reaver about the new MAC address with the argument '-m' maybe?
reaver -i wlan1mon -b e1:g4:d3:8s:35:g2 -vv -m 00:01:02:03:04:05

Cheers mate I completely overlooked that.
I used the above commands and added -A to them, then used aireplay-ng to associate.
That solved the association issue but the attack still failed for some reason.

[Quest]

Could you post all the syntax that you used?

[Quest]

Slim just thinking. Would you consider continuing dev under KL1.1.0a ? That KL2 thingy is abit ridiculous if you ask me, and everything worked well under 1.1.0. I'm all for progress, but when said 'progress' constitute turning everything on its head, that's when I stop playing. Anyways, still have KL2 on a USB, should you want me to test under that horrible POS, but will use mainly FrankenScript_Portable.3rd.May.2015.tar.gz and having alot of fun with it =]

Cheers bro!

[slim76]

Slim just thinking. Would you consider continuing dev under KL1.1.0a ? That KL2 thingy is abit ridiculous if you ask me, and everything worked well under 1.1.0. I'm all for progress, but when said 'progress' constitute turning everything on its head, that's when I stop playing. Anyways, still have KL2 on a USB, should you want me to test under that horrible POS, but will use mainly FrankenScript_Portable.3rd.May.2015.tar.gz and having alot of fun with it =]

Cheers bro!

Ok now i'll admit kali 2.0 sucks BIG TIME, there's way to many issues with it.

1)) The system keeps randomly locking up.
2) I lose internet access if any usb devices are plugged in, I have to unplug all USB devices and the WiFi device and then plug the WiFi device back in to regain network access.
3) Wired connection doesn't re-connect if I kill and restart network-manager.
4) Network-Manager keeps randomly disabling my WiFi device and keeps putting it in Aeroplane Mode??. LOL
5) Reaver doesn't associate if I change mac addresses.
6) Data transfer to any USB device is very slow, all my other OS's transfer data much faster than my kali-2.0-64bit OS.
7) Programs are slow at opening, eg: vlc takes about 8 seconds to open (only for the first time after every system startup).

I've given up on trying to get FrankenScript working on kali-2.0, I'm going to wait for the next kali release and then try again.
I think I might delete my kali-2.0 install and go back to the previous version, if I go back to the previous version of kali I'll continue working on the previous version of FrankenScript.

[Quest]

Like you, I'll be waiting for the next KL, and I'm gonna wish the Dev team to step their game up a notch, starting with the User Interface. Give us a true, PC, Technician's graphical interface to work with.

Again no later than today...

https://forums.kali.org/showthread.p...ll=1#post51450

Hi, Just installed 2.0, so far all the tools I've had a quick look at run fine, but the UI is ****** horrible, everything take three times a long to do now. If it's not broke, don't fix it until it i!

Before that, it took me forever to understand what that guy was on about...
https://forums.kali.org/showthread.p...ll=1#post47601

i mean kali 1.x== linux
kali 2.x== windows 8
and i gess kali 3.x== windows 10

He was so right.

So I'm with you, and not liking at all where this is going. Absent another distro, let's roll with KL1.1.0a

[fruchttiger00x0]

Hey guys, could you please try this command?

nmcli general show

I already tried it at my root ds but i have no access to a kali shell for some hours^^

btw.. nmcli is for controlling the i-make-my-own-thing network m.

[Quest]

I don't understand what you want us to try

The command in KL2
nmcli general show

returns

[email protected]:~# nmcli general show
Usage: nmcli general { COMMAND | help }

COMMAND := { status | hostname | permissions | logging }

status

hostname [<hostname>]

permissions

logging [level <log level>] [domains <log domains>]

Error: 'general' command 'show' is not valid.
[email protected]:~#

[fruchttiger00x0]

sry, as i said i just test it on non kali webserver

here we go

nmcli general permissions

give me some minutes, so i can find a suitable docu

edit: thats nice: https://www.hogarthuk.com/?q=node/8
so i hope you get what i mean. the nm is not that hard to configure. just take the **** automatism down. or did i missed something larger?

[Quest]

"Why you shouldn't hate and disable NetworkManager anymore"
Anything that start with that will get my attention. Looks interesting and if anyone can fix/improve that horrible networkmanager that I hate, would certainly be appreciated by all and help Slim in the process.

when/if that fixed, we could move on to try and fix that horrible UI that I also hate because it was created for tablets and phones, not for PCs.

[slim76]

I was going to give up on trying to get FrankenScript working on kali-2.0 but I changed my mind. LOL
I've solved all the network-manager issues a while ago, the problem I was having was trying to get reaver to associate after changing mac addresses.
I've solved the reaver not associating issue now too, so it looks like all might be good now. :-)

[Quest]

gr8 m8! It would be nice to move forward. Let me know

[slim76]

NOTE:
This version is for Kali-2.0.
The WEP attacks don't work yet, I'll fix them later.

Download Link:
http://multimirrorupload.com/twxyvqc...-Kali20.tar.gz

Please leave feedback.

[Quest]

FrankenScript-Kali20.tar.gz
File size: 86.5 KB
Uploaded: 2015-10-20 06:42:59
http://www.mediafire.com/download/cd...-Kali20.tar.gz

[Quest]

Everything seems to work just fine, except the handshakes that I had no luck with today. Thank you.



- bring back reavers. 1.3, 1.4, and Bully.

- it would more efficient to have the scan results, last to first, instead of first to last. That would avoid scrolling up to see the first results, then scroll back down to enter a target number. = Faster operation.

- I pasted a previously cap hanshake in the /root/FrankenScript-Kali20/Captures/ , but when selecting the [v] = Validate Captured Handshake option, it automatically attack the last chosen target.

[slim76]

Everything seems to work just fine, except the handshakes that I had no luck with today. Thank you.

- I pasted a previously cap hanshake in the /root/FrankenScript-Kali20/Captures/ , but when selecting the [v] = Validate Captured Handshake option, it automatically attack the last chosen target.

The validate handshake error is obvious don't you think. Lol
The validate option will only check a handshake that has just been captured, it doesn't check the capture files in the capture folder.

[jar]

Here's a Dropbox link as well:

https://www.dropbox.com/sh/7ampibg2m...KTPoFXv0a?dl=0

FrankenScript-Kali20.tar.gz
File size: 86.5 KB
Uploaded: 2015-10-20 06:42:59
http://www.mediafire.com/download/cd...-Kali20.tar.gz

[Quest]

^ ")


What's cooking monster maker?

[slim76]

^ ")


What's cooking monster maker?

Not much matey, I'm currently trying to add another function to FrankenScript. ;-)
So how are you getting on with the new version of FrankenScript?, any problems with it?.

[Quest]

I'm not using KL much, but like I've mentioned everything seems to work just fine, with the exception of the handshakes.

1. I did not know that I had to choose [s] to save a handshake. Now that I do, I find that a little unusual if you ask me.

2. Then when saving a handshake, the option [v] still automatically attack the last target instead of verifying it.

So I'm not understanding these two points.

On the positive, it is now possible to cap and save different handshakes from the same AP!! That's progress from previous version. Thanks On a side note, the last FS was DLd 20 times from my mediafire, and unrelated to FS, something tells me that there will be changes with the networkmanager(?) solely based upon incompatibility with aircrack-ng, and the confusion and dissatisfaction it generates.

So what's the new function??

[fruchttiger00x0]

Hey Slim, hey Quest

is it okay for pushing it to git? reason: i need some repos for putting this sweet tool to some postinstall scripting.

ok, actually i already prepared this under my profile so I hope you don't want to punish me for stealing your work
of course i will delete the repo if you want so, promise

https://github.com/fruchttiger00x0/FrankenScript

But if you like it then of course your commits will be highly welcome

[Quest]

it's about time that this project has a Github if you ask me, but let's wait for Slim input on the matter because it is his creation and I have nothing to do with it except complain about everything [insert evil laugh]

Off topic but not by miles, imo, things are somewhat volatile, and I would wait for further dev before investing energy into it. FS was working just fine before they turned everything on its head, and we may not have seen the end of it.

[fruchttiger00x0]

Sure, we wait for slim
btw i took you to the creds

[Quest]

you **** right! It's about time I get credits for my invaluable contribution!

loll

[ravenwest]

Hello.
I'm using FrankenScript for Kali2. My question is:
Does it include - 1) EAPOL Flood Attack; 2) Authentication Flood Attack ?
I haven't found it in the menu.

[nexusnexus]

Seems to work great on my Kali 2, Would it work if i install in on my Nexus 7 running nethunter?

[Pippin]

The -C switch in wash ignores FCS errors and IMHO should always be included as I always get them as I imagine others do.

[slim76]

@ fruchttiger00x0:
I don't mind you puttting it on github, but can you change the name slightly to include something to say that it has been modified by your self.

@ Quest:
Sorry for the late reply mate, To answer your earlier question I've been adding an automated attack feature. :-)

@ ravenwest:
I took those attack options out of FrankenScript a long time ago, sorry.

@ nexusnexus:
I do not use nethunter so I'm not sure, but I would guess it would work providing nethunter contained the same tools as kali-2.0.

@ Pippin:
The wash scan already uses the -C argument, it has used it since the start of FrankenScript.

Sorry if I missed anyone, and a big thank you to everyone.

I've nearly finished the interactive and automated wpa attacks, I'll upload the new version of FrankenScript soon for testing, if it is all good then I'll continue with the wep and wps attacks.

[nexusnexus]

Looking forward to the updates :-)

[soxrok2212]

Dang, almost 2 years and this project is still going strong! I remember when you first posted about it. Keep up the good work!

[slim76]

Dang, almost 2 years and this project is still going strong! I remember when you first posted about it. Keep up the good work!

Yeah I'm like a dog with a bone. (I can't let it go) LOL

Cheers for the support matey.

[Quest]

well you better hold on to your bone. Aircrack-ng 1.2 RC 3
https://bugs.kali.org/view.php?id=2862

...
Airmon-ng: Improved handling of non-monitor interfaces.
Airmon-ng: Fixed error when running 'check kill'.
...

[slim76]

well you better hold on to your bone. Aircrack-ng 1.2 RC 3
https://bugs.kali.org/view.php?id=2862

It shouldn't cause any problems for FrankenScript hopefully. LOL
I'll be uploading a nearly completed version of FrankenScript within the next few days, maybe sooner.

[ravenwest]

@ fruchttiger00x0:
I don't mind you puttting it on github, but can you change the name slightly to include something to say that it has been modified by your self.

@ Quest:
Sorry for the late reply mate, To answer your earlier question I've been adding an automated attack feature. :-)

@ ravenwest:
I took those attack options out of FrankenScript a long time ago, sorry.

@ nexusnexus:
I do not use nethunter so I'm not sure, but I would guess it would work providing nethunter contained the same tools as kali-2.0.

@ Pippin:
The wash scan already uses the -C argument, it has used it since the start of FrankenScript.

Sorry if I missed anyone, and a big thank you to everyone.

I've nearly finished the interactive and automated wpa attacks, I'll upload the new version of FrankenScript soon for testing, if it is all good then I'll continue with the wep and wps attacks.

So now this script can't bypass "Warning:detected AP rate limiting" error?

[slim76]

So now this script can't bypass "Warning:detected AP rate limiting" error?

I think the attack is too disruptive and too noticeable so I left it out of FrankenScript.
If you want to still use that attack method I'd suggest you download or create a script, then you could use the script via FrankenScript's built-in Script Launcher.

[Quest]

This might be an acceptable solution for locked APs, though I've never tried it. Here is a re-post...

https://forums.kali.org/showthread.p...ll=1#post40956

from the included help file..

...

The breakthrough came when MTeams turned their attention to WPS locked routers. It was soon discovered that a small number of WPS pins could be collected from some routers which wash and reaver reported as locked. Presumably no one was spending time attacking locked routers. After more testing, it was found that if these same WPS locked routers were subjected to short bursts of a mdk3 combination simultaneously, usually a mixture of DDOS and EAPOL, then the router would allow further pins to be harvested. In these cases the router did not reset, the WPS locking mechanism remained in place and sometimes the router changed channels. But what was important here was that more WPS pins could be collected. These routers would eventually stop providing pins, BUT if subjected to another dose of mdk3, the router would supply another batch of pins.

...

Maybe mmusket33 can shine on this?

[slim76]

This might be an acceptable solution for locked APs, though I've never tried it. Here is a re-post...

https://forums.kali.org/showthread.p...ll=1#post40956

from the included help file..



Maybe mmusket33 can shine on this?

I saw that some time ago, I think it's the same commands as the router reset method.
If I'm right then the only difference is that you still continue to try pins instead of giving up on the attack.
I could be very wrong on that cause I didn't read everything, I only had a quick browse through the info.

I've got some testing that needs doing soon if you're up for it?.

[Quest]

yes and mmusket33 never confirmed when I asked if that method does not reboot the AP. Then that thread was closed. Was always curious about that attack.

If it does not reboot the AP, then it's certainly interesting.

[slim76]

yes and mmusket33 never confirmed when I asked if that method does not reboot the AP. Then that thread was closed. Was always curious about that attack.

If it does not reboot the AP, then it's certainly interesting.

Like I said I could be wrong.
I think he was saying that some AP's that don't reset and lockup might still allow for more pins to be tried if you re-run the commands.
Oh and I think it does reset some AP's.

[Quest]

it's possible that I'm not reading this correctly. That would explain that he did not confirm about the AP not rebooting and the subsequent locking of that thread.

[Quest]

...
I've got some testing that needs doing soon if you're up for it?.

Testing my fav application under linux?..

I would like to install RC3 and try to run the present FS with it before anything else. If they brake my toys again I'm gonna be in a really bad mood. So yeah bring it on, but KL2.0.1 is scheduled for early December, and I don't see the point in having another version that will last two weeks.

Cheers!!


EDIT:

Can't install RC3, because when using the command line apt-get install, it's telling me that I already have the latest version, same for the package manager, and when trying to install manually, I'm missing dependencies, and those to are nowhere to be found or will lead to unreliable results (like the last time I installed RC2 for tests) making any test null and void. So waiting for the repos to update themselves so I can install and test.

[slim76]

Testing my fav application under linux?..

I would like to install RC3 and try to run the present FS with it before anything else. If they brake my toys again I'm gonna be in a really bad mood. So yeah bring it on, but KL2.0.1 is scheduled for early December, and I don't see the point in having another version that will last two weeks.

Cheers!!


EDIT:

Can't install RC3, because when using the command line apt-get install, it's telling me that I already have the latest version, same for the package manager, and when trying to install manually, I'm missing dependencies, and those to are nowhere to be found or will lead to unreliable results (like the last time I installed RC2 for tests) making any test null and void. So waiting for the repos to update themselves so I can install and test.

You might want to try again, I upgraded to aircrack RC3 and haven't noticed any issues as yet.