Howto frankenScript

[slim76]

Try this link:
http://66ptdww17j.1fichier.com/

[Quest]

oki I'm back. I will do my best to experiment with oclHashcat and Crunch this week...

[Quest]

What I was looking for is actually called "Markov Chains". http://blog.spiderlabs.com/2012/07/h...ov-chains.html

i'm following a very interesting lead http://hashcat.net/forum/thread-1291.html for injecting 'intelligence' into oclhashcat.

Atom, has created a .bin called "statsprocessor-0.083" based upon "Markov Chains". http://hashcat.net/wiki/doku.php?id=statsprocessor


Edit: Actually "Markov Chains" is already included in ocl/cudaHashcat

* Markov:

--markov-hcstat=FILE Specify hcstat file to use, default is hashcat.hcstat
--markov-disable Disables markov-chains, emulates classic brute-force
--markov-classic Enables classic markov-chains, no per-position enhancement
-t, --markov-threshold=NUM Threshold when to stop accepting new markov-chains

http://hashcat.net/wiki/doku.php?id=oclhashcat

Now just need to figure it out. If anyone has some experience using the above arguments, please share.

[Quest]

can't stop progress

philsmd, over at Hashcat.net was good enough to help me out with my quest http://hashcat.net/forum/thread-3668.html Thank you Phil

Can you work with that information Slim? Let me know. I will do some experimenting on my end also..

[slim76]

can't stop progress

philsmd, over at Hashcat.net was good enough to help me out with my quest http://hashcat.net/forum/thread-3668.html Thank you Phil

Can you work with that information Slim? Let me know. I will do some experimenting on my end also..

Yeah I think so, it shouldn't be to difficult to build it into FrankenScript.
I've scrapped the other versions of FrankenScript due to it having to many issue's, so I'm rewritting everything again.

[skycrazy]

I have to say ive been following the growth of this script and find it very interesting. Its not the normal approach to a how too, in fact i'd personally say its far more informative. The collaberation between you guys to create and over come problems, should be encouraged and admired. Keep up the good work.

[Quest]

Hey skycrazy! Glad you enjoy the show =]

I'm just a user with a big mouth. Slim does it all, it's his creation. I would love however to see staticn0de work on this project..



@Slim, any ideas to invoke ocl/cudaHashcat without the full path? Now I'm using this syntax..

cd /usr/share/cudahashcat/ && ./cudaHashcat64.bin -w 3 -m 2500 /root/capture.hccap -a 3 ?u?l?l?l?l?l?d?d

That will be a small problem, as there will be 4 sets of command lines. Two for ocl(i386 and x64) and two for CUDA(i386 and x64).

Also, Markov Chains doesn't seem to kick in. May have to use a mask...

[slim76]

Hey skycrazy! Glad you enjoy the show =]

I'm just a user with a big mouth. Slim does it all, it's his creation. I would love however to see staticn0de work on this project..



@Slim, any ideas to invoke ocl/cudaHashcat without the full path? Now I'm using this syntax..

cd /usr/share/cudahashcat/ && ./cudaHashcat64.bin -w 3 -m 2500 /root/capture.hccap -a 3 ?u?l?l?l?l?l?d?d

That will be a small problem, as there will be 4 sets of command lines. Two for ocl(i386 and x64) and two for CUDA(i386 and x64).

Also, Markov Chains doesn't seem to kick in. May have to use a mask...

Sorry mate but I still haven't had chance to look into hashcat, I've been busy decorating and and rewritting FrankenScript in my spare time.
If you can look into hashcat I can get all the info from you once I've finished FrankenScript.

[Quest]

yes don't worry. Making progress http://hashcat.net/forum/thread-3668....html#pid20987 went from 45days -to- 4hrs for a 8 character set.

Can't see options for Crunch for injecting intelligence into it. So it will stay brutforce(and dumb) unless someone has an idea.

For decorating, lighting is very important and often neglected

[staticn0de]

Hey skycrazy! Glad you enjoy the show =]

I'm just a user with a big mouth. Slim does it all, it's his creation. I would love however to see staticn0de work on this project..



@Slim, any ideas to invoke ocl/cudaHashcat without the full path? Now I'm using this syntax..

cd /usr/share/cudahashcat/ && ./cudaHashcat64.bin -w 3 -m 2500 /root/capture.hccap -a 3 ?u?l?l?l?l?l?d?d

That will be a small problem, as there will be 4 sets of command lines. Two for ocl(i386 and x64) and two for CUDA(i386 and x64).

Also, Markov Chains doesn't seem to kick in. May have to use a mask...

Hey Quest,

I've made a short shell script that will check if hashcat is installed and then offer to set up links so that it can be called without full path (can be called with cudahashcat32 and cudahashcat64)

I was toying around within Frankenscript to insert it as a menu check when hashcat was selected for use.

I don't see it being hard to check the arch type running the script so it can select if you want cudahashcat32/64 and install only the correct one so it is called with the "cudahashcat" command. Could be the same for oclhashcat, nothing a grep of pci devices wont fix (as it looks for nvidia or ATI)

either way, the script I just made in about 5 minutes (don't judge my terrible coding skills) which works (just)

#!/bin/bash
#staticn0des hashcat insert
#check if installed
if [ -f /usr/share/cudahashcat/cudaHashcat32.bin ] && [ -f /usr/share/cudahashat/cudaHashcat64.bin ]; then
echo "cudaHashcat32.bin and cudaHashcat64.bin found"
else
echo "cudaHashcat32.bin and cudaHashcat64.bin not found in /usr/share/cudahashcat/."
echo "Download them from hashcat.net and extract to /usr/share/cudahashcat/"
echo ""
read -p "Press any key..."

fi

#check if bin links are installed 
if [ -f /usr/bin/cudahashcat32 ] && [ -f /usr/bin/cudahashcat64 ]; then
echo "cudahashcat bin links found. Call directly with cudahashcat32 and cudahashcat64 from terminal"
else
echo "cudahashcat bin links not found. cudaHashcat cannot be called without full path"
echo "Install bin links now?"

read -p $GREEN"[y/n]:$STAND " bin_link_option

#Install bin links
if [[ $bin_link_option == "y" ]]; then
cat > /usr/bin/cudahashcat32 <<EOF
#!/bin/bash
cd /usr/share/cudahashcat/ && ./cudaHashcat32.bin "$@"
EOF

cat > /usr/bin/cudahashcat64 <<EOF
cd /usr/share/cudahashcat/ && ./cudaHashcat64.bin "$@"
EOF

chmod +x /usr/bin/cudahashcat64
chmod +x /usr/bin/cudahashcat32

fi
fi

[Quest]

you rock my friend! That will actually solve the problem of implementing cuda/ocl into FS. Let's see what Slim has to say..


I'm very happy with Markov Chains also...

Mampho80
Mannti91
Maasos33
Markse91
Maetro80
Maltro80
Masoti91
Maiamo80
Maosos33
Matryo80
Mambul91
Manoti91
Maadro80
Mardro80
Maedro80
Malues33
Mascia80
Mairyo80
Maooti91
Matsos33
Mamsos33
Mankse91
Maaiti91


Sarint98
Sasers01
Salant98
Satint98
Samint98
Saastr98
Saelet98
Saiant98
Saomam34
Sanint98
Saront98
Sasham34
Salont98
Satont98
Samont98
Saatet98
Saeant98
Saitet98
Saouss01
Sandet98
Sartet98
Sasint98


Elmpil29
Elamol29
Eletol29
Elices29
Elosho29
Elntol29
Elrsho29
Elssho29
Ellula29
Eltrol29
Elmmol29
Eladol29
Eledol29
Eliela29
Eloomi29
Elnomi29
Elrula29
Elsomi29
Ellyla29
Elttol29
Elmula29
Elaces29
Eleela29
Eliomi29
Elotol29
Elnsho29
Elrdol29
Elsula29
Ellsho29

Ansina33
Anlles33
Anthal33
Anmpal33
Anamal33
Anetes33
Anicho33
Anosti87
Anntes33
Anrsti87
Anssti87
Anluse33
Antres33
Anmmal33
Anades33
Anedes33
Anieri87
Anoona33
Annona33
Anruse33
Ansona33
Anlyal33
Anttes33
Anmuse33

funky words, but words non-the-less.


Stay tuned kids, this is interesting

[slim76]

you rock my friend! That will actually solve the problem of implementing cuda/ocl into FS. Let's see what Slim has to say..


I'm very happy with Markov Chains also...

Mampho80
Mannti91
Maasos33
Markse91
Maetro80
Maltro80
Masoti91
Maiamo80
Maosos33
Matryo80
Mambul91
Manoti91
Maadro80
Mardro80
Maedro80
Malues33
Mascia80
Mairyo80
Maooti91
Matsos33
Mamsos33
Mankse91
Maaiti91


Sarint98
Sasers01
Salant98
Satint98
Samint98
Saastr98
Saelet98
Saiant98
Saomam34
Sanint98
Saront98
Sasham34
Salont98
Satont98
Samont98
Saatet98
Saeant98
Saitet98
Saouss01
Sandet98
Sartet98
Sasint98


Elmpil29
Elamol29
Eletol29
Elices29
Elosho29
Elntol29
Elrsho29
Elssho29
Ellula29
Eltrol29
Elmmol29
Eladol29
Eledol29
Eliela29
Eloomi29
Elnomi29
Elrula29
Elsomi29
Ellyla29
Elttol29
Elmula29
Elaces29
Eleela29
Eliomi29
Elotol29
Elnsho29
Elrdol29
Elsula29
Ellsho29

Ansina33
Anlles33
Anthal33
Anmpal33
Anamal33
Anetes33
Anicho33
Anosti87
Anntes33
Anrsti87
Anssti87
Anluse33
Antres33
Anmmal33
Anades33
Anedes33
Anieri87
Anoona33
Annona33
Anruse33
Ansona33
Anlyal33
Anttes33
Anmuse33

funky words, but words non-the-less.


Stay tuned kids, this is interesting

I can do a copy and paste if that's what you want, that's if it's ok with staticn0de?.

[Quest]

well yes that's a piece of the puzzle. Otherwise there will be 4 different command lines to invoke oclHashcat to match what setup a person has..

- nVidia (CUDA) i386 (cudaHashcat32.bin)
- nVidia (CUDA) x64 (cudaHashcat64.bin)
- ATi (ocl) i386 (oclHashcat32.bin)
- ATi (ocl) x64 (oclHashcat64.bin)

The script statcn0de has created will make your life easier to include oclHashcat in the next FS, I would imagine.

I do believe that it is ok with staticn0de for you to steal his code and run away. I will not tell.

[staticn0de]

I can do a copy and paste if that's what you want, that's if it's ok with staticn0de?.

Sure, use what you can.

I'll make It less terrible when I get a chance. Add auto detect for ati / NVIDIA and detect 32/64 bit.

[Quest]

well I object!

It is called FrankenScript!! To make it less terrible would go against all international monster conventions. *Geez do I have to explain everything?*


:P

.............and now back to our regular broadcasting...........


so I'm working with 3 different .hcmask files(2 of them I will probly endup fusing together) that I would like to submit under peer review. All 3 files share common features. Minimum 8, maximum 10, last 4 characters can be anything including symbols...

?d?d?d?d?d?d?a?a?a?a = min8 max10 | 6 numbers |*4 all characters

001999L*
002999L!
113999a?
004999nt
005999w$T3
1234567890


?l?l?l?l?l?l?a?a?a?a = min8 max10 | 6 lowercases | 4 all characters

salonang
saserang
saichang
saoteran
satonang
sammanges
sarter7*2b
saeanang$5


?u?l?l?l?l?l?a?a?a?a = min8 max10 | 1 uppercase | 5 lowercases | 4 all characters

Salonang
Saserang
Saichang
Saoteran
Satonang
Sammanges
Sarter7*2b
Saeanang$5

What do you all think? Good or not good?

also Slim, it will be good to see if you can find a way for the user to build his own syntax, like you did with Crunch, where the user decides the character set, number of characters...

[Quest]

here is the oclHashcat operational sequence of events (as I see them).

I've created a wildHashcat folder inside the FrankenScript2 folder.
Path: /root/FrankenScript2/wildHashcat
This is only to gather all files oclHashcat FrankenScript related into one place.
In that wildHashcat folder I've placed 3 .hcmask files.
8-10-6numbers-4all.hcmask
8-10-6lower-4all.hcmask
8-10-1Capitalized-5lower-4all.hcmask
These files will be used as predefined user options to attack a captured handshake and to make Markov Chains 'kick in'.

1. The oclHashcat operational sequence should start with a captured handshake and creating a .cap file, just like before. So at this point nothing new for FrankenScript, as it can already do that.

2. That .cap file must be transformed into a .hccap for oclHashcat to use it.
Convert .cap into .hccap
Copy the .cap file to your Home folder. Then enter this command(replace the XXXXXXXXX with the file name).

aircrack-ng XXXXXXXXXXXX.cap -J capture

A capture.hccap will be created in Home
I would like a more logical way to do this, so that everything is in the wildHashcat folder...

3. At this point an attack can be initiated on that newly created .hccap

Here one syntax that I'm using.

cd /usr/share/cudahashcat/ && ./cudaHashcat64.bin --status -w 3 -t 10 -m 2500 /root/FrankenScript2/wildHashcat/capture.hccap -a 3 /root/FrankenScript2/wildHashcat/8-10-6numbers-4all.mask

cd /usr/share/cudahashcat/ && ./cudaHashcat64.bin Path to directory && to start the program.
--status Will update the progression status automatically every 10 seconds or so.
-w 3 Not even sure what that does but it works. lol
-t 10 Markov threshold. Super important. Without the -t argument, Markov will go into "smart brutforce" and now the estimated time will be 45days. -t 10 is about 4hours.
-m 2500 WPA/2 Hash-type
/root/FrankenScript2/wildHashcat/capture.hccap Path to capture.hccap file
-a 3 Attack mode.
/root/FrankenScript2/wildHashcat/8-10-6numbers-4all.mask Path to .mask file

would like for staticn0de to shine in on all this...

[staticn0de]

Hey quest, I'm not sure what you want me to shine in on. It all looks good!

If you wanted hashcat to see the hccap file in the home folder after it was converted, don't use the full path. Replace the path to home with $HOME in the script so it always has a good starting point.

It would be good to package this script in a deb so it could place files and configs in etc for use. On that, the installer could set up links for hashcat. But, that's all up to slim as I'm just here to appreciate the great work he does.

@quest, the -w option sets a work load profile.

The options are 1,2 or 3. Details from hashcat below

* Workload Profile:

1 = Reduced performance profile (low latency desktop)
2 = Default performance profile
3 = Tuned performance profile (high latency desktop)

[staticn0de]

@Slim

I was trying out Frankenscript with my new adapter which arrived in the mail. I had the -1 error and could not capture any handshakes.

I added a one liner at line 232 which looks like this

Enable_Attack_Mode(){
<-snip out all of the attack mode section until the last few lines as I'm not copying and pasting ->

clear
ifconfig $wlanX down
airmon-ng start $wlanX

MAC_Address_Options(){

I only inserted the line ifconfig $wlanX down. This has fixed the -1 error and i'm capturing handshakes again. I can't see this change causing any errors down the road but it's not fully tested. Would you consider adding it in to the script as I doubt i'm the only person who will run into it.

Edit:
@Slim again
Mate, I was just trying to do an iw dev scan from the menu. It failed so I added a catch so I could see the error and go have a read.

I have two wifi adapters and am using wlan1 to scan the network. At line 334 you have defined wlan0 as the adapter so it can't detect if I selected a seperate one. I changed the start of this line to:

iw dev $wlanX scan

and the problem was solved.

[slim76]

@Slim

I was trying out Frankenscript with my new adapter which arrived in the mail. I had the -1 error and could not capture any handshakes.

I added a one liner at line 232 which looks like this

Enable_Attack_Mode(){
<-snip out all of the attack mode section until the last few lines as I'm not copying and pasting ->

clear
ifconfig $wlanX down
airmon-ng start $wlanX

MAC_Address_Options(){

I only inserted the line ifconfig $wlanX down. This has fixed the -1 error and i'm capturing handshakes again. I can't see this change causing any errors down the road but it's not fully tested. Would you consider adding it in to the script as I doubt i'm the only person who will run into it.

Edit:
@Slim again
Mate, I was just trying to do an iw dev scan from the menu. It failed so I added a catch so I could see the error and go have a read.

I have two wifi adapters and am using wlan1 to scan the network. At line 334 you have defined wlan0 as the adapter so it can't detect if I selected a seperate one. I changed the start of this line to:

iw dev $wlanX scan

and the problem was solved.

Yeah I'm sorry about the issue's, hopefully this next version will be better. LOL
I've rewritten most of FrankenScript again and I've made several changes:
FrankenScript now detects all available WiFi devices and all enabled monitor modes, you can now use multiple WiFi devices and monitor modes.
You can now perform multiple attacks against the same target or a different target at the same time.

[Quest]

sounds good! Maybe what happened to you with the HDD failure, had a purpose? Create new and better things? I've seen it numerous times where something bad would happen, but endedup, ultimately, being a good thing. That is what the apocalypse is, changes by disaster. Maybe the universe is trying to tell you something

...

It would be good to package this script in a deb so it could place files and configs in etc for use.

...

oh yes I would like to see that. Hopefully Slim, will take your knowhow and that opportunity to move things ahead


little more testing with oclHashcat, and a couple of things stands out.

1. There is nothing to gain by having different lines in one .hccap file, for this reason..
Mask (?d?d?d?d?d?d?a?a) [8] = 3 hours, 27 mins
Mask (?d?d?d?d?d?d?a?a?a) [9] = 1 day, 10 hours
Mask (?d?d?d?d?d?d?a?a?a?a) [10] = 14 days, 11 hours
In other words, the command line and the 't' argument must be adapted according to the length of the passphrase in relation to the GPU capabilities to keep the time reasonable.

2. It is obvious now that the user will have to specify his own '-t XX' argument, as we do not have the same GPU, and what is true for me and my GPU is not true for others and their GPUs.
Here a couple of interesting leads as for building oclHashcat command lines..
PACK https://thesprawl.org/projects/pack/
pyHashcat http://hashcat.net/forum/thread-3478.html
RubyHashcat Wrapper http://hashcat.net/forum/thread-3505.html
(have not tried any of them)

3. Not using the '--status' argument anymore, as it remove the ability to pause, resume, bypass, stop.

[Quest]

It would be good to package this script in a deb so it could place files and configs in etc for use. On that, the installer could set up links for hashcat. But, that's all up to slim as I'm just here to appreciate the great work he does.

and speaking of wrapping FS into a .deb, if FS can be invoked into a simple command, then what would prevent it from making the cut for Kali 1.1.0 ?

It is scheduled for 1-1-15

[slim76]

Can someone test this out for me and report back please.

FrankenScript Download:
http://mir.cr/1XYIKG3H

[Quest]

- Kali 1.0.7 x64 -

Hopefully this is only on my end...


When choosing:

# [1] = Deauthenticate all connected clients #
# [2] = Deauthenticate a specific client #

or
# [1] = WEP Chopchop Without Association #
# [2] = WEP ARPreplay With Association #
# [3] = WEP Chopchop With Association #
# [4] = WEP Fragment With Association m

or
# [1] = Reaver & Default WPS Pin Keygens #
# [2] = Reaver Basic Settings #
# [3] = Reaver Custom Settings #
# [4] = Bully & Default WPS Pin Keygens #
# [5] = Bully Bruteforce Settings #
# [6] = Bully Custom Settings

all return with the same error:

There was an error creating the child process for this terminal

Failed to execute child process "/root/FS3/Scripts/Deauthenticate_all_clients.sh" (Permission denied)

and does not empty Temp_Working_Dirctory, or exits when choosing [q] = Clean & Exit Script

[staticn0de]

- Kali 1.0.7 x64 -

Hopefully this is only on my end...


When choosing:

# [1] = Deauthenticate all connected clients #
# [2] = Deauthenticate a specific client #

or
# [1] = WEP Chopchop Without Association #
# [2] = WEP ARPreplay With Association #
# [3] = WEP Chopchop With Association #
# [4] = WEP Fragment With Association m

or
# [1] = Reaver & Default WPS Pin Keygens #
# [2] = Reaver Basic Settings #
# [3] = Reaver Custom Settings #
# [4] = Bully & Default WPS Pin Keygens #
# [5] = Bully Bruteforce Settings #
# [6] = Bully Custom Settings

all return with the same error:





and does not empty Temp_Working_Dirctory, or exits when choosing [q] = Clean & Exit Script

I'm compiling a new live build now from 1.0.9. I'll have a try soon. Also, was the above a typo from you, Quest or the script?

[Quest]

all the .sh permissions "allow executing file as program" are OFF Slim..

There was an error creating the child process for this terminal

Failed to execute child process "/root/FS3/Scripts/
WEP_Chopchop_Without_Association.sh" (Permission denied)

[Quest]

I'm compiling a new live build now from 1.0.9. I'll have a try soon. Also, was the above a typo from you, Quest or the script?

no it's a Copy/Paste

Decompress FS3 yourself and you will see the Temp_Working_Dirctory

[slim76]

Right click on FS3.sh, choose Properties and then select the permissions tab, now tick the Allow executing file as program.
Then open the Script folder and highlight all of the scripts, right click and then choose Properties and then select the permissions tab, now tick the Allow executing file as program.

[Quest]

Yes that's what I did. It works better now

New prbs:

1.
[1] = Choose A Visable Client To Deauthenticate.
[2] = Input A Client To Deauthenticate.
[q] = Clean & Exit Script.

Please choose an option: 1

Input the number of a client or choose an option: 1

[1] = Basic Set Amount (Is set to send 4 deauth-requests).
[2] = Custom Amount (Input an amount of deauth-requests to send).
[q] = Clean & Exit Script.

Please choose an option: 2

Input the amount of deauthetication requests to send: 10
Invalid destination MAC address.
"aireplay-ng --help" for help.
Invalid destination MAC address.
"aireplay-ng --help" for help.
Checking for a handshake every 7 seconds...

2.

or

[1] = Basic Set Amount (Is set to send 4 deauth-requests).
[2] = Custom Amount (Input an amount of deauth-requests to send).
[q] = Clean & Exit Script.

Please choose an option: 1

The captured handshake is bad, the file will be deleted.

[Quest]

3.

still does not clean the Temp folder

[slim76]

3.

still does not clean the Temp folder

What's left in the temp folder after you've tried to clen it?.
Are you running any attacks while trying to clean the temp folder?.

[Quest]

- Chosen_AP_Line.txt
- Scanned_APs.txt

I choose to exit with [q] at the end. After an attack or after simply after scanning and choosing an AP.

[slim76]

- Chosen_AP_Line.txt
- Scanned_APs.txt

I choose to exit with [q] at the end. After an attack or after simply after scanning and choosing an AP.

Scanned_APs.txt isn't meant to be deleted, but it does get overwritten each time you do a scan.
Chosen_AP_Line.txt I just didn't write a delete option for it, it doesn't effect anything as it get overwritten too.
Everything else excluding the Handshake_Cracking folder should get deleted.

Note:
Attack temp files won't be deleted while running two or more of the same attacks at the same time, the files will remain until the attacks have finished.

[slim76]

and speaking of wrapping FS into a .deb, if FS can be invoked into a simple command, then what would prevent it from making the cut for Kali 1.1.0 ?

It is scheduled for 1-1-15

I would package it if I knew how to.
Does anyone know how to make an installable package?. LOL

[staticn0de]

I would package it if I knew how to.
Does anyone know how to make an installable package?. LOL

I certainly do! made one to automatically install cudahashcat because I'm impatient and didn't want to wait for the latest release to appear in the repo.

I'm going to install everything in the /usr/share folder and have /usr/bin links so users can call frankenscript with the 'frankenscript' command in bash. The catch is, you are normally using /root/ (or $USER, I have not checked.) and you will need to replace instances of $USER or /root/ with /usr/share/frankenscript/

1. make a folder with name based on the release (i'll assume its in your home directory)

cd ~
mkdir frankenscript_3.0-1

2. Make some folders for the scripts that will let frankenscipt be called with the bash command 'frankenscript' and somewhere to install the software.

mkdir frankenscript_3.0-1
mkdir -p ./usr/bin/
mkdir -p ./usr/share/frakenscript

3. Make the script to launch frankenscript from bash

cd ./usr/bin/
cat <<EOF > frankenscript
#!/bin/bash 
cd /usr/share/frankenscript/ && ./FS3.sh "$@"
EOF

4. Make it executable

chmod +x frankenscript

5. Put frankenscript in it's new home

cd ../share/frankenscript/
unrar -x FS3*.rar
rm FS3*.rar
mv FS3/* .

For this version, you will need to fix the script flags (add +x, but I'm sure you know how to do that)

6. Move back to the parent folder (frankenscript_3.0-1) and make the metadata files

cd ../../../
mkdir DEBIAN
cd DEBIAN

7. Update the metadata file (this is altered each time you make changes)

cat <<EOF > control
Package: frankenscript
Version: 3.0-1
Section: base
Priority: optional
Depends: 
Maintainer: Slim <[email protected]>
Description: This script allows holistic wireless penetration testing
 for kali linux
 systems
EOF

8. Build the deb

cd ../../
dpkg-deb --build frankenscript_3.0-1

9. It can now be installed with

dpkg -i frankenscript_3.0-1.deb

10. Or removed with the following (note the name is the name set in the /DEBIAN/control field 'package' Package: frankenscript

dpkg -r frankenscript

[Quest]

Good stuff!

i do not want to muddy the water at this point, but, let's put some thought into this.

- me thinks it would easier to invoke FS with 'franken' only, and also, as it will no longer be considered as a simple script as it was before.

It's like calling Wifite, 'wifitescript'.

thoughts?

[slim76]

@ staticn0de

I've managed to successfully pack FrankenScript into an installable .deb file. :-)

Many thanks for your help mate.

[slim76]

I've had a quick look into hashcat but couldn't get it working using a mask file.
If anyone could help I'd be most greatful.

This worked:
hashcat -m 2500 -a 3 XXXXX.hccap ?d?d?d?d?d?d?d?d

This didn't work:
hashcat -m 2500 -a 3 XXXXX.hccap Default.hcmask

Here's the output:

Initializing hashcat v0.47 by atom with 8 threads and 32mb segment-size...

Added hashes from file XXXXX.hccap: 1 (1 salts)
Activating quick-digest mode for single-hash with salt

NOTE: press enter for status-screen


Input.Mode: Mask (D) [1]
Index.....: 0/1 (segment), 1 (words), 0 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: - plains, - words
Progress..: 1/1 (100.00%)
Running...: --:--:--:--
Estimated.: --:--:--:--


Input.Mode: Mask (De) [2]
Index.....: 0/1 (segment), 1 (words), 0 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: - plains, - words
Progress..: 1/1 (100.00%)
Running...: --:--:--:--
Estimated.: --:--:--:--


Input.Mode: Mask (Def) [3]
Index.....: 0/1 (segment), 1 (words), 0 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: - plains, - words
Progress..: 1/1 (100.00%)
Running...: --:--:--:--
Estimated.: --:--:--:--


Input.Mode: Mask (Defa) [4]
Index.....: 0/1 (segment), 1 (words), 0 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: - plains, - words
Progress..: 1/1 (100.00%)
Running...: --:--:--:--
Estimated.: --:--:--:--


Input.Mode: Mask (Defau) [5]
Index.....: 0/1 (segment), 1 (words), 0 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: - plains, - words
Progress..: 1/1 (100.00%)
Running...: --:--:--:--
Estimated.: --:--:--:--


Input.Mode: Mask (Defaul) [6]
Index.....: 0/1 (segment), 1 (words), 0 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: - plains, - words
Progress..: 1/1 (100.00%)
Running...: --:--:--:--
Estimated.: --:--:--:--


Input.Mode: Mask (Default) [7]
Index.....: 0/1 (segment), 1 (words), 0 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: - plains, - words
Progress..: 1/1 (100.00%)
Running...: --:--:--:--
Estimated.: --:--:--:--


Input.Mode: Mask (Default.) [8]
Index.....: 0/1 (segment), 1 (words), 0 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: - plains, - words
Progress..: 1/1 (100.00%)
Running...: --:--:--:--
Estimated.: --:--:--:--


Input.Mode: Mask (Default.h) [9]
Index.....: 0/1 (segment), 1 (words), 0 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: - plains, - words
Progress..: 1/1 (100.00%)
Running...: --:--:--:--
Estimated.: --:--:--:--


Input.Mode: Mask (Default.hc) [10]
Index.....: 0/1 (segment), 1 (words), 0 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: - plains, - words
Progress..: 1/1 (100.00%)
Running...: --:--:--:--
Estimated.: --:--:--:--


Input.Mode: Mask (Default.hcm) [11]
Index.....: 0/1 (segment), 1 (words), 0 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: - plains, - words
Progress..: 1/1 (100.00%)
Running...: --:--:--:--
Estimated.: --:--:--:--


Input.Mode: Mask (Default.hcma) [12]
Index.....: 0/1 (segment), 1 (words), 0 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: - plains, - words
Progress..: 1/1 (100.00%)
Running...: --:--:--:--
Estimated.: --:--:--:--


Input.Mode: Mask (Default.hcmas) [13]
Index.....: 0/1 (segment), 1 (words), 0 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: - plains, - words
Progress..: 1/1 (100.00%)
Running...: --:--:--:--
Estimated.: --:--:--:--


Input.Mode: Mask (Default.hcmask) [14]
Index.....: 0/1 (segment), 1 (words), 0 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: - plains, - words
Progress..: 1/1 (100.00%)
Running...: --:--:--:--
Estimated.: --:--:--:--

Started: Sat Oct  4 23:26:04 2014
Stopped: Sat Oct  4 23:26:04 2014

[Quest]

Edit: you're using hashcat, not ocl/cuda?



Hey Slim,

below are two syntax I'm using. The .hccap and .hcmask files being in FrankenScript2/wildHashcat/

?l?u?d,?u?l,?2?l?l?l?1?1?1?1 = min8 max8 | 1 uppercase and lowercase | 3 lowercases | 4 all characters no symbols

cd /usr/share/cudahashcat/ && ./cudaHashcat64.bin -w 3 -t 10 -m 2500 /root/FrankenScript2/wildHashcat/capture.hccap -a 3 /root/FrankenScript2/wildHashcat/8=1Capandlower-3lower-4allnosymbols.hcmask

8=1Capandlower-3lower-4allnosymbols.hcmask
content of that .hcmask

?l?u?d,?u?l,?2?l?l?l?1?1?1?1

sammange
Cabo2012
bali35dC




?l?u?d,?d?d?d?d?1?1?1?1 = min8 max8 | 4 numbers |*4 all characters no symbols

cd /usr/share/cudahashcat/ && ./cudaHashcat64.bin -w 3 -m 2500 /root/FrankenScript2/wildHashcat/capture.hccap -a 3 /root/FrankenScript2/wildHashcat/8=4numbers-4allnosymbols.hcmask

8=4numbers-4allnosymbols.hcmask
content of that .hcmask

?l?u?d,?d?d?d?d?1?1?1?1

87654321
1221JP69
1975Jack

[slim76]

Edit: you're using hashcat, not ocl/cuda?



Hey Slim,

below are two syntax I'm using. The .hccap and .hcmask files being in FrankenScript2/wildHashcat/

?l?u?d,?u?l,?2?l?l?l?1?1?1?1 = min8 max8 | 1 uppercase and lowercase | 3 lowercases | 4 all characters no symbols

cd /usr/share/cudahashcat/ && ./cudaHashcat64.bin -w 3 -t 10 -m 2500 /root/FrankenScript2/wildHashcat/capture.hccap -a 3 /root/FrankenScript2/wildHashcat/8=1Capandlower-3lower-4allnosymbols.hcmask

8=1Capandlower-3lower-4allnosymbols.hcmask
content of that .hcmask

?l?u?d,?u?l,?2?l?l?l?1?1?1?1

sammange
Cabo2012
bali35dC




?l?u?d,?d?d?d?d?1?1?1?1 = min8 max8 | 4 numbers |*4 all characters no symbols

cd /usr/share/cudahashcat/ && ./cudaHashcat64.bin -w 3 -m 2500 /root/FrankenScript2/wildHashcat/capture.hccap -a 3 /root/FrankenScript2/wildHashcat/8=4numbers-4allnosymbols.hcmask

8=4numbers-4allnosymbols.hcmask
content of that .hcmask

?l?u?d,?d?d?d?d?1?1?1?1

87654321
1221JP69
1975Jack

Yeah I'm using hashcat at the moment, I really need a new laptop. LOL
I still cant get the mask attack working, I might have another try at some point though.

[Quest]

if I may suggest, sub-contract that portion to staticn0de.

Rap it up, then staticn0de can ship it right back at you with oclHashcat implemented.

[slim76]

if I may suggest, sub-contract that portion to staticn0de.

Rap it up, then staticn0de can ship it right back at you with oclHashcat implemented.

I might do that if staticn0de is up for the job, but I'd still need the standard CPU hashcat implemented too.

[staticn0de]

Of course I can help.

What do you want to see? This is what i am guessing.

Maybe a menu option (can be burried in the hascat menu) that lets the user select if they use hashcat, oclhashcat or cudahashcat. Depending on the option they select, it can set an option in a file (perhaps /etc/franken.conf) that will make frankeknscript no longer prompt for what they are using. Another menu option will let the user change their selection.

I can make it check it hashcat / oclhashcat is installed and if it isn't ask if the user wants it.

cudahashcat is harder as it's not in the repo. It can link back to my deb I made, otherwise the user will need to download and manually install it.

[Quest]

my friend to the rescue!

I would not deal with installation of ocl/cuda at all. FS is not a software installation program. Don't go there. Plus as you've mentioned, it's a little too tricky. Let the user deal with that separately.

for the menu, yes,

hashcat
oclhashcat
cudahashcat

after selection maybe

convert .cap into .hccap?

then

select the length of the password:user input 8 9 10 ??


Let's see what you come up with....

[Quest]

do we want to cover the whole hashes spectrum, or stay within WPA/2 only? Would be nice to cover every possibility but that's alot of work...

* Generic hash types:

0 = MD5
10 = md5($pass.$salt)
20 = md5($salt.$pass)
30 = md5(unicode($pass).$salt)
40 = md5($salt.unicode($pass))
snip
2500 = WPA/WPA2
snip
8900 = scrypt
9000 = Password Safe v2
9100 = Lotus Notes/Domino 8

* Specific hash types:

11 = Joomla < 2.5.18
12 = PostgreSQL
snip
3711 = Mediawiki B type
62XY = TrueCrypt 5.0+
snip

http://hashcat.net/wiki/doku.php?id=oclhashcat

[Quest]

staticn0de,

Here are the .hcmask I'm using (descriptive name of the file and content of that file). I do believe that it would be a good starting point for any user. FS, however, should be able to go into the wildHashcat folder and bring up any .hcmask file it finds.

8=1Capandlower-3lower-4allnosymbols.hcmask

?l?u?d,?u?l,?2?l?l?l?1?1?1?1

8=4numbers-4allnosymbols.hcmask

?l?u?d,?d?d?d?d?1?1?1?1

9=1Capandlower-4lower-4allnosymbols.hcmask

?l?u?d,?u?l,?2?l?l?l?l?1?1?1?1

9=5numbers-4allnosymbols.hcmask

?l?u?d,?d?d?d?d?d?1?1?1?1

10=1Capandlower-5lower-4allnosymbols.hcmask

?l?u?d,?u?l,?2?l?l?l?l?l?1?1?1?1

10=6numbers-4allnosymbols.hcmask

?l?u?d,?d?d?d?d?d?d?1?1?1?1

[Quest]

Slim,

The captured handshake is bad, the file will be deleted.

[1] = Retry attack.
[q] = Exit attack.
Please choose an option?:

can anyone else reproduce this?

[slim76]

Slim,





can anyone else reproduce this?

Nothing wrong with FS3.
Pyrit checks the capture.cap file for a valid handshake, it looks like yours was bad. lol
Use the retry option until you get a good handshake.

[Quest]

really?

- I've not had 1 good handshake with FS3
- That never happened, not once, with previous versions

completely mystified and skeptic here

[Quest]

what about that?..

[1] = Basic Set Amount (Is set to send 4 deauth-requests).
[2] = Custom Amount (Input an amount of deauth-requests to send).
[q] = Clean & Exit Script.
Please choose an option: 2

Input the amount of deauthetication requests to send: 8
Invalid destination MAC address.
"aireplay-ng --help" for help.
Invalid destination MAC address.
"aireplay-ng --help" for help.
Checking for a handshake every 7 seconds...
Invalid destination MAC address.
"aireplay-ng --help" for help.
Checking for a handshake every 7 seconds...

something is outa wack =( not getting anywhere with handshakes.

[slim76]

what about that?..







something is outa wack =( not getting anywhere with handshakes.

I found it, it happens after the option "[2] = Deauthenticate a specific client" but before option "[2] = Custom Amount (Input an amount of deauth-requests to send).".

I'll try and fix it as soon as I get chance.