macchanger disconnects wifi - Kali Rolling

[thornez]

I have been using macchanger for a while now and I have never encountered this issue until the other day. When I use the terminal to change the mac address as I always have, I notice the wifi symbol at the top right of the kali screen disappear. However, if I click on that top bar, it still lists me as connected to my network even though the browser will not connect and ping attempts to the net result in a message: Network is unreachable. I can shut off the wifi and then reconnect, however, this resets my mac address also.

The router does not have mac filtering enabled, so it should not do this and it never has until now. Then I tested the same machine on a different network and it had the same behavior, so I was not able to isolate the issue to the network. I performed all update, upgrade, dist-upgrade, linux-headers, and verified my source list, and the problem persists.

Next I tried a different computer running Kali Rolling. It had not been fully updated. I performed the macchange without any of these problems. Great. Then I ran the update, upgrade, dist-upgrade, linux-headers, and verified my source list. Wait a second. Now this machine is behaving like the other one.

Thoughts anyone?

[grid]

Have you seen this same behavior using macchanger on a wired connection?

From your description, it sounds like one or more of the Kali Rolling updates is to blame.

[thornez]

That is interesting. I have not tried this on a wired connection, but I will check, if only to isolate it to a bug having to do strictly with wifi. I hope it is something that will be fixed in an update. A very annoying problem to have for a function that is one of the first things that I do when logging into a machine.

[grid]

Depending on what you find with a wired connection, I'd report it over at bugs.kali.org

From my perspective, your post describes the issue well.

[thornez]

UPDATE: I can't believe I didn't think of this before! It has nothing to do with macchanger. I tested it out just now simply taking the interface down and then up again

ifconfig wlan0 down

ifconfig wlan0 up

Same result. The interface does not come back up and ping attempts to the net result in:

connect: Network is unreachable

So now I feel like weaksauce for not having isolated it further from the beginning and have tested a few more things.

Taking the interface down and switching to monitor mode works fine, even with a macchange as well. No problems. Taking the interface back down and switching to managed mode is where it fails upon bringing the interface back up.

[thornez]

Bug reported 0003316.

Is anybody else out there having an issue with this? I did a fresh virtual box install tonight using an ISO I downloaded tonight as well from kali.org and right out of the box it displayed this same behavior.

[thornez]

UPDATE: I have been working at isolating the issue and I think I have figured out where it is.

Everything is fine until I:

ifconfig wlan0 down
ifconfig wlan0 up

The network shows connected still if you bring down the network list at the top right of the screen, however, ping attempts to the net result in: Network unreachable.

HOWEVER, ping attempts on the local network work just fine.

Temporary fix (example of a macchange):

ifconfig wlan0 down
macchanger -r wlan0
ifconfig wlan0 up
route add default gw 192.168.1.254
macchanger -s wlan0 (verifies that the spoofed mac address is currently active)

So the issue is in the 4th line where I need to manually add the default gateway: route add default gw {current gateway ip}

Of course if you are mobile and connect to multiple networks, then scripting things like macchanges or anything else that requires a interface down/up sequence is really a problem as I would need to enter it manually.

The question is, why would I now need to manually input the gateway ip to achieve this when I never had to perform such a task before?

[mmusket33]

To thornez

If you wish to spoof your mac address thru macchanger, the macchanger setting will remain valid until you call up Network Manager. Network Manager has its own macchanging module. If you have a connect automatically setting, then Network Manager will attempt to connect to that access point. If the mac address for that access point has a cloned mac address entered then Network Manager will reset the mac address to that setting. If no cloned mac address is entered then the mac address will be reset to the device mac address. In either case any mac address set up thru macchanger is changed or overridden by Network Manager. You can download netmanmac available in these forums to globally set a mac address but that may not work for wired connections.

Open up the Network Manager drop down menus and try entering a cloned mac address for your wireless and wired connection. We have only wireless and therefore cannot test wired here.

MTeams

[thornez]

Thanks mmusket33,

I had figured that out the other day to use in a pinch, however, before this issue started, I always just used macchanger. Regardless, the problem, as it turns out, has nothing to do with macchanger. The issue, narrowed down to my most recent update, is that once wlan0 is taken down and ifconfig wlan0 up is used to bring it back up, the interface no longer remembers the default gateway of the network. So lets say you are doing something unrelated to macchanger, like switching back to managed mode from monitor mode, you will be able to access only your LAN, but not out to the net until you additionally run: route add default gw 192.168.1.254 (or whatever your default gateway is at your current AP).

It was not always this way. I have no idea where things went wrong.

[pedr0 ubuntu]

I have installed kali 2.0 rolling a few days ago, i have used macchanger tool to spoof my mac and ip addr and everyting went well ...
"macchanger did manage to change my mac addr and ip addr (i have confirmed that in router webpage with ifconfig command and in NM)"

The problem cames a few days later , when i have decided to update my kali distro....
after that update i've came across this macchanger issue that does not allow me to change my mac (it revert changes to the persistence mac)...


For Reference:
When using NetworkManager(NM) to access the net, any spoofed mac address(MAC) produced thru the terminal window(TW) when using macchanger tool will be over-written by NM. If no cloned mac address exists in NM menu settings, then the device is returned to the device MAC and any mac spoofing set by the user
thru the TW disappears.


I have writen one toolkit that uses macchanger tool to achive the goal of spoofing our ip+mac, but after this 'update' i was forced to find a soluction to my problem...
NOTE: Gh0st-Ubuntu -> its my ESSID name | 00:03:93:a8:04:b8 -> its the cloned mac address to insert in NM (network manager)
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
service network-manager stop
ifconfig wlan0 down
find "/etc/NetworkManager/system-connections/Gh0st-Ubuntu" -type f -exec sh -c "sed -i "/^cloned-mac-address.*/d;/^\[wifi\]/a\cloned-mac-address=00:03:93:a8:04:b8" "{}"" \;
ifconfig wlan0 up
service network-manager start
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
To revert 'settings' just restart your computer or delete '00:03:93:a8:04:b8' from 'find' command ...




hope this helps ....
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------