Howto frankenScript

[Quest]

actually, 1 or 2 has the same result...

##############################################
# [1] = Deauthenticate all connected clients #
# [2] = Deauthenticate a specific client #
##############################################
# [s] = Return To Scanned AP's #
# [m] = Return To Main Menu #
# [q] = Clean & Exit Script #
##############################################

Chosen Target:
Fibertel WiFiXXX 20:25:64:XX:XX:XX Signal-44.dBm WPA2_WPA_AES-CCM_TKIP Channel-11

Please choose an option: 1

[1] = Basic Set Amount (Is set to send 4 deauth-requests).
[2] = Custom Amount (Input an amount of deauth-requests to send).
[q] = Clean & Exit Script.
Please choose an option: 1

The captured handshake is bad, the file will be deleted.

[1] = Retry attack.
[q] = Exit attack.
Please choose an option?

Thanks for looking into it

[slim76]

actually, 1 or 2 has the same result...

Thanks for looking into it

@ Quest

Try this one.
http://mir.cr/UK5C8P1J

@ staticn0de
Here you go, can you only edit the Attack_Capture_Files.sh file please.
I've created the menu options and such, could you fill in the rest please.

http://mir.cr/UK5C8P1J

[Quest]

I would but...

root@kali:~# dpkg -i FrankenScript_v3.1.deb
dpkg: error processing FrankenScript_v3.1.deb (--install):
package architecture (i386) does not match system (amd64)
Errors were encountered while processing:
FrankenScript_v3.1.deb
root@kali:~#

[slim76]

I would but...

Have added multi-arch yet?.

dpkg --add-architecture i386

[Quest]

root@kali:~# dpkg -i FrankenScript_v3.1.deb
Selecting previously unselected package fs3.
(Reading database ... 372400 files and directories currently installed.)
Unpacking fs3 (from FrankenScript_v3.1.deb) ...
Setting up fs3 (3.1) ...
root@kali:~#

nice! but now... how do you start the **** thing?

root@kali:~# fs3
bash: fs3: command not found
root@kali:~# franken
bash: franken: command not found
root@kali:~# frankenscript
bash: frankenscript: command not found

[slim76]

nice! but now... how do you start the **** thing?

This repackage should work for everyone.
http://mir.cr/1V6BDGMX

You start FrankenScript by typing fs3.sh

[Quest]

Thank you DL niowwwwwww

What's the correct syntax to remove the previously installed .deb?

[slim76]

I think that repack was bad too, I just re-editted the repack download link with the new repack.
Download it again from the editted link.

[Quest]

confirmed. I've reinstalled my kali image, and this is what I got

root@kali:~# dpkg -i FrankenScript_v3.1_0.deb
dpkg: error processing FrankenScript_v3.1_0.deb (--install):
package architecture (any) does not match system (amd64)
Errors were encountered while processing:
FrankenScript_v3.1_0.deb

DL the second new .deb now

[Quest]

- packaging check
- permissions check

- scans check


same problem for creating a .cap

##############################################
# [1] = Deauthenticate all connected clients #
# [2] = Deauthenticate a specific client #
##############################################
# [s] = Return To Scanned AP's #
# [m] = Return To Main Menu #
# [q] = Clean & Exit Script #
##############################################

Chosen Target:
Telecentro 8C:04:FF:XX:XX:XX Signal-72.dBm WPA2_AES-CCM_TKIP Channel-6

Please choose an option: 2

[1] = Choose A Visable Client To Deauthenticate.
[2] = Input A Client To Deauthenticate.
[q] = Clean & Exit Script.
Please choose an option: 1

Connected Clients:

1: 40:6F:2A:62:FD:7F
2: 44:6D:57:A4:FA:38
3: 7C:E93:82:2F:92
4: 44:33:4C:BD:27:49

NOTE: Press the Enter button to refresh the client list.
[q] = Clean & Exit Script.
Input the number of a client or choose an option: 2

[1] = Basic Set Amount (Is set to send 4 deauth-requests).
[2] = Custom Amount (Input an amount of deauth-requests to send).
[q] = Clean & Exit Script.
Please choose an option: 2

Input the amount of deauthetication requests to send: 8

The captured handshake is bad, the file will be deleted.

[1] = Retry attack.
[q] = Exit attack.
Please choose an option?:

i don't understand this as I never had problems with hanshakes and creating a .cap with FS

[Quest]

same with [1] = Deauthenticate all connected clients

[1] = Basic Set Amount (Is set to send 4 deauth-requests).
[2] = Custom Amount (Input an amount of deauth-requests to send).
[q] = Clean & Exit Script.
Please choose an option: 1



The captured handshake is bad, the file will be deleted.

[1] = Retry attack.
[q] = Exit attack.
Please choose an option?:

[slim76]

- packaging check
- permissions check

- scans check


same problem for creating a .cap


i don't understand this as I never had problems with hanshakes and creating a .cap with FS

I get bad handshakes too, keep trying and you should get a good handshake at some point. lol

[Quest]

but Slim, I never had such problems.

I'm absolute 0/100. I could not have a handshake with FS3 to save my life.

can anyone confirm this?

[staticn0de]

but Slim, I never had such problems.

I'm absolute 0/100. I could not have a handshake with FS3 to save my life.

can anyone confirm this?

Quest,

I can also not capture handshakes with the new script.

I have not looked into why as I'm busy with work. I'll take a look when I can if Slim does not beat me too it.

[slim76]

but Slim, I never had such problems.

I'm absolute 0/100. I could not have a handshake with FS3 to save my life.

can anyone confirm this?

I just rechecked and noticed I'm having big issues too.
It only seems to happen with some APs/Networks, I could capture a handshake from a certain AP earlier but can't capture from the same AP now.
It's strange cause I didn't change anything since the last time I captured a good handshake.

I'll continue to try and resolve the issue asap.

@ staticn0de
Hope you have better luck than I'm having, stupid thing is getting the better of me. LOL

[Quest]

just glad that i didn't have to check-in to the local mental hospital.

All part of R&D Had the same happened to me numerous time, where things would work, then, they would not.

Whatever, I'm really thankful for the time you two put in to this. THANKS

[staticn0de]

Hey guys,

First problem, when I run a wash scan I was getting smashed with

[!] Found packet with bad FCS, skipping...
[!] Found packet with bad FCS, skipping...
[!] Found packet with bad FCS, skipping...
[!] Found packet with bad FCS, skipping...
[!] Found packet with bad FCS, skipping...
[!] Found packet with bad FCS, skipping...
[!] Found packet with bad FCS, skipping...

Changed line 575 of FS3.sh to xterm -geometry 111x23+0+350 -l -lf $HOME/FS3/Temp_Working_Dirctory/Wash_Network_Scan.txt -e wash -i $monX -C &

and it was fixed.

[slim76]

Hey guys,

First problem, when I run a wash scan I was getting smashed with

[!] Found packet with bad FCS, skipping...
[!] Found packet with bad FCS, skipping...
[!] Found packet with bad FCS, skipping...
[!] Found packet with bad FCS, skipping...
[!] Found packet with bad FCS, skipping...
[!] Found packet with bad FCS, skipping...
[!] Found packet with bad FCS, skipping...

Changed line 575 of FS3.sh to xterm -geometry 111x23+0+350 -l -lf $HOME/FS3/Temp_Working_Dirctory/Wash_Network_Scan.txt -e wash -i $monX -C &

and it was fixed.

Are you using an old version of FS3?, wash should be located at line number 695.

[slim76]

I can capture handshakes again, not sure if I solved the problem or if I'm just getting lucky. LOL
Try the following:

Open Deauthenticate_all_clients.sh and edit line number 448

From this:
kill $Kill_Airodump_All_Clients

To this:
sleep 5
kill $Kill_Airodump_All_Clients
sleep 5

Then open Deauthenticate_a_specific_client.sh and edit line number 518

From this:
kill $Kill_Airodump_Specific_Client

To this:
sleep 5
kill $Kill_Airodump_Specific_Client
sleep 5

Please let me know if it solves the problem.

[Quest]

have not tried it, will wait for the next .deb, but that sounds about right to give the process more time to execute. It was way too quick or missing a step(?)

Can you reverse engineer the last FS2(the one in the first post) Slim? Everything was fine for cap handshakes with that version.

[Quest]

just a headsup,

they seem to want adding a cudahashcat package http://git.kali.org/gitweb/?a=project_list;pf=packages

Might want to keep an eye on that as it might change the installation path(?), and possibly affect staticn0de's coding of cudaHashcat into FS3(?).

[slim76]

just a headsup,

they seem to want adding a cudahashcat package http://git.kali.org/gitweb/?a=project_list;pf=packages

Might want to keep an eye on that as it might change the installation path(?), and possibly affect staticn0de's coding of cudaHashcat into FS3(?).

I don't follow you, what are you talking about?

[slim76]

I think I've solved the handshake issue.
I had set FrankenScript to only check for a good handshake, it now checks for a good or workable handshake.

I'll pack it and upload it later.

[Quest]

ok great!!

I don't follow you, what are you talking about?

staticn0de had to create a cudaHashcat .deb weeks ago, because v1.30 was only available for ATi/AMD(oclHashcat) in the repo. Now if they come out with an "official" version of cudaHashcat 1.30, installation path might be different from the cudaHashcat 1.30 static created, thus affecting the command lines.

In other words, cudaHashcat v1.01 was inside the oclHashcat directory.

Then with staticn0de version, it was separated in it's own directory(cudaHashcat).

Now we don't know what the correct path will be.

If everyone uses staticn0de's version of 1.30, then there's no problem, as we know the path. If they come out with another version with a different installation path, then there will be problems.

..confused yet? I am

[slim76]

ok great!!



staticn0de had to create a cudaHashcat .deb weeks ago, because v1.30 was only available for ATi/AMD(oclHashcat) in the repo. Now if they come out with an "official" version of cudaHashcat 1.30, installation path might be different from the cudaHashcat 1.30 static created, thus affecting the command lines.

In other words, cudaHashcat v1.01 was inside the oclHashcat directory.

Then with staticn0de version, it was separated in it's own directory(cudaHashcat).

Now we don't know what the correct path will be.

If everyone uses staticn0de's version of 1.30, then there's no problem, as we know the path. If they come out with another version with a different installation path, then there will be problems.

..confused yet? I am

I think I follow what you're saying LOL, hopefully staticn0de will have it covered.

[Quest]

but wait,

the reason why v1.01 was all the the same directory was because both cuda and ocl share the same files, so if someone wants to use both cuda and ocl now, they will have to install oclHashcat twice. Once for cuda and the other for ocl. So we might see them coming full circle and revert back to the 1 version solution in the future.

let me know when you're about ready to jump out the window and I'll stop. lol

The real reason behind the development of oclHashcat-lite was that too many people compared apples to oranges. Back in the days when there was only oclHashcat and oclHashcat-plus people compared them against pure single-hash and brute-force-only crackers such as IGHASHGPU, whitepixel or BarsWF. They took the “cracking performance” as the most important factor for comparison.

The “cracking performance” itself is not the most important factor in cracking passwords. The most important factor is how fast it can crack a password. A big difference, and one that oclHashcat and oclHashcat-plus focused on. The best “cracking performance” however can only be achieved only by using both the pure single-hash and brute-force attack vectors.

I really appreciate the work they have done overthrere but they seriously need un-confuse their creation.

[slim76]

but wait,

the reason why v1.01 was all the the same directory was because both cuda and ocl share the same files, so if someone wants to use both cuda and ocl now, they will have to install oclHashcat twice. Once for cuda and the other for ocl. So we might see them coming full circle and revert back to the 1 version solution in the future.

let me know when you're about ready to jump out the window and I'll stop. lol





I really appreciate the work they have done overthrere but they seriously need un-confuse their creation.

Sounds like a bit of a headache if you ask me LOL.
Think it might be wise if you and staticn0de handled all that, I'll stick to what I know which isn't much. LOL

[slim76]

Updated FrankenScript 8-10-14.

Download Link:
http://mir.cr/XTYJXX7W

[Quest]

wait,

ocl, refers to both nvidia and ati, as it is the name of the program, but when it comes to installation, ocl refers only to ATi and cuda to it's counter part, nVidia.

do not jump Slim! We all need you!!

Updated FrankenScript 8-10-14.

Download Link:
http://mir.cr/XTYJXX7W

Yes DLing miow

[Quest]

How do you uninstall the previous FS3?

[slim76]

How do you uninstall the previous FS3?

I can't remember for sure, try the following:

dpkg -r FrankenScript_v3.1

or

dpkg -r fs3

or

dpkg -r fs3.sh

[Quest]

Thanks.

ok big prbs with the last version. The scans don't work.

airodump: The second window shoing the scan does not apear.

wash:

Chosen monitor interface: mon0

Scanning For Available Networks, Please Wait...

Press [Enter] to stop the wash scan and continue.xterm: cannot open /usr/share/Temp_Working_Dirctory/Wash_Network_Scan.txt: 2:No such file or directory

# [1] = iw dev scan: does not work



hopefully it' only me.

[Quest]

yep I think you forgot a step in the packaging, or something very basic is missing.

System: Linux 3.14-kali1-amd64 x86_64
Available WiFi Devices: Multiple
System Mode Status: Networking Mode Is Enabled

Please choose an option: q

ls: cannot access /usr/share/Temp_Working_Dirctory/Handshake_Cracking: No such file or directory
ls: cannot access /usr/share/Temp_Working_Dirctory: No such file or directory
root@kali:~#

does not create the two files in Temp, and multiple other error messages..

[Quest]

I have 19 files in my script folder. Maybe I need another coffee but looks like I'm missing a couple of feathers?

[slim76]

VERY IMPORTANT WARNING

DO NOT USE THE [R] OPTION TO REMOVE/UNINSTALL FRANKENSCRIPT, DOING SO WILL KILL YOUR SYSTEM.

Please wait for further information.

@ Quest

The problem is the path location, I missed out a folder name.
I'll fix it when i've re-installed kali AGAIN.

[wn722]

hello everybody.
just got the script:
got handshakes captured in .cap files. But I can't see them in Available Capture Files list of the Attack Handshake Files menu...

Available Capture Files.
########################



Please input the number of your chosen capture file: 
./FrankenScript2.sh: line 2381: /root/FrankenScript2/Temp_Working_Dirctory/Handshake_Cracking/Handshake_File.txt: No such file or directory
cat: /root/FrankenScript2/Temp_Working_Dirctory/Handshake_Cracking/Chosen_capture_file.txt: No such file or directory

the Handshake files are in Captured_Handshakes/ directory.

Am i missing something?

[slim76]

To uninstall/remove the previous FrankenScript type: dpkg -r FrankenScript_v3.1 or dpkg -r fs3

Updated FrankenScript (9-10-14).
Fixed the uninstall problem.
Fixed location paths.

Download Link:
http://mir.cr/DHEDYWHS

To start the script type fs3.sh into a terminal.
To uninstall/remove FrankenScript type dpkg -r fs3 into a terminal, or use the [R] option in the FrankenScript menu.

[Quest]

hey Slim, you fixed it! I can cap handshakes..

ERROR: could not insert 'nvidia': No such device
Pyrit 0.4.1-dev (svn r308) (C) 2008-2011 Lukas Lueg http://pyrit.googlecode.com
This code is distributed under the GNU General Public License v3+

Parsing file '/usr/share/FS3/Temp_Working_Dirctory/Deauthenticate_a_client_8C04FFBA5075/psk-01.cap' (1/1)...
Parsed 7 packets (7 802.11-packets), got 1 AP(s)

#1: AccessPoint 8c:04:ff:ba:50:75 ('Xxxxxxxx')
#0: Station 68:ed:43:76:8e:11
#1: Station 40:6f:2a:62:fd:7f, 1 handshake(s)
#1: HMAC_SHA1_AES, good, spread 1

New pcap-file '/usr/share/FS3/Temp_Working_Dirctory/Deauthenticate_a_client_8C04FFBA5075/Stripped.cap' written (4 out of 7 packets)
ERROR: could not insert 'nvidia': No such device

The captured handshake is good or workable, Xxxxxxxx.cap will be coppied to /usr/share/FS3/Captured_Handshakes

Press [Enter] to continue.

[Quest]

Bully works but a couple of questions

# [4] = Bully & Default WPS Pin Keygens #

Bully & WPS-Pin Attack Command:
bully mon0 -c 8 -b 64:70:02:XX:XX:XX -F -B -l 60 -v 3 -p 65822746 <---- has brutforce enabled

Press [Enter] to launch the attack.

# [5] = Bully Bruteforce Settings

Bully Bruteforce Attack Command:
bully mon0 -c 8 -b 64:70:02:XX:XX:XX -F -l 60 -v 3 <------ does not have brutforce enabled

Press [Enter] to launch the attack.

kinda confusing. Which one does a "bruteforce attack" ?

# [6] = Bully Custom Settings

Bully Current Attack Command:
bully mon0 -c 8 -b 64:70:02:XX:XX:XX -v 3 <------two spaces before "-v"?

Please input any additional Bully options:

Bully Custom Attack Command:
bully mon0 -c 8 -b 64:70:02:XX:XX:XX

Press [Enter] to launch the attack.

[!] Bully v1.0-22 - WPS vulnerability assessment utility
[+] Switching interface 'mon0' to channel '8'
[!] Using '4c:a3:c8....' for the source MAC address
[+] Datalink type set to '127', radiotap headers present
[+] Scanning for beacon from '64:70:02:..' on channel '8'
[+] Got beacon for 'MJYS01' (64:70:02:...)
[+] Loading randomized pins from '/root/.bully/pins'
[!] Restoring session from '/root/.bully/647xxxxxx.run'
[!] WARNING: WPS checksum was bruteforced in prior session, now autogenerated
[X] Use --force to ignore above warning(s) and continue anyway

Bully was cancelled or it failed.

- shouldn't that be the first option (# [4] in the menu) as it is the simplest attack?
- and the first one (with the -p argument) the last attack option as it is the most sophisticated?

[slim76]

Bully works but a couple of questions

kinda confusing. Which one does a "bruteforce attack" ?

- shouldn't that be the first option (# [4] in the menu) as it is the simplest attack?
- and the first one (with the -p argument) the last attack option as it is the most sophisticated?

Go by the title of the attack rather than the commands and you won't get confused. LOL
I think the nvidia error your getting is due to a problem with your setup (I THINK lol), I've just done a fresh install and don't get the issue you get.

[Quest]

re-read my post Slim. I'm not saying anything about the nvidia error. That is definitely on my end

[slim76]

re-read my post Slim. I'm not saying anything about the nvidia error. That is definitely on my end

So everything is working ok for you then?.

Can you update the first page please, that's if everything is working ok.

[slim76]

@ Quest

Can you do me a favour please,
Can you try cracking a wpa password using hashcat and a mask file, then post the commands used as well as the actually mask file.

[Quest]

sure thing bro..


I've never used hashcat(CPU), only cudaHashcat(GPU). Will edit this post.

EDIT: I don't see a 'mask' folder in the hashcat directory. Doesn't look good...

got me completely stumped, and a web search shows that no one has figured it out. Not 1 syntax shows hashcat using a .hcmask



http://hashcat.net/forum/thread-2532.html

... so we might be dealing with more 'name convention' confusion. At least they got me confused, so everything is normal xD


Edit #5:

what they call a "mask" for hashcat is things like a word list. Not a .hcmask
So it's a "naming the file convention" problem. Anyways it will be easier and faster for you(or anyone) to just go to the store and buy another ATi or nVidia equipped lappy for ocl/cuda, than to try and figure this out lol

[slim76]

sure thing bro..


I've never used hashcat(CPU), only cudaHashcat(GPU). Will edit this post.

EDIT: I don't see a 'mask' folder in the hashcat directory. Doesn't look good...

got me completely stumped, and a web search shows that no one has figured it out. Not 1 syntax shows hashcat using a .hcmask



http://hashcat.net/forum/thread-2532.html

... so we might be dealing with more 'name convention' confusion. At least they got me confused, so everything is normal xD


Edit #5:

what they call a "mask" for hashcat is things like a word list. Not a .hcmask
So it's a "naming the file convention" problem. Anyways it will be easier and faster for you(or anyone) to just go to the store and buy another ATi or nVidia equipped lappy for ocl/cuda, than to try and figure this out lol

I wanted to add hashcat to FrankenScript so people with netbooks and tablets could benefit too.
Cheers for looking into it for me matey.

[Quest]

hello everybody.
just got the script:
got handshakes captured in .cap files. But I can't see them in Available Capture Files list of the Attack Handshake Files menu...

Available Capture Files.
########################



Please input the number of your chosen capture file: 
./FrankenScript2.sh: line 2381: /root/FrankenScript2/Temp_Working_Dirctory/Handshake_Cracking/Handshake_File.txt: No such file or directory
cat: /root/FrankenScript2/Temp_Working_Dirctory/Handshake_Cracking/Chosen_capture_file.txt: No such file or directory

the Handshake files are in Captured_Handshakes/ directory.

Am i missing something?

Hi wn722 (good choice, luv my tp-link wn722n),

don't know what happened there, we missed your post!??

Do you still have a problem with the above quote? Sorry for the delay :S

[slim76]

hello everybody.
just got the script:
got handshakes captured in .cap files. But I can't see them in Available Capture Files list of the Attack Handshake Files menu...

Available Capture Files.
########################



Please input the number of your chosen capture file: 
./FrankenScript2.sh: line 2381: /root/FrankenScript2/Temp_Working_Dirctory/Handshake_Cracking/Handshake_File.txt: No such file or directory
cat: /root/FrankenScript2/Temp_Working_Dirctory/Handshake_Cracking/Chosen_capture_file.txt: No such file or directory

the Handshake files are in Captured_Handshakes/ directory.

Am i missing something?

Sorry I missed your post.
You're not missing anything lol, the problem is due to FrankenScript.
I advise you to update to the latest version, you should be able to find it on the first page or just below the post you made.

[Quest]

*** happened there, did his post just appeared on the last page or am I bugging out?

[slim76]

*** happened there, did his post just appeared on the last page or am I bugging out?

It beats the **** out of me how that happened, all I know is it wasn't there before. LOL

I've changed the handshake capture attack and will be adding a new feature to FrankenScript soon.
It should all be included in the next update. :-)

[Quest]

ok great!

I have my own laundry list whenever you have time, starting with post #139. That's not clear to me at all.