FrankenScript by Slim76 - It Attacks Access Points and .pcap files

[nuroo]

wow major turn of events here.. https://bugs.kali.org/view.php?id=2219&nbn=2#bugnotes




https://www.kali.org/penetration-tes...ck-ng-updates/

+1 new Aircrack-ng is much improved. Just hate that he changed monitor naming though. I cant even test this script on other pc, because of it.

[Quest]

yes Slim will have to re-write everything again I suppose. All good though, and better now than later. I worry abit about massive confusion until K1.1.1 comes out, as some will not see the same things and have different results. Though we inadvertently provided Slim with a practice run with that Wash Scan Results 50 posts episode.

Thanks for the feedback. Did you have any luck with that FS pixie attack? Can you confirm that it works?

[nuroo]

Actually I did not. I got some association errors, from reaver. Against routers that were in range, and just attacked with command line. Could have been my fault. I will double check my process.

Curious to why Frankenstein insist on installing reaver and pixie---- i had latest versions already!! Plus no confirmation to install, Slim luv confirmation?

[Quest]

oh it does not install them, just decompress them in the FrankenScript_Portable. It does not change anything, but avoids the user from installing them if not installed.

Ok thanks for checking that for me because I don't have a pixie vulnerable AP, and therefore cannot really test that attack. Cheers!!

[nuroo]

Oh ok That is brilliant idea. Save user from having to have preinstalled. And insure script has helper apps it needs. +A

Now when script ask if I want to update archive, ill know it only means it's archive copies.

[slim76]

In reaver 1.5.2, only -K1 is necessary. reaver now automatically does -K2,3.............

-K  --pixie-dust=<number>       [1] Run pixiewps with PKE, PKR, E-Hash1, E-Hash2 and E-Nonce (Ralink, Broadcom, Realtek)

no need to have your script execute -K1,2,3 >>> just -K1

In reaver 1.5.2 the -W1 and -W2 options are only for specific brands (belkin and dlink?). In my opinion the possible pins should not be displayed unless user attacking those brands, otherwise confusing.

As of reaver 1.5.2, user still must notice if new pixiewps 1.1 thinks router may be vulnerable to -f option, then try it manually. So that response should showed to user.

##############
If the user decides he wants a spoof/random mac address, does your script also pass the -m option to reaver
ie:
reaver -i mon0 -b 00:11:22:33:44:55:66 -m 11:00:11:00:11:00 -vv -S -N -K1
also in aireplay, the -h option:
aireplay-ng -1 6000 -o 1 -q 10 -e teddy -a 00:11:22:33:44:55:66 -h 11:00:11:00:11:00 mon0
I recommend for mac filtering routers. Reaver will still pass the real mac if above -m not used......

Cheers for the info, i'll be updating the attacks soon.
I left the -W options just incase any other ap's use the same pin generation method, it's a long shot I know but still worth a try.

[slim76]

@ Quest

I'm currently rewriting the wpa attack script, I think you might be happy with this next one if all goes to plan. LOL

[Quest]

I was enjoying that latest version of FS. The new Aircrack-ng, kinda put the brakes on my fun level. The two not being compatible. Still it's for the best, and I'm sure you will bring the creature, also known as Frank, back from the dead,.. again!

RIP mon0. You will be missed

[nuroo]

Not at my computer at the moment. Can Frankenscript declock hide access points using client macs that may be connected during its scanning?

Older version of wifite, by Brian pow on github does it well. I was surprised by how many "hidden routers" it found.

Killer feature, what u guys think......lol adding extra work

[Quest]

oh yes, and that falls right in the information gathering category, so naturally I'm all for it.

[slim76]

I've got FrankenScript working with the new airmon-ng, but I'm having trouble capturing the wps info from the new airodump-ng.
When I manage to solve the airodump issue I'll upload the new version of FrankenScript. :-)

[slim76]

Not at my computer at the moment. Can Frankenscript declock hide access points using client macs that may be connected during its scanning?

Older version of wifite, by Brian pow on github does it well. I was surprised by how many "hidden routers" it found.

Killer feature, what u guys think......lol adding extra work

FrankenScript has 3 different scan functions:
1) iw dev scan
2) wash scan
3) airodump scan.

I could be wrong but doesn't airodump-ng decloak hidden access points automatically.

[smittyrock_1]

I receive an error: No usable WiFi devices were found, please fix the issue before running FrankenScript again. Is this talked about earlier in the threads? If not, what should i do?

[Quest]

I'm experimenting with salt, garlic and besside-ng. What makes it interesting other than being a nasty little monster, is that it come with its own .cap file cleaning "Crawler"

besside-ng-crawler <SearchDir> <CapFileOut>

http://www.aircrack-ng.org/doku.php?id=besside-ng

It's not included in the Aircrack-ng 1.2 though. Have to download Aircrack-ng SVN version.


EDIT: meh it doesn't seem to do anything right.

[Quest]

I receive an error: No usable WiFi devices were found, please fix the issue before running FrankenScript again. Is this talked about earlier in the threads? If not, what should i do?

Correct. The new FS is not ready yet.

OT: Do you have a pixie attack vulnerable router smittyrock?

[nuroo]

I've got FrankenScript working with the new airmon-ng, but I'm having trouble capturing the wps info from the new airodump-ng.
When I manage to solve the airodump issue I'll upload the new version of FrankenScript. :-)

Greet news that FrankenScript supports new aircrack because as u know, Kali officially upgraded its aricrack-ng to the newest version.

@slim
using wash maybe alot easier to parse, especially with -P option. It was intended for use by programmers, scriptwriters, embedded systems, etc., (also great on my netbook)
> wash -i mon0 -P -c1

00:00:00:00:70:2A| 1|-58|1.0|No |marg000000
00:00:00:00:AA:70| 1|-53|1.0|No |TG100000
00:00:00:00:15:00| 1|-58|1.0|No |TG10000
00:00:00:00:B4:7E| 1|-47|1.0|No |Leaf 0000000
00:00:00:00:AF:20| 1|-58|1.0|No |DG00000
00:00:00:00:93:CA| 1|-55|1.0|No |702
00:00:00:00:76:90| 1|-52|1.0|No |DG100000

[slim76]

I receive an error: No usable WiFi devices were found, please fix the issue before running FrankenScript again. Is this talked about earlier in the threads? If not, what should i do?

Can you provide more details.
1) What version of Frankencript are you using.

2) Are you using the new or old airmon-ng?.

3) Are you using kali-linux or a different os?.

[Quest]

Hey Slim!

he probably updated his Kali installation. That's what I'm getting also.

[slim76]

Greet news that FrankenScript supports new aircrack because as u know, Kali officially upgraded its aricrack-ng to the newest version.

@slim
using wash maybe alot easier to parse, especially with -P option. It was intended for use by programmers, scriptwriters, embedded systems, etc., (also great on my netbook)
> wash -i mon0 -P -c1

00:00:00:00:70:2A| 1|-58|1.0|No |marg000000
00:00:00:00:AA:70| 1|-53|1.0|No |TG100000
00:00:00:00:15:00| 1|-58|1.0|No |TG10000
00:00:00:00:B4:7E| 1|-47|1.0|No |Leaf 0000000
00:00:00:00:AF:20| 1|-58|1.0|No |DG00000
00:00:00:00:93:CA| 1|-55|1.0|No |702
00:00:00:00:76:90| 1|-52|1.0|No |DG100000

I've already sorted the wash scan and iw dev scan, I just need to finish the airodump scan.

[Quest]

you know what.. I've been thinking that it might be better for Frank to have its own Aircrack-ng, and run everything internally, independently. Otherwise it will be a huge mess until K1.1.1 comes out, or even way after it has.

That message up there from smittyrock_1, you will get alot of the same.

[slim76]

you know what.. I've been thinking that it might be better for Frank to have its own Aircrack-ng, and run everything internally, independently. Otherwise it will be a huge mess until K1.1.1 comes out, or even way after it has.

That message up there from smittyrock_1, you will get alot of the same.

I've sorted out all those issues already, I just need to finish editing the attacks. :-)

[Quest]

moreover if they make changes upstream (and there will probly be alot of that), boom back to square one, no worki. So if that's what you had in mind also great!!

Also, just a thought for future dev. Considering that many scripts don't work anymore, wouldn't that be a good time to reintroduce Script Launcher? So two Aircrack-ng? See what I mean?

[slim76]

moreover if they make changes upstream (and there will probly be alot of that), boom back to square one, no worki. So if that's what you had in mind also great!!

Also, just a thought for future dev. Considering that many scripts don't work anymore, wouldn't that be a good time to reintroduce Script Launcher? So two Aircrack-ng? See what I mean?

Dude that really doesn't make sense, what's the point of adding a script launcher if most of the scripts don't work anymore. Lol

[Quest]

They don't work because of the new Aircrack-ng. If you can make FS independent by running its own Aircrack-ng, then nothing prevents adding also the older Aircrack-ng, making the now defunct scripts work again. Daya follow me?

[slim76]

They don't work because of the new Aircrack-ng. If you can make FS independent by running its own Aircrack-ng, then nothing prevents adding also the older Aircrack-ng, making the now defunct scripts work again. Daya follow me?

That makes more sense to me now, and I think its actually a good idea too.
Changing things now is going to cause a further delay, so I might finish editing the attacks and then upload it, then I might make the changes

[Quest]

that would be great. You will save yourself alot of work in the long run, and make alot of friends in the process.

[slim76]

that would be great. You will save yourself alot of work in the long run, and make alot of friends in the process.

I don't mind the work really, I actually enjoy it. :-)
Make alot of friends you say LOL, dude you're about the only person that's bothered to reply and help. LOL
Well friends or no friends I'm not bothered lol, I'll add it for you cause you were good enough to help me by leaving feedback. :-)

[slim76]

I don't mind the work really, I actually enjoy it. :-)
Make alot of friends you say LOL, dude you're about the only person that's bothered to reply and help. LOL
Well friends or no friends I'm not bothered lol, I'll add it for you cause you were good enough to help me by leaving feedback. :-)

I'll probably need your help when I add the script launcher and options and such. :-)

I don't know what happend with this post, I was editing the previous post (At least I thought I was) but it created this post??, guess it must have been my error, sorry.

[Quest]

double posting? I never do that myself

That internal Aircrack-ng implementation will also have the quality of making FS time proof. There are alot of changes on the horizon and to take these steps now will prevent future redundant re-writing of what was. All the work is nice, if you enjoy it, but focusing on improvements is even more rewarding and is where the progress is at. Cheers monster maker, and yes, lets roll

[Quest]

EDIT:

So what is a good older Aircrack-ng version to add in FS in addition to the more recent one?

I reinstalled Kali 1.0.7 because I know that everything was fine then. It runs Aircack-ng 1.2 beta3

root@kali:~# aircrack-ng

Aircrack-ng 1.2 beta3 - (C) 2006-2013 Thomas d'Otreppe
http://www.aircrack-ng.org

http://ftp.debian.org/debian/pool/main/a/aircrack-ng/ > aircrack-ng_1.2-0~beta3.orig.tar.gz


The latest Aircrack-ng is here http://www.aircrack-ng.org/ > Sources


Do we all agree on the old version of Aircrack-ng to be added with FS?

[slim76]

EDIT:

So what is a good older Aircrack-ng version to add in FS in addition to the more recent one?

I reinstalled Kali 1.0.7 because I know that everything was fine then. It runs Aircack-ng 1.2 beta3


http://ftp.debian.org/debian/pool/main/a/aircrack-ng/ > aircrack-ng_1.2-0~beta3.orig.tar.gz


The latest Aircrack-ng is here http://www.aircrack-ng.org/ > Sources


Do we all agree on the old version of Aircrack-ng to be added with FS?

I'm rewriting most of FrankenScript again, if all goes well it should contain the following:

svn version of aircrack and aircrack-ng-1.2-rc1 (Installed in FrankenScript), and whatever version the person has installed in kali.
airmon-ng (monX) and airmon-zc (wlanXmon), both will be installed to FrankenScript, I might do it so the user can choose which one to use.
Bully, pixiewps, reaver-1.3, reaver-1.4, reaver-wps-fork-read-only, reaver-wps-fork-t6x, all will be installed to FrankenScript.
DLink.py, easybox_wps.py, WPSpin.py, WPSPIN1.5_wps.pin.generator, all pingens will be installed to FrankenScript.
Dependencies required for building reaver and other required tools, .deb files will already be in the FrankenScript package so no need to download them.
Scan results will be displayed in white, but if the passkey for the network has previously been recovered the result will be displayed in red.
FrankenScript will be able to attack wep, wpa/wpa2, and wps enabled access points.
And as requested it should contain a script launcher and options for checking handshakes in capture files.

I think i've covered most of it lol, and things could change too. lol

[Quest]

sounds like an excellent plan

I'm experimenting with airmon-ng, because it is the 'problem', not the rest. So if I replace the new airmon-ng with the old one...

So instead of the whole aircrack-ng-1.2-rc1, all that is really needed is the old airmon-ng included with FS. Though I'm not sure hows that going to work. So the original idea of including Aircrack-ng with FS might be the easiest and the best solution. So don't change your plan. I will report back.


EDIT:

Ok, doing an update on a Kali live usb is not doable, so I cannot test the above. They wait too long to come out with an updated version, making the updates download and install 3hrs long. Let me know if you want me to test anything.

[Quest]

just trowing ingredients in the pot.

There might be discrepancies between installations when running certain programs. Some installations are updated running the new -ng, others that are not updated running the old -ng.

If FS runs its own -ng internally for everything it does, that will prevent such discrepancies.

Then maybe it's possible to copy and rename the old airmon-ng, to airmon-ngRC1 into that same directory, so that there will be two. One airmon-ng and one airmon-ngRC1

Everything that needs mon0 will use airmon-ngRC1

The rest will use the new airmon-ng

[slim76]

just trowing ingredients in the pot.

There might be discrepancies between installations when running certain programs. Some installations are updated running the new -ng, others that are not updated running the old -ng.

If FS runs its own -ng internally for everything it does, that will prevent such discrepancies.

Then maybe it's possible to copy and rename the old airmon-ng, to airmon-ngRC1 into that same directory, so that there will be two. One airmon-ng and one airmon-ngRC1

Everything that needs mon0 will use airmon-ngRC1

The rest will use the new airmon-ng

Lol, I did already say FrankenScript will be able to use both versions of airmon, and that it will use the old and new aircrack tool and such. Lol

[Quest]

and do you think that two (2) Aircrack-ng are necessary? All that is needed is 2 airmon. Correct?

[slim76]

and do you think that two (2) Aircrack-ng are necessary? All that is needed is 2 airmon. Correct?

Actually, I think only the old version of airmon is all thats needed. ;-)
I'll probably still add both versions of airmon and two versions of some of the aircrack tools too. LOL
I think its nice to have the choice as well as simplicity. ;-)

[Quest]

Actually, I think only the old version of airmon is all thats needed. ;-)

that's the potential problem with all this. Anjelina has Kali 1.1.0a. Raquel also has the same version but updated, and therefore they both run different version of Aircrack-ng, thus two different airmon. If anything pertaining to FS is run outside of FrankenscriptPortable, then it will work for some, not for others. Moreover, if they makes changes upstream (like -ng RC3), then stuff' not gonna work. See the problem there?

I'll probably still add both versions of airmon and two versions of some of the aircrack tools too. LOL
I think its nice to have the choice as well as simplicity. ;-)

agreed

[slim76]

that's the potential problem with all this. Anjelina has Kali 1.1.0a. Raquel also has the same version but updated, and therefore they both run different version of Aircrack-ng, thus two different airmon. If anything pertaining to FS is run outside of FrankenscriptPortable, then it will work for some, not for others. Moreover, if they makes changes upstream (like -ng RC3), then stuff' not gonna work. See the problem there?

agreed

Trust me it will work ok, I'm testing it on two different setups while I'm writing it.

[Quest]

looks like you will have more 'testers' than usual with that new version

Let me know when would be a good time for you to review the colors. Nothing wrong with them, just thought that certain key colors should be keep for situation awareness. Positive | Negative | Warning

[Quest]

Screenshot from 2015-05-11 12:27:52.jpg oh I see it now. Better late than never

Hey guys when i go to try an attack,it tells me this.

/root/FrankenScript_Portable/Scripts/attack_wps.sh: line 504: /root/FrankenScript_Portable/Reaver/: Is a directory


also when it says "input the ammount of deauth requests to be sent" i press any number and enter and it dont do anything it keeps flashing and not sending any deauths at all,dont know why? any help would be appreciated

Slim, on a fresh K1.1.0a i386 Live USB, I get the same as memasonman.

Reaver.t6x + Pixiewps Fixed Attack Arguments:
-i mon0 -c 6 -b 00:23:69:XX:XX:XX -a -P -K 1 -vv
/root/FrankenScript_Portable/Scripts/attack_wps.sh: line 464: /root/FrankenScript_Portable/Reaver/: Is a directory

The reavers are not in the Reaver folder for some reason. When starting FS, it detects that the reavers are not there and 'installs' them again, everytime it is launched, yet they never make it in the Reaver folder (see pic).

reaver.fork.t6x is missing, it will be reinstalled now.

checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking for pcap_open_live in -lpcap... no
error: pcap library not found!
make: *** No targets specified and no makefile found. Stop.
cp: cannot stat `reaver': No such file or directory

[slim76]

looks like you will have more 'testers' than usual with that new version

Let me know when would be a good time for you to review the colors. Nothing wrong with them, just thought that certain key colors should be keep for situation awareness. Positive | Negative | Warning

That's a good idea, but I've tried that already. lol
I've noticed that some of the colours don't show to good on some laptop screens and some tv's, I found the colours I use now are the most visable.
I'm straining my eyes right now just looking at the yellow warning. LOL

[OsBinHD]

so how to use them now? last version was install deb and run fs3... before was .sh script...so how now run them? extracted trying to run them out:

fu3king@T3ype:~$ '/home/fu3king/FrankenScript.sh'
/home/fu3king/FrankenScript.sh: line 28: airmon-ng: command not found
No usable WiFi devices were found, please fix the issue before running FrankenScript again.

Press [Enter] to exit FrankenScript.

[slim76]

so how to use them now? last version was install deb and run fs3... before was .sh script...so how now run them? extracted trying to run them out:

fu3king@T3ype:~$ '/home/fu3king/FrankenScript.sh'
/home/fu3king/FrankenScript.sh: line 28: airmon-ng: command not found
No usable WiFi devices were found, please fix the issue before running FrankenScript again.

Press [Enter] to exit FrankenScript.

It sounds like you've updated aircrack and are using airmon-zc.
The version of FrankenScript you're using doesn't work with airmon-zc.
I'm currently rewriting FrankenScript, airmon-ng & airmon-zc & airodump (New version) are supported, I just have to rewrite the attacks now and i'll upload it when finished.

[jar]

slim76,

Sorry I been away for sometime, I initially ran the earlier versions and was interested in cuda/Hashcat with FS. I dropped off the bandwagon because my Mother was ill and eventually passed away this past November. But I am back to learning Kali, regaining focus and I have FS in my sights again.

I am running Kali 1.1.0 and have the latest FrankenScript_Portable.3rd.May.2015.tar.gz extracted in root.

However like Quest I am also getting the following errors:

root@kali:~/FrankenScript# ./FrankenScript.sh

reaver.fork is missing, it will be reinstalled now.

checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking for pcap_open_live in -lpcap... no
error: pcap library not found!
make: *** No targets specified and no makefile found.  Stop.
cp: cannot stat `reaver': No such file or directory

reaver.fork.t6x is missing, it will be reinstalled now.

checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking for pcap_open_live in -lpcap... no
error: pcap library not found!
make: *** No targets specified and no makefile found.  Stop.
cp: cannot stat `reaver': No such file or directory

reaver v1.3 is missing, it will be reinstalled now.

checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking for pcap_open_live in -lpcap... no
error: pcap library not found!
make: *** No targets specified and no makefile found.  Stop.
cp: cannot stat `reaver': No such file or directory

reaver v1.4 is missing, it will be reinstalled now.

checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking for pcap_open_live in -lpcap... no
error: pcap library not found!
make: *** No targets specified and no makefile found.  Stop.
cp: cannot stat `reaver': No such file or directory

Any suggestions on how to solve this?

I am going to install reaver-wps-fork from t6x, Pixiewps and a few other new tools later this morning.

jar

[Quest]

Hi jar!

“Don't cry because it's over, smile because it happened.”

― Dr. Seuss


Best thing to do is wait for the next FS, but If you really want to test that latest FS, then do it on a unupdated kali 1.1.0 / a. It won't work on the updated kali version (aircrack-ng RC1 vs aircrack-ng RC2).

I think that the reaver problem might be because of the dependencies? Try to install them first.

apt-get install libsqlite3-dev && apt-get install libpcap0.8-dev

[jar]

Hi jar!

“Don't cry because it's over, smile because it happened.”

― Dr. Seuss


Best thing to do is wait for the next FS, but If you really want to test that latest FS, then do it on a unupdated kali 1.1.0 / a. It won't work on the updated kali version (aircrack-ng RC1 vs aircrack-ng RC2).

I think that the reaver problem might be because of the dependencies? Try to install them first.

apt-get install libsqlite3-dev && apt-get install libpcap0.8-dev

Nice quote! Thanks.

Shortly after I made the post and I realized what was happening and corrected the issue given the error message:

 error: pcap library not found! .

Now I have a problem with:

 No usable WiFi devices were found, please fix the issue before running FrankenScript again.

Press [Enter] to exit FrankenScript.

The problem appears to with the sed commands & the latest version of Kali/Aircrack (Goodbye mon0, hello wlan0mon!). So I don't really want to wait for the new version of FS so I am tinkering with the FS and slowly dissecting it. Whats the worst that can happen

[slim76]

@ jar

I'm sorry for your loss mate.

There were to many problems with the previous versions of FrankenScript so currently rewriting it.
I have a lot going on at the moment and haven't had much time to write the script.
I've already rewritten most of FrankenScript, I just need to finish writing the attacks again and then the new version of FrankenScript will be finished.
I'm going to be very busy for the next few weeks so I cant say when it will be fininshed, sorry.

[Quest]

http://adaywithtape.blogspot.com/

"Basically I thought it would be cool to have some form of alert system based on mobiles so I could keep track of the coming and goings around the house."

[Quest]

*knocks on door* ready to roll bro?

trying to unconfuse myself with the new 2.0 interface here. I'll be running the i386 version on a clean, unmodified, sterilized, exorcised, normal Persistent LiveUSB.

[theoctavist]

Nice quote! Thanks.

Shortly after I made the post and I realized what was happening and corrected the issue given the error message:

 error: pcap library not found! .

Now I have a problem with:

 No usable WiFi devices were found, please fix the issue before running FrankenScript again.

Press [Enter] to exit FrankenScript.

The problem appears to with the sed commands & the latest version of Kali/Aircrack (Goodbye mon0, hello wlan0mon!). So I don't really want to wait for the new version of FS so I am tinkering with the FS and slowly dissecting it. Whats the worst that can happen

im having this problem too(not with FS but with the new reaver fork). ..I Dont know how to correct it