Refactored & implemented targetting subroutines.
The majority of the algorithms are enhanced migrations from fluxion 3. These new subroutines are modular and stand independent from the script.
This commit is contained in:
Matias Barcenas
parent
0dd1e084c8
commit
7987e28b56
193
fluxion
193
fluxion
|
|
@ -811,8 +811,201 @@ function fluxion_get_interface() {
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
# ============== < Fluxion Target Subroutines > ============== #
|
||||||
|
# Parameters: interface [ channel(s) [ band(s) ] ]
|
||||||
|
# ------------------------------------------------------------ #
|
||||||
|
# Return 1: Missing monitor interface.
|
||||||
|
# Return 2: Xterm failed to start airmon-ng.
|
||||||
|
# Return 3: Invalid capture file was generated.
|
||||||
|
# Return 4: No candidates were detected.
|
||||||
|
function fluxion_get_target_candidates() {
|
||||||
|
# Assure a valid wireless interface for scanning was given.
|
||||||
|
if [ ! "$1" ] || ! interface_is_wireless "$1"; then return 1; fi
|
||||||
|
|
||||||
|
echo -e "$FLUXIONVLine $FLUXIONStartingScannerNotice"
|
||||||
|
echo -e "$FLUXIONVLine $FLUXIONStartingScannerTip"
|
||||||
|
|
||||||
|
# Assure all previous scan results have been cleared.
|
||||||
|
sandbox_remove_workfile "$FLUXIONWorkspacePath/dump*"
|
||||||
|
|
||||||
|
#if [ "$FLUXIONAuto" ]; then
|
||||||
|
# sleep 30 && killall xterm &
|
||||||
|
#fi
|
||||||
|
|
||||||
|
# Begin scanner and output all results to "dump-01.csv."
|
||||||
|
if ! xterm -title "$FLUXIONScannerHeader" $TOPLEFTBIG -bg "#000000" -fg "#FFFFFF" -e "airodump-ng -Mat WPA "${2:+"--channel $2"}" "${3:+"--band $3"}" -w \"$FLUXIONWorkspacePath/dump\" $1" 2> $FLUXIONOutputDevice; then
|
||||||
|
echo -e "$FLUXIONVLine$CRed $FLUXIONGeneralXTermFailureError"
|
||||||
|
sleep 5
|
||||||
|
return 2
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Sanity check the capture files generated by the scanner.
|
||||||
|
# If the file doesn't exist, or if it's empty, abort immediately.
|
||||||
|
if [ ! -f "$FLUXIONWorkspacePath/dump-01.csv" -o \
|
||||||
|
! -s "$FLUXIONWorkspacePath/dump-01.csv" ]; then
|
||||||
|
sandbox_remove_workfile "$FLUXIONWorkspacePath/dump*"
|
||||||
|
return 3
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Syntheize scan operation results from output file "dump-01.csv."
|
||||||
|
echo -e "$FLUXIONVLine $FLUXIONPreparingScannerResultsNotice"
|
||||||
|
# WARNING: The code below may break with different version of airmon-ng.
|
||||||
|
# The times matching operator "{n}" isn't supported by mawk (alias awk).
|
||||||
|
# readarray FLUXIONTargetCandidates < <(gawk -F, 'NF==15 && $1~/([A-F0-9]{2}:){5}[A-F0-9]{2}/ {print $0}' $FLUXIONWorkspacePath/dump-01.csv)
|
||||||
|
# readarray FLUXIONTargetCandidatesClients < <(gawk -F, 'NF==7 && $1~/([A-F0-9]{2}:){5}[A-F0-9]{2}/ {print $0}' $FLUXIONWorkspacePath/dump-01.csv)
|
||||||
|
readarray FLUXIONTargetCandidates < <(awk -F, 'NF==15 && length($1)==17 && $1~/([A-F0-9][A-F0-9]:)+[A-F0-9][A-F0-9]/ {print $0}' "$FLUXIONWorkspacePath/dump-01.csv")
|
||||||
|
readarray FLUXIONTargetCandidatesClients < <(awk -F, 'NF==7 && length($1)==17 && $1~/([A-F0-9][A-F0-9]:)+[A-F0-9][A-F0-9]/ {print $0}' "$FLUXIONWorkspacePath/dump-01.csv")
|
||||||
|
|
||||||
|
# Cleanup the workspace to prevent potential bugs/conflicts.
|
||||||
|
sandbox_remove_workfile "$FLUXIONWorkspacePath/dump*"
|
||||||
|
|
||||||
|
if [ ${#FLUXIONTargetCandidates[@]} -eq 0 ]; then
|
||||||
|
echo -e "$FLUXIONVLine $FLUXIONScannerDetectedNothingNotice"
|
||||||
|
sleep 3
|
||||||
|
return 4
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
function fluxion_get_target() {
|
||||||
|
# Assure a valid wireless interface for scanning was given.
|
||||||
|
if [ ! "$1" ] || ! interface_is_wireless "$1"; then return 1; fi
|
||||||
|
|
||||||
|
local choices=( \
|
||||||
|
"$FLUXIONScannerChannelOptionAll (2.4GHz)" \
|
||||||
|
"$FLUXIONScannerChannelOptionAll (5GHz)" \
|
||||||
|
"$FLUXIONScannerChannelOptionAll (2.4GHz & 5Ghz)" \
|
||||||
|
"$FLUXIONScannerChannelOptionSpecific" "$FLUXIONGeneralBackOption"
|
||||||
|
)
|
||||||
|
|
||||||
|
io_query_choice "$FLUXIONScannerChannelQuery" choices[@]
|
||||||
|
|
||||||
|
echo
|
||||||
|
|
||||||
|
case "$IOQueryChoice" in
|
||||||
|
"$FLUXIONScannerChannelOptionAll (2.4GHz)")
|
||||||
|
fluxion_get_target_candidates $interface "" "bg";;
|
||||||
|
|
||||||
|
"$FLUXIONScannerChannelOptionAll (5GHz)")
|
||||||
|
fluxion_get_target_candidates $interface "" "a";;
|
||||||
|
|
||||||
|
"$FLUXIONScannerChannelOptionAll (2.4GHz & 5Ghz)")
|
||||||
|
fluxion_get_target_candidates $interface "" "abg";;
|
||||||
|
|
||||||
|
"$FLUXIONScannerChannelOptionSpecific")
|
||||||
|
fluxion_header
|
||||||
|
|
||||||
|
echo -e "$FLUXIONVLine $FLUXIONScannerChannelQuery"
|
||||||
|
echo
|
||||||
|
echo -e " $FLUXIONScannerChannelSingleTip ${CBlu}6$CClr "
|
||||||
|
echo -e " $FLUXIONScannerChannelMiltipleTip ${CBlu}1-5$CClr "
|
||||||
|
echo -e " $FLUXIONScannerChannelMiltipleTip ${CBlu}1,2,5-7,11$CClr "
|
||||||
|
echo
|
||||||
|
echo -ne "$FLUXIONPrompt"
|
||||||
|
|
||||||
|
local channels
|
||||||
|
read channels
|
||||||
|
|
||||||
|
echo
|
||||||
|
|
||||||
|
fluxion_get_target_candidates $interface $channels;;
|
||||||
|
|
||||||
|
"$FLUXIONGeneralBackOption")
|
||||||
|
return -1;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
# Abort if errors occured while searching for candidates.
|
||||||
|
if [ $? -ne 0 ]; then return 2; fi
|
||||||
|
|
||||||
|
local candidatesMAC=()
|
||||||
|
local candidatesClientsCount=()
|
||||||
|
local candidatesChannel=()
|
||||||
|
local candidatesSecurity=()
|
||||||
|
local candidatesSignal=()
|
||||||
|
local candidatesPower=()
|
||||||
|
local candidatesESSID=()
|
||||||
|
local candidatesColor=()
|
||||||
|
|
||||||
|
# Gather information from all the candidates detected.
|
||||||
|
# TODO: Clean up this for loop using a cleaner algorithm.
|
||||||
|
# Maybe try using array appending & [-1] for last elements.
|
||||||
|
for candidateAPInfo in "${candidates[@]}"; do
|
||||||
|
# Strip candidate info from any extraneous spaces after commas.
|
||||||
|
candidateAPInfo=$(echo "$candidateAPInfo" | sed -r "s/,\s*/,/g")
|
||||||
|
|
||||||
|
local i=${#candidatesMAC[@]}
|
||||||
|
|
||||||
|
candidatesMAC[i]=$(echo "$candidateAPInfo" | cut -d , -f 1)
|
||||||
|
candidatesClientsCount[i]=$(echo "${candidatesClients[@]}" | grep -c "${candidatesMAC[i]}")
|
||||||
|
candidatesChannel[i]=$(echo "$candidateAPInfo" | cut -d , -f 4)
|
||||||
|
candidatesSecurity[i]=$(echo "$candidateAPInfo" | cut -d , -f 6)
|
||||||
|
candidatesPower[i]=$(echo "$candidateAPInfo" | cut -d , -f 9)
|
||||||
|
candidatesColor[i]=$([ ${candidatesClientsCount[i]} -gt 0 ] && echo $CGrn || echo $CClr)
|
||||||
|
|
||||||
|
# Parse any non-ascii characters by letting bash handle them.
|
||||||
|
# Just escape all single quotes in ESSID and let bash's $'...' handle it.
|
||||||
|
local sanitizedESSID=$(echo "${candidateAPInfo//\'/\\\'}" | cut -d , -f 14)
|
||||||
|
candidatesESSID[i]=$(eval "echo \$'$sanitizedESSID'")
|
||||||
|
|
||||||
|
local power=${candidatesPower[i]}
|
||||||
|
if [ $power -eq -1 ]; then
|
||||||
|
# airodump-ng's man page says -1 means unsupported value.
|
||||||
|
candidatesQuality[i]="??"
|
||||||
|
elif [ $power -le $FLUXIONNoiseFloor ]; then
|
||||||
|
candidatesQuality[i]=0
|
||||||
|
elif [ $power -gt $FLUXIONNoiseCeiling ]; then
|
||||||
|
candidatesQuality[i]=100
|
||||||
|
else
|
||||||
|
# Bash doesn't support floating point division, so I gotta work around it...
|
||||||
|
# The function is Q = ((P - F) / (C - F)); Q - quality, P - power, F - floor, C - Ceiling.
|
||||||
|
candidatesQuality[i]=$(((${candidatesPower[i]} * 10 - $FLUXIONNoiseFloor * 10) / (($FLUXIONNoiseCeiling - $FLUXIONNoiseFloor) / 10)))
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
format_center_literals "WIFI LIST"
|
||||||
|
local -r headerTitle="$FormatCenterLiterals\n\n"
|
||||||
|
|
||||||
|
format_apply_autosize "$CRed[$CSYel ** $CClr$CRed]$CClr %-*.*s %4s %3s %3s %2s %-8.8s %18s\n"
|
||||||
|
local -r headerFields=$(printf "$FormatApplyAutosize" "ESSID" "QLTY" "PWR" "STA" "CH" "SECURITY" "BSSID")
|
||||||
|
|
||||||
|
format_apply_autosize "$CRed[$CSYel%03d$CClr$CRed]%b %-*.*s %3s%% %3s %3d %2s %-8.8s %18s\n"
|
||||||
|
io_query_format_fields "$headerTitle$headerFields" "$FormatApplyAutosize" \
|
||||||
|
candidatesColor[@] \
|
||||||
|
candidatesESSID[@] \
|
||||||
|
candidatesQuality[@] \
|
||||||
|
candidatesPower[@] \
|
||||||
|
candidatesClientsCount[@] \
|
||||||
|
candidatesChannel[@] \
|
||||||
|
candidatesSecurity[@] \
|
||||||
|
candidatesMAC[@]
|
||||||
|
|
||||||
|
echo
|
||||||
|
|
||||||
|
FLUXIONGetTargetMAC=${IOQueryFormatFields[7]}
|
||||||
|
FLUXIONGetTargetSSID=${IOQueryFormatFields[1]}
|
||||||
|
FLUXIONGetTargetChannel=${IOQueryFormatFields[5]}
|
||||||
|
|
||||||
|
FLUXIONGetTargetEncryption=${IOQueryFormatFields[6]}
|
||||||
|
|
||||||
|
FLUXIONGetTargetMakerID=${APTargetMAC:0:8}
|
||||||
|
FLUXIONGetTargetMaker=$(
|
||||||
|
macchanger -l | grep ${FLUXIONGetTargetMakerID,,} | cut -d ' ' -f 5-
|
||||||
|
)
|
||||||
|
|
||||||
|
# Sanitize network ESSID to make it safe for manipulation.
|
||||||
|
# Notice: Why remove these? Some smartass might decide to name their
|
||||||
|
# network "; rm -rf / ;". If the string isn't sanitized accidentally
|
||||||
|
# shit'll hit the fan and we'll have an extremly distressed user.
|
||||||
|
# Replacing ' ', '/', '.', '~', '\' with '_'
|
||||||
|
FLUXIONGetTargetSSIDClean=$(
|
||||||
|
echo "$FLUXIONGetTargetSSID" | sed -r 's/( |\/|\.|\~|\\)+/_/g'
|
||||||
|
)
|
||||||
|
|
||||||
|
# We'll change a single hex digit from the target AP's MAC address.
|
||||||
|
# This new MAC address will be used as the rogue AP's MAC address.
|
||||||
|
local -r rogueMACHex=$(printf %02X $((0x${APTargetMAC:13:1} + 1)))
|
||||||
|
FLUXIONGetTargetRogueMAC="${FLUXIONGetTargetMAC::13}${rogueMACHex:1:1}${FLUXIONGetTargetRogueMAC:14:4}"
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue