cowpatty fixup update

This commit is contained in:
Zero_Chaos 2009-07-16 19:50:12 +00:00
parent 9505af6109
commit 5bbeacedf9
3 changed files with 274 additions and 0 deletions

View file

@ -1,6 +1,7 @@
AUX cowpatty-4.3-fixup.patch 7292 RMD160 49f6a15b05c71abc468741cffa332a9566c03122 SHA1 79e7018a2d23c87f48097b64f793122c08f1efd4 SHA256 a3d681d5076bd99cf2430370cc1e8e20a548804d22f8af94fd996784d40f37ce
AUX cowpatty-4.3-fixup2.patch 7550 RMD160 7b8bbb2266b69cf12290ac825f06efaf59b7c39c SHA1 0a42824828f3a91bb8a072b7210d9015205c096a SHA256 a5f1ea5429afd3a6cfc3509fdc564490f85f006258d11c5dc8b515d9490524e2
AUX cowpatty-4.3-hashfix.patch 518 RMD160 7056eb376306bd086e7af8ca63f60799e5630cbf SHA1 10ee4c3796664c3f0a421e5f4901086d5985fd27 SHA256 a32d8dc367d858dda7bf557a9c01a5b9509aad04f4d0491100a1e42fdf749c72
AUX cowpatty-4.6-fixup11.patch 8341 RMD160 f80caffa3b12771ce3f9e8fa48a139d0054c8efd SHA1 e3e54d6d4c9829c7fac2e0731674a71a0e7eacf4 SHA256 0239bd38ba6d1f7351af3951068c73333cd6d4c420b3783120b90a75f643132f
AUX cowpatty-4.6-fixup2.patch 1846 RMD160 882109982359a467a6ba1ed1a4e2c7e9c5473473 SHA1 22b5e84e4f5abf683dbf2d0a1082ccf22d9c5510 SHA256 714742a52f700b4b52e0a8415c42987b23ada6cf2876ccfc4036d396e1366edc
AUX cowpatty-4.6-fixup3.patch 3641 RMD160 4b78b38536af36a18cc96873fd9edf4131bd49a3 SHA1 eab2976b945347253770b29578a476baf58dc464 SHA256 453a75b7edf1cae2ede2ff1801fe000df30b96da063914dc01189551d5442008
AUX cowpatty-4.6-fixup9.patch 8560 RMD160 1066792d663c680fc778c6934db4132fe3ff536c SHA1 4115f0a981d5ff5049eec804fcc2cd3942550b0f SHA256 b190454f2e021b18d2d42d082adaf7c45466b71efc2baa39350540b33f744327
@ -11,4 +12,5 @@ EBUILD cowpatty-4.3-r2.ebuild 729 RMD160 3b379da2de6b216ab9cd98827e0e28a8ce2ed13
EBUILD cowpatty-4.3.ebuild 600 RMD160 041f724b29d10b2c9bd6e2fc95f03b8aa5f8f318 SHA1 01c8e2a9459dc8eefbf753c136072dc34de72b1d SHA256 9bab575f48478186ab885d1b6e312b7fca2c470d082b8d7210d055ee2e3d9af3
EBUILD cowpatty-4.6-r1.ebuild 682 RMD160 d519c5c36471bcf0bdd021646c77e41190cd689c SHA1 819f545eae2eba246a4ac3ff1e77bf0e5b7f785b SHA256 c7de957cb0d933058de2844abd2d2898d9d10a48d3fc337e4081727509bf9c4d
EBUILD cowpatty-4.6-r2.ebuild 682 RMD160 d519c5c36471bcf0bdd021646c77e41190cd689c SHA1 819f545eae2eba246a4ac3ff1e77bf0e5b7f785b SHA256 c7de957cb0d933058de2844abd2d2898d9d10a48d3fc337e4081727509bf9c4d
EBUILD cowpatty-4.6-r3.ebuild 682 RMD160 d519c5c36471bcf0bdd021646c77e41190cd689c SHA1 819f545eae2eba246a4ac3ff1e77bf0e5b7f785b SHA256 c7de957cb0d933058de2844abd2d2898d9d10a48d3fc337e4081727509bf9c4d
EBUILD cowpatty-4.6.ebuild 682 RMD160 e3d5b01a48ba88ce8ba81376894ee18a134f45fe SHA1 dfd82cb37ba84dd61f3e1471155fdf25638b6156 SHA256 fb1b01d7bb9c7a5602611811277c6d4590581210de055251a5e43c6a0e5b1f82

View file

@ -0,0 +1,27 @@
# Copyright 1999-2008 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: $
DESCRIPTION="WLAN tools for bruteforcing 802.11 WPA/WPA2 keys"
HOMEPAGE="http://www.willhackforsushi.com/Cowpatty.html"
SRC_URI="http://www.willhackforsushi.com/code/${PN}/${PV}/${P}.tgz"
inherit eutils
LICENSE="GPL-2"
SLOT="0"
KEYWORDS="amd64 x86"
IUSE=""
DEPEND="dev-libs/openssl
net-libs/libpcap"
RDEPEND="${DEPEND}"
src_compile() {
epatch ${FILESDIR}/cowpatty-4.6-fixup3.patch
emake -j1 || die "emake failed"
}
src_install() {
dobin cowpatty genpmk || die "dobin failed"
dodoc AUTHORS CHANGELOG FAQ INSTALL README TODO dict *.dump
}

View file

@ -0,0 +1,245 @@
diff -uNr cowpatty-4.6/cowpatty.c cowpatty-4.6-fixup11/cowpatty.c
--- cowpatty-4.6/cowpatty.c 2009-07-03 08:15:50.000000000 -0700
+++ cowpatty-4.6-fixup11/cowpatty.c 2009-07-16 12:39:44.220822618 -0700
@@ -94,8 +94,7 @@
"\t-d \tHash file (genpmk)\n"
"\t-r \tPacket capture file\n"
"\t-s \tNetwork SSID (enclose in quotes if SSID includes spaces)\n"
- "\t-2 \tUse frames 1 and 2 or 2 and 3 for key attack (nonstrict mode)\n"
- "\t-c \tCheck for valid 4-way frames, does not crack\n"
+ "\t-c \tCheck for valid 4-way frames, does not crack\n"
"\t-h \tPrint this help information and exit\n"
"\t-v \tPrint verbose information (more -v for more verbosity)\n"
"\t-V \tPrint program version and exit\n" "\n");
@@ -151,7 +150,7 @@
int c;
- while ((c = getopt(argc, argv, "f:r:s:d:c2nhvV")) != EOF) {
+ while ((c = getopt(argc, argv, "f:r:s:d:cnhvV")) != EOF) {
switch (c) {
case 'f':
strncpy(opt->dictfile, optarg, sizeof(opt->dictfile));
@@ -166,9 +165,6 @@
strncpy(opt->hashfile, optarg, sizeof(opt->hashfile));
break;
case 'n':
- case '2':
- opt->nonstrict++;
- break;
case 'c':
opt->checkonly++;
break;
@@ -435,21 +431,11 @@
cdata->ver = key_info & WPA_KEY_INFO_TYPE_MASK;
index = key_info & WPA_KEY_INFO_KEY_INDEX_MASK;
- if (opt->nonstrict == 0) {
-
- /* Check for EAPOL version 1, type EAPOL-Key */
- if (dot1xhdr->version != 1 || dot1xhdr->type != 3) {
- return;
- }
-
- } else {
-
- /* Check for type EAPOL-Key */
- if (dot1xhdr->type != 3) {
- return;
- }
-
+ /* Check for type EAPOL-Key */
+ if (dot1xhdr->type != 3) {
+ return;
}
+
if (cdata->ver != WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 &&
cdata->ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
return;
@@ -457,12 +443,12 @@
if (cdata->ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4) {
/* Check for WPA key, and pairwise key type */
- if (eapolkeyhdr->type != 254 ||
+ if ((eapolkeyhdr->type != 2 && eapolkeyhdr->type != 254) ||
(key_info & WPA_KEY_INFO_KEY_TYPE) == 0) {
return;
}
} else if (cdata->ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
- if (eapolkeyhdr->type != 2 ||
+ if ((eapolkeyhdr->type != 2 && eapolkeyhdr->type != 254) ||
(key_info & WPA_KEY_INFO_KEY_TYPE) == 0) {
return;
}
@@ -480,6 +466,9 @@
memcpy(cdata->snonce, eapolkeyhdr->key_nonce,
sizeof(cdata->snonce));
cdata->snonceset = 1;
+ memcpy(cdata->replay_counter1,
+ eapolkeyhdr->replay_counter, 8);
+ cdata->replay_counter1[7] = cdata->replay_counter1[7] + 1;
/* Check for frame 3 of the 4-way handshake */
} else if ((key_info & WPA_KEY_INFO_MIC)
@@ -497,14 +486,16 @@
cdata->anonceset = 1;
/* We save the replay counter value in the 3rd frame to match
against the 4th frame of the four-way handshake */
- memcpy(cdata->replay_counter,
+ memcpy(cdata->replay_counter2,
eapolkeyhdr->replay_counter, 8);
/* Check for frame 4 of the four-way handshake */
} else if ((key_info & WPA_KEY_INFO_MIC)
&& (key_info & WPA_KEY_INFO_ACK) == 0
&& (key_info & WPA_KEY_INFO_INSTALL) == 0
- && (memcmp (cdata->replay_counter,
+ && (memcmp (cdata->replay_counter1,
+ cdata->replay_counter2, 8) == 0)
+ && (memcmp (cdata->replay_counter2,
eapolkeyhdr->replay_counter, 8) == 0)) {
memcpy(cdata->keymic, eapolkeyhdr->key_mic,
@@ -514,6 +505,7 @@
cdata->keymicset = 1;
cdata->eapolframeset = 1;
}
+
} else {
/* Check for frame 1 of the 4-way handshake */
@@ -524,12 +516,19 @@
memcpy(cdata->anonce, eapolkeyhdr->key_nonce,
sizeof(cdata->anonce));
cdata->anonceset = 1;
-
- /* Check for frame 2 of the 4-way handshake */
+ memcpy(cdata->replay_counter1,
+ eapolkeyhdr->replay_counter, 8);
+
+ /* Check for frame 2 or 4 of the 4-way handshake */
} else if ((key_info & WPA_KEY_INFO_MIC)
&& (key_info & WPA_KEY_INFO_INSTALL) == 0
&& (key_info & WPA_KEY_INFO_ACK) == 0
- && eapolkeyhdr->key_data_length > 0) {
+ && ((memcmp (cdata->replay_counter1,
+ eapolkeyhdr->replay_counter, 8) == 0)
+ || (memcmp (cdata->replay_counter2,
+ cdata->replay_counter3, 8) == 0)
+ || (memcmp (cdata->replay_counter3,
+ eapolkeyhdr->replay_counter, 8) == 0))) {
cdata->eapolframe_size = ( packet[capdata->dot1x_offset + 2] << 8 )
+ packet[capdata->dot1x_offset + 3] + 4;
@@ -554,8 +553,7 @@
cdata->eapolframe_size);
cdata->eapolframeset = 1;
-
- /* Check for frame 3 of the 4-way handshake */
+ /* Check for frame 3 of the 4-way handshake */
} else if ((key_info & WPA_KEY_INFO_MIC)
&& (key_info & WPA_KEY_INFO_ACK)
&& (key_info & WPA_KEY_INFO_INSTALL)) {
@@ -563,13 +561,34 @@
memcpy(cdata->anonce, eapolkeyhdr->key_nonce,
sizeof(cdata->anonce));
cdata->anonceset = 1;
- }
+ /* We save the replay counter value in the 3rd frame to match
+ against the 4th frame of the four-way handshake */
+ memcpy(cdata->replay_counter3,
+ eapolkeyhdr->replay_counter, 8);
+ memcpy(cdata->replay_counter2,
+ eapolkeyhdr->replay_counter, 8);
+ cdata->replay_counter2[7] = cdata->replay_counter2[7] + 1;
+
+ }
+
}
}
void dump_all_fields(struct crack_data cdata, struct user_opt *opt)
{
+ printf("replay_counter1 is:");
+ lamont_hdump(cdata.replay_counter1, 8);
+ printf("\n");
+
+ printf("replay_counter2 is:");
+ lamont_hdump(cdata.replay_counter2, 8);
+ printf("\n");
+
+ printf("replay_counter3 is:");
+ lamont_hdump(cdata.replay_counter3, 8);
+ printf("\n");
+
printf("AA is:");
lamont_hdump(cdata.aa, 6);
printf("\n");
@@ -982,6 +1001,51 @@
}
}
+ if (!(cdata.aaset && cdata.spaset && cdata.snonceset &&
+ cdata.anonceset && cdata.keymicset && cdata.eapolframeset)) {
+
+ cdata.aaset = 0;
+ cdata.spaset = 0;
+ cdata.snonceset = 0;
+ cdata.anonceset = 0;
+ cdata.keymicset = 0;
+ cdata.eapolframeset = 0;
+
+ opt.nonstrict = 1;
+
+ memset(&capdata, 0, sizeof(struct capture_data));
+ memset(&cdata, 0, sizeof(struct crack_data));
+ memset(&eapolkey_nomic, 0, sizeof(eapolkey_nomic));
+
+ /* Populate capdata struct */
+ strncpy(capdata.pcapfilename, opt.pcapfile,
+ sizeof(capdata.pcapfilename));
+ if (openpcap(&capdata) != 0) {
+ printf("Unsupported or unrecognized pcap file.\n");
+ exit(-1);
+ }
+
+ /* populates global *packet */
+ while (getpacket(&capdata) > 0) {
+ if (opt.verbose > 2) {
+ lamont_hdump(packet, h->len);
+ }
+ /* test packet for data that we are looking for */
+ if (memcmp(&packet[capdata.l2type_offset], DOT1X_LLCTYPE, 2) ==
+ 0 && (h->len >
+ capdata.l2type_offset + sizeof(struct wpa_eapol_key))) {
+ /* It's a dot1x frame, process it */
+ handle_dot1x(&cdata, &capdata, &opt);
+ if (cdata.aaset && cdata.spaset && cdata.snonceset &&
+ cdata.anonceset && cdata.keymicset
+ && cdata.eapolframeset) {
+ /* We've collected everything we need. */
+ break;
+ }
+ }
+ }
+ }
+
closepcap(&capdata);
if (!(cdata.aaset && cdata.spaset && cdata.snonceset &&
diff -uNr cowpatty-4.6/cowpatty.h cowpatty-4.6-fixup11/cowpatty.h
--- cowpatty-4.6/cowpatty.h 2009-06-04 06:24:16.000000000 -0700
+++ cowpatty-4.6-fixup11/cowpatty.h 2009-07-15 16:38:28.857191274 -0700
@@ -178,7 +178,9 @@
u8 anonceset;
u8 keymicset;
u8 eapolframeset;
- u8 replay_counter[8];
+ u8 replay_counter1[8];
+ u8 replay_counter2[8];
+ u8 replay_counter3[8];
int ver; /* Hashing algo, MD5 or AES-CBC-MAC */
int eapolframe_size;