1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
|
/* Its just a simple rfmon mode sniffer
i hope my C is at last a bit better then in my
early days :-).
This works only with cisco wireless cards with an rfmon
able driver and not with wifi stuff.
Btw. did i mention that i hate C?
To compile use:
gcc wlan-sniffer.c -o wlan-sniffer -lpcap
use it like this:
wlan-sniffer interface
*/
#include "sniffer.h"
int main(int argc, char **argv)
{
int ret; /* return code */
ret = card_into_monitormode (SNIFFER_DEVICE, CARD_TYPE_NG);
if (ret == -1)
{
exit(-1);
}
start_sniffing (SNIFFER_DEVICE);
return 0;
}
int card_into_monitormode (char * device, int cardtype)
{
int ret = -1;
int datalink; /* used for getting the pcap datalink type */
char CiscoRFMON[35] = "/proc/driver/aironet/";
FILE *CISCO_CONFIG_FILE;
char errbuf[PCAP_ERRBUF_SIZE];
pcap_t *handle;
/* Checks if we have a device to sniff on */
if(device == NULL)
{
printf ("Fatal error i did not have any interfaces to sniff on\n");
exit(1);
}
/* Setting the prmiscous and up flag to the interface */
if (card_set_promisc_up (device) == 0)
{
printf ("Interface flags correctly set using ifconfig\n");
}
/* Check the cardtype and executes the commands to go into monitor mode */
if (cardtype == CARD_TYPE_CISCO) /* I got a cisco card */
{
/* bring the sniffer into rfmon mode */
snprintf(CiscoRFMON, sizeof(CiscoRFMON),DEFAULT_PATH, device);
CISCO_CONFIG_FILE = fopen(CiscoRFMON,"w");
fputs ("Mode: r",CISCO_CONFIG_FILE);
fputs ("Mode: y",CISCO_CONFIG_FILE);
fputs ("XmitPower: 1",CISCO_CONFIG_FILE);
fclose(CISCO_CONFIG_FILE);
}
else if (cardtype == CARD_TYPE_NG)
{
char wlanngcmd[62];
snprintf(wlanngcmd, sizeof(wlanngcmd),"%s %s lnxreq_wlansniff channel=1 enable=true",WLANCTL_PATH,device);
if (ret = (system (wlanngcmd)) != 0)
{
printf ("\n Fatal error could not set %s in raw mode, check cardtype\n",device);
exit(1);
}
}
else if (cardtype == CARD_TYPE_HOSTAP)
{
printf ("Got a host-ap card, nothing is implemented now\n");
}
/* Check the interface if it is in the correct raw mode */
handle = pcap_open_live(device, BUFSIZ, 1, 0, errbuf);
/* getting the datalink type */
datalink = pcap_datalink(handle);
if (datalink == DLT_IEEE802_11) /* Rawmode is IEEE802_11 */
{
printf ("Your successfully listen on %s in 802.11 raw mode\n",device);
pcap_close(handle);
return (0);
}
else
{
printf ("Fatal error, cannot continue, your interface %s does not work in the correct 802.11 raw mode, check you driver please\n",device);
pcap_close(handle);
exit(1);
}
}
int card_set_promisc_up (char * device)
{
int ret;
char ifconfigcmd[32];
snprintf(ifconfigcmd,sizeof(ifconfigcmd),SBIN_PATH, device);
ret = system (ifconfigcmd);
if (ret > 0)
{
printf ("\nFatal error, could not execute %s please check your card,binary location and permission\n",ifconfigcmd);
exit(1);
}
return(0);
}
int start_sniffing (char * device)
{
int ret; /* return code */
pcap_t *handletopcap;
char errbuf[PCAP_ERRBUF_SIZE];
struct pcap_pkthdr header; /* The header that pcap gives us */
const u_char *packet; /* The actual packet */
/* opening the pcap for sniffing */
handletopcap = pcap_open_live(device, BUFSIZ, 1, 1000, errbuf);
/* Next few lines a taken out of kismet */
#ifdef HAVE_PCAP_NONBLOCK
pcap_setnonblock(handletopcap, 1, errstr);
#endif
/*start scanning */
pcap_loop(handletopcap,-1,process_packets,NULL);
printf("\nDone processing packets... wheew!\n");
return 0;
}
void process_packets(u_char *useless,const struct pcap_pkthdr* pkthdr,const u_char* packet)
{
u_int caplen = pkthdr->caplen;
u_int length = pkthdr->len;
u_int16_t fc;
u_int HEADER_LENGTH;
u_short extracted_ethertype;
int snapend;
int ret;
/* pinfo holds all interresting information for us */
struct packetinfo pinfo;
struct packetinfo *pinfoptr;
pinfoptr=&pinfo;
pinfoptr->isvalid = 0;
pinfoptr->pktlen = pkthdr->len;
if (caplen < IEEE802_11_FC_LEN)
{
/* This is a garbage packet, because is does not long enough
to hold a 802.11b header */
pinfoptr->isvalid = 0;
return;
}
/* Gets the framecontrol bits (2bytes long) */
fc = EXTRACT_LE_16BITS(packet);
HEADER_LENGTH = GetHeaderLength(fc);
if (caplen < HEADER_LENGTH)
{
/* This is a garbage packet, because it is not long enough
to hold a correct header of its type */
pinfoptr->isvalid = 0;
return;
}
/* Decode 802.11b header out of the packet */
if (decode_80211b_hdr(packet,pinfoptr) == 0)
{
/* Justification of the ofset to further process the packet */
length -= HEADER_LENGTH;
caplen -= HEADER_LENGTH;
packet += HEADER_LENGTH;
}
else
{ /* Something is wrong,could not be a correct packet */
return;
}
switch (FC_TYPE(fc))
{
/* Is it a managemnet frame? */
case T_MGMT:
switch (FC_SUBTYPE(fc))
{ /* Is it a beacon frame? */
case ST_BEACON:
if (handle_beacon(fc, packet,pinfoptr) ==0)
{
if (!strcmp(pinfoptr->desthwaddr,"ff:ff:ff:ff:ff:ff") == 0)
{
/* Every beacon must have the broadcast as destination
so it must be a shitti packet */
pinfoptr->isvalid = 0;
return;
}
if (pinfoptr->cap_ESS == pinfoptr->cap_IBSS)
{
/* Only one of both are possible, so must be
a noise packet, if this comes up */
pinfoptr->isvalid = 0;
return;
}
if (pinfoptr->channel < 1 || pinfoptr->channel > 14)
{
/* Only channels between 1 and 14 are possible
others must be noise packets */
pinfoptr->isvalid = 0;
return;
}
/* Decoding successfull of beacon frame */
if (pinfoptr->cap_ESS == 1 &&pinfoptr->cap_IBSS ==0)
{
printf ("\nHave found an accesspoint:");
}
else if(pinfoptr->cap_ESS == 0 && pinfoptr->cap_IBSS == 1)
{
printf ("\nHave found an AD-HOC station:");
}
if (strcmp (pinfoptr->ssid,NONBROADCASTING) ==0)
{
printf ("\n\tOn a non-broadcasting network");
}
else
{
printf ("\n\tOn network : %s",pinfoptr->ssid);
}
printf ("\n\tLen SSID : %d",pinfoptr->ssid_len);
printf ("\n\tOn Channel : %d",pinfoptr->channel);
printf ("\n\tEncryption : %s", pinfoptr->cap_WEP ? "ON" : "OFF");
printf ("\n\tMacaddress : %s",pinfoptr->sndhwaddr);
printf ("\n\tBssid : %s",pinfoptr->bssid);
printf ("\n\tDest : %s\n",pinfoptr->desthwaddr);
}
break;
default:
printf("Unknown IEEE802.11 frame subtype (%d)",FC_SUBTYPE(fc));
break;
} /* End of switch over different mgt frame types */
break;
case T_CTRL:
// decode_control_frames(fc, packet);
printf ("Its a control frame");
break;
case T_DATA:
// decode_data_frames(fc, packet);
printf ("Its a date frame");
break;
default:
printf("Unknown IEEE802.11 frame type (%d)",FC_TYPE(fc));
break;
}
}
/* This decodes the 802.11b frame header out of the 802.11b packet
all the infos is placed into the packetinfo structure */
int decode_80211b_hdr(const u_char *p,struct packetinfo *ppinfo)
{
char * ret;
char testme[16];
const struct mgmt_header_t *mgthdr = (const struct mgmt_header_t *) p;
ppinfo->fcsubtype = FC_SUBTYPE(mgthdr->fc);
/* Get the sender, bssid and dest mac address */
etheraddr_string(mgthdr->bssid,ppinfo->bssid);
etheraddr_string(mgthdr->da,ppinfo->desthwaddr);
etheraddr_string(mgthdr->sa,ppinfo->sndhwaddr);
ppinfo->fc_wep = FC_WEP(mgthdr->fc);
return(0);
}
void etheraddr_string(register const u_char *ep,char * text)
{
static char hex[] = "0123456789abcdef";
register u_int i, j;
register char *cp;
char buf[sizeof("00:00:00:00:00:00")];
cp = buf;
if ((j = *ep >> 4) != 0)
*cp++ = hex[j];
*cp++ = hex[*ep++ & 0xf];
for (i = 5; (int)--i >= 0;) {
*cp++ = ':';
if ((j = *ep >> 4) != 0)
*cp++ = hex[j];
*cp++ = hex[*ep++ & 0xf];
}
*cp = '\0';
strcpy(text,buf);
return;
}
int handle_beacon(u_int16_t fc, const u_char *p,struct packetinfo *ppinfo)
{
struct mgmt_body_t pbody;
int offset = 0;
/* Get the static informations out of the packet */
memset(&pbody, 0, sizeof(pbody));
memcpy(&pbody.timestamp, p, 8);
offset += 8;
pbody.beacon_interval = EXTRACT_LE_16BITS(p+offset);
offset += 2;
pbody.capability_info = EXTRACT_LE_16BITS(p+offset);
offset += 2;
/* Gets the different flags out of the capabilities */
ppinfo->cap_ESS = CAPABILITY_ESS(pbody.capability_info);
ppinfo->cap_IBSS = CAPABILITY_IBSS(pbody.capability_info);
ppinfo->cap_WEP = CAPABILITY_PRIVACY(pbody.capability_info);
/* Gets the tagged elements out of the packets */
while (offset + 1 < ppinfo->pktlen)
{
switch (*(p + offset))
{
case E_SSID:
memcpy(&(pbody.ssid),p+offset,2); offset += 2;
if (pbody.ssid.length > 0)
{
memcpy(&(pbody.ssid.ssid),p+offset,pbody.ssid.length); offset += pbody.ssid.length;
pbody.ssid.ssid[pbody.ssid.length]='\0';
if (strcmp(pbody.ssid.ssid,"")==0)
{
ppinfo->ssid = NONBROADCASTING;
}
else
{
ppinfo->ssid = pbody.ssid.ssid;
}
ppinfo->ssid_len = pbody.ssid.length;
}
break;
case E_CHALLENGE:
memcpy(&(pbody.challenge),p+offset,2); offset += 2;
if (pbody.challenge.length > 0)
{
memcpy(&(pbody.challenge.text),p+offset,pbody.challenge.length); offset += pbody.challenge.length;
pbody.challenge.text[pbody.challenge.length]='\0';
}
break;
case E_RATES:
memcpy(&(pbody.rates),p+offset,2); offset += 2;
if (pbody.rates.length > 0) {
memcpy(&(pbody.rates.rate),p+offset,pbody.rates.length); offset += pbody.rates.length;
}
break;
case E_DS:
memcpy(&(pbody.ds),p+offset,3); offset +=3;
ppinfo->channel = pbody.ds.channel;
break;
case E_CF:
memcpy(&(pbody.cf),p+offset,8); offset +=8;
break;
case E_TIM:
memcpy(&(pbody.tim),p+offset,2); offset +=2;
memcpy(&(pbody.tim.count),p+offset,3); offset +=3;
if ((pbody.tim.length -3) > 0)
{
memcpy((pbody.tim.bitmap),p+(pbody.tim.length -3),(pbody.tim.length -3));
offset += pbody.tim.length -3;
}
break;
default:
#if 0
printf("(1) unhandled element_id (%d) ", *(p+offset) );
#endif
offset+= *(p+offset+1) + 2;
break;
} /* end of switch*/
} /* end of for loop */
return(0);
} /* End of handle_beacon */
static int GetHeaderLength(u_int16_t fc)
{
int iLength=0;
switch (FC_TYPE(fc)) {
case T_MGMT:
iLength = MGMT_HEADER_LEN;
break;
case T_CTRL:
switch (FC_SUBTYPE(fc)) {
case CTRL_PS_POLL:
iLength = CTRL_PS_POLL_LEN;
break;
case CTRL_RTS:
iLength = CTRL_RTS_LEN;
break;
case CTRL_CTS:
iLength = CTRL_CTS_LEN;
break;
case CTRL_ACK:
iLength = CTRL_ACK_LEN;
break;
case CTRL_CF_END:
iLength = CTRL_END_LEN;
break;
case CTRL_END_ACK:
iLength = CTRL_END_ACK_LEN;
break;
default:
iLength = 0;
break;
}
break;
case T_DATA:
if (FC_TO_DS(fc) && FC_FROM_DS(fc))
iLength = 30;
else
iLength = 24;
break;
default:
printf("unknown IEEE802.11 frame type (%d)",
FC_TYPE(fc));
break;
}
return iLength;
}
|