First import of the msflorcon interface (hack hack hack)
git-svn-id: file:///home/svn/framework3/trunk@4048 4d416f70-5f16-0410-b530-b9f4589650daunstable
HD Moore
parent
286fee8ca4
commit
ce048eed73
|
|
@ -0,0 +1,19 @@
|
|||
#
|
||||
# Makefile for msflorcon
|
||||
#
|
||||
|
||||
NAME=msflorcon-$(shell ruby -e 'puts RUBY_PLATFORM')
|
||||
CFLAGS := -I. -I/usr/include -I/usr/local/include
|
||||
LDFLAGS := -L. -lorcon
|
||||
|
||||
%.o:
|
||||
$(CC) -fPIC -c $(CFLAGS) *.c
|
||||
|
||||
shared: %.o
|
||||
$(CC) -fPIC -shared -o $(NAME).so *.o $(LDFLAGS)
|
||||
|
||||
all: shared
|
||||
strip *.so
|
||||
|
||||
clean:
|
||||
rm -f *.o core a.out *.so
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
This is an experimental interface for lorcon, a 802.11 library
|
||||
developed by Joshua Wright and dragorn. This interface is only
|
||||
available on Linux and with lorcon-supported wireless drivers.
|
||||
|
||||
For more information, please see the lorcon documentation and code:
|
||||
http://www.802.11mercenary.net/lorcon/
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
#
|
||||
# This class wraps the lorcon 802.11 packet injection library
|
||||
#
|
||||
|
||||
class MSFLorcon
|
||||
|
||||
# Symbol definitions for userstack interface
|
||||
LIBSYMBOLS =
|
||||
{
|
||||
:msflorcon_send => 'IPPIII',
|
||||
:msflorcon_close => '0P',
|
||||
:msflorcon_open => 'IPPPI',
|
||||
:msflorcon_driverlist => 'IPI',
|
||||
:msflorcon_in_tx_size => 'I',
|
||||
}
|
||||
|
||||
LIBSYMBOLS.each_pair { |name, args| LORCON::SYM[name] = LORCON::LIB[name.to_s, args] }
|
||||
|
||||
|
||||
def self.driverlist
|
||||
buff = DL.malloc(1024)
|
||||
r, rs = LORCON::SYM[:msflorcon_driverlist].call(buff, buff.size)
|
||||
r == 1 ? buff.to_str.gsub("\x00", '').split(",") : []
|
||||
end
|
||||
|
||||
def self.open(iface='ath0', driver='madwifi', channel=11)
|
||||
r, rs = LORCON::SYM[:msflorcon_in_tx_size].call()
|
||||
tx = DL.malloc(r)
|
||||
r, rs = LORCON::SYM[:msflorcon_open].call(tx, iface, driver, channel)
|
||||
r == 1 ? Interface.new(tx) : nil
|
||||
end
|
||||
|
||||
class Interface
|
||||
attr_accessor :tx
|
||||
|
||||
def initialize(tx)
|
||||
self.tx = tx
|
||||
end
|
||||
|
||||
def close
|
||||
r, rs = LORCON::SYM[:msflorcon_close].call(self.tx)
|
||||
end
|
||||
|
||||
def write(buff, count=1, delay=0)
|
||||
r, rs = LORCON::SYM[:msflorcon_send].call(self.tx, buff.to_ptr, buff.length, count, delay)
|
||||
return r
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
end
|
||||
|
|
@ -0,0 +1,121 @@
|
|||
#include <msflorcon.h>
|
||||
|
||||
/*
|
||||
This is a derivative of the tx.c sample included with lorcon
|
||||
|
||||
lorcon is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation; either version 2 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
lorcon is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with lorcon; if not, write to the Free Software
|
||||
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
Copyright (c) 2005 dragorn and Joshua Wright
|
||||
Copyright (c) 2006 H D Moore
|
||||
*/
|
||||
|
||||
/* This is quick and ugly code I wrote as PoC */
|
||||
|
||||
int msflorcon_in_tx_size(void) {
|
||||
return(sizeof(struct tx80211));
|
||||
}
|
||||
|
||||
int msflorcon_send(struct tx80211 *in_tx, char *buff, int len, int cnt, int delay) {
|
||||
struct tx80211_packet in_packet;
|
||||
int ret = 0;
|
||||
int c = cnt;
|
||||
|
||||
in_packet.packet = buff;
|
||||
in_packet.plen = len;
|
||||
|
||||
for (; c > 0; c--) {
|
||||
ret = tx80211_txpacket(in_tx, &in_packet);
|
||||
if (ret < 0)
|
||||
return(ret);
|
||||
if (delay > 0)
|
||||
usleep(delay);
|
||||
}
|
||||
|
||||
return(cnt);
|
||||
}
|
||||
|
||||
|
||||
int msflorcon_open(struct tx80211 *in_tx, char *iface, char *driver, int channel) {
|
||||
int ret = 0;
|
||||
int drivertype = INJ_NODRIVER;
|
||||
|
||||
drivertype = tx80211_resolvecard(driver);
|
||||
if (drivertype == INJ_NODRIVER) {
|
||||
fprintf(stderr, "Driver name not recognized.\n");
|
||||
return(0);
|
||||
}
|
||||
|
||||
if (tx80211_init(in_tx, iface, drivertype) < 0) {
|
||||
perror("tx80211_init");
|
||||
return(0);
|
||||
}
|
||||
|
||||
ret = tx80211_setmode(in_tx, IW_MODE_MONITOR);
|
||||
if (ret != 0) {
|
||||
fprintf(stderr, "Error setting mode, returned %d.\n", ret);
|
||||
return(0);
|
||||
}
|
||||
|
||||
/* Switch to the given channel */
|
||||
ret = tx80211_setchannel(in_tx, channel);
|
||||
if (ret < 0) {
|
||||
fprintf(stderr, "Error setting channel, returned %d.\n", ret);
|
||||
return(0);
|
||||
}
|
||||
|
||||
/* Open the interface to get a socket */
|
||||
ret = tx80211_open(in_tx);
|
||||
if (ret < 0) {
|
||||
fprintf(stderr, "Unable to open interface %s.\n", in_tx->ifname);
|
||||
return(0);
|
||||
}
|
||||
|
||||
return(1);
|
||||
}
|
||||
|
||||
void msflorcon_close(struct tx80211 *in_tx) {
|
||||
tx80211_close(in_tx);
|
||||
}
|
||||
|
||||
int msflorcon_driverlist(char *buff, int len) {
|
||||
struct tx80211_cardlist *cardlist = NULL;
|
||||
int i,l,r;
|
||||
|
||||
if (buff == NULL)
|
||||
return(0);
|
||||
|
||||
cardlist = tx80211_getcardlist();
|
||||
if (cardlist == NULL) {
|
||||
free(buff);
|
||||
return(0);
|
||||
}
|
||||
|
||||
r = len;
|
||||
for (i = 1; i < cardlist->num_cards; i++) {
|
||||
|
||||
l = strlen(cardlist->cardnames[i]);
|
||||
|
||||
if (l + 1 > r)
|
||||
return(0);
|
||||
|
||||
strcat(buff, cardlist->cardnames[i]);
|
||||
if (i + 1 < cardlist->num_cards)
|
||||
strcat(buff, ",");
|
||||
|
||||
r -= l + 1;
|
||||
}
|
||||
|
||||
return(1);
|
||||
}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
#ifndef _MSFLORCON_H
|
||||
#define _MSFLORCON_H
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <errno.h>
|
||||
#include <string.h>
|
||||
#include <stdio.h>
|
||||
#include <sys/socket.h>
|
||||
#include <linux/wireless.h>
|
||||
|
||||
#include <tx80211.h>
|
||||
#include <tx80211_packet.h>
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
#
|
||||
# This class wraps the lorcon 802.11 packet injection library
|
||||
# The real wrapper code can be found in msflorcon.c and features.rb
|
||||
#
|
||||
|
||||
class MSFLorcon
|
||||
|
||||
LIBNAME = File.join(File.dirname(__FILE__), "msflorcon-" + RUBY_PLATFORM + ".so")
|
||||
|
||||
require 'dl'
|
||||
|
||||
@@loaded = false
|
||||
|
||||
def self.loaded
|
||||
@@loaded
|
||||
end
|
||||
|
||||
begin
|
||||
module LORCON
|
||||
LIB = DL.dlopen(LIBNAME)
|
||||
SYM = { }
|
||||
end
|
||||
|
||||
@@loaded = true
|
||||
|
||||
require 'features.rb'
|
||||
|
||||
rescue ::Exception => e
|
||||
end
|
||||
end
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
#!/usr/bin/env ruby
|
||||
|
||||
require 'msflorcon'
|
||||
|
||||
if (not MSFLorcon.loaded)
|
||||
$stderr.puts "Error: msflorcon could not be loaded"
|
||||
exit(0)
|
||||
end
|
||||
|
||||
$stdout.puts "Drivers: " + MSFLorcon.driverlist.join(", ")
|
||||
|
||||
# Beacon frame from tx.c
|
||||
packet = [
|
||||
0x80, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, # dur ffff
|
||||
0xff, 0xff, 0x00, 0x0f, 0x66, 0xe3, 0xe4, 0x03,
|
||||
0x00, 0x0f, 0x66, 0xe3, 0xe4, 0x03, 0x00, 0x00, # 0x0000 - seq no.
|
||||
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, # BSS timestamp
|
||||
0x64, 0x00, 0x11, 0x00, 0x00, 0x0f, 0x73, 0x6f,
|
||||
0x6d, 0x65, 0x74, 0x68, 0x69, 0x6e, 0x67, 0x63,
|
||||
0x6c, 0x65, 0x76, 0x65, 0x72, 0x01, 0x08, 0x82,
|
||||
0x84, 0x8b, 0x96, 0x24, 0x30, 0x48, 0x6c, 0x03,
|
||||
0x01, 0x01, 0x05, 0x04, 0x00, 0x01, 0x00, 0x00,
|
||||
0x2a, 0x01, 0x05, 0x2f, 0x01, 0x05, 0x32, 0x04,
|
||||
0x0c, 0x12, 0x18, 0x60, 0xdd, 0x05, 0x00, 0x10,
|
||||
0x18, 0x01, 0x01, 0xdd, 0x16, 0x00, 0x50, 0xf2,
|
||||
0x01, 0x01, 0x00, 0x00, 0x50, 0xf2, 0x02, 0x01,
|
||||
0x00, 0x00, 0x50, 0xf2, 0x02, 0x01, 0x00, 0x00,
|
||||
0x50, 0xf2, 0x02
|
||||
].pack('C*')
|
||||
|
||||
tx = MSFLorcon.open('ath0', 'madwifi', 1)
|
||||
|
||||
sa = Time.now.to_f
|
||||
tx.write(packet, 500, 0)
|
||||
ea = Time.now.to_f - sa
|
||||
|
||||
sb = Time.now.to_f
|
||||
1.upto(500) { |i| tx.write(packet, 11, 0) }
|
||||
eb = Time.now.to_f - sb
|
||||
|
||||
tx.close
|
||||
|
||||
$stdout.puts "Sent 500 packets (C) in #{ea.to_s}"
|
||||
$stdout.puts "Sent 500 packets (Ruby) in #{eb.to_s}"
|
||||
Loading…
Reference in New Issue