search

brav0hax / easy-creds

274 stars 97 forks source link

MAC change leads to Fake AP disconnections #8

Closed cmavr8 closed 10 years ago

cmavr8 commented 10 years ago

First of all, this is probably not a problem of easy-creds itself, but some of the components used.

Steps to reproduce: FakeAP attacks > Fake AP attack static. Most settings are irrelevant (do not affect), but if I choose to change my mon card's MAC, the problem manifests.

Everything seems to go on OK (MAC changed ok, AP created etc) but once my client connects to the AP and tries downloading they get disconnected. Then it tries to connect again (Android phone) and succeeds, only to get disconnected a few seconds later. This goes on forever. Haven't tried other clients.

I have tried this many times, and it's consistently reproducible. If I do not change the MAC it works great.

brav0hax commented 10 years ago

Can you please tell me what type of wireless card you are using.

Also, are you running through a VM? If so, virtualbox or VMWare.

Also, good to know what OS you're running on,etc.

I cant reproduce anything if I don't know the full story.

Thanks, Eric

cmavr8 commented 10 years ago

Hi Eric! Thanks for the reply.

So, I'm using an Alfa 1W card, reported as "0bda:8187 Realtek Semiconductor Corp. RTL8187 Wireless Adapter" by lsusb.

Host OS is Ubuntu 13.04 with kernel 3.8.0-30-generic, Guest OS is latest Kali. Vmware is used.

What else should I provide? Cheers, Chris

brav0hax commented 10 years ago

Can you do me a favor and just let me know what your airbase-ng version is?

On Sat, Sep 21, 2013 at 10:25 AM, Chris Mavrakis notifications@github.comwrote:

Hi Eric! Thanks for the reply.

So, I'm using an Alfa 1W card, reported as "0bda:8187 Realtek Semiconductor Corp. RTL8187 Wireless Adapter" by lsusb.

Host OS is Ubuntu 13.04 with kernel 3.8.0-30-generic, Guest OS is latest Kali. Vmware is used.

What else should I provide? Cheers, Chris

— Reply to this email directly or view it on GitHubhttps://github.com/brav0hax/easy-creds/issues/8#issuecomment-24866898 .

cmavr8 commented 10 years ago

Oh it's not a favor! Using Airbase-ng 1.2 beta1 r2333. I've used easy-creds' update aircrack-ng. I'll try to run everything on a different system (raspberry pi) now... maybe something changes

cmavr8 commented 10 years ago

Update: tried setting manual MAC instead of random (from within easy-creds). Same problem. The MAC I chose was close to the original.

EDIT: same problem with TwinEvil AP mode, even without changing MAC. Client connects momentarily (takes IP) and disconnects. Then reconnects and disconnects all the time very rapidly. I'll try to get some friends to try it so that we know if it's my client's fault.

EDIT2: I noticed that the problem also manifests when there are results after running "airmon-ng check". This is not the case with my setup though. Nothing else is running.

cmavr8 commented 10 years ago

I read somewhere that (e.g.) wlan0 and (e.g.) mon0 must have the same MAC. I thought this may be causing my problems so I set my wlan0's mac before running easy-creds, and modyfied the script to assign the same IP to mon0.

And it freakin works!!! I haven't tested it much yet, but seems to be OK. I'll report back once I'm sure so you/I can fix it in the code :D

cmavr8 commented 10 years ago

I have fixed the problem by adding code to change all iface's MACs to one and only. I did it in a clone branch of this repo: https://github.com/cmavr8/easy-creds

But it is ugly and dirty. Maybe I will clean it up in the future. If I do, I'll submit a pull request back to the original repo. Until then, I close this issue :)

Thanks for EC anyway. I like it very much.

cmavr8 commented 10 years ago

Actually I rewrote my changes and it is much cleaner now. I'll do a pull request after the previous pull request is accepted/rejected :) https://github.com/cmavr8/easy-creds/commit/8fcf27290e059f95d696a16faa69da053648cae3