halo / LinkLiar

:link: Link-Layer MAC spoofing GUI for macOS
http://halo.github.io/LinkLiar
MIT License
1.24k stars 84 forks source link

Selected replacement MAC not accepted #3

Closed kwolk closed 11 years ago

kwolk commented 12 years ago

Not only was this and has this always been an issue, but in this very early beta there is no indication that the new IP did not work, it's always annoying to have a dialogue box to basically tell you something that you can't do anything about, in this instance I'd take the approach that a prevention is better than a cure and as such always have the code work, but I understand this might well be a prevailing problem for a reason - too many combinations to be known which will and will not work.

How about then, if possible, have a red background flash for a second behind the IP not changed? I have disability settings configured so that the window will flash when an error occurs, it's a nice effect, but not on by default, to my knowledge. Is there then a way to highlight the fact, to possibly draw the users eyes to the area of contention, that a change has not been made without the need for a dialogue box or a GROWL notification?

The problem is when you've set the number and let it go, much like a sling-shot - one expects it to keep on travelling in the desired direction and not end in the anti-climax of the conker still in the sling, the IP should change. Perhaps then, this is just a personal preference, that only the positive elements be highlighted i.e. when the IP is successfully changed then a GROWL notification be shown.

halo commented 12 years ago

I think there are two sub-problems to this one.

  1. The new MAC won't be accepted
  2. If it was not accepted, the user doesn't get a GUI response.

As for 1: This could be because Lion denies particular addresses. All that LinkLiar does is calling the underlying ifconfig command and that one sometimes simply says "Bad value" and won't allow you to spoof to that address. Another reason could be that LinkLiar is not using the underlying command correctly. In the first case there is not much we can do. In the second case, I would maybe need an example address that always fails for you. I can then experiment whether this address works at all (using different ifconfig combinations).

As for 2: Good idea, I will come up with something.

kwolk commented 12 years ago

I think I've found the problem, it was much the same as before, so I'm not sure if it's my computer or not, but it seems to be the same. That is, with AirPortClown, I would have to disassociate myself from my WLAN manually, then invoke APC and make the changes, however, like that 007 film The Man with the Golden Gun (1974), it only works once and if for example the IP entered wasn't accepted then I would have to close and re-open APC, significantly the IP would not change unless disassociated, manually.

It's the same with the Pref Pane option as it will not change my IP unless I manually disassociate myself, as well as being a Golden Gun affair, in that I would have to actually close down and re-open System Preferences each time I attempted to change the IP, this I know as I was testing from a list of known IPs to work and those that didn't.

When the IP changed then it was reflected in the Preference Pane itself, I confirmed this by checking my router's settings page in a browser also.

So it's still got the old habits of APC, unfortunately.

works: a2:85:9e:ab:68:64 no go: 00:14:AB:93:ed:48

halo commented 12 years ago

OK, do you know how to start the Terminal? You should be able to search for the word "Terminal" in your spotlight search and you should be able to start it. We need to do some research on why your machine behaves different from mine (both MACs that you posted work flawlessly on my Mac - by the way, which Mac do you have?)

There are three commands which are interesting. The first we can use to disassociate from all WLAN stations:

sudo /System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport -z

The second is used for changing the MAC address. You'll have to replace en0 with whatever your Wi-Fi interface is (LinkLiar will tell you):

sudo ifconfig en0 aa:bb:cc:dd:ee:ff

You can verify your MAC address using:

sudo ifconfig en0 | grep ether

I think that is all we have. We have a couple of scenarios:

  1. Changing the Ethernet (cable) MAC address
  2. Changing the Wi-Fi MAC address while connected to a station
  3. Changing the Wi-Fi MAC address immediately after having disassociated from a station
  4. Changing the Wi-Fi MAC address while not having been connected to any station for at least 15 seconds

In each scenario I'd like to know the output of the following commands (replace en1 with whatever your interface is):

echo "Current MAC: $(sudo ifconfig en1 | grep ether)"
sudo ifconfig en1 ether a2:85:9e:ab:68:64
echo $?
echo "Current MAC: $(sudo ifconfig en1 | grep ether)"
sudo ifconfig en1 ether 00:14:AB:93:ed:48
echo $?
echo "Current MAC: $(sudo ifconfig en1 | grep ether)"
kwolk commented 12 years ago

Having fallen at the first hurdle I put this down to not being loved in as Admin, this I think turned out to be the case as I could get the first command to work, now logged in as Admin.

But I had a problem with the second command "sudo ifconfig en0 aa:bb:cc:dd:ee:ff", I knew that I was "en1" and changed it accordingly and changed the IP to one of the ones from my last post, but nothing worked, I kept getting a "bad value" error from before, this is what frustrated me into looking for an app like APC in the first place.

However the final command did work, but of course there were no changes, I did however have to drop the "sudo" element for it to work. I tried experimenting with the other commands by dropping sudo but that didn't help. The IP address shown is my actual one, nothing unusual as I'd just rebooted to get into Admin mode.

Not sure what's going on but found some info here:

http://www.tonymacx86.com/hp-probook-4530s/51818-mac-address-spoofing-not-working.html

I did not try it myself.

But I notice now that one of your final commands did work, my IP now "a2:85:9e:ab:68:64" for some reason, I was copying & pasting it in and noticed, after some time, that it had changed. I tried looking back over what I had done and could see it was the initial "sudo ifconfig en1 ether a2:85:9e:ab:68:64" command you gave of that last section but I can't change it to anything else now (via Terminal).

I know it sounds strange it's very frustrating, I am not sure why this is happening and I remember the same thing going on before I found APC, Terminal is just about as fun as DOS was for me on Windows, I'm a uI man, not a coder.

As for the last four scenarios I just cannot comply with them, given my situation. I managed to change the IP though with the "sudo ifconfig en1 ether a2:85:9e:ab:68:64" command and that was when I was disassociated for more thn 15second I believe, as for the others: trying to change anything while connected wouldn't work and changing it after immediately disassociating myself with my network, well, that didn't work either.

Sorry about that.

halo commented 12 years ago

So would the answer to the following questions be yes?

  1. You can change your MAC address to anything if you have not been connected to a station for at least 15 seconds.
  2. You have a normal, off-the-shelf Mac Book.

And another thing that really confuses me: you talk about some "now logged in as Admin". What is that? Do you mean that you cannot run a command like sudo whoami from the user that you are logged in with? I mean, you have to type in your admin password once in Terminal, but the subsequent sudo-commands should work without password then.

And don't say sorry ;) You're a valuable bug hunter :)

kwolk commented 12 years ago

Yes and yes, but I can only reliably change the IP via dedicate software like APC, the Terminal thing only worked by accident!

I like to be careful with security so I have an admin account but never run in it, in case my machine compromised, and so it always asks me for a password before I do anything too important that isn't the login password, it's a bit of a bore (especially the length of it, but then we all know what happened to a certain reporter and a certain Cloud based service just recently - i.e. it does happen).

I find that there are certain things that do not work, specifically Terminal based ones, when not logged in with the ability to administrate my machine i.e. not logged in as admin. For example if I try the "sudo whoami" command it spits back "is not in the sudoers file. This incident will be reported.", even after a successful password entry (note: I tried my admin password too and it wouldn't accept it), however I know under Admin things would be different.

I apologise because I know what it's like to have a set of instructions in mind and they are not, or partially, completed, my problem is the command line, I've just never gotten along with it.

kwolk commented 12 years ago

Just wondering what the status was on this thanks.

halo commented 12 years ago

Hi! I was on a short vacation, that's the status ;)

I find it difficult to run a command that requires sudo from a user that has sudo disabled by the operating system. So does MacDaddyX succeed in running sudo commands from a non-privileged user on your system? If so, I need to do some digging :)

kwolk commented 12 years ago

No, it doesn't, I tried with the following, which it thought was successful, but which didn't translate into an actual change of IP:

New Address: A0:34:2B:13:92:7F Manufacturer: Motorola CHS OID=001A66

That was on "en1", however, I tried with LinkLiar and when I tried to change the "Wi-Fi en1" option it ended up changing the "Ethernet en0" instead, also, there was no feedback, even after a password request, so am not sure if some wires are crossed or not?

I actually don't even get what the difference is between them anyway.

Thanks.

halo commented 12 years ago

Well, maybe there is no way to change your MAC address when you are no privileged user. Mac OS maybe prevents you from changing the address because of the lack of administrative rights.

kwolk commented 12 years ago

But that can't be because AirPortClown does work, this code was the code from that project wasn't it?

kwolk commented 11 years ago

Guys come on, don't give up on the project. As I said APC works with my current configuration, if you're using the same code then surely it should function the same, what's changed?