martin-olivier / airgorah

A WiFi security auditing software mainly based on aircrack-ng tools suite
https://crates.io/crates/airgorah
MIT License
233 stars 17 forks source link

Anyway to run without systemd? #68

Closed 0323pin closed 7 months ago

0323pin commented 8 months ago

The README.md states "This software only works on linux and requires root privileges to run."

Now, it's true that I'm not on Linux (I'm on NetBSD) but, I'm not sure it will run on my Linux machine (Void musl) either. According to the error I'm getting, one needs systemd.

2024-01-08-102709_1366x768_scrot

Anyway to run airgorah without systemd?

martin-olivier commented 8 months ago

Hello @0323pin,

If the parameter kill_network_manager has been enabled, Airgorah is using systemctl to restart the network manager when exiting the application to ensure network management goes back to normal, It must be done because I am calling airmon-ng check kill after interface selection to avoid busy resource errors and channel hopping by other processes during the execution:

// src/backend/app.rs

pub fn restore_network_manager() -> Result<(), Error> {
    if !get_settings().kill_network_manager {
        return Ok(());
    }

    Command::new("systemctl")
        .args(["restart", "NetworkManager"])
        .output()?;
    Command::new("systemctl")
        .args(["restart", "network-manager"])
        .output()?;
    Command::new("systemctl")
        .args(["restart", "wpa-supplicant"])
        .output()?;

    log::warn!("network manager restored");

    Ok(())
}

What is the equivalent for NetBSD or Void MUSL ?

I also saw on multiple forums that airmon-ng check kill should not be called and instead use the following commands:

sudo ifconfig iface down
sudo iwconfig iface mode monitor
sudo ifconfig iface up

What is your opinion on that ?

0323pin commented 8 months ago

@martin-olivier thanks for the explanation. I'll give it a thought, I don't use network manager at all, only plain wpa_supplicant and dhcpcd.

0323pin commented 8 months ago

@martin-olivier I haven't check on Linux but, on NetBSD we have ifconfig but, not iwconfig. The equivalent to

sudo ifconfig iface down
sudo iwconfig iface mode monitor
sudo ifconfig iface up

would be,

sudo ifconfig iface down
sudo wiconfig iface -D
sudo ifconfig iface up
martin-olivier commented 8 months ago

Hey @0323pin

I made systemctl optional on the last commit of the following branch: https://github.com/martin-olivier/airgorah/tree/fix/net-manager

Can you try to re-build from this branch ?

martin-olivier commented 8 months ago

Also, I saw on your screenshot that you have missing icons. To fix that, you will need to install adwaita-icon-theme

0323pin commented 8 months ago

@martin-olivier Yes, I can build from that branch but, I won't have time before tomorrow. Anything I need to be aware of to build it with systemctl off or, is it off on a default build?

I'm aware of the need of adwaita-icon-theme and will add those at due time, if we ever get a package that works. But, I don't like Gnome stuff, so I'll keep it of my local builds for now.

0323pin commented 8 months ago

@martin-olivier I need to rebuild a few thing on my NetBSD dev system but, didn't want to leave you another day or two without an answer.

On Void musl, the branch builds fine using Rust-1.75.0 with a minor warning. Leaving it here for your reference,

warning: unused import: `icon_text_button::IconTextButton`
 --> src/frontend/widgets/mod.rs:7:9
  |
7 | pub use icon_text_button::IconTextButton;
  |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  |
  = note: `#[warn(unused_imports)]` on by default

Launching the binary gives could not enable monitor mode on "wlp2s0". Even after killing the interface manually.

For reference on Void, the following commands bring the interface down and up, respectively:

sudo ip link set iface down
sudo ip link set iface up
martin-olivier commented 8 months ago

Hello @0323pin

Sorry for my late response. I fixed the warning on the latest commit of the dev branch

For your issue, maybe your network card doesn't support monitor mode ?

Can you try to enable it manually with the following command:

sudo airmon-ng start wlp2s0
0323pin commented 8 months ago

I should have sometime to try this tomorrow.

0323pin commented 8 months ago

@martin-olivier After explicitly telling runit to keep dhcpcd and wpa-supplicant services down, I get the following output:

~> sudo airmon-ng start wlp2s0

PHY Interface   Driver      Chipset

null    
        ??????      non-mac80211 device? (report this!)
phy0    wlp2s0      iwlwifi     Intel Corporation Wireless 8260 (rev 3a)
        (mac80211 monitor mode vif enabled for [phy0]wlp2s0 on [phy0]wlp2s0mon)
        (mac80211 station mode vif disabled for [phy0]wlp2s0)
martin-olivier commented 8 months ago

Hello @0323pin,

The error you encounter is raised from src/backend/interface.rs

let enable_monitor_cmd = Command::new("airmon-ng").args(["start", iface]).output()?;

if !enable_monitor_cmd.status.success() {
    return Err(Error::new(&format!(
        "Could not enable monitor mode on \"{}\"",
        iface
    )));
}

It seems that the command sudo airmon-ng start wlp2s0 fails on your machine. Can you check the return code of this command ? After that is the wlp2s0mon interface available and working ?

0323pin commented 7 months ago

@martin-olivier I'm sorry for the delay, my card does support monitor mode,

~> sudo sv down /var/service/wpa_supplicant
~> sudo sv down /var/service/dhcpcd
~> sudo airmon-ng start wlp2s0

PHY Interface   Driver      Chipset

null    
        ??????      non-mac80211 device? (report this!)
phy0    wlp2s0      iwlwifi     Intel Corporation Wireless 8260 (rev 3a)
        (mac80211 monitor mode vif enabled for [phy0]wlp2s0 on [phy0]wlp2s0mon)
        (mac80211 station mode vif disabled for [phy0]wlp2s0)
~> sudo airmon-ng start wlp2s0mon

PHY Interface   Driver      Chipset

null    
        ??????      non-mac80211 device? (report this!)
phy0    wlp2s0mon   iwlwifi     Intel Corporation Wireless 8260 (rev 3a)
        (mac80211 monitor mode already enabled for [phy0]wlp2s0mon on [phy0]10)

monitor mode already enabled.

After this, sudo airodump-ng wlp2s0mon starts listing all wifi networks nearby.

0323pin commented 7 months ago

@martin-olivier I've rebuilt airgorah from the fix-systemd branch, the dev branch still wants to use systemd commands.

Now, launching it still gives could not enable monitor mode on "wlp2s0" but,

~> sudo sv down /var/service/wpa_supplicant
~> sudo sv down /var/service/dhcpcd
~> sudo airgorah

gives Test :smiley:

So. it works if I manually kill the running services first. I guess this could be related to runit initializing the services again once they are killed by the commands you are using or, those are actually not killing the relevant services. As already mentioned, I use plain dhcpcd and wpa_supplicant, no fancy controls.

martin-olivier commented 7 months ago

Thank you for your response.

I am gonna implement the support of both runit and systemd for airgorah

Just a question, does it also work if you do :

sudo airmon-ng check kill
sudo airgorah
0323pin commented 7 months ago

You may not like the result.

sudo airmon-ng check kill does bring the services down but, sudo airgorah gives me could not enable monitor mode on "wlp2s0".

The problem is, runit has already restarted the services before the second command is issued. Yes, I've checked which services were running.

Maybe looking into the runit documentation could give us some hints. Or, if we could bring a Void dev into the discussion.

martin-olivier commented 7 months ago

@0323pin

I have Implemented the support of both systemctl and sv on the dev branch (diff: https://github.com/martin-olivier/airgorah/commit/0771c7c8bfa497b66f3d2f4b901edf6a0fe3844d)

I am not using anymore airmon-ng check kill, instead, I am using the following list of services that would potentially interfere with the app on the management of wireless cards. This list is available on the source code of airmon-ng, line 1270: https://github.com/aircrack-ng/aircrack-ng/blob/master/scripts/airmon-ng.linux

const INTERFERENCE_SERVICES: [&str; 19] = [
    "wpa_action",
    "wpa_supplicant",
    "wpa_cli",
    "dhclient",
    "ifplugd",
    "dhcdbd",
    "dhcpcd",
    "udhcpc",
    "NetworkManager",
    "knetworkmanager",
    "avahi-autoipd",
    "avahi-daemon",
    "wlassistant",
    "wifibox",
    "net_applet",
    "wicd-daemon",
    "wicd-client",
    "iwd",
    "hostapd",
];

I then check for each of the services if it is running. If it is the case, I properly stop them using systemctl stop X or sv down X depending on the service manager installed on the device.

for service in INTERFERENCE_SERVICES {
    let is_service_running = Command::new(&service_manager.cmd)
        .args([&service_manager.status, service])
        .output()?;

    if is_service_running.status.success() {
        Command::new(&service_manager.cmd)
            .args([&service_manager.stop, service])
            .output()?;

        SERVICES_TO_RESTORE.lock().unwrap().push(service.to_string());

        log::warn!("killed '{}'", service);
    }
}

Also, I am storing inside SERVICES_TO_RESTORE the services I killed to be able to restore them when exiting airgorah.

Can you confirm that sv status X returns exit code 0 if the service is running and a non 0 value if it is not ?

Can you tell me if it works fine on your system using runit ?

0323pin commented 7 months ago

Can you tell me if it works fine on your system using runit ?

I can confirm that it's working fine on Void, i.e. with runit. It should also work on other distros shipping with the runit init, Artix, AntiX, Devuan, ... but, of course I have no testing bed for those.

Can you confirm that sv status X returns exit code 0 if the service is running and a non 0 value if it is not ?

I understand what you are asking but, the output has a slightly different format. See below for the agetty-tty6 service.

[Fri Feb 02 08:54] pin@muslbox ~$ sudo sv status /var/service/*
Password:
run: /var/service/acpid: (pid 989) 283s
run: /var/service/agetty-tty1: (pid 978) 283s
run: /var/service/agetty-tty2: (pid 993) 283s
run: /var/service/agetty-tty3: (pid 990) 283s
run: /var/service/agetty-tty4: (pid 995) 283s
run: /var/service/agetty-tty5: (pid 994) 283s
run: /var/service/agetty-tty6: (pid 988) 283s
run: /var/service/alsa: (pid 979) 283s; run: log: (pid 976) 283s
run: /var/service/dbus: (pid 992) 283s; run: log: (pid 991) 283s
run: /var/service/dhcpcd: (pid 1009) 283s; run: log: (pid 1007) 283s
run: /var/service/nanoklogd: (pid 1006) 283s
run: /var/service/polkitd: (pid 972) 283s
run: /var/service/socklog-unix: (pid 987) 283s; run: log: (pid 986) 283s
run: /var/service/tlp: (pid 980) 283s; run: log: (pid 977) 283s
run: /var/service/udevd: (pid 983) 283s; run: log: (pid 982) 283s
run: /var/service/ufw: (pid 1011) 283s; run: log: (pid 1010) 283s
run: /var/service/uuidd: (pid 985) 283s; run: log: (pid 984) 283s
run: /var/service/wpa_supplicant: (pid 1012) 283s; run: log: (pid 1008) 283s
[Fri Feb 02 08:55] pin@muslbox ~$ sudo sv status /var/service/agetty-tty6
run: /var/service/agetty-tty6: (pid 988) 325s
[Fri Feb 02 08:55] pin@muslbox ~$ sudo sv down /var/service/agetty-tty6
[Fri Feb 02 08:55] pin@muslbox ~$ sudo sv status /var/service/agetty-tty6
down: /var/service/agetty-tty6: 2s, normally up

If you don't mind a suggestion, it would be nice to be able to see when reading the code that sv is related to the use of runit. I think this would become added value if/when, you decide to support other init/supervision suites, e.g. openrc or, dinit.

Thank you so much for supporting runit. Once you have this on a release, it would be nice with a Void package request :smiley:

It will take time but, eventually I would like to get this running on my dev environment, i.e. on NetBSD. There are still other missing pieces there, for example, we don't have macchanger in the package collection.

If you ever plan on expanding on the README, here are the dependencies I had to install on Void to be able to use airgorah:

Please feel free to close this for now, I can open a NetBSD specific issue once I'm there to test. Thank you!

martin-olivier commented 7 months ago

Hello @0323pin,

Thank you for your feedback :)

If you don't mind a suggestion, it would be nice to be able to see when reading the code that sv is related to the use of runit. I think this would become added value if/when, you decide to support other init/supervision suites, e.g. openrc or, dinit.

I have made it more explicit on the commit fix: made explicit that sv is related to the use of runit on the dev branch.

I will open a separate issue to also support dinit, openrc, and s6

Thank you so much for supporting runit. Once you have this on a release, it would be nice with a Void package request 😃

I will open a separate issue to add on the CI the generation of a void and alpine package on a release

It will take time but, eventually I would like to get this running on my dev environment, i.e. on NetBSD. There are still other missing pieces there, for example, we don't have macchanger in the package collection.

Sure, do not hesitate to open another issue to support NetBSD

BR