Skip to content

Commit 1d361f5

Browse files
jsteubejsteube
committed
Update cap2hccapx format to version 4
1 parent 8d8557f commit 1d361f5

File tree

2 files changed

+125
-45
lines changed

2 files changed

+125
-45
lines changed

‎CHANGES‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
- Skip essid if it's length 0 or if first by is zero-byte (hidden network)
44
- Allow reading broken .cap files even it has been cut short in the middle of a packet
5+
- Allow Message-Pair 1+2, 1+4, 2+3 and 3+4 in cap2hccapx.c
6+
- Update cap2hccapx format to version 4
57

68
* v1.5 -> v1.6
79

‎src/cap2hccapx.c‎

Lines changed: 123 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -246,10 +246,25 @@ typedef struct
246246

247247
#define EAPOL_TTL 2
248248

249-
#define EXC_PKT_NUM_1 1
250-
#define EXC_PKT_NUM_2 2
251-
#define EXC_PKT_NUM_3 3
252-
#define EXC_PKT_NUM_4 4
249+
typedef enum
250+
{
251+
EXC_PKT_NUM_1 = 1,
252+
EXC_PKT_NUM_2 = 2,
253+
EXC_PKT_NUM_3 = 3,
254+
EXC_PKT_NUM_4 = 4,
255+
256+
} exc_pkt_num_t;
257+
258+
typedef enum
259+
{
260+
MESSAGE_PAIR_M12E2 = 0,
261+
MESSAGE_PAIR_M14E4 = 1,
262+
MESSAGE_PAIR_M32E2 = 2,
263+
MESSAGE_PAIR_M32E3 = 3,
264+
MESSAGE_PAIR_M34E3 = 4,
265+
MESSAGE_PAIR_M34E4 = 5,
266+
267+
} message_pair_t;
253268

254269
#define BROADCAST_MAC "\xff\xff\xff\xff\xff\xff"
255270

@@ -288,13 +303,14 @@ lsearch_cnt_t excpkts_cnt = 0;
288303

289304
// output
290305

306+
#define HCCAPX_VERSION 4
291307
#define HCCAPX_SIGNATURE 0x58504348 // HCPX
292308

293309
struct hccapx
294310
{
295311
u32 signature;
296312
u32 version;
297-
u8 authenticated;
313+
u8 message_pair;
298314
u8 essid_len;
299315
u8 essid[32];
300316
u8 keyver;
@@ -445,49 +461,43 @@ static int handle_auth (const auth_packet_t *auth_packet, const int pkt_offset,
445461
}
446462
}
447463

448-
// process packet based on handshake exchange number
464+
// we're only interested in packets carrying a nonce
449465

450-
excpkt->excpkt_num = excpkt_num;
466+
char zero[32] = { 0 };
467+
468+
if (memcmp (auth_packet->wpa_key_nonce, zero, 32) == 0) return -1;
469+
470+
// copy data
451471

452472
memcpy (excpkt->nonce, auth_packet->wpa_key_nonce, 32);
453473

454474
excpkt->replay_counter = ap_replay_counter;
455475

456-
if (excpkt_num == EXC_PKT_NUM_1)
457-
{
458-
// nothing to do
459-
}
460-
else if (excpkt_num == EXC_PKT_NUM_2)
461-
{
462-
excpkt->eapol_len = sizeof (auth_packet_t) + ap_wpa_key_data_length;
476+
excpkt->excpkt_num = excpkt_num;
463477

464-
if ((pkt_offset + excpkt->eapol_len) > pkt_size) return -1;
478+
excpkt->eapol_len = sizeof (auth_packet_t) + ap_wpa_key_data_length;
465479

466-
if ((sizeof (auth_packet_t) + ap_wpa_key_data_length) > sizeof (excpkt->eapol)) return -1;
480+
if ((pkt_offset + excpkt->eapol_len) > pkt_size) return -1;
467481

468-
// we need to copy the auth_packet_t but have to clear the keymic
469-
auth_packet_t auth_packet_orig;
482+
if ((sizeof (auth_packet_t) + ap_wpa_key_data_length) > sizeof (excpkt->eapol)) return -1;
470483

471-
memcpy (&auth_packet_orig, auth_packet, sizeof (auth_packet_t));
484+
// we need to copy the auth_packet_t but have to clear the keymic
485+
auth_packet_t auth_packet_orig;
472486

473-
memset (auth_packet_orig.wpa_key_mic, 0, 16);
487+
memcpy (&auth_packet_orig, auth_packet, sizeof (auth_packet_t));
474488

475-
memcpy (excpkt->eapol, &auth_packet_orig, sizeof (auth_packet_t));
476-
memcpy (excpkt->eapol + sizeof (auth_packet_t), auth_packet + 1, ap_wpa_key_data_length);
489+
memset (auth_packet_orig.wpa_key_mic, 0, 16);
477490

478-
memcpy (excpkt->keymic, auth_packet->wpa_key_mic, 16);
491+
memcpy (excpkt->eapol, &auth_packet_orig, sizeof (auth_packet_t));
492+
memcpy (excpkt->eapol + sizeof (auth_packet_t), auth_packet + 1, ap_wpa_key_data_length);
479493

480-
excpkt->keyver = ap_key_information & WPA_KEY_INFO_TYPE_MASK;
481-
}
482-
else if (excpkt_num == EXC_PKT_NUM_3)
483-
{
484-
// reduce by one
494+
memcpy (excpkt->keymic, auth_packet->wpa_key_mic, 16);
485495

486-
excpkt->replay_counter--;
487-
}
488-
else if (excpkt_num == EXC_PKT_NUM_4)
496+
excpkt->keyver = ap_key_information & WPA_KEY_INFO_TYPE_MASK;
497+
498+
if ((excpkt_num == EXC_PKT_NUM_3) || (excpkt_num == EXC_PKT_NUM_4))
489499
{
490-
return -1;
500+
excpkt->replay_counter--;
491501
}
492502

493503
return 0;
@@ -676,7 +686,7 @@ static void process_packet (const u8 *packet, const pcap_pkthdr_t *header)
676686
{
677687
db_excpkt_add (&excpkt, header->tv_sec, header->tv_usec, ieee80211_hdr_3addr->addr2, ieee80211_hdr_3addr->addr1);
678688
}
679-
else if (excpkt.excpkt_num == EXC_PKT_NUM_2)
689+
else if ((excpkt.excpkt_num == EXC_PKT_NUM_2) || (excpkt.excpkt_num == EXC_PKT_NUM_4))
680690
{
681691
db_excpkt_add (&excpkt, header->tv_sec, header->tv_usec, ieee80211_hdr_3addr->addr1, ieee80211_hdr_3addr->addr2);
682692
}
@@ -908,14 +918,14 @@ int main (int argc, char *argv[])
908918
{
909919
const excpkt_t *excpkt_sta = excpkts + excpkt_sta_pos;
910920

911-
if (excpkt_sta->excpkt_num != EXC_PKT_NUM_2) continue;
921+
if ((excpkt_sta->excpkt_num != EXC_PKT_NUM_2) && (excpkt_sta->excpkt_num != EXC_PKT_NUM_4)) continue;
912922

913923
if (memcmp (excpkt_ap->mac_ap, excpkt_sta->mac_ap, 6) != 0) continue;
914924
if (memcmp (excpkt_ap->mac_sta, excpkt_sta->mac_sta, 6) != 0) continue;
915925

916926
if (excpkt_ap->replay_counter != excpkt_sta->replay_counter) continue;
917927

918-
if (excpkt_ap->excpkt_num == EXC_PKT_NUM_1)
928+
if (excpkt_ap->excpkt_num < excpkt_sta->excpkt_num)
919929
{
920930
if (excpkt_ap->tv_sec > excpkt_sta->tv_sec) continue;
921931

@@ -928,41 +938,109 @@ int main (int argc, char *argv[])
928938
if ((excpkt_sta->tv_sec + EAPOL_TTL) < excpkt_ap->tv_sec) continue;
929939
}
930940

931-
const u8 authenticated = (excpkt_ap->excpkt_num == EXC_PKT_NUM_3);
941+
u8 message_pair = 255;
932942

933-
printf (" --> STA=%02x:%02x:%02x:%02x:%02x:%02x, Authenticated=%u, Replay Counter=%" PRIu64 "\n",
943+
if ((excpkt_ap->excpkt_num == EXC_PKT_NUM_1) && (excpkt_sta->excpkt_num == EXC_PKT_NUM_2))
944+
{
945+
if (excpkt_sta->eapol_len > 0)
946+
{
947+
message_pair = MESSAGE_PAIR_M12E2;
948+
}
949+
else
950+
{
951+
continue;
952+
}
953+
}
954+
else if ((excpkt_ap->excpkt_num == EXC_PKT_NUM_1) && (excpkt_sta->excpkt_num == EXC_PKT_NUM_4))
955+
{
956+
if (excpkt_sta->eapol_len > 0)
957+
{
958+
message_pair = MESSAGE_PAIR_M14E4;
959+
}
960+
else
961+
{
962+
continue;
963+
}
964+
}
965+
else if ((excpkt_ap->excpkt_num == EXC_PKT_NUM_3) && (excpkt_sta->excpkt_num == EXC_PKT_NUM_2))
966+
{
967+
if (excpkt_sta->eapol_len > 0)
968+
{
969+
message_pair = MESSAGE_PAIR_M32E2;
970+
}
971+
else if (excpkt_ap->eapol_len > 0)
972+
{
973+
message_pair = MESSAGE_PAIR_M32E3;
974+
}
975+
else
976+
{
977+
continue;
978+
}
979+
}
980+
else if ((excpkt_ap->excpkt_num == EXC_PKT_NUM_3) && (excpkt_sta->excpkt_num == EXC_PKT_NUM_4))
981+
{
982+
if (excpkt_ap->eapol_len > 0)
983+
{
984+
message_pair = MESSAGE_PAIR_M34E3;
985+
}
986+
else if (excpkt_sta->eapol_len > 0)
987+
{
988+
message_pair = MESSAGE_PAIR_M34E4;
989+
}
990+
else
991+
{
992+
continue;
993+
}
994+
}
995+
else
996+
{
997+
fprintf (stderr, "BUG!!! AP:%d STA:%d\n", excpkt_ap->excpkt_num, excpkt_sta->excpkt_num);
998+
}
999+
1000+
printf (" --> STA=%02x:%02x:%02x:%02x:%02x:%02x, Message Pair=%u, Replay Counter=%" PRIu64 "\n",
9341001
excpkt_sta->mac_sta[0],
9351002
excpkt_sta->mac_sta[1],
9361003
excpkt_sta->mac_sta[2],
9371004
excpkt_sta->mac_sta[3],
9381005
excpkt_sta->mac_sta[4],
9391006
excpkt_sta->mac_sta[5],
940-
authenticated,
1007+
message_pair,
9411008
excpkt_sta->replay_counter);
9421009

9431010
// finally, write hccapx
9441011

9451012
hccapx_t hccapx;
9461013

9471014
hccapx.signature = HCCAPX_SIGNATURE;
948-
hccapx.version = 3;
1015+
hccapx.version = HCCAPX_VERSION;
9491016

950-
hccapx.authenticated = authenticated;
1017+
hccapx.message_pair = message_pair;
9511018

9521019
hccapx.essid_len = essid->essid_len;
9531020
memcpy (&hccapx.essid, essid->essid, 32);
9541021

955-
hccapx.keyver = excpkt_sta->keyver;
956-
memcpy (&hccapx.keymic, excpkt_sta->keymic, 16);
957-
9581022
memcpy (&hccapx.mac_ap, excpkt_ap->mac_ap, 6);
9591023
memcpy (&hccapx.nonce_ap, excpkt_ap->nonce, 32);
9601024

9611025
memcpy (&hccapx.mac_sta, excpkt_sta->mac_sta, 6);
9621026
memcpy (&hccapx.nonce_sta, excpkt_sta->nonce, 32);
9631027

964-
hccapx.eapol_len = excpkt_sta->eapol_len;
965-
memcpy (&hccapx.eapol, excpkt_sta->eapol, 256);
1028+
if (excpkt_sta->eapol_len > 0)
1029+
{
1030+
hccapx.keyver = excpkt_sta->keyver;
1031+
memcpy (&hccapx.keymic, excpkt_sta->keymic, 16);
1032+
1033+
hccapx.eapol_len = excpkt_sta->eapol_len;
1034+
memcpy (&hccapx.eapol, excpkt_sta->eapol, 256);
1035+
}
1036+
else
1037+
{
1038+
hccapx.keyver = excpkt_ap->keyver;
1039+
memcpy (&hccapx.keymic, excpkt_ap->keymic, 16);
1040+
1041+
hccapx.eapol_len = excpkt_ap->eapol_len;
1042+
memcpy (&hccapx.eapol, excpkt_ap->eapol, 256);
1043+
}
9661044

9671045
fwrite (&hccapx, sizeof (hccapx_t), 1, fp);
9681046

0 commit comments

Comments
 (0)