-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathhcxpcaptool.c
7760 lines (7331 loc) · 196 KB
/
hcxpcaptool.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#define _GNU_SOURCE
#include <ctype.h>
#include <errno.h>
#include <stdarg.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdbool.h>
#include <string.h>
#include <getopt.h>
#include <time.h>
#include <unistd.h>
#include <netinet/in.h>
#include <sys/time.h>
#include <sys/types.h>
#include <openssl/sha.h>
#include <openssl/evp.h>
#include <openssl/hmac.h>
#include <openssl/cmac.h>
#if defined (__APPLE__) || defined(__OpenBSD__)
#if defined(__OpenBSD__)
#define PATH_MAX 1024 /* as defined in sys/syslimits.h */
#endif
#include <libgen.h>
#include <sys/socket.h>
#else
#include <stdio_ext.h>
#endif
#ifdef __linux__
#include <linux/limits.h>
#endif
#include "include/hcxpcaptool.h"
#include "include/ieee80211.old.c"
#include "include/strings.c"
#include "include/byteops.c"
#include "include/fileops.c"
#include "include/hashops.c"
#include "include/pcap.c"
#include "include/gzops.c"
#include "include/hashcatops.c"
#include "include/johnops.c"
#define MAX_TV_DIFF 600000000llu
#define MAX_RC_DIFF 8
#define MAX_ESSID_CHANGES 1
#define HCXT_REPLAYCOUNTGAP 1
#define HCXT_TIMEGAP 2
#define HCXT_MAX_ESSID_CHANGES 3
#define HCXT_NETNTLM_OUT 4
#define HCXT_MD5_OUT 5
#define HCXT_MD5_JOHN_OUT 6
#define HCXT_TACACSP_OUT 7
#define HCXT_EAPOL_OUT 8
#define HCXT_NETWORK_OUT 9
#define HCXT_HEXDUMP_OUT 10
#define HCXT_HCCAP_OUT 11
#define HCXT_HCCAP_OUT_RAW 12
#define HCXT_FILTER_MAC 13
#define HCXT_IGNORE_FAKE_FRAMES 14
#define HCXT_IGNORE_ZEROED_PMKS 15
#define HCXT_IGNORE_REPLAYCOUNT 16
#define HCXT_IGNORE_MAC 17
#define HCXT_PREFIX_OUT 18
#define HCXT_NMEA_NAME 19
#define HCXT_WPA12_OUT 'w'
#define HCXT_HCCAPX_OUT 'o'
#define HCXT_HCCAPX_OUT_RAW 'O'
#define HCXT_HC_OUT_PMKID 'k'
#define HCXT_HC_OUT_PMKID_RAW 'K'
#define HCXT_HC_OUT_PMKID_OLD 'z'
#define HCXT_HC_OUT_PMKID_RAW_OLD 'Z'
#define HCXT_JOHN_OUT 'j'
#define HCXT_JOHN_OUT_RAW 'J'
#define HCXT_ESSID_OUT 'E'
#define HCXT_STAESSID_OUT 'X'
#define HCXT_TRAFFIC_OUT 'T'
#define HCXT_GPX_OUT 'g'
#define HCXT_IDENTITY_OUT 'I'
#define HCXT_USERNAME_OUT 'U'
#define HCXT_IMSI_OUT 'M'
#define HCXT_DEVICEINFO_OUT 'D'
#define HCXT_PMK_OUT 'P'
#define HCXT_VERBOSE_OUT 'V'
#define HCXT_HELP 'h'
#define HCXT_VERSION 'v'
#define GPSDDATA_MAX 1536
void process80211packet(uint32_t tv_sec, uint32_t tv_usec, uint32_t caplen, uint8_t *packet);
/*===========================================================================*/
/* global var */
bool hexmodeflag;
bool verboseflag;
bool filtermacflag;
bool fakeframeflag;
bool zeroedpmkflag;
bool fcsflag;
bool wantrawflag;
bool gpxflag;
bool nmeaflag;
bool tscleanflag;
bool tssameflag;
bool replaycountcheckflag;
bool maccheckflag;
bool hcxdumptoolcbflag;
bool hcxdumptoolcoflag;
unsigned long long int maxtvdiff;
unsigned long long int maxrcdiff;
int maxessidchanges;
unsigned long long int apstaessidcount;
apstaessidl_t *apstaessidliste;
unsigned long long int apstaessidcountcleaned;
apstaessidl_t *apstaessidlistecleaned;
unsigned long long int eapolcount;
eapoll_t *eapolliste;
pmkidl_t *pmkidliste;
unsigned long long int handshakecount;
unsigned long long int handshakeaplesscount;
hcxl_t *handshakeliste;
unsigned long long int rawhandshakecount;
unsigned long long int rawhandshakeaplesscount;
hcxl_t *rawhandshakeliste;
unsigned long long int pmkidallcount;
unsigned long long int pmkidcount;
unsigned long long int pmkidapcount;
unsigned long long int pmkidstacount;
unsigned long long int zeroedpmkcount;
unsigned long long int zeroedpmkidcount;
unsigned long long int leapcount;
leapl_t *leapliste;
unsigned long long int leap2count;
leapl_t *leap2liste;
unsigned long long int md5count;
md5l_t *md5liste;
unsigned long long int tacacspcount;
tacacspl_t *tacacspliste;
unsigned long long int gpsdframecount;
unsigned long long int gpsnmeaframecount;
unsigned long long int fcsframecount;
unsigned long long int wdsframecount;
unsigned long long int beaconframecount;
unsigned long long int beaconframedamagedcount;
unsigned long long int wpsframecount;
unsigned long long int deviceinfoframecount;
unsigned long long int meshidframecount;
unsigned long long int proberequestframecount;
unsigned long long int proberesponseframecount;
unsigned long long int associationrequestframecount;
unsigned long long int associationresponseframecount;
unsigned long long int reassociationrequestframecount;
unsigned long long int reassociationresponseframecount;
unsigned long long int authenticationunknownframecount;
unsigned long long int authenticationosframecount;
unsigned long long int authenticationskframecount;
unsigned long long int authenticationfbtframecount;
unsigned long long int authenticationsaeframecount;
unsigned long long int authenticationfilsframecount;
unsigned long long int authenticationfilspfsframecount;
unsigned long long int authenticationfilspkframecount;
unsigned long long int authenticationnetworkeapframecount;
unsigned long long int authenticationbroadcomframecount;
unsigned long long int authenticationsonosframecount;
unsigned long long int authenticationappleframecount;
unsigned long long int authenticationnetgearframecount;
unsigned long long int authenticationwiliboxframecount;
unsigned long long int authenticationciscoframecount;
unsigned long long int deauthenticationframecount;
unsigned long long int disassociationframecount;
unsigned long long int actionframecount;
unsigned long long int atimframecount;
unsigned long long int eapolframecount;
unsigned long long int eapoloversizedframecount;
unsigned long long int eapolwpaakmframecount;
unsigned long long int eapolwpa1framecount;
unsigned long long int eapolwpa2framecount;
unsigned long long int eapolwpa2kv3framecount;
unsigned long long int eapolpmkidwpaakmframecount;
unsigned long long int eapolpmkidwpa1framecount;
unsigned long long int eapolpmkidwpa2framecount;
unsigned long long int eapolpmkidwpa2kv3framecount;
unsigned long long int groupkeyframecount;
unsigned long long int rc4descriptorframecount;
unsigned long long int eapolstartframecount;
unsigned long long int eapollogoffframecount;
unsigned long long int eapolasfframecount;
unsigned long long int eapolmkaframecount;
unsigned long long int eapframecount;
unsigned long long int ipv4framecount;
unsigned long long int ipv6framecount;
unsigned long long int icmp4framecount;
unsigned long long int icmp6framecount;
unsigned long long int tcpframecount;
unsigned long long int udpframecount;
unsigned long long int greframecount;
unsigned long long int chapframecount;
unsigned long long int papframecount;
unsigned long long int tacacspframecount;
unsigned long long int radiusframecount;
unsigned long long int dhcpframecount;
unsigned long long int tzspframecount;
unsigned long long int dhcp6framecount;
unsigned long long int wepframecount;
unsigned long long int tzspframecount;
unsigned long long int tzspethernetframecount;
unsigned long long int tzsptokenringframecount;
unsigned long long int tzspslipframecount;
unsigned long long int tzsppppframecount;
unsigned long long int tzspfddiframecount;
unsigned long long int tzsprawframecount;
unsigned long long int tzsp80211framecount;
unsigned long long int tzsp80211prismframecount;
unsigned long long int tzsp80211avsframecount;
static long double lat = 0;
static long double lon = 0;
static long double alt = 0;
static int nmealen = 0;
static int day = 0;
static int month = 0;
static int year = 0;
static int hour = 0;
static int minute = 0;
static int second = 0;
char *hexmodeoutname;
char *wpa12bestoutname;
char *hccapxbestoutname;
char *hccapxrawoutname;
char *hcpmkidoutname;
char *hcpmkidrawoutname;
char *hcpmkidoldoutname;
char *hcpmkidrawoldoutname;
char *hccapbestoutname;
char *hccaprawoutname;
char *johnbestoutname;
char *johnrawoutname;
char *essidoutname;
char *staessidoutname;
char *trafficoutname;
char *gpxoutname;
char *nmeaoutname;
char *pmkoutname;
char *identityoutname;
char *useroutname;
char *imsioutname;
char *deviceinfooutname;
char *netntlm1outname;
char *md5outname;
char *md5johnoutname;
char *tacacspoutname;
char *eapoloutname;
char *networkoutname;
char *prefixoutname;
FILE *fhhexmode;
FILE *fhgpx;
FILE *fhnmea;
FILE *fheapol;
FILE *fhnetwork;
int endianess;
int pcapreaderrors;
unsigned long long int rawpacketcount;
unsigned long long int skippedpacketcount;
uint16_t versionmajor;
uint16_t versionminor;
uint16_t dltlinktype;
struct timeval mintv;
struct timeval maxtv;
uint8_t myaktap[6];
uint8_t myaktsta[6];
uint8_t myaktanonce[32];
uint8_t myaktsnonce[32];
uint64_t myaktreplaycount;
uint8_t filtermac[6];
char pcapnghwinfo[1024];
char pcapngosinfo[1024];
char pcapngapplinfo[1024];
char pcapngoptioninfo[1024];
uint8_t pcapngdeviceinfo[6];
char weakcandidate[64];
int exeaptype[256];
char nmeasentence[NMEA_MAX];
/*===========================================================================*/
/* global init */
bool globalinit()
{
hexmodeoutname = NULL;
wpa12bestoutname = NULL;
hccapxbestoutname = NULL;
hccapxrawoutname = NULL;
hcpmkidoutname = NULL;
hcpmkidrawoutname = NULL;
hcpmkidoldoutname = NULL;
hcpmkidrawoldoutname = NULL;
hccapbestoutname = NULL;
hccaprawoutname = NULL;
johnbestoutname = NULL;
johnrawoutname = NULL;
essidoutname = NULL;
staessidoutname = NULL;
trafficoutname = NULL;
gpxoutname = NULL;
nmeaoutname = NULL;
pmkoutname = NULL;
identityoutname = NULL;
useroutname = NULL;
imsioutname = NULL;
deviceinfooutname = NULL;
netntlm1outname = NULL;
md5outname = NULL;
md5johnoutname = NULL;
tacacspoutname = NULL;
eapoloutname = NULL;
networkoutname = NULL;
prefixoutname = NULL;
verboseflag = false;
hexmodeflag = false;
wantrawflag = false;
filtermacflag = false;
fakeframeflag = false;
zeroedpmkflag = false;
replaycountcheckflag = false;
maccheckflag = false;
gpxflag = false;
nmeaflag = false;
maxtvdiff = MAX_TV_DIFF;
maxrcdiff = MAX_RC_DIFF;
maxessidchanges = MAX_ESSID_CHANGES;
setbuf(stdout, NULL);
srand(time(NULL));
memset(&pcapngdeviceinfo, 0, 6);
memset(&myaktap, 0, 6);
memset(&myaktanonce, 0, 32);
memset(&myaktsta, 0, 6);
memset(&myaktsnonce, 0, 32);
memset(&weakcandidate, 0, 64);
memset(&nmeasentence, 0, NMEA_MAX);
return true;
}
/*===========================================================================*/
char *geteaptypestring(int exapt)
{
switch(exapt)
{
case EAP_TYPE_ID: return "EAP type ID";
case EAP_TYPE_NAK: return "Legacy Nak";
case EAP_TYPE_MD5: return "MD5-Challenge";
case EAP_TYPE_OTP: return "One-Time Password (OTP)";
case EAP_TYPE_GTC: return "Generic Token Card (GTC)";
case EAP_TYPE_RSA: return "RSA Public Key Authentication";
case EAP_TYPE_EXPAND: return "WPS Authentication";
case EAP_TYPE_LEAP: return "EAP-Cisco Wireless Authentication";
case EAP_TYPE_DSS: return "DSS Unilateral";
case EAP_TYPE_KEA: return "KEA";
case EAP_TYPE_KEA_VALIDATE: return "KEA-VALIDATE";
case EAP_TYPE_TLS: return "EAP-TLS Authentication";
case EAP_TYPE_AXENT: return "Defender Token (AXENT)";
case EAP_TYPE_RSA_SSID: return "RSA Security SecurID EAP";
case EAP_TYPE_RSA_ARCOT: return "Arcot Systems EAP";
case EAP_TYPE_SIM: return "EAP-SIM (GSM Subscriber Modules) Authentication";
case EAP_TYPE_SRP_SHA1: return "SRP-SHA1 Authentication";
case EAP_TYPE_TTLS: return "EAP-TTLS Authentication";
case EAP_TYPE_RAS: return "Remote Access Service";
case EAP_TYPE_AKA: return "UMTS Authentication and Key Agreement (EAP-AKA)";
case EAP_TYPE_3COMEAP: return "EAP-3Com Wireless Authentication";
case EAP_TYPE_PEAP: return "PEAP Authentication";
case EAP_TYPE_MSEAP: return "MS-EAP Authentication";
case EAP_TYPE_MAKE: return "Mutual Authentication w/Key Exchange (MAKE)";
case EAP_TYPE_CRYPTOCARD: return "CRYPTOCard";
case EAP_TYPE_MSCHAPV2: return "EAP-MSCHAP-V2 Authentication";
case EAP_TYPE_DYNAMICID: return "DynamicID";
case EAP_TYPE_ROB: return "Rob EAP";
case EAP_TYPE_POTP: return "Protected One-Time Password";
case EAP_TYPE_MSTLV: return "MS-Authentication-TLV";
case EAP_TYPE_SENTRI: return "SentriNET";
case EAP_TYPE_AW: return "EAP-Actiontec Wireless Authentication";
case EAP_TYPE_CSBA: return "Cogent Systems Biometrics Authentication EAP";
case EAP_TYPE_AIRFORT: return "AirFortress EAP";
case EAP_TYPE_HTTPD: return "EAP-HTTP Digest";
case EAP_TYPE_SS: return "SecureSuite EAP";
case EAP_TYPE_DC: return "DeviceConnect EAP";
case EAP_TYPE_SPEKE: return "EAP-SPEKE Authentication";
case EAP_TYPE_MOBAC: return "EAP-MOBAC Authentication";
case EAP_TYPE_FAST: return "FAST Authentication";
case EAP_TYPE_ZLXEAP: return "ZoneLabs EAP (ZLXEAP)";
case EAP_TYPE_LINK: return "EAP-Link Authentication";
case EAP_TYPE_PAX: return "EAP-PAX Authentication";
case EAP_TYPE_PSK: return "EAP-PSK Authentication";
case EAP_TYPE_SAKE: return "EAP-SAKE Authentication";
case EAP_TYPE_IKEV2: return "EAP-IKEv2 Authentication";
case EAP_TYPE_AKA1: return "EAP-AKA Authentication";
case EAP_TYPE_GPSK: return "EAP-GPSK Authentication";
case EAP_TYPE_PWD: return "EAP-pwd Authentication";
case EAP_TYPE_EKE1: return "EAP-EKE Version 1 Authentication";
case EAP_TYPE_PTEAP: return "EAP Method Type for PT-EAP Authentication";
case EAP_TYPE_TEAP: return "TEAP Authentication";
case EAP_TYPE_EXPERIMENTAL: return "Experimental Authentication";
default: return "unknown authentication type";
}
return "unknown authentication type";
}
/*===========================================================================*/
char *getdltstring(int networktype)
{
switch(networktype)
{
case DLT_NULL: return "DLT_NULL";
case DLT_EN10MB: return "DLT_EN10MB";
case DLT_AX25: return "DLT_AX25";
case DLT_IEEE802: return "DLT_IEEE802";
case DLT_ARCNET: return "DLT_ARCNET";
case DLT_SLIP: return "DLT_SLIP";
case DLT_PPP: return "DLT_PPP";
case DLT_FDDI: return "DLT_FDDI";
case DLT_PPP_SERIAL: return "DLT_PPP_SERIAL";
case DLT_PPP_ETHER: return "DLT_PPP_ETHER";
case DLT_ATM_RFC1483: return "DLT_ATM_RFC1483";
case DLT_RAW: return "DLT_RAW";
case DLT_C_HDLC: return "DLT_C_HDLC";
case DLT_IEEE802_11: return "DLT_IEEE802_11";
case DLT_FRELAY: return "DLT_FRELAY";
case DLT_LOOP: return "DLT_LOOP";
case DLT_LINUX_SLL: return "DLT_LINUX_SLL";
case DLT_LTALK: return "DLT_LTALK";
case DLT_PFLOG: return "DLT_PFLOG";
case DLT_PRISM_HEADER: return "DLT_PRISM_HEADER";
case DLT_IP_OVER_FC: return "DLT_IP_OVER_FC";
case DLT_SUNATM: return "DLT_SUNATM";
case DLT_IEEE802_11_RADIO: return "DLT_IEEE802_11_RADIO";
case DLT_ARCNET_LINUX: return "DLT_ARCNET_LINUX";
case DLT_APPLE_IP_OVER_IEEE1394: return "DLT_APPLE_IP_OVER_IEEE1394";
case DLT_MTP2_WITH_PHDR: return "DLT_MTP2_WITH_PHDR";
case DLT_MTP2: return "DLT_MTP2";
case DLT_MTP3: return "DLT_MTP3";
case DLT_SCCP: return "DLT_SCCP";
case DLT_DOCSIS: return "DLT_DOCSIS";
case DLT_LINUX_IRDA: return "DLT_LINUX_IRDA";
case DLT_IEEE802_11_RADIO_AVS: return "DLT_IEEE802_11_RADIO_AVS";
case DLT_BACNET_MS_TP: return "DLT_BACNET_MS_TP";
case DLT_PPP_PPPD: return "DLT_PPP_PPPD";
case DLT_GPRS_LLC: return "DLT_GPRS_LLC";
case DLT_GPF_T: return "DLT_GPF_T";
case DLT_GPF_F: return "DLT_GPF_F";
case DLT_LINUX_LAPD: return "DLT_LINUX_LAPD";
case DLT_BLUETOOTH_HCI_H4: return "DLT_BLUETOOTH_HCI_H4";
case DLT_USB_LINUX: return "DLT_USB_LINUX";
case DLT_PPI: return "DLT_PPI";
case DLT_IEEE802_15_4: return "DLT_IEEE802_15_4";
case DLT_SITA: return "DLT_SITA";
case DLT_ERF: return "DLT_ERF";
case DLT_BLUETOOTH_HCI_H4_WITH_PHDR: return "DLT_BLUETOOTH_HCI_H4_WITH_PHDR";
case DLT_AX25_KISS: return "DLT_AX25_KISS";
case DLT_LAPD: return "DLT_LAPD";
case DLT_PPP_WITH_DIR: return "DLT_PPP_WITH_DIR";
case DLT_C_HDLC_WITH_DIR: return "DLT_C_HDLC_WITH_DIR";
case DLT_FRELAY_WITH_DIR: return "DLT_FRELAY_WITH_DIR";
case DLT_IPMB_LINUX: return "DLT_IPMB_LINUX";
case DLT_IEEE802_15_4_NONASK_PHY: return "DLT_IEEE802_15_4_NONASK_PHY";
case DLT_USB_LINUX_MMAPPED: return "DLT_USB_LINUX_MMAPPED";
case DLT_FC_2: return "DLT_FC_2";
case DLT_FC_2_WITH_FRAME_DELIMS: return "DLT_FC_2_WITH_FRAME_DELIMS";
case DLT_IPNET: return "DLT_IPNET";
case DLT_CAN_SOCKETCAN: return "DLT_CAN_SOCKETCAN";
case DLT_IPV4: return "DLT_IPV4";
case DLT_IPV6: return "DLT_IPV6";
case DLT_IEEE802_15_4_NOFCS: return "DLT_IEEE802_15_4_NOFCS";
case DLT_DBUS: return "DLT_DBUS";
case DLT_DVB_CI: return "DLT_DVB_CI";
case DLT_MUX27010: return "DLT_MUX27010";
case DLT_STANAG_5066_D_PDU: return "DLT_STANAG_5066_D_PDU";
case DLT_NFLOG: return "DLT_NFLOG";
case DLT_NETANALYZER: return "DLT_NETANALYZER";
case DLT_NETANALYZER_TRANSPARENT: return "DLT_NETANALYZER_TRANSPARENT";
case DLT_IPOIB: return "DLT_IPOIB";
case DLT_MPEG_2_TS: return "DLT_MPEG_2_TS";
case DLT_NG40: return "DLT_NG40";
case DLT_NFC_LLCP: return "DLT_NFC_LLCP";
case DLT_INFINIBAND: return "DLT_INFINIBAND";
case DLT_SCTP: return "DLT_SCTP";
case DLT_USBPCAP: return "DLT_USBPCAP";
case DLT_RTAC_SERIAL: return "DLT_RTAC_SERIAL";
case DLT_BLUETOOTH_LE_LL: return "DLT_BLUETOOTH_LE_LL";
case DLT_NETLINK: return "DLT_NETLINK";
case DLT_BLUETOOTH_LINUX_MONITOR: return "DLT_BLUETOOTH_LINUX_MONITOR";
case DLT_BLUETOOTH_BREDR_BB: return "DLT_BLUETOOTH_BREDR_BB";
case DLT_BLUETOOTH_LE_LL_WITH_PHDR: return "DLT_BLUETOOTH_LE_LL_WITH_PHDR";
case DLT_PROFIBUS_DL: return "DLT_PROFIBUS_DL";
case DLT_PKTAP: return "DLT_PKTAP";
case DLT_EPON: return "DLT_EPON";
case DLT_IPMI_HPM_2: return "DLT_IPMI_HPM_2";
case DLT_ZWAVE_R1_R2: return "DLT_ZWAVE_R1_R2";
case DLT_ZWAVE_R3: return "DLT_ZWAVE_R3";
case DLT_WATTSTOPPER_DLM: return "DLT_WATTSTOPPER_DLM";
case DLT_ISO_14443: return "DLT_ISO_14443";
case DLT_RDS: return "DLT_RDS";
default: return "unknown network type";
}
return "unknown network type";
}
/*===========================================================================*/
char *geterrorstat(int errorstat)
{
switch(errorstat)
{
case 0: return "flawless";
case 1: return "yes";
default: return "unknown";
}
return "unknown";
}
/*===========================================================================*/
char *getendianessstring(int endianess)
{
switch(endianess)
{
case 0: return "little endian";
case 1: return "big endian";
default: return "unknown endian";
}
return "unknow nendian";
}
/*===========================================================================*/
void printcapstatus(char *pcaptype, char *pcapinname, int version_major, int version_minor, int networktype, int endianess, unsigned long long int rawpacketcount, unsigned long long int skippedpacketcount, int pcapreaderrors, bool tscleanflag)
{
int p;
static char *hcxsignedinfo = "(custom options)";
static char *hcxunsignedinfo = "(no custom options)";
static char mintimestring[32];
static char maxtimestring[32];
static char *hcxsignedptr;
hcxsignedptr = hcxsignedinfo;
if(hcxdumptoolcbflag == false)
{
hcxsignedptr = hcxunsignedinfo;
}
strftime(mintimestring, 32, "%d.%m.%Y %H:%M:%S", gmtime(&mintv.tv_sec));
strftime(maxtimestring, 32, "%d.%m.%Y %H:%M:%S", gmtime(&maxtv.tv_sec));
printf( " \n"
"summary capture file: \n"
"---------------------\n"
"file name........................: %s\n"
"file type........................: %s %d.%d\n"
"file hardware information........: %s\n"
"capture device vendor information: %02x%02x%02x\n"
"file os information..............: %s\n"
"file application information.....: %s %s\n"
"network type.....................: %s (%d)\n"
"endianness.......................: %s\n"
"read errors......................: %s\n"
"minimum time stamp...............: %s (GMT)\n"
"maximum time stamp...............: %s (GMT)\n"
"packets inside...................: %llu\n"
"skipped damaged packets..........: %llu\n"
"packets with GPS NMEA data.......: %llu\n"
"packets with GPS data (JSON old).: %llu\n"
"packets with FCS.................: %llu\n"
, basename(pcapinname), pcaptype, version_major, version_minor, pcapnghwinfo, pcapngdeviceinfo[0], pcapngdeviceinfo[1], pcapngdeviceinfo[2], pcapngosinfo, pcapngapplinfo, hcxsignedptr, getdltstring(networktype), networktype, getendianessstring(endianess), geterrorstat(pcapreaderrors), mintimestring, maxtimestring, rawpacketcount, skippedpacketcount, gpsnmeaframecount, gpsdframecount, fcsframecount);
if(tscleanflag == true)
{
printf("warning..........................: zero value time stamps detected\n"
" this prevents EAPOL timeout calculation\n");
}
if(tssameflag == true)
{
printf("warning..........................: EAPOL packet time stamps with the same value detected\n"
" this prevents EAPOL timeout calculation\n");
}
if(wdsframecount != 0)
{
printf("WDS packets......................: %llu\n", wdsframecount);
}
if(beaconframecount != 0)
{
printf("beacons (total)..................: %llu\n", beaconframecount);
}
if(beaconframedamagedcount != 0)
{
printf("beacons (damaged)................: %llu\n", beaconframedamagedcount);
}
if(wpsframecount != 0)
{
printf("beacons (WPS info inside)........: %llu\n", wpsframecount);
}
if(deviceinfoframecount != 0)
{
printf("beacons (device info inside).....: %llu\n", deviceinfoframecount);
}
if(meshidframecount != 0)
{
printf("beacons (MESH-ID inside).........: %llu\n", meshidframecount);
}
if(proberequestframecount != 0)
{
printf("probe requests...................: %llu\n", proberequestframecount);
}
if(proberesponseframecount != 0)
{
printf("probe responses..................: %llu\n", proberesponseframecount);
}
if(associationrequestframecount != 0)
{
printf("association requests.............: %llu\n", associationrequestframecount);
}
if(associationresponseframecount != 0)
{
printf("association responses............: %llu\n", associationresponseframecount);
}
if(reassociationrequestframecount != 0)
{
printf("reassociation requests...........: %llu\n", reassociationrequestframecount);
}
if(reassociationresponseframecount != 0)
{
printf("reassociation responses..........: %llu\n", reassociationresponseframecount);
}
if(authenticationunknownframecount != 0)
{
printf("authentications (UNKNOWN)........: %llu\n", authenticationunknownframecount);
}
if(authenticationosframecount != 0)
{
printf("authentications (OPEN SYSTEM)....: %llu\n", authenticationosframecount);
}
if(authenticationskframecount != 0)
{
printf("authentications (SHARED KEY).....: %llu\n", authenticationskframecount);
}
if(authenticationfbtframecount != 0)
{
printf("authentications (FBT)............: %llu\n", authenticationfbtframecount);
}
if(authenticationsaeframecount != 0)
{
printf("authentications (SAE)............: %llu\n", authenticationsaeframecount);
}
if(authenticationfilsframecount != 0)
{
printf("authentications (FILS)...........: %llu\n", authenticationfilsframecount);
}
if(authenticationfilspfsframecount != 0)
{
printf("authentications (FILS PFS).......: %llu\n", authenticationfilspfsframecount);
}
if(authenticationfilspkframecount != 0)
{
printf("authentications (FILS PK)........: %llu\n", authenticationfilspkframecount);
}
if(authenticationnetworkeapframecount != 0)
{
printf("authentications (NETWORK EAP)....: %llu\n", authenticationnetworkeapframecount);
}
if(authenticationbroadcomframecount != 0)
{
printf("authentications (BROADCOM).......: %llu\n", authenticationbroadcomframecount);
}
if(authenticationsonosframecount != 0)
{
printf("authentications (SONOS)..........: %llu\n", authenticationsonosframecount);
}
if(authenticationappleframecount != 0)
{
printf("authentications (APPLE)..........: %llu\n", authenticationappleframecount);
}
if(authenticationnetgearframecount != 0)
{
printf("authentications (NETGEAR)........: %llu\n", authenticationnetgearframecount);
}
if(authenticationwiliboxframecount != 0)
{
printf("authentications (WILIBOX)........: %llu\n", authenticationwiliboxframecount);
}
if(authenticationciscoframecount != 0)
{
printf("authentications (CISCO)..........: %llu\n", authenticationciscoframecount);
}
if(deauthenticationframecount != 0)
{
printf("deauthentications................: %llu\n", deauthenticationframecount);
}
if(disassociationframecount != 0)
{
printf("disassociations..................: %llu\n", disassociationframecount);
}
if(actionframecount != 0)
{
printf("action packets...................: %llu\n", actionframecount);
}
if(atimframecount != 0)
{
printf("ATIM packets.....................: %llu\n", atimframecount);
}
if(eapolframecount != 0)
{
printf("EAPOL packets (total)............: %llu\n", eapolframecount);
}
if(eapoloversizedframecount != 0)
{
printf("EAPOL packets (oversized)........: %llu\n", eapoloversizedframecount);
}
if(eapolwpaakmframecount != 0)
{
printf("EAPOL packets (AKM defined)......: %llu\n", eapolwpaakmframecount);
}
if(eapolwpa1framecount != 0)
{
printf("EAPOL packets (WPA1).............: %llu\n", eapolwpa1framecount);
}
if(eapolwpa2framecount != 0)
{
printf("EAPOL packets (WPA2).............: %llu\n", eapolwpa2framecount);
}
if(eapolwpa2kv3framecount != 0)
{
printf("EAPOL packets (WPA2 kever 3).....: %llu\n", eapolwpa2kv3framecount);
}
if(zeroedpmkidcount != 0)
{
printf("PMKIDs (zeroed and useless)......: %llu\n", zeroedpmkidcount);
}
if(pmkidallcount != 0)
{
printf("PMKIDs (not zeroed - total)......: %llu\n", pmkidallcount);
}
if(eapolpmkidwpaakmframecount != 0)
{
printf("PMKIDs (AKM defined).............: %llu\n", eapolpmkidwpaakmframecount);
}
if(eapolpmkidwpa1framecount != 0)
{
printf("PMKIDs (WPA1)....................: %llu\n", eapolpmkidwpa1framecount);
}
if(eapolpmkidwpa2framecount != 0)
{
printf("PMKIDs (WPA2)....................: %llu\n", eapolpmkidwpa2framecount);
}
if(eapolpmkidwpa2kv3framecount != 0)
{
printf("PMKIDs (WPA2 keyver 3)...........: %llu\n", eapolpmkidwpa2kv3framecount);
}
if(pmkidapcount != 0)
{
printf("PMKIDs from access points........: %llu\n", pmkidapcount);
}
if(pmkidstacount != 0)
{
printf("PMKIDs from stations.............: %llu\n", pmkidstacount);
}
if(rc4descriptorframecount != 0)
{
printf("EAPOL RC4 KEYs...................: %llu\n", rc4descriptorframecount);
}
if(groupkeyframecount != 0)
{
printf("EAPOL GROUP KEYs.................: %llu\n", groupkeyframecount);
}
if(eapframecount != 0)
{
printf("EAP packets......................: %llu\n", eapframecount);
}
if(eapolstartframecount != 0)
{
printf("EAP START packets................: %llu\n", eapolstartframecount);
}
if(eapollogoffframecount != 0)
{
printf("EAP LOGOFF packets...............: %llu\n", eapollogoffframecount);
}
if(eapolasfframecount != 0)
{
printf("EAP ASF ALERT packets............: %llu\n", eapolasfframecount);
}
if(wepframecount != 0)
{
printf("WEP packets......................: %llu\n", wepframecount);
}
if(ipv4framecount != 0)
{
printf("IPv4 packets.....................: %llu\n", ipv4framecount);
}
if(ipv6framecount != 0)
{
printf("IPv6 packets.....................: %lld\n", ipv6framecount);
}
if(tcpframecount != 0)
{
printf("TCP packets......................: %lld\n", tcpframecount);
}
if(udpframecount != 0)
{
printf("UDP packets......................: %lld\n", udpframecount);
}
if(icmp4framecount != 0)
{
printf("ICMPv4 packets...................: %lld\n", icmp4framecount);
}
if(icmp6framecount != 0)
{
printf("ICMPv6 packets...................: %lld\n", icmp6framecount);
}
if(dhcpframecount != 0)
{
printf("DHCP packets.....................: %lld\n", dhcpframecount);
}
if(dhcp6framecount != 0)
{
printf("DHCPv6 packets...................: %lld\n", dhcp6framecount);
}
if(greframecount != 0)
{
printf("GRE packets......................: %lld\n", greframecount);
}
if(tzspframecount != 0)
{
printf("TZSP packets.....................: %lld\n", tzspframecount);
}
if(tzspethernetframecount != 0)
{
printf("TZSP (ETHERNET) packets..........: %lld\n", tzspethernetframecount);
}
if(tzsptokenringframecount != 0)
{
printf("TZSP (TOKEN RING) packets........: %lld\n", tzsptokenringframecount);
}
if(tzspslipframecount != 0)
{
printf("TZSP (SLIP) packets..............: %lld\n", tzspslipframecount);
}
if(tzsppppframecount != 0)
{
printf("TZSP (PPP) packets...............: %lld\n", tzsppppframecount);
}
if(tzspfddiframecount != 0)
{
printf("TZSP (FDDI) packets..............: %lld\n", tzspfddiframecount);
}
if(tzsprawframecount != 0)
{
printf("TZSP (RAW) packets...............: %lld\n", tzsprawframecount);
}
if(tzsp80211framecount != 0)
{
printf("TZSP (802.11) packets............: %lld\n", tzsp80211framecount);
}
if(tzsp80211prismframecount != 0)
{
printf("TZSP (802.11 PRSIM) packets......: %lld\n", tzsp80211prismframecount);
}
if(tzsp80211avsframecount != 0)
{
printf("TZSP (802.11 AVS) packets........: %lld\n", tzsp80211avsframecount);
}
for(p = 0; p < 256; p++)
{
if(exeaptype[p] != 0)
{
printf("found............................: %s\n", geteaptypestring(p));
}
}
if(eapolmkaframecount != 0)
{
printf("found............................: MKA Authentication (Macsec Key Agreement protocol)\n");
}
if(chapframecount != 0)
{
printf("found............................: PPP-CHAP Authentication\n");
}
if(papframecount != 0)
{
printf("found............................: PPP-PAP Authentication\n");
}
if(tacacspframecount != 0)
{
printf("found............................: TACACS+ Authentication\n");
}
if(radiusframecount != 0)
{
printf("found............................: RADIUS Authentication\n");
}
if(zeroedpmkcount != 0)
{
printf("zeroed PMK(s)....................: %llu\n", zeroedpmkcount);
}
if(rawhandshakecount != 0)
{
printf("raw handshakes...................: %llu (ap-less: %llu)\n", rawhandshakecount, rawhandshakeaplesscount);
}
if(handshakecount != 0)
{
printf("best handshakes (total)..........: %llu (ap-less: %llu)\n", handshakecount, handshakeaplesscount);
}
if(pmkidcount != 0)
{
printf("best PMKIDs (total)..............: %llu\n", pmkidcount);
}
printf("\n");
return;
}
/*===========================================================================*/
/* PMKID zeroed PMK check */
bool testpmkidzeropmk(uint8_t *macsta, uint8_t *macap, uint8_t *pmkid)
{
char *pmkname = "PMK Name";
uint8_t zeropmk[] =
{
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};
uint8_t salt[32];
uint8_t zeropmkid[32];
memcpy(&salt, pmkname, 8);
memcpy(&salt[8], macap, 6);
memcpy(&salt[14], macsta, 6);
HMAC(EVP_sha1(), zeropmk, 32, salt, 20, zeropmkid, NULL);
if(memcmp(&zeropmkid, pmkid, 16) == 0)
{
return true;
}
return false;
}
/*===========================================================================*/
int omac1_aes_128_vector(const uint8_t *key, size_t num_elem, const uint8_t *addr[], const size_t *len, uint8_t *mac)
{
CMAC_CTX *ctx;
int ret = -1;
size_t outlen, i;
ctx = CMAC_CTX_new();
if (ctx == NULL)
{
return -1;
}
if (!CMAC_Init(ctx, key, 16, EVP_aes_128_cbc(), NULL))
{
goto fail;
}
for (i = 0; i < num_elem; i++)
{
if (!CMAC_Update(ctx, addr[i], len[i]))
{
goto fail;
}
}
if (!CMAC_Final(ctx, mac, &outlen) || outlen != 16)
{
goto fail;
}
ret = 0;
fail:
CMAC_CTX_free(ctx);
return ret;
}
/*===========================================================================*/
int omac1_aes_128(const uint8_t *key, const uint8_t *data, size_t data_len, uint8_t *mac)
{
return omac1_aes_128_vector(key, 1, &data, &data_len, mac);
}
/*===========================================================================*/
/* EAPOL zeroed PMK check */
bool testeapolzeropmk(uint8_t keyver, uint8_t *macsta, uint8_t *macap, uint8_t *nonceap, uint8_t *noncesta, uint8_t eapollen, uint8_t *eapolmessage)
{