Scapy does not transmit / inject wifi packets - sniffing works #2076
Comments
marc-y-marc
changed the title
|
Thanks for the very complete report ! I see that you figured out the I don't know how the aircrack driver works, for instance if special calls should be used. Maybe you could ask there. Maybe retry against master ? It has dropped the need to have |
|
This RPI as embedded Wi-Fi. Did you select the correct interface while trying to inject packets?
What is the output of conf.iface and conf.routes ?
|
|
Thanks for both replies! edit: see below -> i tried to add it to my Python evt using Pip. It get's a newer version but results remain. @guedou : yes - i selected the correct one. wlan0 is the onboard, wlan1 and wlan2 are my external which are in monitor mode. conf.iface = wlan1 (i changed my code a bit after your comment so i dont use iface=wlan1 but conf.iface=wlan1 from now on) Below the full config:
|
|
Now looking at it... the strange thing is that use_pcap is set to False while in my code i explicitly set it to True. |
|
I tried adding libpcap to my Python environment, so not using apt-get but: No difference, the use_pcap value remains False. I do think we are on to something here. edit: if i set use_pypy = True this actually works. So the real issue is that i can't set use_pcap to True |
|
@marc-y-marc If the issue is something like "pcapy not installed", please retry against master |
|
I did not turn of warnings, so its weird that it did not show me any. Anyway, i hopped into the scapy shell using sudo pyhton3 -m scapy. i got: So now i managed to resolve that issue in 2 ways:
Now i can change the conf.use_pcap without errors :-) The problem however that i cannot transmit packets is still there. See next post. |
|
When i added the 'monitor=True' to sendp() it gives me the following: Master branch: Back to 2.4.3rc1 sort of the same: |
|
I also see the sockets have changed in my config object, so that part seems to function now. |
|
OK - I just tried to use a diffrent library (pypcap) - so i uninstalled pcapy - and i got an error from this library that gave some more detail then the pcapy library. Error using pypcap |
|
Same issue here. I am using an AWUS036ACH adapter with the same chipset and driver reported by @marc-y-marc . The injection test with aireplay-ng works but on USB2.0 only. Injection also works with the mdk3 tool (tested in beacon flood mode). With scapy I have no error reported by the script which starts fine but I see no beacon frames captured from another adapter. Environment
I have tested the same example script used by @marc-y-marc Here's the output: Here's the config: However, the same script is working fine with another adapter TL-WN722N (ath9k_htc driver). The scapy configuration printed out before the sendp instruction is exactly the same. |
|
@matteomartelli : I see you are running on 2.4.2. Can you install the master branch of scapy? Or install pypcap using pip? I see in your config:
The script should set it to True but it fails if you dont have pypcap or the latest master which doesnt need it anymore. |
|
I have just tested with the latest version from master (2.4.3rc1.dev223) and I have the same issue. I also tried installing pypcap and nothing changed. Running the script from the scapy shell I noticed that use_pcap is correctly set to True. Still, my other adapter works fine, thus I believe the issue is related to something more deeper and closer to the raw socket and the driver. @marc-y-marc is it fixed for you? Do you see your injected beacons? |
|
Ok @matteomartelli - No, i'm having the same issue and really hope we can figure a way to make it work with some help of the dev's. It could be an issue with the driver, just not sure how to proceed as aircrack-ng is working correctly. Could also be related to pypcap or libpcap. |
|
Can you share frames that you are able to capture with the |
|
@guedou : sure, see below screenshot. I used sniff('wlan0', prn=lambda x: x.summary()).
Hope this helps! |
|
@guedou : i also made a screenshot of a single packet more detailed. See below.
|
|
I just performed a full reinstall of my raspberry. Instead of using Raspbian i switched to Ubuntu server. Same results: I also updated to master branch. Same error. |
|
I check the return value of ‘pcap.activate’ which is returned from libpcap. Libpcap returns ‘-1’ which stands for ‘generic error’. |
|
TBH, you will most likely have more luck if you ask either on the driver's page or on libpcap than here. On the networking side, apart from all the detection & cross platforming, we don't do much apart from calling either Python/ However please stick up to the master branch. We had some issues related with |
|
@gpotter2 : I think you are right. I discovered today that injection (airepaly-ng --test) does not work when the adapter is in monitor mode. It only works when it is 'managed' or 'auto'. This is probably the source of the problem and needs to be fixed first before anything else. I'm rebuilding drivers etc now and will report back when i have some news for those also having the same problem. |
|
Ladies and gentlemen, we've got him! There seems to be an issue with the 5.3.4 branch (and up) of the driver: when libpcap needs to PCAP_SET_RFMON to 1 it just doenst PCAP_ACTIVATE() anymore and results in error code -1. I went back to the 5.2.20 driver and everything worked again! Not sure if related but i did not use the dkms installer. I also used ifconfig and iwconfig instead of ip link and iw dev (which is in the manual). @matteomartelli : hope this also fixes your issue! Ps my packet is still 'mallformed' but i can now actually receive it from another adapter. Will tweak to scapy code to make sure its not malformed. |
|
@marc-y-marc yes it's working for me too! Thank you for having shared your findings. I reinstalled the driver after editing the AUR package PKGBUILD script to point it to the 5.2.20 branch of the git repository. So this is my setup right now: About the malformed packet I had the same issue. First make sure you correctly set up the binary string of the information elements: since you are using python 3 you have to place a 'b' character before the string (https://stackoverflow.com/questions/55589199/why-scapy-added-c2-byte-in-dot11-element-infomation). Also I guess that there is some isssue with that specific example because I still see malformed beacons with it but if I try to replay a beacon which is similar to a beacon I captured over the air it works fine : The injected beacons with that custom frame are not marked as malformed by Wireshark. Still, my Android device does not list it but maybe it's because there is some mismatch between the injected capabilities and what my device is capable of. I would first try to replay one beacon of an AP listed by your other adapters exactly as it is. Then you may try to craft it. EDIT: First I am in Italy so I changed the Country Information Element from US to IT to match my country as the smartphone might have rejecteted that beacon due to some regulatory filter. Also, since I was injecting on channel 40 (5GHz) I added the maximum transmit power for channel 40 into the Country IE and changed the DSset element to 0x28 (channel 40). At last I removed the erpinfo information element too as it shouldn't make much sense for the 5GHz band: |
|
Thanks @matteomartelli, i've managed to make it appear on my phone now as well. I followed your instruction regarding the 'b' character. The only layers i needed to make it work were: I kind of figured out that adding more layers was not requried. |
|
@rofl0r this may be interesting? PCAP error we faced |
check dmesg output. the driver has some debug code which could produce clues. |
|
I confirm, injection still not working(for scapy) on rtl8812au branches >= 5.3 Worst thing is that the latest kali driver (realtek-rtl88xxau-dkms) is crashing on boot. Fortunately, branch 5.2 is working for kali 2019.4 |
|
Don't know if Kali pushed the latest commit, the kernel v5.3 support patch. I'll check |
|
I'll notify Kali, its working on kernel v5.3 here, I'll tag a new dkms string. Will check injection also first. |
|
Injection om branch v5.3.4 is working fine.
|
|
Aireplay Works but not scapy, you need to test injection with scapy and check if you received the beacon/packet on a other device. |
Brief description
The issue is that Scapy does not send any packets. No errors appear. I've tried 2 examples (beacons + answering machine) and both do not seem to work. Receiving in scapy works.
My adapter does support monitor mode & injection. If i run aireplay-ng and i perform a death attack or any other option, i can see the broadcasted packets using my second adapter as sniffer.
Environment
How to reproduce
Example 1: Beacons
I tried to play with the conf.use_pcap=True and the sendp(monitor=True). However they don't seem to have any influence.
Actual result
Expected result
Expected that the packetis sent using wlan1 - so it can be sniffed with wlan2 operating both on the same channel. However they are not broadcasted. No error occurs when i pressed enter to start the transmit.
The text was updated successfully, but these errors were encountered: