1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
|
#include <libwifi.h>
#include <pcap.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
static int has_radiotap = 0;
void handle_pkt(unsigned char *args, const struct pcap_pkthdr *header, const unsigned char *packet) {
unsigned long data_len = header->caplen;
unsigned char *data = (unsigned char *) packet;
// Initialise a libwifi_frame struct and populate it
struct libwifi_frame frame = {0};
int ret = libwifi_get_wifi_frame(&frame, data, data_len, has_radiotap);
if (ret != 0) {
return;
}
// Ensure the parsed frame is a data frame
if (frame.frame_control.type == TYPE_DATA) {
// Ensure the parsed data frame is a WPA handshake
if (libwifi_check_wpa_handshake(&frame) > 0) {
// Use libwifi to get the EAPOL message part, and also pretty-print it
int part = libwifi_check_wpa_message(&frame);
printf("WPA Handshake Message: %d (%s)\n", part, libwifi_get_wpa_message_string(&frame));
// Initlaise a WPA Authentication Data struct and populate it
struct libwifi_wpa_auth_data data = {0};
libwifi_get_wpa_data(&frame, &data);
// Print all of the available WPA Auth data
printf("EAPOL: Version: %d\n", data.version);
printf("EAPOL: Type: %d\n", data.type);
printf("EAPOL: Length: %d\n", data.length);
printf("EAPOL: Descriptor: %d\n", data.descriptor);
printf("EAPOL: Key Info: Information: 0x%04x\n", data.key_info.information);
printf("EAPOL: Key Info: Key Length: %d\n", data.key_info.key_length);
printf("EAPOL: Key Info: Replay Counter: %llu\n", data.key_info.replay_counter);
printf("EAPOL: Key Info: Nonce: ");
for (size_t i = 0; i < sizeof(data.key_info.nonce); ++i) {
printf("%02x ", data.key_info.nonce[i]);
}
printf("\n");
printf("EAPOL: Key Info: IV: ");
for (size_t i = 0; i < sizeof(data.key_info.iv); ++i) {
printf("%02x ", data.key_info.iv[i]);
}
printf("\n");
printf("EAPOL: Key Info: RSC: ");
for (size_t i = 0; i < sizeof(data.key_info.rsc); ++i) {
printf("%02x ", data.key_info.rsc[i]);
}
printf("\n");
printf("EAPOL: Key Info: ID: ");
for (size_t i = 0; i < sizeof(data.key_info.id); ++i) {
printf("%02x ", data.key_info.id[i]);
}
printf("\n");
printf("EAPOL: Key Info: MIC: ");
for (size_t i = 0; i < sizeof(data.key_info.mic); ++i) {
printf("%02x ", data.key_info.mic[i]);
}
printf("\n");
printf("EAPOL: Key Info: Key Data Length: %d\n", data.key_info.key_data_length);
if (data.key_info.key_data_length) {
printf("EAPOL: Key Info: Key Data: ");
for (size_t i = 0; i < data.key_info.key_data_length; ++i) {
printf("%02x ", data.key_info.key_data[i]);
}
printf("\n");
}
// Cleanup the WPA Data
libwifi_free_wpa_data(&data);
printf("\n");
}
}
// Clean up the libwifi frame
libwifi_free_wifi_frame(&frame);
}
void helpexit() {
fprintf(stderr, "[!] Usage: ./parse_eapol --file <file.pcap>\n");
exit(EXIT_FAILURE);
}
int main(int argc, char **argv) {
pcap_t *handle = NULL;
pcap_dumper_t *dumper = NULL;
char errbuf[PCAP_ERRBUF_SIZE];
if (argc < 2) {
helpexit();
}
if (strcmp(argv[1], "--file") == 0) {
if ((handle = pcap_open_offline(argv[2], errbuf)) == NULL) {
fprintf(stderr, "[!] Error opening file %s (%s)\n", argv[2], errbuf);
exit(EXIT_FAILURE);
}
} else {
helpexit();
}
int linktype = pcap_datalink(handle);
if (linktype == DLT_IEEE802_11_RADIO) {
has_radiotap = 1;
}
if (linktype != DLT_IEEE802_11 && linktype != DLT_IEEE802_11_RADIO) {
fprintf(stderr, "[!] 802.11 and radiotap headers not provided (%d)\n", pcap_datalink(handle));
pcap_close(handle);
exit(EXIT_FAILURE);
}
printf("[+] Setup Complete\n");
dumper = pcap_dump_open(handle, "/tmp/parse_eapol.pcap");
pcap_loop(handle, -1 /*INFINITY*/, &handle_pkt, (unsigned char *) dumper);
pcap_dump_close(dumper);
pcap_close(handle);
return 0;
}
|
