# airba.sh
[![Codacy Badge](https://api.codacy.com/project/badge/Grade/6edeb433a77c47a5b7a670906fd06006)](https://app.codacy.com/app/tehw0lf/airbash?utm_source=github.com&utm_medium=referral&utm_content=tehw0lf/airbash&utm_campaign=Badge_Grade_Dashboard)
Airbash is a POSIX-compliant, fully automated WPA PSK [PMKID](https://hashcat.net/forum/thread-7717.html) and handshake capture script aimed at penetration testing.
It is compatible with Bash and Android Shell (tested on Kali Linux and Cyanogenmod 10.2) and uses [aircrack-ng](https://aircrack-ng.org) to scan for clients that are currently connected to access points (AP).
Those clients are then deauthenticated in order to capture the PMKID and/or handshake when attempting to reconnect to the AP.
Verification of captured data is done using hcxpcaptool and hcxpcapngtool from [hcxtools](https://github.com/ZerBea/hcxtools) by [ZeroBeat](https://github.com/ZerBea). If one or more PMKIDs and/or handshakes are captured, they are entered into an SQLite3 database, along with the time of capture and current GPS data (if properly configured).
After capture, the database can be tested for vulnerable router models using `crackdefault.sh`.
It will search for entries that match the implemented modules, which currently include algorithms to compute default keys for
Speedport 500-700 series, Thomson/SpeedTouch, UPC 7 digits (UPC1234567) and HOTBOX routers.
For more information on the PMKID attack, [New attack on WPA/WPA2 using PMKID](https://hashcat.net/forum/thread-7717.html) is a good read.
## Sample Run
[![asciicast](https://asciinema.org/a/pIfGjdsqaNoINE5w0ItvfYK2i.svg)](https://asciinema.org/a/pIfGjdsqaNoINE5w0ItvfYK2i)
## Requirements
WiFi interface in monitor mode (on Android this can be achieved by using [bcmon](https://code.google.com/archive/p/bcmon/) if the device is compatible)
aircrack-ng (for Android [android_aircrack](https://github.com/kriswebdev/android_aircrack) prebuilt binaries can be used)
SQLite3 (Android: installed by default on CyanogenMod 10.2)
openssl for compilation of modules and hcxtools
hcxpcaptool and hcxpcapngtool from [hcxtools](https://github.com/ZerBea/hcxtools) for detection of PMKIDs and/or handshakes and conversion to hashcat formats
In order to log GPS coordinates of access points, configure your coordinate logging software to log to .location/\_.txt (the filename can be chosen as desired). Airbash will always use the output of `cat "$path$loc"*.txt 2>/dev/null | sed '2q;d'`, which equals to reading all .txt files in .loc/ and picking the second line. The reason for this way of implementation is the functionality of [GPSLogger](https://play.google.com/store/apps/details?id=com.mendhak.gpslogger&hl=en), which was used on the development device.
## Calculating default keys
After capturing a new PMKID or handshake, the database can be queried for vulnerable router models. If a module applies,
the default keys for this router series are calculated and used as input for aircrack-ng to try and recover
the passphrase.
## Compiling Modules
The modules for calculating [Thomson/SpeedTouch](https://packetstormsecurity.com/files/84788/STKeys-Thomson-WPA-Key-Recovery-Tool-1.0.html) and [UPC1234567](https://haxx.in/) (7 random digits) default keys are included in `src/`
Credits for the code go to the authors Kevin Devine and <mailto:peter@haxx.in>.
```bash
On Linux:
gcc -fomit-frame-pointer -O3 -funroll-all-loops -o modules/st modules/stkeys.c -lcrypto
gcc -O2 -o modules/upckeys modules/upc_keys.c -lcrypto
```
In order to enable auto detection, please move the binaries to `airbash/bin` (will be added to `PATH` during execution) or a directory that's on `PATH`.
If on Android, you may need to copy the binaries to /system/xbin/ or to another directory where binary execution is allowed.
## Usage
Running `install.sh` will create the database, prepare the folder structure and create shortlinks to both scripts which can be moved to a directory that is on \$PATH to allow execution from any location.
After installation, you may need to manually adjust `INTERFACE` on line 46 in `airba.sh`. This will later be determined automatically, but for now the default is set to `wlan0`, to allow out of the box compatibility with [bcmon](https://code.google.com/archive/p/bcmon/) on Android.
`./airba.sh` starts the script, automatically scanning and attacking targets that are not found in the database.
`./crackdefault.sh` attempts to break known default key algorithms.
To view the database contents, run `sqlite3 .db.sqlite3 "SELECT * FROM hs"` in the main directory.
## Update (Linux only ... for now)
Airbash can be updated by executing `update.sh`. This will clone the master branch into /tmp/ and overwrite the local files.
## Output
`_n`: number of access points found
`__c/m`: represents client number and maximum number of clients found, respectively
`-`: access point is blacklisted
`x`: access point already in database
`?`: access point out of range (not visible to airodump anymore)
## The Database
The database contains a table called `captures` with seven columns.
`id`: incrementing counter of table entries
`latitude` and `longitude`: GPS coordinates of the handshake (if available)
`bssid`: MAC address of the access point
`essid`: Name identifier
`pmkid`: WPA PMKID, if captured
`psk`: WPA Passphrase, if known
`processed`: Flag that gets set by crackdefault.sh to prevent duplicate calculation of default keys if a custom passphrase was used.
Currently, the SQLite3 database is not password-protected.
## Contributing
Contributions are very welcome, especially additional modules to be able to crack more default keys. A template module is [included](https://github.com/tehw0lf/airbash/blob/master/modules/template.sh) in modules/. `crackdefault.sh` contains a template elif statement to include the new module.
If you want to contribute, make sure your code is licensed under the MIT License (like this project).
When contributing shell scripts, please make sure the code is POSIX-compliant.
Other than that, just open up an issue briefly describing the changes and create a pull request!
Contributors:
[D4rk4](https://github.com/D4rk4/) (committed the [HOTBOX](https://github.com/tehw0lf/airbash/blob/master/modules/hotbox.sh) module!)
没有合适的资源?快使用搜索试试~ 我知道了~
符合 POSIX 标准的全自动 WPA PSK PMKID 和握手捕获脚本,旨在进行渗透测试_shell_代码_下载
共17个文件
sh:9个
txt:2个
c:2个
1.该资源内容由用户上传,如若侵权请联系客服进行举报
2.虚拟产品一经售出概不退款(资源遇到问题,请及时私信上传者)
2.虚拟产品一经售出概不退款(资源遇到问题,请及时私信上传者)
版权申诉
0 下载量 16 浏览量
2022-07-02
20:11:00
上传
评论
收藏 20KB ZIP 举报
温馨提示
Airbash 是一个符合 POSIX 的、全自动的 WPA PSK PMKID和握手捕获脚本,旨在进行渗透测试。它与 Bash 和 Android Shell 兼容(在 Kali Linux 和 Cyanogenmod 10.2 上测试)并使用aircrack-ng扫描当前连接到接入点 (AP) 的客户端。然后,这些客户端将被取消身份验证,以便在尝试重新连接到 AP 时捕获 PMKID 和/或握手。使用来自ZeroBeat的hcxtools的hcxpcaptool 和 hcxpcapngtool 来验证捕获的数据。如果捕获了一个或多个 PMKID 和/或握手,则将它们连同捕获时间和当前 GPS 数据(如果配置正确)一起输入 SQLite3 数据库。 捕获后,可以使用crackdefault.sh. 它将搜索与已实现模块匹配的条目,这些模块目前包括计算 Speedport 500-700 系列、Thomson/SpeedTouch、UPC 7 位 (UPC1234567) 和 HOTBOX 路由器的默认密钥的算法。 更多详情、使用方法,请下载后阅读README.md文件
资源推荐
资源详情
资源评论
收起资源包目录
airbash-master.zip (17个子文件)
airbash-master
.wordlists
known_passwords.txt 182B
LICENSE 1KB
install.sh 2KB
src
README_stkeys.txt 326B
stkeys.c 10KB
airba.sh 9KB
upc_keys.c 7KB
crackdefault.sh 3KB
update.sh 426B
.gitignore 131B
README.md 6KB
.blacklist 18B
modules
sp5700.sh 1KB
upc7d.sh 973B
st.sh 768B
template.sh 939B
hotbox.sh 1KB
共 17 条
- 1
资源评论
快撑死的鱼
- 粉丝: 1w+
- 资源: 9156
上传资源 快速赚钱
- 我的内容管理 展开
- 我的资源 快来上传第一个资源
- 我的收益 登录查看自己的收益
- 我的积分 登录查看自己的积分
- 我的C币 登录后查看C币余额
- 我的收藏
- 我的下载
- 下载帮助
安全验证
文档复制为VIP权益,开通VIP直接复制
信息提交成功