Fluxion: Handshake Captor bug (channel hopping)

[brunoaduarte]

---

Read the wiki?

NO

Do you want to request a feature or report a bug?

Bug

What is the current behaviour?

Channel hopping when capturing handshake from specific ap

If the current behaviour is a bug, please provide the steps to reproduce it.

Select -> [2] Handshake Snopper Acquires WPA/WPA2 encryption hashes.

[2] wlan1    [+] Atheros Communications, Inc. AR9271 802.11n

[1] All channels (2.4GHz)

[*] Select an interface for target tracking.
[*] Avoid selecting a virtual interface here.
[1] wlan1    [*] Atheros Communications, Inc. AR9271 802.11n

[3] mdk3 deauthentication (aggressive)

[*] Select an interface for monitoring & jamming.
[1] wlan1    [*] Atheros Communications, Inc. AR9271 802.11n

[3] cowpatty verification (recommended)

[*] How often should the verifier check for a handshake?
        [1] Every 30 seconds (recommended).

[*] How should verification occur?
        [2] Synchronously (recommended).

Then a window opens with title
Handshake Captor (CH7)
CH 7 Elapsed Date fixed fluxwl0: [here the channel number changes all the time]

This is because there are 2 running instances of airodump-ng
1) airodump-ng --ignore-negative-one -d MAC -w /tmp/fluxspace/capture/dump -c 7 -a fluxwl0
2) airodump-ng -aw /tmp/fluxspace/capture/tracker_capture -d MAC fluxwl0
THIS SECOND ONE WITHOUT -c FLAG CAUSES THE CHANNEL HOPPING ON THE DEVICE
Because of this line
./fluxion.sh:1321: timeout --preserve-status $monitorTimeout airodump-ng -aw "$capturePath" \

What do you think the expected behaviour should be?

"Handshake Captor" runs only on the same AP channel, it makes no sense to change channels in this step

FIX FOR THE BUG:
https://github.com/FluxionNetwork/fluxion/blob/master/fluxion.sh#L1322
Add "-c $FluxionTargetChannel" to beginning of line
-c $FluxionTargetChannel -d "$FluxionTargetMAC" $FluxionTargetTrackerInterface &> /dev/null

If this is a feature request, what is the motivation or use case for the added feature?

Specs

Paste the output of ./script/diagnostics.sh [interface]

FLUXION Info

FLUXION V4.10

BASH Info

GNU bash, version 4.4.19(1)-release (i686-pc-linux-gnu)
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Path: /bin/bash

Interface (wlan1) Info

Device: phy1
Driver: ath9k_htc
Chipset: Atheros Communications, Inc. AR9271 802.11n
Master Modes Yes
Injection Test: ioctl(SIOCSIWMODE) failed: Device or resource busy
Injection is working!

XTerm Infos

Version: XTerm(332)
Path: /usr/bin/xterm
Test: XServer/XTerm success!

HostAPD Info

hostapd v2.6
User space daemon for IEEE 802.11 AP management,
IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator
Copyright (c) 2002-2016, Jouni Malinen [e-mail] and contributors
Path: /usr/sbin/hostapd

Aircrack-ng Info

Aircrack-ng 1.2 rc4 - (C) 2006-2015 Thomas d'Otreppe
http://www.aircrack-ng.org

Pyrit Info

Pyrit 0.5.1 (C) 2008-2011 Lukas Lueg - 2015 John Mora
https://github.com/JPaulMora/Pyrit
This code is distributed under the GNU General Public License v3+
Scapy Version: 2.3.3

System Info

Chipset: Linux version 4.14.0-kali3-686-pae ([email protected]) (gcc version 7.2.0 (Debian 7.2.0-18)) #1 SMP Debian 4.14.12-2kali1 (2018-01-08)

[MPX4132]

@brunoaduarte This isn't a bug man, you just ignored the warning:

[*] Avoid selecting a virtual interface here.

If you want target tracking, you're going to need a secondary wireless device.

[MPX4132]

Let me elaborate on what I said. You selected the same interface, wlan1, for monitoring and jamming, which is fine. The problem is that you also selected it for channel scanning, which requires channel hopping. That's a problem because most wireless drivers don't support three virtual interfaces, one for monitoring, one for jamming, and another for channel scanning. You need to have a separate device doing the channel scanning.

[brunoaduarte]

@MPX4132 what's the purpose of channel scanning while i'm trying to capture the handshake of a specific AP that is on a fixed channel ?

[MPX4132]

@brunoaduarte Channel scanning is optional, you can just skip it if you'd like. Now, to answer your question, channel scanning is an option because deauthenticating clients connected to the target access point could lead it's firmware to think it's under sever interference. That would cause the target access point to change channels. If the channels change, the attack will fail since fluxion is listening for the access point in channel X, while it is now in channel Y. Channel scanning allows the script to detect changes in channel and re-start the attack automatically with updated parameters.

[strasharo]

Or in the most common case after being hit by constant deauthentication users tend to restart their access point and if it's not set to a specific channel it will probably relocated to a new one after the restart.

[brunoaduarte]

Ok. Got it. I missed the "skip" option here.
Sorry! And thanks !

[chmiela]

So you need another device or not? I'm playing with my long range antena. It's not possible to get any hack. So I don't know if I should buy another "set".