latest
This commit is contained in:
commit
964703d920
6
.gitignore
vendored
Normal file
6
.gitignore
vendored
Normal file
@ -0,0 +1,6 @@
|
||||
__pycache__/
|
||||
*.py[cod]
|
||||
*$py.class
|
||||
|
||||
reports/
|
||||
|
||||
154
README.md
Normal file
154
README.md
Normal file
@ -0,0 +1,154 @@
|
||||
|
||||
# Overview
|
||||
**OneShot** performs [Pixie Dust attack](https://forums.kali.org/showthread.php?24286-WPS-Pixie-Dust-Attack-Offline-WPS-Attack) without having to switch to monitor mode.
|
||||
# Features
|
||||
- [Pixie Dust attack](https://forums.kali.org/showthread.php?24286-WPS-Pixie-Dust-Attack-Offline-WPS-Attack);
|
||||
- integrated [3WiFi offline WPS PIN generator](https://3wifi.stascorp.com/wpspin);
|
||||
- [online WPS bruteforce](https://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf);
|
||||
- Wi-Fi scanner with highlighting based on iw;
|
||||
# Requirements
|
||||
- Python 3.6 and above;
|
||||
- [Wpa supplicant](https://www.w1.fi/wpa_supplicant/);
|
||||
- [Pixiewps](https://github.com/wiire-a/pixiewps);
|
||||
- [iw](https://wireless.wiki.kernel.org/en/users/documentation/iw).
|
||||
# Setup
|
||||
## Debian/Ubuntu
|
||||
**Installing requirements**
|
||||
```
|
||||
sudo apt install -y python3 wpasupplicant iw wget
|
||||
```
|
||||
**Installing Pixiewps**
|
||||
|
||||
***Ubuntu 18.04 and above or Debian 10 and above***
|
||||
```
|
||||
sudo apt install -y pixiewps
|
||||
```
|
||||
|
||||
***Other versions***
|
||||
```
|
||||
sudo apt install -y build-essential unzip
|
||||
wget https://github.com/wiire-a/pixiewps/archive/master.zip && unzip master.zip
|
||||
cd pixiewps*/
|
||||
make
|
||||
sudo make install
|
||||
```
|
||||
**Getting OneShot**
|
||||
```
|
||||
cd ~
|
||||
wget https://raw.githubusercontent.com/drygdryg/OneShot/master/oneshot.py
|
||||
```
|
||||
Optional: getting a list of vulnerable to pixie dust devices for highlighting in scan results:
|
||||
```
|
||||
wget https://raw.githubusercontent.com/drygdryg/OneShot/master/vulnwsc.txt
|
||||
```
|
||||
## Arch Linux
|
||||
**Installing requirements**
|
||||
```
|
||||
sudo pacman -S wpa_supplicant pixiewps wget python
|
||||
```
|
||||
**Getting OneShot**
|
||||
```
|
||||
wget https://raw.githubusercontent.com/drygdryg/OneShot/master/oneshot.py
|
||||
```
|
||||
Optional: getting a list of vulnerable to pixie dust devices for highlighting in scan results:
|
||||
```
|
||||
wget https://raw.githubusercontent.com/drygdryg/OneShot/master/vulnwsc.txt
|
||||
```
|
||||
## Alpine Linux
|
||||
It can also be used to run on Android devices using [Linux Deploy](https://play.google.com/store/apps/details?id=ru.meefik.linuxdeploy)
|
||||
|
||||
**Installing requirements**
|
||||
Adding the testing repository:
|
||||
```
|
||||
sudo sh -c 'echo "http://dl-cdn.alpinelinux.org/alpine/edge/testing/" >> /etc/apk/repositories'
|
||||
```
|
||||
```
|
||||
sudo apk add python3 wpa_supplicant pixiewps iw
|
||||
```
|
||||
**Getting OneShot**
|
||||
```
|
||||
sudo wget https://raw.githubusercontent.com/drygdryg/OneShot/master/oneshot.py
|
||||
```
|
||||
Optional: getting a list of vulnerable to pixie dust devices for highlighting in scan results:
|
||||
```
|
||||
sudo wget https://raw.githubusercontent.com/drygdryg/OneShot/master/vulnwsc.txt
|
||||
```
|
||||
## [Termux](https://termux.com/)
|
||||
Please note that root access is required.
|
||||
|
||||
#### Using installer
|
||||
```
|
||||
curl -sSf https://raw.githubusercontent.com/drygdryg/OneShot_Termux_installer/master/installer.sh | bash
|
||||
```
|
||||
#### Manually
|
||||
**Installing requirements**
|
||||
```
|
||||
pkg install -y root-repo
|
||||
pkg install -y git tsu python wpa-supplicant pixiewps iw openssl
|
||||
```
|
||||
**Getting OneShot**
|
||||
```
|
||||
git clone --depth 1 https://github.com/drygdryg/OneShot OneShot
|
||||
```
|
||||
#### Running
|
||||
```
|
||||
sudo python OneShot/oneshot.py -i wlan0 --iface-down -K
|
||||
```
|
||||
|
||||
# Usage
|
||||
```
|
||||
oneshot.py <arguments>
|
||||
Required arguments:
|
||||
-i, --interface=<wlan0> : Name of the interface to use
|
||||
|
||||
Optional arguments:
|
||||
-b, --bssid=<mac> : BSSID of the target AP
|
||||
-p, --pin=<wps pin> : Use the specified pin (arbitrary string or 4/8 digit pin)
|
||||
-K, --pixie-dust : Run Pixie Dust attack
|
||||
-B, --bruteforce : Run online bruteforce attack
|
||||
--push-button-connect : Run WPS push button connection
|
||||
|
||||
Advanced arguments:
|
||||
-d, --delay=<n> : Set the delay between pin attempts [0]
|
||||
-w, --write : Write AP credentials to the file on success
|
||||
-F, --pixie-force : Run Pixiewps with --force option (bruteforce full range)
|
||||
-X, --show-pixie-cmd : Alway print Pixiewps command
|
||||
--vuln-list=<filename> : Use custom file with vulnerable devices list ['vulnwsc.txt']
|
||||
--iface-down : Down network interface when the work is finished
|
||||
-l, --loop : Run in a loop
|
||||
-r, --reverse-scan : Reverse order of networks in the list of networks. Useful on small displays
|
||||
--mtk-wifi : Activate MediaTek Wi-Fi interface driver on startup and deactivate it on exit
|
||||
(for internal Wi-Fi adapters implemented in MediaTek SoCs). Turn off Wi-Fi in the system settings before using this.
|
||||
-v, --verbose : Verbose output
|
||||
```
|
||||
|
||||
## Usage examples
|
||||
Start Pixie Dust attack on a specified BSSID:
|
||||
```
|
||||
sudo python3 oneshot.py -i wlan0 -b 00:90:4C:C1:AC:21 -K
|
||||
```
|
||||
Show avaliable networks and start Pixie Dust attack on a specified network:
|
||||
```
|
||||
sudo python3 oneshot.py -i wlan0 -K
|
||||
```
|
||||
Launch online WPS bruteforce with the specified first half of the PIN:
|
||||
```
|
||||
sudo python3 oneshot.py -i wlan0 -b 00:90:4C:C1:AC:21 -B -p 1234
|
||||
```
|
||||
Start WPS push button connection:s
|
||||
```
|
||||
sudo python3 oneshot.py -i wlan0 --pbc
|
||||
```
|
||||
## Troubleshooting
|
||||
#### "RTNETLINK answers: Operation not possible due to RF-kill"
|
||||
Just run:
|
||||
```sudo rfkill unblock wifi```
|
||||
#### "Device or resource busy (-16)"
|
||||
Try disabling Wi-Fi in the system settings and kill the Network manager. Alternatively, you can try running OneShot with ```--iface-down``` argument.
|
||||
#### The wlan0 interface disappears when Wi-Fi is disabled on Android devices with MediaTek SoC
|
||||
Try running OneShot with the `--mtk-wifi` flag to initialize Wi-Fi device driver.
|
||||
# Acknowledgements
|
||||
## Special Thanks
|
||||
* `rofl0r` for initial implementation;
|
||||
* `Monohrom` for testing, help in catching bugs, some ideas;
|
||||
* `Wiire` for developing Pixiewps.
|
||||
1242
oneshot.py
Executable file
1242
oneshot.py
Executable file
File diff suppressed because it is too large
Load Diff
158
vulnwsc.txt
Normal file
158
vulnwsc.txt
Normal file
@ -0,0 +1,158 @@
|
||||
ADSL Router EV-2006-07-27
|
||||
ADSL RT2860
|
||||
AIR3G WSC Wireless Access Point AIR3G WSC Device
|
||||
AirLive Wireless Gigabit AP AirLive Wireless Gigabit AP
|
||||
Archer_A9 1.0
|
||||
ArcherC20i 1.0
|
||||
Archer A2 5.0
|
||||
Archer A5 4.0
|
||||
Archer C2 1.0
|
||||
Archer C2 3.0
|
||||
Archer C5 4.0
|
||||
Archer C6 3.20
|
||||
Archer C6U 1.0.0
|
||||
Archer C20 1.0
|
||||
Archer C20 4.0
|
||||
Archer C20 5.0
|
||||
Archer C50 1.0
|
||||
Archer C50 3.0
|
||||
Archer C50 4.0
|
||||
Archer C50 5.0
|
||||
Archer C50 6.0
|
||||
Archer MR200 1.0
|
||||
Archer MR200 4.0
|
||||
Archer MR400 4.2
|
||||
Archer MR200 5.0
|
||||
Archer VR300 1.20
|
||||
Archer VR400 3.0
|
||||
Archer VR2100 1.0
|
||||
B-LINK 123456
|
||||
Belkin AP EV-2012-09-01
|
||||
DAP-1360 DAP-1360
|
||||
DIR-635 B3
|
||||
DIR-819 v1.0.1
|
||||
DIR-842 DIR-842
|
||||
DWR-921C3 WBR-0001
|
||||
D-Link N Router GO-RT-N150
|
||||
D-Link Router DIR-605L
|
||||
D-Link Router DIR-615H1
|
||||
D-Link Router DIR-655
|
||||
D-Link Router DIR-809
|
||||
D-Link Router GO-RT-N150
|
||||
Edimax Edimax
|
||||
EC120-F5 1.0
|
||||
EC220-G5 2.0
|
||||
EV-2009-02-06
|
||||
Enhanced Wireless Router F6D4230-4 v1
|
||||
Home Internet Center KEENETIC series
|
||||
Home Internet Center Keenetic series
|
||||
Huawei Wireless Access Point RT2860
|
||||
JWNR2000v2(Wireless AP) JWNR2000v2
|
||||
Keenetic Keenetic series
|
||||
Linksys Wireless Access Point EA7500
|
||||
Linksys Wireless Router WRT110
|
||||
NBG-419N NBG-419N
|
||||
Netgear AP EV-2012-08-04
|
||||
NETGEAR Wireless Access Point NETGEAR
|
||||
NETGEAR Wireless Access Point R6220
|
||||
NETGEAR Wireless Access Point R6260
|
||||
N/A EV-2010-09-20
|
||||
Ralink Wireless Access Point RT2860
|
||||
Ralink Wireless Access Point WR-AC1210
|
||||
RTL8196E
|
||||
RTL8xxx EV-2009-02-06
|
||||
RTL8xxx EV-2010-09-20
|
||||
RTL8xxx RTK_ECOS
|
||||
RT-G32 1234
|
||||
Sitecom Wireless Router 300N X2 300N
|
||||
Smart Router R3 RT2860
|
||||
Tenda 123456
|
||||
Timo RA300R4 Timo RA300R4
|
||||
TD-W8151N RT2860
|
||||
TD-W8901N RT2860
|
||||
TD-W8951ND RT2860
|
||||
TD-W9960 1.0
|
||||
TD-W9960 1.20
|
||||
TD-W9960v 1.0
|
||||
TD-W8968 2.0
|
||||
TEW-731BR TEW-731BR
|
||||
TL-MR100 1.0
|
||||
TL-MR3020 3.0
|
||||
TL-MR3420 5.0
|
||||
TL-MR6400 3.0
|
||||
TL-MR6400 4.0
|
||||
TL-WA855RE 4.0
|
||||
TL-WR840N 4.0
|
||||
TL-WR840N 5.0
|
||||
TL-WR840N 6.0
|
||||
TL-WR841N 13.0
|
||||
TL-WR841N 14.0
|
||||
TL-WR841HP 5.0
|
||||
TL-WR842N 5.0
|
||||
TL-WR845N 3.0
|
||||
TL-WR845N 4.0
|
||||
TL-WR850N 1.0
|
||||
TL-WR850N 2.0
|
||||
TL-WR850N 3.0
|
||||
TL-WR1042N EV-2010-09-20
|
||||
Trendnet router TEW-625br
|
||||
Trendnet router TEW-651br
|
||||
VN020-F3 1.0
|
||||
VMG3312-T20A RT2860
|
||||
VMG8623-T50A RT2860
|
||||
WAP300N WAP300N
|
||||
WAP3205 WAP3205
|
||||
Wi-Fi Protected Setup Router RT-AC1200G+
|
||||
Wi-Fi Protected Setup Router RT-AX55
|
||||
Wi-Fi Protected Setup Router RT-N10U
|
||||
Wi-Fi Protected Setup Router RT-N12
|
||||
Wi-Fi Protected Setup Router RT-N12D1
|
||||
Wi-Fi Protected Setup Router RT-N12VP
|
||||
Wireless Access Point .
|
||||
Wireless Router 123456
|
||||
Wireless Router RTL8xxx EV-2009-02-06
|
||||
Wireless Router Wireless Router
|
||||
Wireless WPS Router <#ZVMODELVZ#>
|
||||
Wireless WPS Router RT-N10E
|
||||
Wireless WPS Router RT-N10LX
|
||||
Wireless WPS Router RT-N12E
|
||||
Wireless WPS Router RT-N12LX
|
||||
WN3000RP V3
|
||||
WN-200R WN-200R
|
||||
WPS Router (5G) RT-N65U
|
||||
WPS Router DSL-AC51
|
||||
WPS Router DSL-AC52U
|
||||
WPS Router DSL-AC55U
|
||||
WPS Router DSL-N14U-B1
|
||||
WPS Router DSL-N16
|
||||
WPS Router DSL-N17U
|
||||
WPS Router RT-AC750
|
||||
WPS Router RT-AC1200
|
||||
WPS Router RT-AC1200_V2
|
||||
WPS Router RT-AC1750
|
||||
WPS Router RT-AC750L
|
||||
WPS Router RT-AC1750U
|
||||
WPS Router RT-AC51
|
||||
WPS Router RT-AC51U
|
||||
WPS Router RT-AC52U
|
||||
WPS Router RT-AC52U_B1
|
||||
WPS Router RT-AC53
|
||||
WPS Router RT-AC57U
|
||||
WPS Router RT-AC65P
|
||||
WPS Router RT-AC85P
|
||||
WPS Router RT-N11P
|
||||
WPS Router RT-N12E
|
||||
WPS Router RT-N12E_B1
|
||||
WPS Router RT-N12 VP
|
||||
WPS Router RT-N12+
|
||||
WPS Router RT-N14U
|
||||
WPS Router RT-N56U
|
||||
WPS Router RT-N56UB1
|
||||
WPS Router RT-N65U
|
||||
WPS Router RT-N300
|
||||
WR5570 2011-05-13
|
||||
ZyXEL NBG-416N AP Router
|
||||
ZyXEL NBG-416N AP Router NBG-416N
|
||||
ZyXEL NBG-418N AP Router
|
||||
ZyXEL NBG-418N AP Router NBG-418N
|
||||
ZyXEL Wireless AP Router NBG-417N
|
||||
Loading…
Reference in New Issue
Block a user