Page 1 of 2 12 LastLast
Results 1 to 10 of 17

Thread: AirPwn running but not injecting > pulling hair out

  1. #1
    Junior Member
    Join Date
    Jan 2010
    Posts
    66

    Default AirPwn running but not injecting > pulling hair out

    So, I read through all the posts on airpwn and priariefire's howto (thanks for that).

    I'm at the point now where airpwn is up and running, i.e. no segfaults. However I'm not seeing it inject.

    Setup:
    laptop 1 - BT3, AWN108 card with atheros chipset.
    laptop 2 - Generic XP machine with wireless
    router - 802.11g no encryption > internets

    Quote Originally Posted by iwconfig at boot
    bt airpwn-1.3 # iwconfig
    lo no wireless extensions.

    eth0 no wireless extensions.

    wifi0 no wireless extensions.

    ath0 IEEE 802.11g ESSID:"" Nickname:""
    Mode:Managed Channel:0 Access Point: Not-Associated
    Bit Rate:0 kb/s Tx-Power:17 dBm Sensitivity=1/1
    Retry:off RTS thr:off Fragment thr:off
    Encryption key:off
    Power Management:off
    Link Quality=0/70 Signal level=-96 dBm Noise level=-96 dBm
    Rx invalid nwid:34938 Rx invalid crypt:0 Rx invalid frag:0
    Tx excessive retries:0 Invalid misc:0 Missed beacon:0
    Code:
    bt airpwn-1.3 # cd /pentest/wireless/aircrack-ng/ 
    bt aircrack-ng # airmon-ng start wifi0
    
    
    Interface       Chipset         Driver
    
    wifi0           Atheros         madwifi-ng
    ath0            Atheros         madwifi-ng VAP (parent: wifi0)
    ath1            Atheros         madwifi-ng VAP (parent: wifi0) (monitor mode enabled)
    Quote Originally Posted by iwconfig after monitor
    bt airpwn-1.3 # iwconfig
    lo no wireless extensions.

    eth0 no wireless extensions.

    wifi0 no wireless extensions.

    ath0 IEEE 802.11g ESSID:"" Nickname:""
    Mode:Managed Channel:0 Access Point: Not-Associated
    Bit Rate:0 kb/s Tx-Power:17 dBm Sensitivity=1/1
    Retry:off RTS thr:off Fragment thr:off
    Encryption key:off
    Power Management:off
    Link Quality=0/70 Signal level=-96 dBm Noise level=-96 dBm
    Rx invalid nwid:29448 Rx invalid crypt:0 Rx invalid frag:0
    Tx excessive retries:0 Invalid misc:0 Missed beacon:0

    ath1 IEEE 802.11g ESSID:"" Nickname:""
    Mode:Monitor Frequency:2.412 GHz Access Point: 00:40:F4:E5:04:EC
    Bit Rate:0 kb/s Tx-Power:17 dBm Sensitivity=1/1
    Retry:off RTS thr:off Fragment thr:off
    Encryption key:off
    Power Management:off
    Link Quality=0/70 Signal level=-96 dBm Noise level=-96 dBm
    Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
    Tx excessive retries:0 Invalid misc:0 Missed beacon:0
    So it looks like my card is in monitor mode, now back to airpwn and try to run it.

    Quote Originally Posted by airpwn
    bt aircrack-ng # cd ~
    bt ~ # cd airpwn-1.3
    bt airpwn-1.3 # airpwn -c conf/greet_html -d madwifi -i ath1 -v -v -v -v
    Parsing configuration file..
    Opening command socket..
    Opening monitor socket..
    Opening injection socket..
    Listening for packets...
    Channel changing thread starting..
    So, I start surfing the internet on laptop 2 and nothing happens. I fire up wireshark, set the capture on ath1.
    I start capturing and see beacon traffic from a co-worker's laptop.
    I set the filter to http and see nothing. Surf the web on laptop 2 still no http traffic seen.

    I've also tried:
    running the madwifi_prep.sh instead of airmon
    airmon-ng start wifi0 1 which should set it listen to the channel my router is on.

    So far nothing seems to make this program trigger. Any suggestions?

    Each time I try a different setting I'll ifconfig <adapter> down and then re-run airmon and use the new athx interface.

  2. #2
    Junior Member
    Join Date
    Jan 2010
    Posts
    66

    Default

    Looks like it may be the driver. If you've got a card, non atheros, that works well let me know.

  3. #3
    Senior Member PrairieFire's Avatar
    Join Date
    Apr 2007
    Posts
    705

    Default

    Have had random problems in BT3 as well just no time lately to work on it. Have you tried that card in BT2 after fixing airpwn/lorcon? -i worked for DWL-G650 in BT2 not certain at the moment of any other working cards.
    Μολὼν λαβέ - Great spirits encounter heavy opposition from mediocre minds.

  4. #4
    Member
    Join Date
    Oct 2007
    Posts
    52

    Default

    im getting same results let us know if u find fix...

  5. #5
    Junior Member
    Join Date
    Jan 2010
    Posts
    66

    Default

    I spoke with Josh through a 3rd party and he believes that the Atheros driver is broken. Currently I have on order a Hawking Technology hwc54g with a Ralink chipset. I've also been informed that the Prism54g chipset is viable. I'll report back on BT3 next week. I'm going to get BT2 on a drive now.

    Still waiting on the Ralink card but the madwifi 0.9.4 drivers don't fix the monitor/injection issue.

  6. #6
    Junior Member
    Join Date
    Jan 2010
    Posts
    66

    Default

    Ok, so here I am with a Hawking Ralink RT2500 cardbus card (HWC54G).

    I try it out and no luck. Do some reading and grab the latest trunk of lorcon and put it into the airpwn directory. I configure, make, make install lorcon. Then I configure, make, make install airpwn.

    Code:
    bt airpwn-1.3 # airpwn -c conf/greet_html -d rt2500 -i ra0 -v -v -v -v
    Parsing configuration file..
    Opening command socket..
    Opening monitor socket..
    Opening injection socket..
    LORCON - tx80211_setmode(...) is deprecated, please use tx80211_setfunctionalmode(...) instead
    Unable to open interface ra0.
    Quote Originally Posted by iwconfig
    bt airpwn-1.3 # iwconfig
    lo no wireless extensions.

    eth0 no wireless extensions.

    ra0 RT2500 Wireless ESSID:"sakai"
    Mode:Monitor Frequency=2.412 GHz Bit Rate:11 Mb/s
    RTS thr:off Fragment thr:off
    Encryption key:off
    Link Quality:0 Signal level:218 Noise level:177
    Rx invalid nwid:0 invalid crypt:0 invalid misc:0
    Code:
    bt airpwn-1.3 # airmon-ng start ra0 1
    
    
    Interface       Chipset         Driver
    
    ra0             Ralink b/g      rt2500 (monitor mode enabled)
    So, at this point I'm looking into why it says
    Unable to open interface ra0.

    For what it's worth, I CAN run kismet using source=rt2500,ra0,ralink

  7. #7
    Senior Member PrairieFire's Avatar
    Join Date
    Apr 2007
    Posts
    705

    Default

    I also did a lorcon trunk (131) update then tried to make & install airpwn with this error:

    Code:
    bt airpwn-1.3 # make
    make  all-am
    make[1]: Entering directory `/root/airpwn-1.3'
    if gcc -DHAVE_CONFIG_H -I. -I. -I.     -g -O2 -MT airpwn.o -MD -MP -MF ".deps/airpwn.Tpo" -c -o airpwn.o airpwn.c; \
            then mv -f ".deps/airpwn.Tpo" ".deps/airpwn.Po"; else rm -f ".deps/airpwn.Tpo"; exit 1; fi
    In file included from airpwn.c:35:
    /usr/include/linux/wireless.h:891: error: 'IFNAMSIZ' undeclared here (not in a function)
    make[1]: *** [airpwn.o] Error 1
    make[1]: Leaving directory `/root/airpwn-1.3'
    make: *** [all] Error 2
    bt airpwn-1.3 #
    This is not the first time in BT3B I have had complaints and errors about "wireless.h".

    Tried the supplied airpwn version and copied conf folder over and it will run with an error similar to yours:
    Code:
    bt airpwn-1.3 # airpwn -c conf/greet_html -d madwifi -i ath1 -v -v -v -v
    Parsing configuration file..
    Opening command socket..
    Opening monitor socket..
    Opening injection socket..
    LORCON - tx80211_setmode(...) is deprecated, please use tx80211_setfunctionalmode(...) instead
    Listening for packets...
    Channel changing thread starting..
    also according to wireless.h line 891 is :
    Code:
    struct iw_param power;          /* PM duration/timeout */
    and 'IFNAMSIZ' @ line's 77, 872, 911, 1035 and 1058
    Μολὼν λαβέ - Great spirits encounter heavy opposition from mediocre minds.

  8. #8
    Just burned his ISO
    Join Date
    Jan 2008
    Posts
    11

    Default

    ..........

  9. #9
    Senior Member PrairieFire's Avatar
    Join Date
    Apr 2007
    Posts
    705

    Default

    Quote Originally Posted by sir_inferno View Post
    Bung in
    Code:
    #include <linux/if.h>
    at the beginning of
    wireless.h to "solve" the issue.
    No errors while running but it also fails to see anything.
    Μολὼν λαβέ - Great spirits encounter heavy opposition from mediocre minds.

  10. #10
    Junior Member
    Join Date
    Jan 2010
    Posts
    66

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •