Alfa AWUS050NH + rt2x00 from compat-wireless

[fnord0]

this post is to document the alfa AWUS050NH 802.11a/b/g/n 500mW USB adapter's compatibility with the rt2x00 (specifically rt2800usb) linux driver from compat-wireless-2.6 in backtrack 4beta
[[ that was a mouthful ]]

************************************************
be advised that the AWUS050NH adapter will work just fine with the rt2870sta driver
the BT4beta rt2870sta HOWTO resides here :: http://forums.remote-exploit.org/bt4...e-working.html
************************************************

I started all over, fresh install of backtrack 4beta using a mixture of pureh@te's hard drive install tutorial + Virchanza's tutorial for Hard Disk Install : Just 1 Partition

-ok, ready to go-
linuxwireless.org's documentation explains everything, really...

1. grab the latest compat-wireless-2.6 from Index of /kernel/compat-wireless-2.6 -- it turned out to be exactly ::
   

   wget http://wireless.kernel.org/download/...-06-11.tar.bz2

   
   (( I hear you can also just grab http://wireless.kernel.org/download/...ss-2.6.tar.bz2 which is supposed to be the LATEST compat-wireless-2.6 "bleeding edge compat-wireless" ))
2. you need the rt2870 USB FIRMWARE from Ralink corp. | Linux
   direct link to RT2870_Firmware_V8.zip with rt2870 USB firmware included = http://www.ralinktech.com.tw/data/dr...irmware_V8.zip
   ** we will download+extract the rt2870.bin firmware file, and move it /lib/firmware **
   

3. root@bt:~# cd
   root@bt:~# unzip RT2870_Firmware_V8.zip
   (( I got some strange warnings here - mismatching "local" filename - nothing that was fatal tho ))
   root@bt:~# mv RT2870_Firmware_V8/rt2870.bin /lib/firmware
   

   root@bt:~# ls -al /lib/firmware/rt2870.bin
   -rw-r--r-- 1 root root 4096 2008-04-25 18:38 /lib/firmware/rt2870.bin

   root@bt:~# tar jxvf compat-wireless-2009-06-11.tar.bz2
   root@bt:~# cd compat-wireless-2009-06-11
   root@bt:~# make clean
   root@bt:~# make
   root@bt:~# make install
   root@bt:~# make unload
   root@bt:~# modprobe rt2800usb
   root@bt:~#

1. I grabbed the newest version of the tool "iw" straight from the iw git repository
   once you get to the iw git page, near the top in the "shortlog" category, I clicked the first "snapshot" link, which downloads the latest tarball of the iw git repository!
   
   **you can also grab the latest stable release of iw as well, from this page**

2. root@bt:~/downloads# tar vxzf iw-aea5dbd2fe8f70be333b008e64788c4b8410cbfa.tar.gz
   root@bt:~/downloads# cd iw
   root@bt:~/downloads/iw# mv /usr/bin/iw /usr/sbin/OLDiw--OGbt4beta <<-- allows you to backup yr old version of iw
   root@bt:~/downloads/iw# make
   root@bt:~/downloads/iw# make install
   root@bt:~/downloads/iw# cp -p iw /usr/sbin

it t`was quite simple really ... here is some info about the driver, etc ::

root@bt:~# modinfo rt2800usb
filename: /lib/modules/2.6.28.1/updates/drivers/net/wireless/rt2x00/rt2800usb.ko
license: GPL
firmware: rt2870.bin
description: Ralink RT2800 USB Wireless LAN driver.
version: 2.3.0
author: http://rt2x00.serialmonkey.com
srcversion: CFCA4A312BA1DF73A0822CC
alias: usb:v0586p341Ad*dc*dsc*dp*ic*isc*ip*
***MANY alias: usb:* here*** (soo many that i got the "too many characters to post" error)
alias: usb:v07B8p2870d*dc*dsc*dp*ic*isc*ip*
depends: rt2x00lib,rt2x00usb
vermagic: 2.6.28.1 SMP mod_unload 486
parm: nohwcrypt:Disable hardware encryption. (bool)

this adapter supports multiple virtual interfaces (with some restrictions) from the rt2x00 forum

[once your card is connected via USB] ... there should already be a single interface, say "wlan0". Now you can create a new interface with the iw tool (replace "wlan1" with a name, you like):

# iw dev wmaster0 interface add wlan1 type managed

You should now be able to see the interface with "iwconfig".
Configuration and association works just like with any other interface, but be aware, that the hardware currently does not support connection to different APs or mixed AP/Client mode. Multiple interfaces are thus only helpful for "monitor" interfaces and sniffing tools.

Allowed interface combinations:
1 Managed + x Monitor
1 Adhoc + x Monitor
y Master + x Monitor

Where y depends on the hardware:
rt61pci/rt73usb support up to 4 virtual AP interfaces
rt2800pci/rt2800usb support up to 8 virtual AP interfaces

-= systems tested/tester =-

• back|track 4beta DVD + VMWare image/fnord0
• kubuntu 9.04 X64/fnord0
• ubuntu 8.10 intrepid ibex X64/Zermelo
• ubuntu 9.04 jaunty jackalope/jano

::: overview of test results :::

• packet injection :: using the aircrack-ng tools suite, injection works out-of-the box *NO PATCH REQUIRED* with recent compat-wireless-2.6 (rt2x00/rt2800usb) linux drivers.
• mac address changing :: you can change your MAC address successfully using "macchanger".
• monitor mode :: "airmon-ng start wlan0" -OR- "iw phy phy0 interface add mon0 type monitor"
• scanning APs :: "iw dev wlan0 scan [passive]" -OR- "iwlist wlan0 scan"

***************BT4 pre final + rt2x00/rt2800usb driver info***************
turns out BT4 pre final ships with rt2870sta by default for the Alfa AWUS050NH adapter, which DOES WORK! but if you want to use the rt2x00/rt2800usb drivers documented here (which imho work a little better for me), you will need to make small amount of changes.

1. rmmod rt2870sta <<-- unloads the rt2870sta driver from memory
2. echo "blacklist rt2870sta" >> /etc/modprobe.d/blacklist
3. follow the document from the very top and you should have operational rt2800usb drivers in no time flat!

IF you want to go BACK to the rt2870sta drivers while still in BT4 pre final ::

1. comment out "blacklist rt2870sta" by adding a # to the front of the line in /etc/modprobe.d/blacklist
   

   sed -i 's|blacklist rt2870sta|#blacklist rt2870sta|g' /etc/modprobe.d/blacklist

2. then blacklist the rt2x00/rt2800usb drivers in /etc/modprobe.d/blacklist like so ::
   

   echo "blacklist rt2800usb
   blacklist rt2x00usb
   blacklist rt2x00lib
   blacklist mac80211
   blacklist cfg80211
   blacklist rfkill_backport
   blacklist input_polldev
   blacklist led_class" >> /etc/modprobe.d/blacklist

3. then remove the rt2x00/rt2800usb drivers from memory ::
   

   rmmod rt2800usb rt2x00usb rt2x00lib mac80211 cfg80211 rfkill_backport input_polldev led_class

4. lastly, call rt2870sta driver ::
   

   modprobe rt2870sta

[fnord0]

some more output ::

from dmesg ::

cfg80211: Using static regulatory domain info
cfg80211: Regulatory domain: US
(start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
(2402000 KHz - 2472000 KHz @ 40000 KHz), (600 mBi, 2700 mBm)
(5170000 KHz - 5190000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
(5190000 KHz - 5210000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
(5210000 KHz - 5230000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
(5230000 KHz - 5330000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
(5735000 KHz - 5835000 KHz @ 40000 KHz), (600 mBi, 3000 mBm)
cfg80211: Calling CRDA for country: US
phy0: Selected rate control algorithm 'minstrel'
Registered led device: rt2800usb-phy0::radio
Registered led device: rt2800usb-phy0::assoc
Registered led device: rt2800usb-phy0::quality
usbcore: registered new interface driver rt2800usb
rootrt2800usb 1-8:1.0: firmware: requesting rt2870.bin
device mon0 entered promiscuous mode

from /var/log/messages ::

Jun 13 08:54:50 bt kernel: cfg80211: Using static regulatory domain info
Jun 13 08:54:50 bt kernel: cfg80211: Regulatory domain: US
Jun 13 08:54:50 bt kernel: ^I(start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
Jun 13 08:54:50 bt kernel: ^I(2402000 KHz - 2472000 KHz @ 40000 KHz), (600 mBi, 2700 mBm)
Jun 13 08:54:50 bt kernel: ^I(5170000 KHz - 5190000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
Jun 13 08:54:50 bt kernel: ^I(5190000 KHz - 5210000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
Jun 13 08:54:50 bt kernel: ^I(5210000 KHz - 5230000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
Jun 13 08:54:50 bt kernel: ^I(5230000 KHz - 5330000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
Jun 13 08:54:50 bt kernel: ^I(5735000 KHz - 5835000 KHz @ 40000 KHz), (600 mBi, 3000 mBm)
Jun 13 08:54:50 bt kernel: cfg80211: Calling CRDA for country: US
Jun 13 08:54:50 bt kernel: Registered led device: rt2800usb-phy0::radio
Jun 13 08:54:50 bt kernel: Registered led device: rt2800usb-phy0::assoc
Jun 13 08:54:50 bt kernel: Registered led device: rt2800usb-phy0::quality
Jun 13 08:54:50 bt kernel: usbcore: registered new interface driver rt2800usb
((( snip ))) ((( snip ))) ((( snip )))
Jun 13 08:54:52 bt kernel: lo: Disabled Privacy Extensions
Jun 13 08:57:03 bt kernel: rt2800usb 1-8:1.0: firmware: requesting rt2870.bin
Jun 13 08:57:14 bt kernel: device mon0 entered promiscuous mode

root@bt:~# iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
wmaster0 no wireless extensions.

wlan0 IEEE 802.11abgn ESSID:""
Mode:Managed Frequency:2.452 GHz Access Point: Not-Associated
Tx-Power=8 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:on
Link Quality:0 Signal level:0 Noise level:0
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0

root@bt:~# airmon-ng start wlan0

Interface Chipset Driver

wlan0 rt2800usb - [phy0]
(monitor mode enabled on mon0)

root@bt:~# iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
wmaster0 no wireless extensions.

wlan0 IEEE 802.11abgn ESSID:""
Mode:Managed Frequency:2.452 GHz Access Point: Not-Associated
Tx-Power=8 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:on
Link Quality:0 Signal level:0 Noise level:0
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0

mon0 IEEE 802.11abgn Mode:Monitor Frequency:2.452 GHz Tx-Power=8 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
Link Quality:0 Signal level:0 Noise level:0
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0

root@bt:~# aireplay-ng --test mon0
For information, no action required: Using gettimeofday() instead of /dev/rtc
10:09:07 Trying broadcast probe requests...
10:09:07 Injection is working!
10:09:08 Found 2 APs

10:09:08 Trying directed probe requests...
10:09:08 00:0F:B3:xx:xx:xx - channel: 9 - 'XXXXXXXX'
10:09:14 Ping (min/avg/max): 3.998ms/117.001ms/168.003ms Power: 58.25
10:09:14 4/30: 13%

10:09:14 00:15:05:xx:xx:xx - channel: 9 - 'XXXXX'
10:09:19 Ping (min/avg/max): 11.998ms/104.001ms/200.005ms Power: 63.88
10:09:19 17/30: 56%

[fnord0]

also of note - this really should just be implied without having to say... but just in case ::
yes, this driver will work in conjunction with the rt2870sta driver from apocolipse269.

myself, during testing with this rt2800usb driver I ended up blacklisting the rt2870sta using the /etc/modprobe.d/blacklist file.
just add a new line in /etc/modprobe.d/blacklist (at the end is where I put it) ::

# wireless USB card for alfa AWUS050NH
blacklist rt2870sta

anytime I need to go back to the rt2870sta driver ::

1. unload all the rt2x00 modules
2. comment out (using #) the line we created in the blacklist file
3. modprobe rt2870sta

and I am back to using rt2870sta

rinse, repeat to go back and forth

[apocolipse269]

Interesting to see the rt2x00 driver works with the proper firmware. If you could do some tests look into the efficiency of each driver. See how many pps you can get, IV's/s, and #IV's to crack WEP w/ arp replay attack on each driver and post them. Also, if you have a x64 system, throw kubuntu x64 on there and see if you can get rt2x00 driver working in monitor mode at all (x64 crashes on monitor mode w/ my driver for some reason :/)

[fnord0]

Interesting to see the rt2x00 driver works with the proper firmware.

my friend apocolipse269 --- intesting indeed, and so far so good...

If you could do some tests look into the efficiency of each driver. See how many pps you can get, IV's/s, and #IV's to crack WEP w/ arp replay attack on each driver and post them.

I was thinking just the same, heh!

posted in the below pic, I am using rt2800usb drivers w/AWUS050NH - looks like arp replay = 329pps, took ~26K IV's in 27mins w/airodump-ng, and 6mins28sec w/aircrack-ng to crack a 128bit WEP key. need to watch the #IV's per second again and maybe the pps to make sure I got correct #s here.

larger view

same drivers this time around = rt2800usb
- arp replay/injection = 329pps
- fragmenation = ~241pps
- cafe latte = 329pps
- hirte attack = 222pps
- the IV's were going up anywhere from 1 IV/second were literally going 10's/100's per second - it can get intense! sometimes quicker, sometimes slower... hard to get this # properly.

larger view

Also, if you have a x64 system, throw kubuntu x64 on there and see if you can get rt2x00 driver working in monitor mode at all (x64 crashes on monitor mode w/ my driver for some reason :/)

here's the dealio with that... yes I do have an x64 capable system (intel C2D Q6600), but no linux OS that is x64 capable yet (which reminds me to ask this OT question, heh ... can one just configure the linux kernel with CONFIG_64BIT + CONFIG_X86_X64 flags set to y/ON - and then you will be running a 64bit kernel, after recompile?? from there just install 64libs, etc, etc?? i need to learn more about this). I am waiting for slackware13 to hit, and then it's 64bit time for me... until then, maybe i will try to locate an x64 live-cd (apocolipse269/anyone wanna recommend one?) to hammer out some tests n such

[apocolipse269]

Indeedy just go grab a kubuntu x64 live CD. Nice KDE environment, granted you'll have to install aircrack-ng suite, wireless drivers, etc every time you boot but still a stable enough platform to test. And post me those tests with rt2870sta driver injecting!! :P

[fnord0]

here we go - this time using rt2870sta apocolipse driver ::
- arp replay/injection = 329pps
- fragmenation = ~255pps
- hirte attack = 255pps
- IV's per second, on this one wasn't a good test... need to look into this more

larger

I found that by messing with aireplay-ng --arpreplay "-x 1024" command, I can get ~520pps with the rt2800usb drivers (need to screenshot that soon). also need to try again with the "-x 1024" switch with rt2870sta

all in all, BOTH drivers seem quite good! i gonna continue to mess around, and post here with updates/comparisons.

apocolipse269: I found kubuntu-9.04-desktop-amd64.iso and am downloading now... i will let ya know how things pan out yo!

[apocolipse269]

sweet sounds good. you may need to use source to get aircrack on ubuntu liveCD, i dont think they have any repo's active on the live (might be wrong check synaptic)
If the rt2800usb driver works in x64 environments then i can almost say scrap the rt2870sta driver as legacy for now

[Jano]

Hi,
- You have solved the problem about exchange MAC address ?
- My personal script in "/etc/udev" with "macchanger" or "hw ether" command,are no longer accepted, because the card always reset the default MAC.

- This is not good for some situations with wep encryption and for use in N mode/QoS attack with tool "Tkiptun-ng".

Bye Jano

[Zermelo]

sweet sounds good. you may need to use source to get aircrack on ubuntu liveCD, i dont think they have any repo's active on the live (might be wrong check synaptic)
If the rt2800usb driver works in x64 environments then i can almost say scrap the rt2870sta driver as legacy for now

I can confirm that the rt2800usb appears to be working on x64 environments (I tried it on Intrepid x64), there does appear still be some stability issues - I did get one lock up after injection started and airmon-ng produced some odd output:

zermelo@Narzugon:~$ sudo airmon-ng stop wlan3


Interface	Chipset		Driver

wlan1		Intel 4965/5xxx	iwlagn - [phy0]
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
[: 1120: 1: unexpected operator
wlan3		Unknown 	lrwxrwxrwx 1 root root 0 2009-06-15 06:05 /sys/class/net/wlan3/device/driver -> ../../../../../../bus/usb/drivers/
                                                                  �00usb - [phy2]
				(monitor mode disabled)

But on subsequent attempts, it actually injected successfully and all attacks worked as they should have. In any case, it is a significant improvement over the rt2870sta driver's performance on x64 systems which in my experience is a complete lock up after trying to put the card in monitor mode.