maemo.org - Talk - rt73 + aireplay-ng = packet injection

maemo.org - Talk (https://talk.maemo.org/index.php)

- Applications (https://talk.maemo.org/forumdisplay.php?f=41)

- - rt73 + aireplay-ng = packet injection (https://talk.maemo.org/showthread.php?t=13458)

rt73 + aireplay-ng = packet injection

I finally managed to get aireplay-ng to compile in scratchbox, after alot of cussing and driving my girlfriend totally nuts.
Anyway I loaded the rt73 driver and then iwpriv wlan1 rfmontx 1, after that I tested injection with aireplay-ng wlan1 --test, and aireplay found one AP and reported that injections worked.

I don't have the skills (yet) to make a deb package, but if anyone of you guys want to trie it out I can put up the binary files + driver.

Pardon my slightly confused post and bad english, but I have been at this this for about 9 hours non-stop.

Re: rt73 + aireplay-ng = packet injection

That's incredible! I hope it's fully working. Thanks for all your effort! Can you please tell me how to do this on my N800? Please keep us up to date. Thanks again.

Re: rt73 + aireplay-ng = packet injection

Binary + files + a nice readme to boot please :)

Re: rt73 + aireplay-ng = packet injection

i would also appreciate the binaries

Re: rt73 + aireplay-ng = packet injection

Ok I'll post a little howto tomorrow + all the needed file, but right now I gotta get some sleep.

Re: rt73 + aireplay-ng = packet injection

Great news!!!!!!!!!!!!!!!!!! Dude you`re the man!

Re: rt73 + aireplay-ng = packet injection

muahahahaha ::evilgrin:: been waitin for that, i thought it was a hardware issue, didn't know it could be resolved so easily..

not bad my good friend, the n8x0 just went up a couple notches ;).. anyone try metasploit on os2008?.. i remember msfweb being pretty darn slow on os2007.. haven't tried it as of yet

Re: rt73 + aireplay-ng = packet injection

1 install package becomroot
2 install package wirelesstools, dl from http://olya.com/maemo/ (big thanks to ag2).
3 in xterm type "sudo gainroot"
4 dowload test.tar.gz to N800 internal memory ie /home/user/MyDocs/.documents/
http://rapidshare.com/files/77821232/test.tar.gz.html

5 extract test.tar.gz with "tar -xvzf test.tar.gz"

You will now have a folder called test that should contain:
aircrack-ng aireplay-ng airodump-ng rt73.bin rt73.ko

6 type "cd test", then copy rt73.bin to /lib/firmware/ with "cp rt73.bin /lib/firmware/"
7 Now activate host mode "echo host > /sys/devices/platform/musb_hdrc/mode"
8 Plug in wifi adapter to powerd hub
9 Load the driver with insmod ./rt73.ko
10 check that everything worked by checking the output from dmesg or iwconfig

You should now have an new interface called wlan1

11 Activate injection with "iwpriv wlan1 rfmontx 1" verify with "iwpriv wlan1 get_rfmontx"
12 Check injection with aireplay-ng, "./aireplay-ng wlan1 --test", aireplay-ng needs a AP in range in order to test injection, I had to run it a couple of times ,and move my wifi adapter before it worked.
Sometimes you need to run "ifconfig wlan1 up", so try that if you get into trouble.

Well that's it, and please let me know if something is wrong (I'm no linux guru)

Re: rt73 + aireplay-ng = packet injection

Oh and another thing, I bought myself a mini powerd usb-hub that runs on 5V from the AC adapter, but instead I'm running it of 4 R6 (AA) batteries hooked up in series -> 1.2V x 4 (nimh battries) = 4.8V and that's close enough, it works great so now I'm mobile.
Just remember to use nimh rechargable batteris, regular one have an higher voltage (1.5V) and might fry your equipment.

Re: rt73 + aireplay-ng = packet injection

Quote:

Originally Posted by mutex (Post 111781)

I cant do this using the built-in wifi chip ? i need a external wifi adapter for this to work ? Great work BTW :)

Re: rt73 + aireplay-ng = packet injection

Quote:

Originally Posted by loaderr (Post 111976)

I cant do this using the built-in wifi chip ? i need a external wifi adapter for this to work ? Great work BTW :)

Thanks :)
As far as I know, packet injection is not possible on the built-in chip, the drivers need to modified to make it possible to pass raw data on the "wire".
But that would be the best solution.

Re: rt73 + aireplay-ng = packet injection

Quote:

Originally Posted by mutex (Post 112109)

But since the relevant part of the driver is closed source it's impossible to modify, so the only way is using an external adapter.

Re: rt73 + aireplay-ng = packet injection

Quote:

Originally Posted by mutex (Post 111781)

8 Plug in wifi adapter to powerd hub

what wifi adapter are you using?
Thanks!

Re: rt73 + aireplay-ng = packet injection

Quote:

Originally Posted by ioan (Post 112316)

what wifi adapter are you using?
Thanks!

I have a Belkin F5D7050B good unit but needs to be modded if you want to attach a ext aerial it if:

Quote:

Belkin F5D7050B

* Driver : rt73
* Chipset: Ralink 2570

Works fine on boot including packet injection.

A good list of cards/chipsets and if they are working for injection:

http://backtrack.offensive-security....elkin_F5D7050B

Re: rt73 + aireplay-ng = packet injection

Quote:

Originally Posted by ioan (Post 112316)

what wifi adapter are you using?
Thanks!

Edimax 7318USg, really cheap and has an external rp-sma antenna connector.
http://www.edimax.com/en/produce_det...id=1&pl2_id=44

Re: rt73 + aireplay-ng = packet injection

The Best USB device at the moment is the "Alfa USB 500mW WiFi Adapter".
It has custom drivers written by the AirCrack team IIRC and has a ext SMA connection. {But a driver will need to be compiled for the 2008 Kernel)

I'm trying to source one in Ireland or EU at the moment , the best place seems to be http://www.yatow.de/ ; there is a special offer for at

http://babelfish.altavista.com/babel...91906dd0653e0c

Quote:

ALFA USB adapter AWUS036H, 500mW, forum package 75.00EUR
ALFA USB Adapter AWUS036H, 500mW, Forumpaket
Für eine grössere Darstellung
klicken Sie auf das Bild.

SPECIAL CAMPAIGN for members of the Wardriving forum

Note: The solid magnet feet with R-SMA are in approx.. 2 weeks again available and are delivered subsequently free of charge with an order.

ALFA Wireless 802.11b/g High power 500mW USB adapter with R-SMA Connector (inclusive 2dBi Omni antenna) and substantial magnet foot and 9 dBi antenna

as total package for 75 euro

Can a German speaking person on here please register a account on the Wardriving forum for me I've tried but there a few anti-spam secuirty question that are translating properly.

----------
Edit:

I found aplace that has US/UK/CANADIA - http://www.data-alliance.net/servlet...6H-Alfa/Detail

Re: rt73 + aireplay-ng = packet injection

I think the next logical program port to the n800 would be MDK3 :cool:

Re: rt73 + aireplay-ng = packet injection

Anyone curious on how to install the driver for a Alfa AWUS036H usb or airlink 101 Zydas zd1211-BC usb? I am? I can get them recognized using usb hub but cant get them into wlan1 mode using existing drivers that work for BT and Ubuntu,but realized theres no way that will work,any help in the right direction, give me an arm! if by the grace of the n800 gods can help me, i would be forever in debt to you with major payments of many,many thank yous.

Re: rt73 + aireplay-ng = packet injection

Quote:

Originally Posted by mikedmann (Post 133414)

You'll need to recompile from drivers from source under the Maemo SDK.
I'm trying to find a source for one of these card in EU that does not charge a crazy P&P price.

Re: rt73 + aireplay-ng = packet injection

mutex - what modifications did you make to aireplay-ng to get it to compile for the n8x0?

After all, the source code is GPL'd and you're only redistributing binaries. ;p

Re: rt73 + aireplay-ng = packet injection

@Mutex thanks for the tutorial
i used edimax ew-7318usg wifi adapter and with powered usb hub everything seems ok and i have wlan1 as you described.

But when i tried to run aireplay-ng, it say aireplay-ng not found can you help with this matter.

Re: rt73 + aireplay-ng = packet injection

Try ./aireplay-ng while you are in the same directory as the application

Re: rt73 + aireplay-ng = packet injection

There's no need to modify the source at all.
When I get some spare time I'll make an deb I have also manage to compile mdk3, which is a wirless DoS (Denial of Service) application.

Re: rt73 + aireplay-ng = packet injection

I tried ./aireplay-ng in the same directory as the application but it says Permission Denied, am I doing something wrong?

Re: rt73 + aireplay-ng = packet injection

chmod +x

(no my message isn't too short ! stupid rule !)

Re: rt73 + aireplay-ng = packet injection

was just wondering instead of a powered hub could you use a power injector?

http://www.siliconchip.com.au/cms/A_102685/article.html

Re: rt73 + aireplay-ng = packet injection

sorry right after that post i found this:
http://tabletblog.com/2006/01/usb-power-injector-2.html

was wondering if this would work instead of the aforementioned more complicated design??

Re: rt73 + aireplay-ng = packet injection

I tried to use it on N770 running 2007HE.
Aireplay can be executed - although I can't insmod this driver - there's an error about format (probably some kernel issue).
Is there any way to compile this driver for my kernel format to make it universal?
Or maybe I should reflash the kernel itself - if so - which kernel I could use?

Why limit such exciting thing to N800 extended users only :)

Re: rt73 + aireplay-ng = packet injection

I have EDIMAX ew-7318usg
I do not work my edimax, I can do?
I have USB Injector, usb host work

EDIMAX works in my ubuntu linux

Re: rt73 + aireplay-ng = packet injection

Quote:

Originally Posted by mutex (Post 111781)

...

You should now have an new interface called wlan1

11 Activate injection with "iwpriv wlan1 rfmontx 1" verify with "iwpriv wlan1 get_rfmontx"
12 Check injection with aireplay-ng, "./aireplay-ng wlan1 --test", aireplay-ng needs a AP in range in order to test injection, I had to run it a couple of times ,and move my wifi adapter before it worked.
Sometimes you need to run "ifconfig wlan1 up", so try that if you get into trouble.

So I got a $25 RT73 adapter and a powered hub and I (finally) got the N800 to recognize the adapter and make it into wlan1...

Funny thing is, the aireplay-ng injection test thing isn't working. It runs, it just doesn't succeed. Is there some way to specify an SSID? wifi-radar picks up lots of APs when I tell it to use wlan1...

EDIT: Sorry, my usual post-before-research idiocy. The official site has all of the docs that I need...

I was able to find some APs when I ran this in another window:

Quote:

airodump-ng --ivs -w capture wlan1

Strange, I couldn't use the "-b XX:XX:XX:XX:XX:XX" parameter with aireplay-ng to focus on a specific AP... It just tried every AP in the neighbourhood... :o

However, I'm still getting "0/30 0%" on all the APs.

Re: rt73 + aireplay-ng = packet injection

So I've noticed a power drain on captured packets while injecting and dumping from the same interface (afaik the most common practice). I anxiously awaiting my r73 dongle, but wanted to pose this question.

Is there any reason to not to use wlan0 for airodump and wlan1 for aireplay? Wouldn't this provide a much better packet capture then using wlan1 for everything?

Knowing that wifi chips are full duplex, this may be a non-issue. Any thoughts? :)

Re: rt73 + aireplay-ng = packet injection

Quote:

Originally Posted by qole (Post 189780)

Isn't it -a BSSID?

Re: rt73 + aireplay-ng = packet injection

I cant seem to get my Belkin F5D7050 working yet. After I follow the steps and load the RT73.ko, my n800 would get segmentation faults if I try to us iwconfig, ifconfig or even sudo gainroot in another terminal. Sometimes it would just restart as well. Here is a dmesg before it decided to restart.

Code:

[   19.000000] hub 1-0:1.0: power on to power good time: 10ms

[   19.000000] hub 1-0:1.0: 200mA bus power budget for each child

[   19.000000] hub 1-0:1.0: local power source is good

[   19.000000] hub 1-0:1.0: enabling power on all ports

[   19.000000] drivers/usb/musb/tusb6010.c musb_platform_enable: dma not reactivated

[   19.109375] drivers/usb/core/inode.c: creating file '001'

[   19.109375] hub 1-0:1.0: state 7 ports 1 chg 0000 evt 0000

[   20.804687] EAC mode: play disabled, rec disabled

[   21.109375] hub 1-0:1.0: hub_suspend

[   21.109375] usb usb1: usb auto-suspend

[   24.046875] EAC mode: play enabled, rec enabled

[   31.648437] EAC mode: play disabled, rec disabled

[   37.539062] Adding 131064k swap on /media/mmc2/.swap.  Priority:-1 extents:1 across:131064k

[   42.671875] cx3110x: loading 3826.arm firmware.

[   42.929687] (c)opyright 2004 Conexant

[   42.929687]

[   42.929687] build info: PRISM SoftMAC

[   42.929687]   creator: [kvalo]

[   42.929687]   date: [07/10/05-11:45]

[   42.929687]

[   42.937500] cx3110x: MAC address 00:19:4f:d5:5e:56.

[   42.945312] cx3110x: libumac version 2.12.0.0.a.9.15-5

[   42.945312] cx3110x: lmac version 2.13.0.0.a.22.8

[   42.945312] cx3110x: PSM disabled.

[   44.796875] cx3110x: scanned 11 channels.

[   45.078125] cx3110x: shut down softmac.

[   45.546875] cx3110x: loading 3826.arm firmware.

[   45.804687] (c)opyright 2004 Conexant

[   45.804687]

[   45.804687] build info: PRISM SoftMAC

[   45.804687]   creator: [kvalo]

[   45.804687]   date: [07/10/05-11:45]

[   45.804687]

[   45.812500] cx3110x: MAC address 00:19:4f:d5:5e:56.

[   45.820312] cx3110x: libumac version 2.12.0.0.a.9.15-5

[   45.820312] cx3110x: lmac version 2.13.0.0.a.22.8

[   47.671875] cx3110x: scanned 11 channels.

[   49.898437] cx3110x: associated to 00:13:46:a5:47:da (bcn 100 msec, DTIM 1).

[   52.546875] cx3110x: PSM dynamic with 200 ms CAM timeout.

[   65.914062] JFFS2 notice: (402) check_node_data: wrong data CRC in data node at 0x0982b4b8: read 0xe061b648, calculated 0xc82d4081.

[   75.601562] JFFS2 notice: (402) check_node_data: wrong data CRC in data node at 0x09346764: read 0x13b525eb, calculated 0xaaeff032.

[   77.242187] JFFS2 notice: (402) check_node_data: wrong data CRC in data node at 0x0cd84bac: read 0xc637ee2c, calculated 0xbdd5c5e4.

[   78.484375] JFFS2 notice: (402) check_node_data: wrong data CRC in data node at 0x0eda6c78: read 0xebd8cca3, calculated 0x539ba63f.

[   78.554687] JFFS2 notice: (402) check_node_data: wrong data CRC in data node at 0x0a0e16d8: read 0xdd9e52f3, calculated 0x131d3113.

[   92.320312] DSP Pausing failed, skipping OP change!

[  142.039062] tusb_source_power 629: VBUS a_wait_vrise, devctl 81 otg 184 conf c0010001 prcm 00a80500

[  146.250000] cx3110x: PSM dynamic with 100 ms CAM timeout.

[  421.703125] EAC mode: play enabled, rec enabled

[  422.046875] cx3110x: PSM dynamic with 200 ms CAM timeout.

[  424.203125] EAC mode: play disabled, rec disabled

[  502.773437] musb_stage0_irq 570: VBUS_ERROR in a_wait_bcon (91, <VBusValid), retry #1, port1 00000100

[  513.710937] EAC mode: play enabled, rec enabled

[  516.210937] EAC mode: play disabled, rec disabled

[  537.460937] musb_stage0_irq 570: VBUS_ERROR in a_wait_bcon (91, <VBusValid), retry #2, port1 00000100

[  558.281250] tusb_source_power 629: VBUS a_wait_vrise, devctl 91 otg 15c conf c0010000 prcm 00a80500

[  558.375000] tusb_otg_ints 833: vbus too slow, devctl 81

[  558.375000] tusb_source_power 629: VBUS b_idle, devctl 80 otg 188 conf c0000000 prcm 00a80500

[  560.976562] musb_stage2_irq 817: SUSPEND (b_idle) devctl 91 power e0

[  562.835937] tusb_source_power 629: VBUS a_wait_vrise, devctl 91 otg 151 conf c0010000 prcm 00a80500

[  562.929687] tusb_otg_ints 833: vbus too slow, devctl 91

[  562.929687] tusb_source_power 629: VBUS a_wait_vfall, devctl 90 otg 151 conf c0000000 prcm 00a80500

[  563.804687] tusb_source_power 629: VBUS a_idle, devctl 90 otg 154 conf c0000000 prcm 00a80300

[  563.812500] tusb_source_power 629: VBUS a_idle, devctl 90 otg 154 conf c0000000 prcm 00a80300

[  570.984375] tusb_source_power 629: VBUS a_wait_vrise, devctl 91 otg 154 conf c0010001 prcm 00a80300

[  571.156250] musb_stage0_irq 646: CONNECT (a_host) devctl 5d

[  571.156250] hub 1-0:1.0: state 8 ports 1 chg 0000 evt 0000

[  571.156250] usb usb1: usb auto-resume

[  571.156250] usb usb1: finish resume

[  571.156250] hub 1-0:1.0: hub_resume

[  571.179687] hub 1-0:1.0: port 1, status 0101, change 0001, 12 Mb/s

[  571.335937] hub 1-0:1.0: debounce: port 1: total 100ms stable 100ms status 0x101

[  571.460937] usb 1-1: new high speed USB device using musb_hdrc and address 2

[  571.593750] usb 1-1: default language 0x0409

[  571.593750] usb 1-1: new device strings: Mfr=1, Product=2, SerialNumber=0

[  571.593750] usb 1-1: Product: USB2.0 Hub Controller

[  571.593750] usb 1-1: Manufacturer: NEC Corporation

[  571.593750] usb 1-1: hub v0409 p0058 is not supported

[  571.593750] usb 1-1: uevent

[  571.593750] usb 1-1: usb_probe_device

[  571.593750] usb 1-1: configuration #1 chosen from 1 choice

[  571.593750] usb 1-1: adding 1-1:1.0 (config #1, interface 0)

[  571.593750] usb 1-1:1.0: uevent

[  571.593750] hub 1-1:1.0: usb_probe_interface

[  571.593750] hub 1-1:1.0: usb_probe_interface - got id

[  571.593750] hub 1-1:1.0: USB hub found

[  571.593750] hub 1-1:1.0: 4 ports detected

[  571.593750] hub 1-1:1.0: standalone hub

[  571.593750] hub 1-1:1.0: individual port power switching

[  571.593750] hub 1-1:1.0: individual port over-current protection

[  571.593750] hub 1-1:1.0: Single TT

[  571.593750] hub 1-1:1.0: TT requires at most 16 FS bit times (1332 ns)

[  571.593750] hub 1-1:1.0: Port indicators are supported

[  571.593750] hub 1-1:1.0: power on to power good time: 100ms

[  571.601562] hub 1-1:1.0: local power source is good

[  571.601562] hub 1-1:1.0: enabling power on all ports

[  571.710937] drivers/usb/core/inode.c: creating file '002'

[  571.710937] hub 1-0:1.0: 100mA power budget left

[  571.710937] hub 1-0:1.0: state 7 ports 1 chg 0000 evt 0002

[  571.710937] hub 1-0:1.0: port 1 enable change, status 00000503

[  571.710937] hub 1-1:1.0: state 7 ports 4 chg 0000 evt 0002

[  571.710937] hub 1-1:1.0: port 1, status 0101, change 0001, 12 Mb/s

[  571.867187] hub 1-1:1.0: debounce: port 1: total 100ms stable 100ms status 0x101

[  571.953125] usb 1-1.1: new high speed USB device using musb_hdrc and address 3

[  572.085937] usb 1-1.1: new device strings: Mfr=0, Product=0, SerialNumber=0

[  572.085937] usb 1-1.1: hub v050d p7050 is not supported

[  572.085937] usb 1-1.1: uevent

[  572.085937] usb 1-1.1: usb_probe_device

[  572.085937] usb 1-1.1: configuration #1 chosen from 1 choice

[  572.085937] usb 1-1.1: adding 1-1.1:1.0 (config #1, interface 0)

[  572.085937] usb 1-1.1:1.0: uevent

[  572.085937] usbtest 1-1.1:1.0: usb_probe_interface

[  572.085937] usbtest 1-1.1:1.0: usb_probe_interface - got id

[  572.085937] drivers/usb/core/inode.c: creating file '003'

[  574.085937] usb 1-1.1: usb auto-suspend

[  576.109375] hub 1-1:1.0: hub_suspend

[  576.109375] usb 1-1: usb auto-suspend

[  578.132812] hub 1-0:1.0: hub_suspend

[  578.132812] usb usb1: usb auto-suspend

[  586.843750] EAC mode: play enabled, rec enabled

[  591.054687] EAC mode: play disabled, rec disabled

[  703.140625] rtusb init ====>

[  703.140625] rt73 1-1.1:1.0: usb_probe_interface

[  703.140625] rt73 1-1.1:1.0: usb_probe_interface - got id

[  703.140625] usb usb1: usb auto-resume

[  703.140625] usb usb1: finish resume

[  703.140625] hub 1-0:1.0: hub_resume

[  703.164062] usb 1-1: usb auto-resume

[  703.164062] hub 1-0:1.0: state 7 ports 1 chg 0000 evt 0000

[  703.265625] hub 1-0:1.0: state 7 ports 1 chg 0000 evt 0002

[  703.304687] usb 1-1: finish resume

[  703.304687] hub 1-1:1.0: hub_resume

[  703.304687] hub 1-1:1.0: state 7 ports 4 chg 0000 evt 0000

[  703.304687] usb 1-1.1: usb auto-resume

[  703.367187] usb 1-1.1: finish resume

[  703.367187] idVendor = 0x50d, idProduct = 0x7050

[  703.445312] rt73: Firmware loading error

[  703.445312] rt73: probe of 1-1.1:1.0 failed with error -32

[  703.445312] usbcore: registered new interface driver rt73

[  705.445312] usb 1-1.1: usb auto-suspend

Nokia-N800-23-14:~#

Anyone else have this issue? I am using a powered usbhub.

Re: rt73 + aireplay-ng = packet injection

here's a quick question frm a nerd!! what is it for? i read in the net its to crack wep keys. is it correct? do i need external hardware for it to work coz i tried but got confused in your step 8 when you refered to plug in wifi adapter to powered hub. thanks..

Re: rt73 + aireplay-ng = packet injection

Yes aireplay can be used to crack wep keys, and for that matter wpa keys. Packet injection is not something we can do using wireless from the tablet, so we need to use an external usb wireless card. To ensure we have enough power to power the external usb card we need a powered hub.

Re: rt73 + aireplay-ng = packet injection

Ok, so I'll need MicroUSB male to USB femal adapter, don't I? As I'm just a new kid in the town, can anyone please suggest me of one such good adaper. Thanks

Re: rt73 + aireplay-ng = packet injection

I think it might be easier for you to just use a USB Gender Changer, like this one, to attach to your microUSB cord then attach a standard male to female usb cord to the hub.

Re: rt73 + aireplay-ng = packet injection

hey by the way,any wireless network adapter will do or does it have to be of a particular brand? thnx

Re: rt73 + aireplay-ng = packet injection

Quote:

Originally Posted by jaeezzy (Post 221426)

hey by the way,any wireless network adapter will do or does it have to be of a particular brand? thnx

you'll need one with an rt73 chipset or one that supports injection. I suggest getting a Hawking hwug1a from bestbuy, they're like 40 bucks and it has an external antanna that can be upgradeable.

Re: rt73 + aireplay-ng = packet injection

Hi I have the Alpha Network AWSUS036H but can't get aireplay to work on Ubuntu 8.04. I had this working with Fedora Core 6 a while back with the patch from aircrack-ng. I installed Ubuntu yesterday and followed the same steps but couldn't get it to work.

When I run:
sudo aireplay-ng -1 0 -e bigjoejack -a 00:1C:10:1B:0E:C1 -h 00:c0:ca:19:cd:48 wlan1

it tells me that the attack was unsuccessful.

Linux pcuser-laptop 2.6.24-19-generic #1 SMP Wed Aug 20 22:56:21 UTC 2008 i686 GNU/Linux

Patched it following the link below:
http://www.aircrack-ng.org/doku.php?id=r8187

Patch was applied successfully....

I followed these steps for the cracking:
http://s32.photobucket.com/player.sw...fs=1&os=1&ap=1

Why can I get this going in FC but not Ubuntu?

I'm in the process of download the BT3 ISO but would prefer using Ubuntu.

Thanks for reading and hope I hear back from someone soon.

Later,

BigJoeJack