Commit 95ca250d authored by Raphaël Hertzog's avatar Raphaël Hertzog

Imported Upstream version 2011.03.R2

parent 5a2b62b4
This diff is collapsed.
This source diff could not be displayed because it is too large. You can view the blob instead.
This diff is collapsed.
INSTGRP ?= "@instgrp@"
MANGRP ?= "@mangrp@"
INSTUSR ?= "root"
ZAURUS = @zaurus@
PCAPLNK = @pcaplnk@
THREADL = @threadlib@
BLDHOME = @srcdir@
CXX = @CXX@
CC = @CC@
LD = @CXX@
LDFLAGS = @LDFLAGS@
INSTALL = @INSTALL@
INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
LIBS = @LIBS@
CLIBS = @CLIBS@
CXXLIBS = @CXXLIBS@
KSLIBS = @KSLIBS@
CFLAGS = @CPPFLAGS@
CLIENTLIBS = @CLIENTCLIBS@
CAPLIBS = @caplibs@
CLIENTFLAGS = @CLIENTCFLAGS@
CXXFLAGS = -Wall @CXXFLAGS@
CPPFLAGS = @CPPFLAGS@
SUIDGROUP = @suidgroup@
prefix = @prefix@
exec_prefix = @exec_prefix@
ETC = ${DESTDIR}@sysconfdir@
BIN = ${DESTDIR}@bindir@
SHARE = ${DESTDIR}@datadir@/kismet/
MAN = ${DESTDIR}@mandir@
WAV = ${SHARE}/wav/
PLUGINLDFLAGS = @PLUGINLDFLAGS@
This diff is collapsed.
Tested on AppleTV that was originally set to version 1.1 and downgraded
to 1.0 via Factory Restore
http://manuals.info.apple.com/en/AppleTV_UserGuide.pdf
The first step to getting kismet running on AppleTV is to install ssh.
If you are not familiar with AppleTV mods I suggest
you look at: http://wiki.awkwardtv.org/wiki/Main_Page
I found it easiest to open my AppleTV and place the ATVLoader on via
USB hard disk interface. First run through the AppleTV setup. I chose
to reset my AppleTV before preparing for the kismet install.
TV->Settings->Reset Settings->Factory Restore. (Warning this resets to 1.0)
I went with a Streaming only config (not necessary) after the reset.
Open up the AppleTV and attach the Hard disk via external USB case.
http://wiki.awkwardtv.org/wiki/Hardware_Modification_Prerequisites
On OSX the disk should mount as follows once it is plugged in.
/dev/disk1s3 on /Volumes/OSBoot (local, nodev, nosuid, journaled)
/dev/disk1s4 on /Volumes/Media (local, nodev, nosuid, journaled)
We need to install AwkwardTV Loader so we can enable ssh.
http://wiki.awkwardtv.org/wiki/ATV_Loader
http://plugins.awkwardtv.org/det.php?recordID=atvloader
http://alanquatermain.net/atvloader/
Unpack ATVLoader.zip to get ATVLoader.pkg, run it once it is unpacked.
Choose your OSBoot partition in the installer...
Umount the disks, reinstall the drive and turn on your AppleTV.
Make sure you boot wit the LAN cable plugged in.
Then enable ssh. TV->Awkward TV->SSH Service Disabled->Enable
This make take a second because the machine needs to generate the ssh
keys.
Get the IP and ssh in to the AppleTV using the username frontrow with
a pass of frontrow.
TV->Settings->About
Welcome to Darwin!
MacbookPro:~ kfinisterre$ ssh -l frontrow 192.168.2.68
Password:
Last login: Mon Aug 6 21:17:35 2007
-bash-2.05b$ sudo sh
Password: (frontrow)
sh-2.05b#
Make sure you use the username frontrow and the password frontrow. Make
yourself root via 'sudo sh'. (Note this is "sh" and not "su")
Mount the hard disk in rm mode.
sh-2.05b# mount -uw /
If you check ifconfig you can see that configd is doing some nasty things
to prevent both interfaces from working together. Note how en1 is inactive.
If you remove the LAN cable you will note that en0 will switch to inactive.
-bash-2.05b$ ifconfig
...
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
inet6 fe80::217:f2ff:fef8:b946%en0 prefixlen 64 scopeid 0x4
inet 192.168.2.109 netmask 0xffffff00 broadcast 192.168.2.255
ether 00:17:f2:f8:b9:46
media: autoselect (100baseTX <full-duplex,flow-control>) status: active
supported media: autoselect 100baseTX <full-duplex> 100baseTX <full-duplex,flow-control> 100baseTX <hw-loopback> 100baseTX <half-duplex> 10baseT/UTP <full-duplex> 10baseT/UTP <full-duplex,flow-control> 10baseT/UTP <hw-loopback> 10baseT/UTP <half-duplex> none
en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether 00:19:e3:dd:cf:db
media: autoselect (<unknown type>) status: inactive
supported media: autoselect
wlt1: flags=41<UP,RUNNING> mtu 1500
To prevent this behavior we need to disable the configd Kernel Event Manager.
We first need to set a static IP address on the LAN interface.
TV->Settings->Network->Configure Ethernet->Manually
Connect via ssh again to your new static IP and then disable KEM and reboot.
This is also a good opportunity to install kismet.
-bash-2.05b$ sudo sh
Password:
sh-2.05b# cd /System/Library/SystemConfiguration/
sh-2.05b# mv KernelEventMonitor.bundle/ KernelEventMonitor.bundle_disabled
Next set launchd to fire off kismet at reboot.
sh-2.05b# cd /System/Library/LaunchDaemons/
sh-2.05b# cat > com.kismet.kismet_server
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.kismet.kismet_server</string>
<key>OnDemand</key>
<false/>
<key>ProgramArguments</key>
<array>
<string>/usr/local/bin/kismet_server</string>
<string>--daemonize</string>
</array>
<key>ServiceIPC</key>
<false/>
</dict>
</plist>
download and compile kismet from svn
MacbookPro:~/Desktop kfinisterre$ svn co http://svn.kismetwireless.net/code/trunk kismet-devel
scp it to the AppleTV
MacbookPro:~/Desktop/kismet-devel kfinisterre$ scp /usr/local/bin/kismet* /usr/local/etc/kismet* frontrow@192.168.2.68:/tmp
MacbookPro:~/Desktop/kismet-devel kfinisterre$ scp /usr/bin/nano frontrow@192.168.2.68:/tmp
sh-2.05b# mv nano /usr/bin/
sh-2.05b# mkdir -p /usr/local/bin
sh-2.05b# mkdir -p /usr/local/etc
sh-2.05b# mv kismet kismet_client kismet_drone kismet_server /usr/local/bin/
sh-2.05b# mv kismet.conf kismet_drone.conf kismet_ui.conf /usr/local/etc/
Edit the kismet.conf accordingly
sh-2.05b# grep frontrow /usr/local/etc/kismet.conf
suiduser=frontrow
source=darwin,en1,none
Since the drone is broken set kismet_server up to listen on the eth0 interface
set allowedhosts= and bindaddress=
allowedhosts=192.168.2.0/24
bindaddress=192.168.2.68
Set the log path to /tmp also.
logdefault=/tmp/Kismet
Next start kismet_client -s AppleTV:2501
\ No newline at end of file
2010-07-R1
----------
Enhancements:
Ruby interface and examples
Proper TCP Async (for large numbers of drones and other situations)
Add hidedata= option for "safer" sniffing in public environments
Kluged escape handler for broken ncurses arrow handling on some systems
Add --no-root option for zero-priv drone-only deploys
Bugfixes:
Fix installation on Ubuntu dash
IPC updates and fixes for drone
IPC architectural fixes
2010-01-R1
----------
Enhancements:
Add basic scanning support (NOT SNIFFING) for bluetooth via BTSCAN plugin
Add JSON parsers to accommodate GPSD moving to JSON for all its protocols
Add preferredchannels= config file option to delay on chans automatically
Allow plugins to append to View, Sort menus
Add support for unix domain servers (via Ilya)
Sub-menus in UI work with mice
Bugfixes:
Fix segfault bugs in PTW plugin
Fix thread signal stealing in plugins
Fix compiling plugins on Snow Leopard
Revamp GPS connected logic
Fix duplicated callbacks in network handler which lead to wasted CPU and
doubled lines on reconnecting to a server
Fix GPSD client cancelling own reconnect timer
20050815211952
In no particular order:
first-seen-source
cardtype/interface dumps
non-rfmon-signal gps logger
ipv6
key management via panels client
server and client plugins
strings dumpfile
fakeap detection
retry ratios
gpsmap client-link drawing (dot-line clusters)
gpsmap coloring/plotting by encoding, carrier, data rate
gpsmap font picking
gpsmap strongest point plotting
congestion simulation
Multiple host= lines for kismet_client
Alerts as forged packets in pipe
VPN detection
linkage of seen-on devices to network info
AP uptime extraction
strong authentication/SSL of client/server server/drone
acpi/apm reporting via server protocol
detect dupe packets on multiple input streams
/*
This file is part of Kismet
Kismet is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
Kismet is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with Kismet; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#include "config.h"
#if defined(HAVE_LIBPCAP) && defined(HAVE_LIBAIRPCAP) && defined(SYS_CYGWIN)
#include "airpcapsource.h"
// Prototypes of Windows-specific pcap functions.
// wpcap.dll contains these functions, but they are not exported to cygwin because
// cygwin doesn't "officially" support the Windows extensions. These functions,
// however, are safe to use.
extern "C" PAirpcapHandle pcap_get_airpcap_handle(pcap_t *p);
extern "C" HANDLE pcap_getevent (pcap_t *p);
extern "C" int pcap_setmintocopy (pcap_t *p, int size);
int AirPcapSource::OpenSource() {
channel = 0;
errstr[0] = '\0';
char *unconst = strdup(interface.c_str());
pd = pcap_open_live(unconst, MAX_PACKET_LEN, 1, -1, errstr);
free(unconst);
if (strlen(errstr) > 0)
return -1;
paused = 0;
errstr[0] = '\0';
// Gather the data link
if (DatalinkType() < 0) {
snprintf(errstr, 1024, "unable to get the data link on %s",
interface.c_str());
pcap_close(pd);
return -1;
}
// Fetch the airpcap channel
if ((airpcap_handle = pcap_get_airpcap_handle(pd)) == NULL) {
snprintf(errstr, 1024, "Adapter %s does not have wireless extensions",
interface.c_str());
pcap_close(pd);
return -1;
}
// Set the link mode to give us radiotap headers
// Removed - no deterministic method to set radiotap mode on airpcap. By
// default the drivers ought to be in rtap mode, if they're not we'll
// figure it out from the link type later but can't try to set the mode.
#if 0
if (!AirpcapSetLinkType(airpcap_handle, AIRPCAP_LT_802_11_PLUS_RADIO)) {
snprintf(errstr, 1024, "Adapter %s failed setting radiotap link layer: %s",
interface.c_str(), AirpcapGetLastError(airpcap_handle));
pcap_close(pd);
return -1;
}
#endif
// Tell the AirPcap adapter that we want the correct frames only
// (XXX Is this needed?)
// (XXX It doesn't hurt. Kismet doesn't do anything but validate FCS itself
// and throw them out, so we might as well toss them out at the
// airpcap level - dragorn)
if (!AirpcapSetFcsValidation(airpcap_handle, AIRPCAP_VT_ACCEPT_CORRECT_FRAMES)) {
snprintf(errstr, 1024, "Adapter %s failed setting radiotap link layer: %s",
interface.c_str(), AirpcapGetLastError(airpcap_handle));
pcap_close(pd);
return -1;
}
// Add it to our local copy of the fd event mangler
fd_mangle.AddHandle(pcap_getevent(pd));
fd_mangle.Activate();
return 0;
}
int AirPcapSource::FetchPacket(kis_packet *packet, uint8_t *data, uint8_t *moddata) {
int ret;
if ((ret = PcapSource::FetchPacket(packet, data, moddata)) == 0) {
fd_mangle.Reset();
fd_mangle.Signalread();
}
return ret;
}
#if 0
int AirPcapSource::FetchChannel() {
unsigned int ch;
if (!AirpcapGetDeviceChannel(airpcap_handle, &ch))
return -1;
return (int) ch;
}
#endif
int AirPcapSource::FetchDescriptor() {
// Fall through to our HANDLE to FD mangler
return fd_mangle.GetFd();
}
int AirPcapSource::SetChannel(unsigned int in_ch, char *in_err) {
if (!AirpcapSetDeviceChannel(airpcap_handle, in_ch)) {
snprintf(in_err, 1024, "Adapter %s failed setting channel: %s",
interface.c_str(), AirpcapGetLastError(airpcap_handle));
return -1;
}
return 0;
}
int AirPcapSource::FetchSignalLevels(int *in_siglev, int *in_noiselev) {
*in_siglev = 0;
*in_noiselev = 0;
return 0;
}
KisPacketSource *airpcapsource_registrant(string in_name, string in_device,
char *in_err) {
return new AirPcapSource(in_name, in_device);
}
// Spawn an airpcap device and get the info from the user
KisPacketSource *airpcapsourceq_registrant(string in_name, string in_device,
char *in_err) {
pcap_if_t *alldevs, *d;
int i;
int intnum;
AirPcapSource *src = NULL;
char errbuf[1024];
if (pcap_findalldevs(&alldevs, errbuf) == -1) {
snprintf(in_err, 1024, "Error in pcap_findalldevs: %s\n", errbuf);
return NULL;
}
fprintf(stdout, "Available interfaces:\n");
for (d = alldevs, i = 0; d != NULL; d = d->next) {
fprintf(stdout, "%d. %s\n", ++i, d->name);
if (d->description)
fprintf(stdout, " %s\n", d->description);
else
fprintf(stdout, " No description available\n");
}
if (i == 0) {
pcap_freealldevs(alldevs);
snprintf(in_err, 1024, "No interfaces found, are WinPcap and AirPcap "
"installed and the AirPcap device attached?");
return NULL;
}
while (1) {
fprintf(stdout, "Enter interface number (1-%d):", i);
if (fscanf(stdin, "%d", &intnum) != 1) {
fprintf(stdout, "Invalid entry\n");
continue;
}
if (intnum < 1 || intnum > i) {
fprintf(stdout, "Invalid entry, must be between 1 and %d\n", i);
continue;
}
break;
}
// Find the adapter
for (d = alldevs, i = 0; i < intnum - 1; d = d->next, i++)
;
src = new AirPcapSource(in_name, string(d->name));
pcap_freealldevs(alldevs);
return src;
}
int chancontrol_airpcap(const char *in_dev, int in_ch, char *in_err, void *in_ext) {
// Channel control uses the external pointer
return ((AirPcapSource *) in_ext)->SetChannel(in_ch, in_err);
}
#endif
/*
This file is part of Kismet
Kismet is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
Kismet is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with Kismet; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#include "airsnortdump.h"
#include "packetracker.h"
int AirsnortDumpFile::OpenDump(const char *file) {
snprintf(type, 64, "airsnort (weak packet) dump");
snprintf(filename, 1024, "%s", file);
num_dumped = 0;
dumper = new WtapDumpFile;
int ret;
ret = dumper->OpenDump(file);
if (ret < 0)
snprintf(errstr, 1024, "%s", dumper->FetchError());
return ret;
}
int AirsnortDumpFile::CloseDump() {
int ret;
ret = dumper->CloseDump();
if (ret < 0)
snprintf(errstr, 1024, "%s", dumper->FetchError());
// delete dumper;
return ret;
}
int AirsnortDumpFile::DumpPacket(const packet_info *in_info, const kis_packet *packet) {
int ret = 1;
// Is it a beacon? Do we know about this network? Log it if we don't.
if (in_info->type == packet_management && in_info->subtype == packet_sub_beacon) {
if (bssid_dumped_map.find(in_info->bssid_mac) == bssid_dumped_map.end()) {
// We only count weak packets as logged, not the headers
bssid_dumped_map[in_info->bssid_mac] = 1;
ret = dumper->DumpPacket(in_info, packet);
if (ret < 0)
snprintf(errstr, 1024, "%s", dumper->FetchError());
return ret;
}
}
// Is it weak? Always log them, and add it to our count
if (in_info->type == packet_data && in_info->interesting == 1) {
num_dumped++;
ret = dumper->DumpPacket(in_info, packet);
if (ret < 0)
snprintf(errstr, 1024, "%s", dumper->FetchError());
return ret;
}
return ret;
}
This diff is collapsed.
......@@ -29,8 +29,53 @@
#include <algorithm>
#include <string>
#include "tcpserver.h"
#include "server_protocols.h"
#include "globalregistry.h"
#include "messagebus.h"
#include "packetchain.h"
#include "timetracker.h"
#include "kis_netframe.h"
class kis_alert_info : public packet_component {
public:
kis_alert_info() {
tm.tv_sec = 0;
tm.tv_usec = 0;
channel = 0;
// We do NOT self-destruct because we get cached in the alertracker
// for playbacks. It's responsible for discarding us
self_destruct = 0;
}
string header;
struct timeval tm;
mac_addr bssid;
mac_addr source;
mac_addr dest;
mac_addr other;
int channel;
string text;
};
class kis_alert_component : public packet_component {
public:
kis_alert_component() {
// We can self destruct because we won't clear out the vector
// of actual alert info
self_destruct = 1;
}
vector<kis_alert_info *> alert_vec;
};
enum ALERT_fields {
ALERT_sec, ALERT_usec, ALERT_header, ALERT_bssid, ALERT_source,
ALERT_dest, ALERT_other, ALERT_channel, ALERT_text,
ALERT_maxfield
};
int Protocol_ALERT(PROTO_PARMS); // kis_alert_info
void Protocol_ALERT_enable(PROTO_ENABLE_PARMS);
static const int alert_time_unit_conv[] = {
1, 60, 3600, 86400
......@@ -43,7 +88,7 @@ enum alert_time_unit {
class Alertracker {
public:
// A registered alert type
typedef struct alert_rec {
struct alert_rec {
int ref_index;
string header;
......@@ -66,16 +111,20 @@ public:
time_t time_last;
};
// Simple struct from reading config lines
struct alert_conf_rec {