ildar@ROBOT-1:~$ wifite
. .
.´ · . . · `. wifite 2.2.5
: : : (¯) : : : automated wireless auditor
`. · ` /¯\ ´ · .´ https://github.com/derv82/wifite2
` /¯¯¯\ ´
[!] error: wifite must be run as root
[!] re-run with sudo
ildar@ROBOT-1:~$ sudo wifite
[sudo] пароль для ildar:
. .
.´ · . . · `. wifite 2.2.5
: : : (¯) : : : automated wireless auditor
`. · ` /¯\ ´ · .´ https://github.com/derv82/wifite2
` /¯¯¯\ ´
[!] Warning: Recommended app bully was not found. install @ https://github.com/aanarchyy/bully
[!] Warning: Recommended app hashcat was not found. install @ https://hashcat.net/hashcat/
[!] Warning: Recommended app hcxdumptool was not found. install @ https://github.com/ZerBea/hcxdumptool
[!] Warning: Recommended app hcxpcaptool was not found. install @ https://github.com/ZerBea/hcxtools
[!] Conflicting processes: avahi-daemon (PID 812), NetworkManager (PID 818), wpa_supplicant (PID 819), avahi-daemon (PID 884)
[!] If you have problems: kill -9 PID or re-run wifite with --kill)
Interface PHY Driver Chipset
-----------------------------------------------------------------------
1. wlp3s0 phy0 rt2800pci Ralink corp. RT5390R 802.11bgn PCIe Wireless Network Adapter
[+] enabling monitor mode on wlp3s0... enabled wlp3s0mon
NUM ESSID CH ENCR POWER WPS? CLIENT^C
--- ------------------------- --- ---- ----- ---- ------
1 MikroTik 1 WPA 68db no
2 DIR-300-11 1 WPA 22db no
3 Keenetic-8702 1 WPA 19db no
4 TP-Link_7B5A 10 WPA 16db no
[+] select target(s) (1-4) separated by commas, dashes or all: ^C
[!] Interrupted, Shutting down...
[!] Note: Leaving interface in Monitor Mode!
[!] To disable Monitor Mode when finished: airmon-ng stop wlp3s0mon
ildar@ROBOT-1:~$ sudo git clone https://github.com/aanarchyy/bully
Клонирование в «bully»…
remote: Enumerating objects: 435, done.
remote: Total 435 (delta 0), reused 0 (delta 0), pack-reused 435
Получение объектов: 100% (435/435), 596.51 KiB | 1.16 MiB/s, готово.
Определение изменений: 100% (179/179), готово.
ildar@ROBOT-1:~$ ls
bully hs snap Видео Изображения 'Рабочий стол'
examples.desktop MITMf test Документы Музыка Шаблоны
functions.sh SHARE wifite Загрузки Общедоступные
ildar@ROBOT-1:~$ cd bully/
ildar@ROBOT-1:~/bully$ ls
LICENSE.md Makefile README.md src version.mk
ildar@ROBOT-1:~/bully$ cat README.md
# OVERVIEW [](https://github.com/aanarchyy/bully/blob/master/LICENSE.md)
**Bully** is a new implementation of the WPS brute force attack, written in C. It is conceptually identical
to other programs, in that it exploits the (now well known) design flaw in the WPS specification. It has
several advantages over the original reaver code. These include fewer dependencies, improved memory and
cpu performance, correct handling of endianness, and a more robust set of options. It runs on Linux, and
was specifically developed to run on embedded Linux systems (OpenWrt, etc) regardless of architecture.
Bully provides several improvements in the detection and handling of anomalous scenarios. It has been
tested against access points from numerous vendors, and with differing configurations, with much success.
You **must** already have Wiire's Pixiewps installed.
The latest version can be found here: [https://github.com/wiire/pixiewps](https://github.com/wiire/pixiewps).
# Requirements
`apt-get -y install build-essential libpcap-dev aircrack-ng pixiewps`
# Setup
**Download**
`git clone https://github.com/aanarchyy/bully`
or
`wget https://github.com/aanarchyy/bully/archive/master.zip && unzip master.zip`
**Build**
```bash
cd bully*/
cd src/
make
```
**Install**
```
sudo make install
```
# Usage
```
usage: bully <options> interface
Required arguments:
interface : Wireless interface in monitor mode (root required)
-b, --bssid macaddr : MAC address of the target access point
Or
-e, --essid string : Extended SSID for the access point
Optional arguments:
-c, --channel N[,N...] : Channel number of AP, or list to hop [b/g]
-i, --index N : Starting pin index (7 or 8 digits) [Auto]
-l, --lockwait N : Seconds to wait if the AP locks WPS [43]
-o, --outfile file : Output file for messages [stdout]
-p, --pin N : Starting pin number (7 or 8 digits) [Auto]
-s, --source macaddr : Source (hardware) MAC address [Probe]
-v, --verbosity N : Verbosity level 1-4, 1 is quietest [3]
-w, --workdir path : Location of pin/session files [~/.bully/]
-5, --5ghz : Hop on 5GHz a/n default channel list [No]
-B, --bruteforce : Bruteforce the WPS pin checksum digit [No]
-F, --force : Force continue in spite of warnings [No]
-S, --sequential : Sequential pins (do not randomize) [No]
-T, --test : Test mode (do not inject any packets) [No]
Advanced arguments:
-d, --pixiewps : Attempt to use pixiewps [No]
-a, --acktime N : Deprecated/ignored [Auto]
-r, --retries N : Resend packets N times when not acked [2]
-m, --m13time N : Deprecated/ignored [Auto]
-t, --timeout N : Deprecated/ignored [Auto]
-1, --pin1delay M,N : Delay M seconds every Nth nack at M5 [0,1]
-2, --pin2delay M,N : Delay M seconds every Nth nack at M7 [5,1]
-A, --noacks : Disable ACK check for sent packets [No]
-C, --nocheck : Skip CRC/FCS validation (performance) [No]
-D, --detectlock : Detect WPS lockouts unreported by AP [No]
-E, --eapfail : EAP Failure terminate every exchange [No]
-L, --lockignore : Ignore WPS locks reported by the AP [No]
-M, --m57nack : M5/M7 timeouts treated as WSC_NACK's [No]
-N, --nofcs : Packets don't contain the FCS field [Auto]
-P, --probe : Use probe request for nonbeaconing AP [No]
-R, --radiotap : Assume radiotap headers are present [Auto]
-W, --windows7 : Masquerade as a Windows 7 registrar [No]
-Z, --suppress : Suppress packet throttling algorithm [No]
-V, --version : Print version info and exit
-h, --help : Display this help information
```
## -d // --pixiewps
The -d option performs an offline attack, Pixie Dust _(`pixiewps`)_, by automatically passing the **PKE**, **PKR**, **E-Hash1**, **E-Hash2**, **E-Nonce** and **Authkey**. `pixiewps` will then try to attack **Ralink**, **Broadcom** and **Realtek** chipsets.
## -v // --verbosity
The -v option specifies the verbosity of **bully**.
-v 4 now prints all the collected hashes and outputs the pixiewps command run.
Default runlevel is 3.
# Acknowledgements
None of this would have happened without the rest of the great team I am proud to credit with helping me:
`t6_x`, `DataHead`, `Soxrok2212`, `Wiire`
Huge thanks to `wiire` for helping remove the openssl dependancy!
ildar@ROBOT-1:~/bully$ sudo apt-get -y install build-essential libpcap-dev aircrack-ng pixiewps
Чтение списков пакетов… Готово
Построение дерева зависимостей
Чтение информации о состоянии… Готово
Уже установлен пакет build-essential самой новой версии (12.8ubuntu1).
build-essential помечен как установленный вручную.
Уже установлен пакет aircrack-ng самой новой версии (1:1.5.2-3).
aircrack-ng помечен как установленный вручную.
Уже установлен пакет pixiewps самой новой версии (1.4.2-2).
pixiewps помечен как установленный вручную.
Следующие НОВЫЕ пакеты будут установлены:
libpcap-dev
Обновлено 0 пакетов, установлено 1 новых пакетов, для удаления отмечено 0 пакетов, и 64 пакетов не обновлено.
Необходимо скачать 3480 B архивов.
После данной операции объём занятого дискового пространства возрастёт на 20,5 kB.
Пол:1 http://ru.archive.ubuntu.com/ubuntu eoan/main amd64 libpcap-dev amd64 1.9.1-2 [3480 B]
Получено 3480 B за 0с (30,2 kB/s)
Выбор ранее не выбранного пакета libpcap-dev:amd64.
(Чтение базы данных … на данный момент установлено 196498 файлов и каталогов.)
Подготовка к распаковке …/libpcap-dev_1.9.1-2_amd64.deb …
Распаковывается libpcap-dev:amd64 (1.9.1-2) …
Настраивается пакет libpcap-dev:amd64 (1.9.1-2) …
ildar@ROBOT-1:~/bully$ cd src/
ildar@ROBOT-1:~/bully/src$ make
cc -I`pwd` -I`pwd`/utils/ -I`pwd`/tls/ -I`pwd`/wps/ -I`pwd`/crypto/ -I`pwd`/common/ -DUSE_INTERNAL_CRYPTO -DCONFIG_NO_RANDOM_POOL -o bully bully.c -lpcap
/usr/bin/ld: невозможно открыть выходной файл bully: Отказано в доступе
collect2: error: ld returned 1 exit status
make: *** [Makefile:20: bully] Ошибка 1
ildar@ROBOT-1:~/bully/src$ sudo make
cc -I`pwd` -I`pwd`/utils/ -I`pwd`/tls/ -I`pwd`/wps/ -I`pwd`/crypto/ -I`pwd`/common/ -DUSE_INTERNAL_CRYPTO -DCONFIG_NO_RANDOM_POOL -o bully bully.c -lpcap
ildar@ROBOT-1:~/bully/src$ sudo make unstall
make: *** Нет правила для сборки цели «unstall». Останов.
ildar@ROBOT-1:~/bully/src$ sudo make install
install -d /usr/local/bin
install -m 755 bully /usr/local/bin
ildar@ROBOT-1:~/bully/src$
