vanhoefm / krackattacks-poc-zerokey

Proof-of-concept of the KRACK attack against Linux and Android

This script is currently not actively supported. The documentation is also not complete.

Before running this script, you must compile hostapd. This only needs to be done once:

  cd ../hostapd
  cp defconfig .config
  make -j 2

Then you can exece this script. See our video for example commands.

krackattacks-poc-zerokey's Issues

fail krack attack

i have this problem with script:
connect exception hostapd_ctrl/wlan0 9877
please a need help for solve this.

Rogue hostapd: hostapd_eid_wmm: not including WMM element in beacon or probe response

So great to find these scripts. Thanks for sharing.
When I run scripts like vedio, It seems something wrong with it.
It always report som log like this:

[15:43:13] Rogue hostapd: hostapd_eid_wmm: not including WMM element in beacon or probe response
[15:43:13] WARNING: Didn't receive beacon from rogue AP for two seconds

But I got AP's beacon packets by wireshark.
How can I deal with it?

Socket.gaierror [Errno -2]

Hi,
Thanks for sharing your scripts.
I'm testing "krack-all-zero-tk.py" but it doesn't work for me.
During the executing appears this error: socket.gaierror: [Errno -2] Name or service not known. This exception runs when trying to create the object Ctrl("hostapd_ctrl/" + self.nic_rogue_ap).
Can you help me to understand how to solve it?

Thanks in advance.
Best Regards,
Giove.

Here my screenshot:

[Error] No beacon received of network <SSID>. Is monitor mode working? Did you enter the correct SSID?

I'm getting this error:

[17:49:41] Note: remember to disable Wi-Fi in your network manager so it doesn't interfere with this script [17:49:41] Note: keep >1 meter between both interfaces. Else packet delivery is unreliable & target may disconnect [17:49:42] WARNING: Targeting ALL clients is not fully supported! Please provide a specific target using --target. [17:49:45] Searching for target network on other channels [17:49:50] No beacon received of network <CASA>. Is monitor mode working? Did you enter the correct SSID? [17:49:50] Closing hostapd and cleaning up ... Exception TypeError: 'super() argument 1 must be type, not None' in <bound method MitmSocket.__del__ of <__main__.MitmSocket object at 0x7f26ac5dd890>> ignored Exception TypeError: 'super() argument 1 must be type, not None' in <bound method MitmSocket.__del__ of <__main__.MitmSocket object at 0x7f26ac5dd590>> ignored

How can i solve it? I was able to make work krackattacks test script but i'm having problem with this one...

KeyError: 4

Hello,

I have been trying to run krack-all-zero-tk.py for a while now. I have 2 NIC's and made sure that both client and AP are vulnerable to the attack. While running the program, I seem to get a KeyError: 4 issue and it will stop the process of the code.

Any suggestions on how to fix?

Thanks!

Try to krackattacks-poc-zerokey but doen not work properly

Thank you this script.
I try to this script.Attacker Kali Linux be attacked Ubuntu 15.10 (wpa_supplicant 2.4)
I check disconnect real channel(1ch). And I check rogue channel(11ch).
Be attacked Client unconnected. After try to rogue channel but require password.
and end krackattacks-poc-zerokey.py I don't know why don't work properly.

[11:23:16] Rogue channel: xx:xx:xx:xx:xx:xx -> 00:00:00:00:00:00: ProbeResp(seq=1412)
[11:23:17] Rogue channel: 00:00:00:00:00:00 -> ff:ff:ff:ff:ff:ff: ProbeReq(seq=4082)
[11:23:17] Rogue channel: 00:00:00:00:00:00 -> ff:ff:ff:ff:ff:ff: ProbeReq(seq=4083)
[11:23:17] Rogue channel: injected Disassociation to 00:00:00:00:00:00
[11:23:17] Rogue channel: xx:xx:xx:xx:xx:xx -> 00:00:00:00:00:00: ProbeResp(seq=1413)
[11:23:17] Rogue channel: xx:xx:xx:xx:xx:xx -> 00:00:00:00:00:00: ProbeResp(seq=1414)
Traceback (most recent call last):
File "./krack-all-zero-tk.py", line 1018, in
attack.run(strict_echo_test=args.strict_echo_test)
File "./krack-all-zero-tk.py", line 950, in run
if self.sock_rogue in sel[0]: self.handle_rx_roguechan()
File "./krack-all-zero-tk.py", line 760, in handle_rx_roguechan
if Dot11Beacon in p and ord(get_tlv_value(p, IEEE_TLV_TYPE_CHANNEL)) == self.netconfig.rogue_channel:
TypeError: ord() expected string of length 1, but NoneType found
[11:23:17] Closing hostapd and cleaning up ...