Remove instructions from scripts themselves

krackattack/krack-ft-test.py

@@ -23,103 +23,6 @@ IEEE80211_RADIOTAP_DATA_RETRIES = (1 << 17)
 #TODO: - Option to use a secondary interface for injection + WARNING if a virtual interface is used + repeat advice to disable hardware encryption
 #TODO: - Test whether injection works on the virtual interface (send probe requests to nearby AP and wait for replies)
 
-# FIXME: We are repeating the "disable hw encryption" script to client tests
-USAGE = """{name} - Tool to test Key Reinstallation Attacks against an AP
-
-To test wheter an AP is vulnerable to a Key Reinstallation Attack against
-the Fast BSS Transition (FT) handshake, take the following steps:
-
-1. The hardware encryption engine of some Wi-Fi NICs have bugs that interfere
-   with our script. So disable hardware encryption by executing:
-
-      ./disable-hwcrypto.sh
-
-   This only needs to be done once. It's recommended to reboot after executing
-   this script. After plugging in your Wi-Fi NIC, use `systool -vm ath9k_htc`
-   or similar to confirm the nohwcript/.. param has been set. We tested this
-   with an a TP-Link TL-WN722N and an Alfa AWUS051NH v2.
-
-2. Create a wpa_supplicant configuration file that can be used to connect
-   to the network. A basic example is:
-
-      ctrl_interface=/var/run/wpa_supplicant
-      network={{
-          ssid="testnet"
-          key_mgmt=FT-PSK
-          psk="password"
-      }}
-
-   Note the use of "FT-PSK". Save it as network.conf or similar. For more
-   info see https://w1.fi/cgit/hostap/plain/wpa_supplicant/wpa_supplicant.conf
-
-3. Try to connect to the network using your platform's wpa_supplicant.
-   This will likely require a command such as:
-
-      sudo wpa_supplicant -D nl80211 -i wlan0 -c network.conf
-
-   If this fails, either the AP does not support FT, or you provided the wrong
-   network configuration options in step 1.
-
-4. Use this script as a wrapper over the previous wpa_supplicant command:
-
-      sudo {name} wpa_supplicant -D nl80211 -i wlan0 -c network.conf
-
-   This will execute the wpa_supplicant command using the provided parameters,
-   and will add a virtual monitor interface that will perform attack tests.
-
-5. Use wpa_cli to roam to a different AP of the same network. For example:
-
-      sudo wpa_cli -i wlan0
-      > status
-      bssid=c4:e9:84:db:fb:7b
-      ssid=testnet
-      ...
-      > scan_results 
-      bssid / frequency / signal level / flags / ssid
-      c4:e9:84:db:fb:7b	2412  -21  [WPA2-PSK+FT/PSK-CCMP][ESS] testnet
-      c4:e9:84:1d:a5:bc	2412  -31  [WPA2-PSK+FT/PSK-CCMP][ESS] testnet
-      ...
-      > roam c4:e9:84:1d:a5:bc
-      ...
-   
-   In this example we were connected to AP c4:e9:84:db:fb:7b of testnet (see
-   status command). The scan_results command shows this network also has a
-   second AP with MAC c4:e9:84:1d:a5:bc. We then roam to this second AP.
-
-6. Generate traffic between the AP and client. For example:
-
-      sudo arping -I wlan0 192.168.1.10
-
-7. Now look at the output of {name} to see if the AP is vulnerable.
-
-   6a. First it should say "Detected FT reassociation frame". Then it will
-       start replaying this frame to try the attack.
-   6b. The script shows which IVs (= packet numbers) the AP is using when
-       sending data frames.
-   6c. Message "IV reuse detected (IV=X, seq=Y). AP is vulnerable!" means
-       we confirmed it's vulnerable.
-
-  !! Be sure to manually check network traces as well, to confirm this script
-  !! is replaying the reassociation request properly, and to manually confirm
-  !! whether there is IV (= packet number) reuse or not.
-
-   Example output of vulnerable AP:
-      [15:59:24] Replaying Reassociation Request
-      [15:59:25] AP transmitted data using IV=1 (seq=0)
-      [15:59:25] Replaying Reassociation Request
-      [15:59:26] AP transmitted data using IV=1 (seq=0)
-      [15:59:26] IV reuse detected (IV=1, seq=0). AP is vulnerable!
-
-   Example output of patched AP (note that IVs are never reused):
-      [16:00:49] Replaying Reassociation Request
-      [16:00:49] AP transmitted data using IV=1 (seq=0)
-      [16:00:50] AP transmitted data using IV=2 (seq=1)
-      [16:00:50] Replaying Reassociation Request
-      [16:00:51] AP transmitted data using IV=3 (seq=2)
-      [16:00:51] Replaying Reassociation Request
-      [16:00:52] AP transmitted data using IV=4 (seq=3)
-"""
-
 #### Man-in-the-middle Code ####
 
 class KRAckAttackFt():
@@ -249,7 +152,7 @@ def argv_get_interface():
 
 if __name__ == "__main__":
 	if len(sys.argv) <= 1 or "--help" in sys.argv or "-h" in sys.argv:
-		print USAGE.format(name=sys.argv[0])
+		print "See README.md for instructions on how to use this script"
 		quit(1)
 
 	# TODO: Verify that we only accept CCMP?

krackattack/krack-test-client.py

@@ -22,118 +22,6 @@ from wpaspy import Ctrl
 # - Ability to test the group key handshake against specific clients only
 # - Individual test to see if the client accepts replayed broadcast traffic (without performing key reinstallation)
 
-# FIXME: We are repeating the "disable hw encryption" of FT tests
-USAGE = """{name} - Tool to test Key Reinstallation Attacks against clients
-
-To test wheter a client is vulnerable to Key Reinstallation Attack against
-the 4-way handshake or group key handshake, take the following steps:
-
-1. Compile our modified hostapd instance. This only needs to be done once.
-
-      cd ../hostapd
-      cp defconfig .config
-      make -j 2
-
-2. The hardware encryption engine of some Wi-Fi NICs have bugs that interfere
-   with our script. So disable hardware encryption by executing:
-
-      cd ../krackattack/
-      ./disable-hwcrypto.sh
-
-   This only needs to be done once. It's recommended to reboot after executing
-   this script. After plugging in your Wi-Fi NIC, use `systool -vm ath9k_htc`
-   or similar to confirm the nohwcript/.. param has been set. We tested this
-   script with an Intel Dual Band Wireless-AC 7260 and a TP-Link TL-WN722N.
-
-3. Execute this script. Accepted parameters are:
-
-      --group      Test the group key handshake instead of the 4-way handshake
-      --debug      Show more debug messages
-      --tptk       See step 5 (forge Msg1/4 with replayed ANonce before Msg3/4)
-      --tptk-rand  See step 5 (forge Msg1/4 with random ANonce before Msg3/4)
-
-   All other supplied arguments are passed on to hostapd.
-   The only two commands you will normally have to execute are:
-
-      {name}
-      {name} --group
-
-   The first one tests for key reinstallations in the 4-way handshake (see
-   step 4), and the second tests one for key reinstallations in the group key
-   handshake (see step 5).
-
-   !! The default network name is testnetwork with password abcdefgh !!
-
-   Note that you can change settings of the AP by modifying hostapd.conf.
-   You will probably have to edit the line `interface=` to specify the
-   correct Wi-Fi interface to use for the AP.
-
-4. To test key reinstallations in the 4-way handshake, the script will keep
-   sending encrypted message 3's to the client. To start the script execute:
-
-      {name}
-
-   Connect the the AP and the following tests will be performed automatically:
-
-   4a. The script monitors traffic sent by the client to see if the pairwise
-     key is being reinstalled. To assure the client is sending enough frames,
-     you can optionally ping the AP: ping 192.168.100.254 .
-
-     If the client is vulnerable, the script will show something like:
-        [19:02:37] 78:31:c1:c4:88:92: IV reuse detected (IV=1, seq=10). Client is vulnerable to pairwise key reinstallations in the 4-way handshake!
-
-     If the client is patched, the script will show (this can take a minute):
-        [18:58:11] 90:18:7c:6e:6b:20: client DOESN'T seem vulnerable to pairwise key reinstallation in the 4-way handshake.
-
-   4b. Once the client has requested an IP using DHCP, the script tests for
-     reinstallations of the group key by sending broadcast ARP requests to the
-     client using an already used (replayed) packet number (= IV). The client
-     *must* request an IP using DHCP for this test to start.
-
-     If the client is vulnerable, the script will show something like:
-        [19:03:08] 78:31:c1:c4:88:92: Received 5 unique replies to replayed broadcast ARP requests. Client is vulnerable to group
-        [19:03:08]                    key reinstallations in the 4-way handshake (or client accepts replayed broadcast frames)!
-
-     If the client is patched, the script will show (this can take a minute):
-        [19:03:08] 78:31:c1:c4:88:92: client DOESN'T seem vulnerable to group key reinstallation in the 4-way handshake handshake.
-
-     Note that this scripts *indirectly* tests for reinstallations of the group
-     key, by testing if replayed broadcast frames are accepted by the client.
-
-5. Some supplicants (e.g. wpa_supplicant v2.6) are only vulnerable to pairwise
-   key reinstallations in the 4-way handshake when a forged message 1 is
-   injected before sending a retransmitted message 3. To test for this variant
-   of the attack, you can execute:
-
-      {name} --tptk         # Inject message 1 with a replayed ANonce
-      {name} --tptk-rand    # Inject message 1 with a random ANonce
-
-   Now follow the same steps as in step 4 to see if a supplicant is vulnerable.
-   Try both these attack variants after running the normal tests of step 4.
-
-6. To test key reinstallations in the group key handshake, the script will keep
-   performing new group key handshakes using an identical (static) group key.
-   The client *must* request an IP using DHCP for this test to start. To start
-   the script execute:
-
-      {name} --group
-
-   Connect the the AP and all tests will be performed automatically. The
-   working and output of the script is now similar as in step 4b.
-
-7. Some final recommendations:
-
-   6a. Perform these tests in a room with little interference. A high amount
-       of packet loss will make this script unreliable!
-   6b. Manually inspect network traffic to confirm the output of the script:
-       - Use an extra Wi-Fi NIC in monitor mode to check pairwise key reinstalls
-         by monitoring the IVs of frames sent by the client.
-       - Capture traffic on the client to see if the replayed broadcast ARP
-         requests are accepted or not.
-   6c. If the client being tested can use multiple Wi-Fi radios/NICs, test
-       using a few different ones.
-"""
-
 # After how many seconds a new message 3, or new group key message 1, is sent.
 # This value must match the one in `../src/ap/wpa_auth.c` (same variable name).
 HANDSHAKE_TRANSMIT_INTERVAL = 2
@@ -595,7 +483,7 @@ def hostapd_read_config(config):
 
 if __name__ == "__main__":
 	if "--help" in sys.argv or "-h" in sys.argv:
-		print USAGE.format(name=sys.argv[0])
+		print "See README.md for instructions on how to use this script"
 		quit(1)
 
 	test_grouphs = argv_pop_argument("--group")