DiGiNinga Karma Patch for Atheros Cards ROCKS!!!!

I have been playing with the karma patch that DiGiNinja coded for the Madwifi-ng kernel modules for Atheros wireless cards. This allows us to set our Atheros wireless card to respond to any request broadcast from wireless client as if we are the AP they are looking for, in addition we will broadcast the SSID as if we are the AP to see if any other client in the area is looking for the network. This patched kernel modules are in BT3 and in iPwn OS that HD Moore uses for his mobile laptops, and I have to say this patch is a must for any serius pentester. I decided to make an lzm for Backtrack 3 after being foolish enough to over write the modules with a clean install of madwifi.
The features that it adds are as follows:

• Karma functionality
• SSID Blacklist and Whitelist
• MacAddress Blacklist and Whitelist

As a pentester this gives you the flexibility to target your attacks and be able to follow strict Rules of Engagement allowing you to only attack machines wich you are allowed to attack, the SSID's and MAC's can be added dynamically so you do not have to stop your attack. The commands that I found are as follows:
Enabling and Disabling Karma:

• iwpriv atho karma 1 (Enable Karma)
  
• iwpriv ath0 karma 0 (Disable Karma)
  
• iwpriv ath0 get_karma (Get status of Karma)
  

MAC Address Whitelisting and Blacklisting:

• iwpriv ath0 maccmd 1 (Sets the card in whitelist mode)
• iwpriv ath0 maccmd 2 (Sets the card in Blacklist mode)
• iwpriv ath0 maccmd 0 (Disable all MAC filtering modes)
• iwpriv ath0 addmac (Adds mac address to the list)
• iwpriv ath0 kickmac (Removes MAC Address form the list)
• iwpriv ath0 maccmd 3 (Clears the entire MAC Address list)

SSID Whitelisting and Blacklisting:

• iwpriv ath0 karma_bw 0 (Sets the card in Blacklist mode)
  
• iwpriv ath0 karma_bw 1 (Sets the card in Whitelist mode)
• iwpriv ath0 get_karma_bw (Get status of Blacklisting and Whitelisting Mode)
• iwpriv ath0 addkarmassid (Adds SSID to the list)
  
• iwpriv ath0 clrkarmalist 0 (Clears SSID List)
  

Comments

[Anonymous]

Enjoying your blog, keep it up!
- Deathray, Remote-Exploit forums

[Saumil Shah]

Slight modification to the patching process for Madwifi + Digininja on Backtrack4.

I followed your (meticulous!) instructions from:

http://www.darkoperator.com/karmapatchinst

The SVN update now fetches version 4022, and the patches are meant for version 3925

The line:

svn co http://svn.madwifi-project.org/madwifi/branches/madwifi-hal-0.10.5.6/

needs to be changed to:

svn -r 3925 co http://svn.madwifi-project.org/madwifi/branches/madwifi-hal-0.10.5.6/

in order for the patches to be applied successfully.

This is a workaround until the patches themselves get updated (or hopefully included in the project itself *sigh*)

I am posting this comment on your blog so that googlers like me will arrive at the solution quicker than sifting through forums and putting up with n00bs' clueless requests and moderators' high-and-mighty attitudes :)