DiGiNinga Karma Patch for Atheros Cards ROCKS!!!!

I have been playing with the karma patch that DiGiNinja coded for the Madwifi-ng kernel modules for Atheros wireless cards. This allows us to set our Atheros wireless card to respond to any request broadcast from wireless client as if we are the AP they are looking for, in addition we will broadcast the SSID as if we are the AP to see if any other client in the area is looking for the network. This patched kernel modules are in BT3 and in iPwn OS that HD Moore uses for his mobile laptops, and I have to say this patch is a must for any serius pentester. I decided to make an lzm for Backtrack 3 after being foolish enough to over write the modules with a clean install of madwifi.
The features that it adds are as follows:

• Karma functionality
• SSID Blacklist and Whitelist
• MacAddress Blacklist and Whitelist

As a pentester this gives you the flexibility to target your attacks and be able to follow strict Rules of Engagement allowing you to only attack machines wich you are allowed to attack, the SSID's and MAC's can be added dynamically so you do not have to stop your attack. The commands that I found are as follows:
Enabling and Disabling Karma:

• iwpriv atho karma 1 (Enable Karma)
  
• iwpriv ath0 karma 0 (Disable Karma)
  
• iwpriv ath0 get_karma (Get status of Karma)
  

MAC Address Whitelisting and Blacklisting:

• iwpriv ath0 maccmd 1 (Sets the card in whitelist mode)
• iwpriv ath0 maccmd 2 (Sets the card in Blacklist mode)
• iwpriv ath0 maccmd 0 (Disable all MAC filtering modes)
• iwpriv ath0 addmac (Adds mac address to the list)
• iwpriv ath0 kickmac (Removes MAC Address form the list)
• iwpriv ath0 maccmd 3 (Clears the entire MAC Address list)

SSID Whitelisting and Blacklisting:

• iwpriv ath0 karma_bw 0 (Sets the card in Blacklist mode)
  
• iwpriv ath0 karma_bw 1 (Sets the card in Whitelist mode)
• iwpriv ath0 get_karma_bw (Get status of Blacklisting and Whitelisting Mode)
• iwpriv ath0 addkarmassid (Adds SSID to the list)
  
• iwpriv ath0 clrkarmalist 0 (Clears SSID List)
  

Updated Karmetasploit Attack Script

---

Here is the version of the script that will use the DigiNinja Karma patch for atheros, I find it a more flexible and reliable alternative to airbase-ng, but it will be limited to atheros cards for all other aircrack supported cards the modes that use airbase-ng can be used, plus fixed the path issue with Metasploit. Hope you guys like it. Here is the link to the script with the changes:
http://www.darkoperator.com/kmsapng.tar.gz
if you changed the kernel modules of your BT3 install you can get the patched modules of madwifi with digininja's karma patch and the patch from aircrack-ng here:
http://www.darkoperator.com/madwifi-r37 … g-patc.lzm
I do have to say that digininjas karma patch is a must for anyone using an atheros card and is doing wireless client side attacks.

Karmetasploit AP launcher by Carlos Perez for Backtrack3
Version 0.3
carlos_perez[at]darkoperator.com
usage: kmsap.sh 
Options:
-m         : Every mode is a different approach of the attack.
                       km     for regular karmetasploit attack using airbase-ng
                       kmf    for filtered attack where only targeted
                              clients can associate to the fake AP using the
                              filter file.
                       kma    for karmetasploit attack using DigiNinja patched
                              madwifi drivers.
                       kmaf   for karmetasploit attack using DigiNinja patched
                              madwifi drivers and mac address filtering.
-i    : Interface supported by aircrack-ng for injection
-f  : Text file with mac addresses of client computers
                 permited to connect to the fake AP used with kmf and
                       kmaf modes, on mac address per line.
-s         : SSID name used as the initial broadcast
-r  : Metasploit Resource Script (Optional)
-h               : This help message
Note: mode and interface are required for all types of attacks and -f for filtered attacks

Jasager

I have been playing a lot lately with a Fon router that a friend lent me, I installed Openwrt and Jasager on it, here is a description of Jasager (Yes Man):

Jasager is an implementation of Karma designed to run on OpenWrt on the Fon. It will probably run on most APs with Atheros wifi cards but it was designed with the Fon in mind as it is a nice small AP which gives it a lot of scope for use in pentration tests and other related fun.

A quick highlight of features:

• Web interface showing currently connected clients with their MAC address, IP address (if assigned) and the SSID they associated with
• The web interface allows control of all Karma features and can either run fully featured through AJAX enabled browsers or just as well through lynx
• Auto-run scripts on both association and IP assignment
• Full logging for later review
• Basic command line interface so you don't have to remember the different iwpriv commands

As you can see is like Judicious Karma but in an embeded device. I see a lot of promise in this tool for pentesters. The chipset of the radio is Atheros and it is supported under the madwifi drivers, so this little AP has a lot of pontetial, one of its draw backs is the limited space for tools. Right now my only problem has been setting it up as a router. One I have it figured out I will write some scripts to handle most of the stuff I need and document it for whe I have to retur the unit to my friend.