1
0

PRBflags.c 5.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159
  1. /*
  2. Fuzzes PrbResp by testing all 256 IEs on overflow in four ways
  3. */
  4. #include <stdio.h>
  5. #include <stdlib.h>
  6. #include <stdint.h>
  7. #include <string.h>
  8. #include <math.h>
  9. #include "../frameDefinitions.h"
  10. //Creates Probe response frame
  11. u_char *Prbflags(u_char *dstAddress, int *packetSize, u_char * radioTapHeader, u_char *myMAC, int step)
  12. {
  13. #define PRBflagsIES (3) //number of information elements
  14. //definition of all info elements
  15. infoElem ssid = {
  16. 0, //id
  17. 8, //len
  18. 8, //real length of data
  19. "\x43\x43\x43\x43\x43\x43\x43\x43" //data
  20. };
  21. infoElem suppRates = {
  22. 1, //id
  23. 7, //len
  24. 7, //real length of data
  25. "\x96\x18\x24\x30\x48\x60\x6c" //data
  26. };
  27. infoElem ds = {
  28. 3, //id
  29. 1, //len
  30. 1, //real length of data
  31. "\x01" //data
  32. };
  33. //create array of information elements
  34. infoElem taggedParams[PRBflagsIES] = {ssid, suppRates, ds};
  35. //length of all info elements, including id and len field
  36. int len_taggedParams = 0;
  37. for(int i = 0; i < PRBflagsIES; i++)
  38. {
  39. if (taggedParams[i].len_data != -1) //do not include when len_data == -1
  40. {
  41. //+2 to include id and len field size
  42. len_taggedParams = len_taggedParams + taggedParams[i].len_data+2;
  43. }
  44. }
  45. //fill in struct
  46. probeResponse probeResp = {
  47. 36, radioTapHeader, //RadioTap hdr
  48. 1, "\x50", //Type
  49. 1, "\x00", //Flags
  50. 2, "\x3a\x01", //Duration
  51. 6, dstAddress, //DST addr
  52. 6, myMAC, //Source addr
  53. 6, myMAC, //BSS addr
  54. 2, "\x00\x00", //Seq nr (overwritten by firmware)
  55. 8, "\x00\x00\x00\x00\x00\x00\x00\x00", //Timestamp (overwritten by firmware)
  56. 2, "\x64\x00", //Beacon interval
  57. 2, "\x01\x00", //Capab info
  58. len_taggedParams,
  59. taggedParams, //Information elements
  60. 4, "\x00\x00\x00\x00" //FSC (overwritten by firmware)
  61. };
  62. u_char *value = malloc(1);
  63. memset(value, step, 1);
  64. probeResp.flags = value;
  65. //calculate size of final packet
  66. *packetSize = probeResp.len_radioTapHdr
  67. + probeResp.len_type
  68. + probeResp.len_flags
  69. + probeResp.len_duration
  70. + probeResp.len_destAddr
  71. + probeResp.len_sourceAddr
  72. + probeResp.len_bssAddr
  73. + probeResp.len_seqNr
  74. + probeResp.len_timeStamp
  75. + probeResp.len_beaconInterval
  76. + probeResp.len_capabInfo
  77. + probeResp.len_taggedParams
  78. + probeResp.len_fsc;
  79. //define packet
  80. u_char *probeRespPacket = malloc(*packetSize);
  81. if(!probeRespPacket)
  82. {
  83. printf("Memory allocation error!\n");
  84. exit(-1);
  85. }
  86. //copy all struct fields into packet
  87. int copyOffset = 0;
  88. memcpy(probeRespPacket + copyOffset, probeResp.radioTapHdr, probeResp.len_radioTapHdr);
  89. copyOffset = copyOffset + probeResp.len_radioTapHdr;
  90. memcpy(probeRespPacket + copyOffset, probeResp.type, probeResp.len_type);
  91. copyOffset = copyOffset + probeResp.len_type;
  92. memcpy(probeRespPacket + copyOffset, probeResp.flags, probeResp.len_flags);
  93. copyOffset = copyOffset + probeResp.len_flags;
  94. memcpy(probeRespPacket + copyOffset, probeResp.duration, probeResp.len_duration);
  95. copyOffset = copyOffset + probeResp.len_duration;
  96. memcpy(probeRespPacket + copyOffset, probeResp.destAddr, probeResp.len_destAddr);
  97. copyOffset = copyOffset + probeResp.len_destAddr;
  98. memcpy(probeRespPacket + copyOffset, probeResp.sourceAddr, probeResp.len_sourceAddr);
  99. copyOffset = copyOffset + probeResp.len_sourceAddr;
  100. memcpy(probeRespPacket + copyOffset, probeResp.bssAddr, probeResp.len_bssAddr);
  101. copyOffset = copyOffset + probeResp.len_bssAddr;
  102. memcpy(probeRespPacket + copyOffset, probeResp.seqNr, probeResp.len_seqNr);
  103. copyOffset = copyOffset + probeResp.len_seqNr;
  104. memcpy(probeRespPacket + copyOffset, probeResp.timeStamp, probeResp.len_timeStamp);
  105. copyOffset = copyOffset + probeResp.len_timeStamp;
  106. memcpy(probeRespPacket + copyOffset, probeResp.beaconInterval, probeResp.len_beaconInterval);
  107. copyOffset = copyOffset + probeResp.len_beaconInterval;
  108. memcpy(probeRespPacket + copyOffset, probeResp.capabInfo, probeResp.len_capabInfo);
  109. copyOffset = copyOffset + probeResp.len_capabInfo;
  110. //copy all information elements
  111. for(int i = 0; i < PRBflagsIES; i++)
  112. {
  113. if (taggedParams[i].len_data != -1) //if id == -1, we do not want to include the information element
  114. {
  115. memcpy(probeRespPacket + copyOffset, &taggedParams[i].id, 1);
  116. copyOffset = copyOffset + 1;
  117. memcpy(probeRespPacket + copyOffset, &taggedParams[i].len, 1);
  118. copyOffset = copyOffset + 1;
  119. memcpy(probeRespPacket + copyOffset, taggedParams[i].data, taggedParams[i].len_data);
  120. copyOffset = copyOffset + taggedParams[i].len_data;
  121. }
  122. }
  123. memcpy(probeRespPacket + copyOffset, probeResp.fsc, probeResp.len_fsc);
  124. copyOffset = copyOffset + probeResp.len_fsc;
  125. //return packet
  126. return probeRespPacket;
  127. }