1
0

PRBieid.c 6.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205
  1. /*
  2. Fuzzes PrbResp by testing all 256 IEs on overflow in four ways
  3. */
  4. #include <stdio.h>
  5. #include <stdlib.h>
  6. #include <stdint.h>
  7. #include <string.h>
  8. #include <math.h>
  9. #include "../frameDefinitions.h"
  10. //Creates Probe response frame
  11. u_char *Prbieid(u_char *dstAddress, int *packetSize, u_char * radioTapHeader, u_char *myMAC, int step)
  12. {
  13. #define PRBieidIES (4) //number of information elements
  14. //definition of all info elements
  15. infoElem ssid = {
  16. 0, //id
  17. 8, //len
  18. 8, //real length of data
  19. "\x43\x43\x43\x43\x43\x43\x43\x43" //data
  20. };
  21. infoElem suppRates = {
  22. 1, //id
  23. 7, //len
  24. 7, //real length of data
  25. "\x96\x18\x24\x30\x48\x60\x6c" //data
  26. };
  27. infoElem ds = {
  28. 3, //id
  29. 1, //len
  30. 1, //real length of data
  31. "\x01" //data
  32. };
  33. infoElem fuzzIE;
  34. switch(step % 4)
  35. {
  36. case 0:
  37. {
  38. fuzzIE.id = step/4;
  39. fuzzIE.len = 255;
  40. fuzzIE.len_data = 255;
  41. //create data of 255 times 0xff
  42. u_char *data = malloc(255);
  43. memset(data, 0xff, 255);
  44. fuzzIE.data = data;
  45. break;
  46. }
  47. case 1:
  48. {
  49. fuzzIE.id = step/4;
  50. fuzzIE.len = 254;
  51. fuzzIE.len_data = 254;
  52. //create data of 254 times 0xff
  53. u_char *data = malloc(254);
  54. memset(data, 0xff, 254);
  55. fuzzIE.data = data;
  56. break;
  57. }
  58. case 2:
  59. {
  60. fuzzIE.id = step/4;
  61. fuzzIE.len = 253;
  62. fuzzIE.len_data = 253;
  63. //create data of 253 times 0xff
  64. u_char *data = malloc(253);
  65. memset(data, 0xff, 253);
  66. fuzzIE.data = data;
  67. break;
  68. }
  69. case 3:
  70. {
  71. fuzzIE.id = step/4;
  72. fuzzIE.len = 255;
  73. fuzzIE.len_data = 255;
  74. //create data of 255 times 0x00
  75. u_char *data = malloc(255);
  76. memset(data, 0x00, 255);
  77. fuzzIE.data = data;
  78. break;
  79. }
  80. }
  81. //create array of information elements
  82. infoElem taggedParams[PRBieidIES] = {ssid, suppRates, ds, fuzzIE};
  83. //length of all info elements, including id and len field
  84. int len_taggedParams = 0;
  85. for(int i = 0; i < PRBieidIES; i++)
  86. {
  87. if (taggedParams[i].len_data != -1) //do not include when len_data == -1
  88. {
  89. //+2 to include id and len field size
  90. len_taggedParams = len_taggedParams + taggedParams[i].len_data+2;
  91. }
  92. }
  93. //fill in struct
  94. probeResponse probeResp = {
  95. 36, radioTapHeader, //RadioTap hdr
  96. 1, "\x50", //Type
  97. 1, "\x00", //Flags
  98. 2, "\x3a\x01", //Duration
  99. 6, dstAddress, //DST addr
  100. 6, myMAC, //Source addr
  101. 6, myMAC, //BSS addr
  102. 2, "\x00\x00", //Seq nr (overwritten by firmware)
  103. 8, "\x00\x00\x00\x00\x00\x00\x00\x00", //Timestamp (overwritten by firmware)
  104. 2, "\x64\x00", //Beacon interval
  105. 2, "\x01\x00", //Capab info
  106. len_taggedParams,
  107. taggedParams, //Information elements
  108. 4, "\x00\x00\x00\x00" //FSC (overwritten by firmware)
  109. };
  110. //calculate size of final packet
  111. *packetSize = probeResp.len_radioTapHdr
  112. + probeResp.len_type
  113. + probeResp.len_flags
  114. + probeResp.len_duration
  115. + probeResp.len_destAddr
  116. + probeResp.len_sourceAddr
  117. + probeResp.len_bssAddr
  118. + probeResp.len_seqNr
  119. + probeResp.len_timeStamp
  120. + probeResp.len_beaconInterval
  121. + probeResp.len_capabInfo
  122. + probeResp.len_taggedParams
  123. + probeResp.len_fsc;
  124. //define packet
  125. u_char *probeRespPacket = malloc(*packetSize);
  126. if(!probeRespPacket)
  127. {
  128. printf("Memory allocation error!\n");
  129. exit(-1);
  130. }
  131. //copy all struct fields into packet
  132. int copyOffset = 0;
  133. memcpy(probeRespPacket + copyOffset, probeResp.radioTapHdr, probeResp.len_radioTapHdr);
  134. copyOffset = copyOffset + probeResp.len_radioTapHdr;
  135. memcpy(probeRespPacket + copyOffset, probeResp.type, probeResp.len_type);
  136. copyOffset = copyOffset + probeResp.len_type;
  137. memcpy(probeRespPacket + copyOffset, probeResp.flags, probeResp.len_flags);
  138. copyOffset = copyOffset + probeResp.len_flags;
  139. memcpy(probeRespPacket + copyOffset, probeResp.duration, probeResp.len_duration);
  140. copyOffset = copyOffset + probeResp.len_duration;
  141. memcpy(probeRespPacket + copyOffset, probeResp.destAddr, probeResp.len_destAddr);
  142. copyOffset = copyOffset + probeResp.len_destAddr;
  143. memcpy(probeRespPacket + copyOffset, probeResp.sourceAddr, probeResp.len_sourceAddr);
  144. copyOffset = copyOffset + probeResp.len_sourceAddr;
  145. memcpy(probeRespPacket + copyOffset, probeResp.bssAddr, probeResp.len_bssAddr);
  146. copyOffset = copyOffset + probeResp.len_bssAddr;
  147. memcpy(probeRespPacket + copyOffset, probeResp.seqNr, probeResp.len_seqNr);
  148. copyOffset = copyOffset + probeResp.len_seqNr;
  149. memcpy(probeRespPacket + copyOffset, probeResp.timeStamp, probeResp.len_timeStamp);
  150. copyOffset = copyOffset + probeResp.len_timeStamp;
  151. memcpy(probeRespPacket + copyOffset, probeResp.beaconInterval, probeResp.len_beaconInterval);
  152. copyOffset = copyOffset + probeResp.len_beaconInterval;
  153. memcpy(probeRespPacket + copyOffset, probeResp.capabInfo, probeResp.len_capabInfo);
  154. copyOffset = copyOffset + probeResp.len_capabInfo;
  155. //copy all information elements
  156. for(int i = 0; i < PRBieidIES; i++)
  157. {
  158. if (taggedParams[i].len_data != -1) //if id == -1, we do not want to include the information element
  159. {
  160. memcpy(probeRespPacket + copyOffset, &taggedParams[i].id, 1);
  161. copyOffset = copyOffset + 1;
  162. memcpy(probeRespPacket + copyOffset, &taggedParams[i].len, 1);
  163. copyOffset = copyOffset + 1;
  164. memcpy(probeRespPacket + copyOffset, taggedParams[i].data, taggedParams[i].len_data);
  165. copyOffset = copyOffset + taggedParams[i].len_data;
  166. }
  167. }
  168. memcpy(probeRespPacket + copyOffset, probeResp.fsc, probeResp.len_fsc);
  169. copyOffset = copyOffset + probeResp.len_fsc;
  170. //return packet
  171. return probeRespPacket;
  172. }