I have a github project called 'Evil-Twin Framework' which basically is a very extensible Wi-Fi pentesting framework. I'm not going to delve into the details but basically one can code any type of Wi-Fi feature/attack on top of the framework. I've recently been implementing WEP attacks such as the ARP replay attack and Caffe-Latte. The ARP replay attack works fine since I only need to identify the encrypted ARP packet a replay it. The Caffe-Latte attack seems to be a little more challenging. One has to capture a gratuitous ARP packet, flip some bits, recalculate the crc32 checksum and then replay it. I have opened an issue on this with many details and even *.pcap files with my my forged packets in comparison to aircrack-ng's forged packet. I'll leave the link here if you guys/gals would like to check it out: https://github.com/Esser420/EvilTwinFramework/issues/2
Ok here I'll guide you through my 'faulty' implementation of the attack. After I identify the packet I extract the original wepdata and ICV like so:
wepdata = list(packet[Dot11WEP].wepdata) original_icv = packet[Dot11WEP].icv
Then I create the bitmask as suggested by Vivek Ramachandran, flip the correct bits (I can decrypt the packet after and check). Then I calculate the crc32 of the bitmask like so:
bitmask = list('\x00' * len(wepdata)) Flip bits of the bitmask corresponding to the last byte of sender MAC and IP respectively bitmask[len(wepdata) - 11] = chr(randint(0, 255)) bitmask[len(wepdata) - 15] = chr(randint(0, 255)) Create crc32 checksum for the bitmask, the logical AND with only Fs turns it into a unsigned crc32 icv_patch = crc32("".join(bitmask)) & 0xffffffff
Finally I XOR the bitmask with the original wepdata and the same for the ICV and put the results back in the packet.
flipped_result = [ chr( ord(wepdata[i]) ^ ord(bitmask[i]) ) for i in range(len(wepdata)) ] patched_icv = icv_patch ^ original_icv Put the results back in the packet flipped_packet[Dot11WEP].wepdata = "".join(flipped_result) flipped_packet[Dot11WEP].icv = patched_icv
Here "flipped_packet" is a copy of the original packet.
I cannot figure out where the error is, I think the packet is malconstructed because Wireshark "refuses" to decrypt it but it is able to decrypt the original packets and the successful forgeries created by airbase-ng/aireplay-ng.
More details about this are in the issue to which I left the link above.