Metasploit mailing list archives

Atheros 5212 and Wifi Exploits


From: mrowley at esoft.com (mat)
Date: Tue, 14 Nov 2006 10:40:59 -0700

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Im trying to get the daringphucball exploit to work with my Atheros 5212
card, but I am receiving this error.

Unable to open proc device "/proc/sys/dev/ath1/rawdev", fopen: No such
file or directory

What seems to be happening is that Lorcon is trying to access the rawdev
file (which doesnt exist) and use that to inject raw packets.  Im using
the madwifi driver, which can have packets injected using aircrack-ng.
Lorcon also, cannot set the card into monitor mode, I had to manually do
it (using airmon-ng).  It was giving this error

[-] Auxiliary failed: Lorcon could not place the card into monitor mode

When I try to do it manually, I get this error

10:36[root]~ # iwconfig ath0 mode monitor
Error for wireless request "Set Mode" (8B06) :
    SET failed on device ath0 ; Invalid argument.

When looking at the directory structure of /proc/sys/dev/ I saw no ath1
directory (as was trying to be accessed by Loricon), but there was an
ath as well as a wifi0 directory.  Here is the structure, but nothing
seems to be a rawdev like file.

10:38[root]/proc/sys/dev # ls -R wifi0/; ls -R ath
wifi0/:
ackrate      ctstimeout  fftxqmin   rxantenna  tkipmic       xrpollcount
acktimeout   debug       ledpin     slottime   txantenna     xrpollperiod
countrycode  diversity   regdomain  softled    txintrperiod
ath:
calibrate  countrycode  debug  hal  outdoor  xchanmode

ath/hal:
dma_beacon_response_time  swba_backoff  sw_beacon_response_time


I know the framework3 is still being developed, and I was writing this
to try to point out bugs that I can foresee.  Hope this helps with any
future development.



- --


\\ Mathew Rowley
\\ eSoft Inc.
\\ email: echo 'kpmujcw>cqmdr,amk'|perl -pe 's/(.)/chr(ord($1)+2)/ge;'
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFFWf+q47s/xIwy7o0RAmnSAJ9TJEQeWkPkxS970RqK1xaV2MVizACggTAh
+72LlAX6dr21yN+01Fi/ihI=
=gGk9
-----END PGP SIGNATURE-----



Current thread: