patronus_fati 0.9.32 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: b306e11499b0e488195a50d09903c63ce1b91929
-  data.tar.gz: d7792915f6e0118627788053d363f09945791f36
+  metadata.gz: 3f6f3ad421d728ab9ad441d5863d7fb3ddb05182
+  data.tar.gz: e04b299336bb0630b70b21cd5c8a516ec7a859b2
 SHA512:
-  metadata.gz: fb93258bb27ffd004e2a90784118af9daaff3d33592874c48b798349ef3a62efb76570e0968183d00c9bdaecf6091d6fa9c9aa40262eabd528afb3c83b7834e8
-  data.tar.gz: 5af5155a352342d521b4f86cff6e3d4c74379e00b93f5c3b2ed208409bb379b8c0becd94ef1a32e68e7de689627d1239a7a229c9e8457c0341aa8fe408d5d5ca
+  metadata.gz: 6776c2501935b588b7b7fc64d0885718407c783aaebd65c55a0e08619599c24c1e2c4d65a6671a69834b542dd5fe3debeb98616f5fa7b72bf8eaf8a41e299b93
+  data.tar.gz: c9ca33dc0d16de2317557c17f6b82ec50dffc4dfaab68e16c50d8dc912715df1402b0b330814968a57ed34425285ad4f31695c81efc80c25930e22a98805a370

data/lib/patronus_fati/consts.rb

@@ -34,23 +34,21 @@ module PatronusFati
     (1 << 3) => 'WEP40',
     (1 << 4) => 'WEP104',
     (1 << 5) => 'WPA+TKIP',
-    (1 << 6) => 'WPA', # Appears deprecated but still in the kismet source
     (1 << 7) => 'WPA+PSK',
     (1 << 8) => 'WPA+AES-OCB',
     (1 << 9) => 'WPA+AES-CCM',
-    (1 << 10) => 'WPA Migration Mode',
-    (1 << 11) => 'WPA+EAP', # Not a value that shows up in kismet exports... Bonus?
-    (1 << 12) => 'WPA+LEAP',
-    (1 << 13) => 'WPA+TTLS',
-    (1 << 14) => 'WPA+TLS',
-    (1 << 15) => 'WPA+PEAP',
-    (1 << 20) => 'ISAKMP',
-    (1 << 21) => 'PPTP',
-    (1 << 22) => 'Fortress',
-    (1 << 23) => 'Keyguard',
-    (1 << 24) => 'Unknown Protected',
-    (1 << 25) => 'Unknown Non-WEP',
-    (1 << 26) => 'WPS'
+    (1 << 10) => 'WPA+LEAP',
+    (1 << 11) => 'WPA+TTLS',
+    (1 << 12) => 'WPA+TLS',
+    (1 << 13) => 'WPA+PEAP',
+    (1 << 14) => 'ISAKMP',
+    (1 << 15) => 'PPTP',
+    (1 << 16) => 'Fortress',
+    (1 << 17) => 'Keyguard',
+    (1 << 18) => 'Unknown_NonWEP',
+    (1 << 19) => 'WPA Migration Mode',
+    (1 << 20) => 'WPA',
+    (1 << 21) => 'WPA2',
   }
 
   SSID_CRYPT_MAP_INVERTED = Hash[SSID_CRYPT_MAP.map { |k, v| [v, k] }]

data/lib/patronus_fati/message_models/ssid.rb

@@ -1,8 +1,11 @@
 module PatronusFati
   module MessageModels
+    # NOTE: If you change these fields the SSID message parser needs to be
+    # manually updated since these fields are very broken.
     Ssid = CapStruct.new(
       :mac, :checksum, :type, :ssid, :beaconinfo, :cryptset, :cloaked,
-      :firsttime, :lasttime, :maxrate, :beaconrate
+      :maxrate, :beaconrate, :firsttime, :lasttime, :wps, :wps_device_name,
+      :wps_manuf, :wps_model_name, :wps_model_number
     )
     Ssid.set_data_filter(:mac) { |val| val.downcase }
     Ssid.set_data_filter(:checksum, :firsttime, :lasttime, :maxrate,
@@ -20,6 +23,16 @@ module PatronusFati
 
       SSID_CRYPT_MAP.select { |k, _| (k & val) != 0 }.map { |_, v| v }
     end
+    Ssid.set_data_filter(:wps) do |val|
+      next WPS_SETTING_MAP[0] unless val
+      next WPS_SETTING_MAP[0] if val.ord == 0
+
+      WPS_SETTING_MAP.select { |k, _| (k & val.ord) != 0 }.map { |_, v| v}.first
+    end
+    Ssid.set_data_filter(:wps_device_name) do |val|
+      next if val.nil? || val.empty?
+      val
+    end
 
     # Attempt to map the returned SSID type to one we know about it and convert
     # it to a string. In the event we don't know it will leave this as an

data/lib/patronus_fati/message_parser.rb

@@ -27,6 +27,27 @@ module PatronusFati
       data_line.scan(PatronusFati::DATA_DELIMITER).map { |a, b| (a || b).tr("\x01", '') }
     end
 
+    def self.extract_ssid_data(data_line)
+      data_scanner = StringScanner.new(data_line.force_encoding(Encoding::BINARY))
+
+      # We can use our normal scanner for the first 11 fields, the remainder
+      # are the WPS specific fields which are just bad...
+      results =  11.times.map do
+        field = data_scanner.scan(PatronusFati::DATA_DELIMITER).tr("\x01", '')
+        data_scanner.skip(/\s/)
+        field
+      end
+
+      # We need to grab the WPS state as a byte
+      results << data_scanner.get_byte
+      data_scanner.skip(/\s/)
+
+      # Put everything else in the 'wps_info' field
+      results << data_scanner.rest.strip
+
+      results
+    end
+
     def self.get_model(mdl)
       return unless PatronusFati::MessageModels.const_defined?(model_name(mdl))
       PatronusFati::MessageModels.const_get(model_name(mdl))
@@ -37,8 +58,11 @@ module PatronusFati
       return unless resp
 
       h = Hash[resp.names.zip(resp.captures)]
-
-      [h['header'], extract_data(h['data'])]
+      if h['header'] == 'SSID'
+        [h['header'], extract_ssid_data(h['data'])]
+      else
+        [h['header'], extract_data(h['data'])]
+      end
     end
 
     def self.model_name(hdr)

data/lib/patronus_fati/version.rb

@@ -1,3 +1,3 @@
 module PatronusFati
-  VERSION = '0.9.32'
+  VERSION = '1.0.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: patronus_fati
 version: !ruby/object:Gem::Version
-  version: 0.9.32
+  version: 1.0.0
 platform: ruby
 authors:
 - Sam Stelfox
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-03-31 00:00:00.000000000 Z
+date: 2017-04-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dm-constraints