evilsocket/pwnagotchi

(⌐■_■) - Deep Reinforcement Learning instrumenting bettercap for WiFi pwning.

Pwnagotchi

Pwnagotchi is an A2C-based "AI" leveraging bettercap that learns from its surrounding WiFi environment to maximize the crackable WPA key material it captures (either passively, or by performing authentication and association attacks). This material is collected as PCAP files containing any form of handshake supported by hashcat, including PMKIDs, full and half WPA handshakes.

Instead of merely playing Super Mario or Atari games like most reinforcement learning-based "AI" (yawn), Pwnagotchi tunes its parameters over time to get better at pwning WiFi things to in the environments you expose it to.

More specifically, Pwnagotchi is using an LSTM with MLP feature extractor as its policy network for the A2C agent. If you're unfamiliar with A2C, here is a very good introductory explanation (in comic form!) of the basic principles behind how Pwnagotchi learns. (You can read more about how Pwnagotchi learns in the Usage doc.)

Keep in mind: Unlike the usual RL simulations, Pwnagotchi learns over time. Time for a Pwnagotchi is measured in epochs; a single epoch can last from a few seconds to minutes, depending on how many access points and client stations are visible. Do not expect your Pwnagotchi to perform amazingly well at the very beginning, as it will be exploring several combinations of key parameters to determine ideal adjustments for pwning the particular environment you are exposing it to during its beginning epochs ... but ** listen to your Pwnagotchi when it tells you it's boring!** Bring it into novel WiFi environments with you and have it observe new networks and capture new handshakes—and you'll see. :)

Multiple units within close physical proximity can "talk" to each other, advertising their presence to each other by broadcasting custom information elements using a parasite protocol I've built on top of the existing dot11 standard. Over time, two or more units trained together will learn to cooperate upon detecting each other's presence by dividing the available channels among them for optimal pwnage.

Documentation

https://www.pwnagotchi.ai

Links

	Official Links
Website	pwnagotchi.ai
Forum	community.pwnagotchi.ai
Slack	pwnagotchi.slack.com
Subreddit	r/pwnagotchi
Twitter	@pwnagotchi

License

pwnagotchi is made with ♥ by @evilsocket and the amazing dev team. It is released under the GPL3 license.

pwnagotchi's Issues

refactor the logging system

right now everything is made via core.log which sucks and was meant to be a temporary logging stub. It should integrated in the idiomatic python way with its logging library ... and possibly some nice ascii coloring should be added to the different levels! :D

consider using a localization platform

The use of a localization platform (such as Transifex or Crowdin) is a better way of having multiple people work on translations in all sorts of languages together, hence the reason why I'm proposing the integration of this repository in either one of those platforms.

A few of the benefits would be:

• better organization.
• less PRs to deal with/automation features.
• easier for people (and outsiders that haven't looked into the codebase) to contribute to/does not require knowledge of Git, which could result in the attraction of a wider base of volunteers.

Missing SDCARD folder, causing create to fail [BUG]

Went through the history of the repo and on 10/4 SDCARD was in the repo and at some point it went missing, causing the rsync on lines 175/176 to fail causing the create script to fail. Not sure if there is a reason for its removal. To solve it for me I copied it from an archieved repo i stored of the last passing build. I figure its easier for you to push it then for me to do a pull just in case sdcard was removed for a reason.

Yesterday it was there with all the contents, earlier today only sdcard/rootfs and at the end of the day for me it was completely removed from the repo

unify all scripts in a pwnagotchi companion app

once all scripts (image creation + internet sharing from host) are nice and working, we should unify their functionalities in a single pwnagotchi companion app (maybe in go for easy cross compilation?), some idea for what the app should be doing:

1. Create an image.
2. Share connection from host computer.
3. Setup the usb0 interface automatically on the host if a unit is detected.
4. Update the software of a unit.
5. Backup a unit.
6. Restore a backup.

Markdown cleanup of docs

Cleanup markdown and content within docs to be super helpful!

[BUG]

Describe the bug
The URL:
https://github.com/evilsocket/pwnagotchi/blob/master/docs/install.md —

Refers to a pre-compiled release file, however the destination lacks any release files. Monitoring GitHub today, there have been a bunch of updates, which likely explains why it hasn’t made sense to drop a release, but figured it was worth mentioning here. LOVE the project thus far and especially the community involvement.

To Reproduce
Steps to reproduce the behavior:

1. ...
2. ...
3. ...

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Environment (please complete the following information):

• Pwnagotchi version
• OS version
• Type of hardware
• Any additional hardware used

Additional context
Add any other context about the problem here.

Add plugin for auto-uploading handshakes to https://wpa-sec.stanev.org

I want to upload my handshakes to that site as soon as internet is available.

-S for the bmap-tool is not completely done

./create_sibling.sh: illegal option -- S

seems like the option is documented but not (fully) implemented. probably this was missed in #41 ?

implement a clean shutdown button on a free gpio pin

implement a clean shutdown button on a free gpio pin that will gracefully stop the pwnagotchi software, sync the filesystem and then halt the unit in order to avoid sdcard corrutions

use BMP files for the faces

By using a bmp instead of just text for faces, we can render whatever we want, while now we have limitations due to what the font and generally ascii emoji support

research / implement a generative NN for the face

Wouldn't it be cool if the face would be automatically generated by another neural network depending on the current status?

https://process.studio/works/aimoji-ai-generated-emoji/
https://www.semanticscholar.org/paper/EmotiGAN-%3A-Emoji-Art-using-Generative-Adversarial-Puyat/0c78a3cbf9b7627c1da63909b935ad278a73f750

config.yml should be a config.defaults.yml

imho it would be better if the config.yml has only entries for overwriting values from defaults.

so its easier to backup config and copy to the new version.

best, look for an /etc/pwnagotchi/config.yml and if exist then overwrite values from there

example:

import hiyapyco

conf = hiyapyco.load('/root/pwnagotchi/config.defaults.yml', '/etc/pwnagotchi/config.yml', '/root/pwnagotchi/config.yml', method=hiyapyco.METHOD_MERGE, interpolate=True, failonmissingfiles=False)

or existing pwnagotchi.utils.merge_config(user, default)

Plugins should be configureable via config.yml

It would be nice if i could configure the plugins via config.yml, escpecially if i overwrite the code regulary.

Maybe something like:

plugins:
  twitter:
    api: 'key'
  wpa-sec:
    api: 'key'

The activation is implicit. If configuration is there, i want to activate that plugin.

find a way to optimize AI loading times

TensorFlow takes minutes to import on a Raspberry Pi Zero W and that's probably because of the huge .so file with native primitives it has to load, among other things. Given the nature of the project, that stuff is imported only once, so caching it in memory wouldn't speed things up. Switching frameworks is not feasible, unless we have the same exact features (unlikely given that stable-baselines is TF based). For instance, there's no stable-baselines port for TF-lite.

Inkyphat/inky display

Support for the Inkyphat display is missing, despite the documentation stating it's supported.

[BUG] Two start-methods in agent.py

The agent.py got refractured and now there is a name conflict.

package the code as a python package

We need a setup.py based build of the software so that it gets correctly installed as a python package and main.py becomes a command available in $PATH

Related to #57

update script overwrites changes to hostnames

The update script currently overwrites changes to the following files which contains potential modifications to the local settings:
/etc/hosts
/etc/hostname
/etc/network/interfaces

Maybe these can be added to the backup script.

plugins should be set to enabled or disabled via config.yml

there should be a new section in config.yml:

plugins: gps, twitter, memtemp

to enable plugins without touching the main python file

research GA

Using A2C and generally neural networks (mostly because of the TF dependency) is extremely heavy to bootstrap on less powerful hardware such as the rpi0w, it takes approximately 30 minutes for all the imports to load.

Since this is just a parameters research problem, we can optionally have a genetic algorithm based search running as a replacement for neural networks when the hardware is not powerful enough, ideally configurable from the ai section of config.yml

x86 32-bit Support

Spent today trying to get Pwnagotchi working on a certain 32-bit x86 tablet-esque device... Ran into some issues with libjasper-dev not existing in Debian repositories for 32-bit Linux, same with tensorflow in pip repositories.

Getting this working is probably possible with some one-off compiles of Jasper and Tensorflow for 32bit (okay I'm not 100% sure how possible this is but I'd just like to assume 😛). So while support 32-bit x86 officially may not be worth it, it could be worth just hosting some builds of the required libraries. That way if people do want to put in the leg-work to get it working, then they don't have to spend ages waiting on library compiles. What do you think?

Though I'm yet to get it working, and will have to spend more time on it tomorrow.

Reset display once in a while

Is your feature request related to a problem? Please describe.
When running for some time, the eink display gets very noisy due to partial updates. It would be nice, if the display could be completely wiped once in a while look crispy again

Describe the solution you'd like
I'd suggest to have a configuration which allows to set the time in minutes after which the display is cleared.

Put the code for twitter in a plugin

The code should be into a plugin.

[BUG] Round / truncate times in UI

Describe the bug
When the pwnagotchi is sleeping, it displays the remaining time. The time is not rounded or truncated, so it might be something like (13.9999999999s) which is too long to display.

To Reproduce
Steps to reproduce the behavior:

1. Run a pwnagotchi
2. Wait for it to sleep
3. Check the time

Expected behavior
I'd expect that the remaining time is displayed as a integer and not a float.

Environment (please complete the following information):

• Pwnagotchi version: build 5968030
• OS version: create_sibling.sh created raspbian
• Type of hardware: Pi0W with waveshare v1

requirements.txt versions should be frozen

requirements.txt versions must be frozen so to have reproducible installs and upgrades via pip

clean the repo and use an ansible based installation

We should clean the repository and only keep the actual codebase, while having an ansible based installation script for everything else.

Join effort with @caquino

[BUG] Strings like minutes/hours/seconds are not localized

Those strings are still in english, because they are hardcoded in log.py. So when the tweet is created, the text is not fully correctly translated.

[BUG] Incorrect filename in update script

Describe the bug
The update script backs up config.yml using one (incorrect) filename, then restores using a different filename.

To Reproduce
Steps to reproduce the behavior:

1. Execute scripts/update_pwnagotchi.sh
2. Note error (see screenshots section below)

Expected behavior
Existing config.yml is backed up and restored without error.

Screenshots

root@steve:~/pwnagotchi# ./updateme -m manual -b -r
[+] Checking prerequisites.
[+] Cloning to /tmp/pwnagotchi...
[+] Creating backup of config.yml and hostname references
[+] Installing 0acc0e4
[+] Restoring backup of config.yml and hostname references
mv: cannot stat '/root/config.yml.bak': No such file or directory
[+] Restarting pwnagotchi in manual mode.
[+] Finished

Environment (please complete the following information):

• Pwnagotchi version: 87d8d49 (HEAD at time of writing)
• OS version: macOS Sierra (10.12)

Add multi-display preview

For the translation process it would be awesome to see all possible displays at the same time without starting multiple preview.py's.

idea from @caquino

[BUG] create_sibling crash when using single cpu vm.

Describe the bug
Running Ubuntu 18.10 in a VirtualBox VM with a single cpu causes an error in create_sibling.sh on line 208. Changing the line to taskset -c 0 from taskset -c 1 allows the script to continue running.

To Reproduce
Steps to reproduce the behavior:

1. ... Run Ubuntu in VM with single CPU
2. ... Run create_sibling.sh

Expected behavior
Expect script to finish build.

Screenshots
If applicable, add screenshots to help explain your problem.

Environment (please complete the following information):

• Pwnagotchi version - commit 58edfd2
• OS version - Ubuntu 18.10 in VM
• Type of hardware
• Any additional hardware used

Additional context
I did not test changing the VM to 2 CPU's, but I imagine that would also be a viable fix.

The reward function should take into account bored and sad states

The reward function should take into account bored and sad states, if they've been happening from more than, say, 5 epochs, that should decrease the reward.

organize documentation

organize the documentation in the docs folder as markdown files that can also be used for the wiki

related to #50

Add a plugin to upload APs to wigle.net

Idea from @evilsocket ^^

Add plugin for auto-uploading handshakes to https://www.onlinehashcrack.com/

I want to upload my handshakes to that site as soon as internet is availaible.

implement optional BT connection and possibly tethering

implement optional BT connection and possibly tethering in order to reach the UI from a smartphone or tablet without wires

Auto-backup-plugin

I imagine the following:

plugins:
  auto-backup:
    enabled: true
    files:
      - /root/brain.nn
      - /root/brain.json
      - ....
    backup_cmd: tar czf /tmp/backup.tar.gz {files}
    upload_cmd: scp /tmp/backup.tar.gz 10.0.0.1:/backups/pwnagotchi/backup$(date).tar.gz

[BUG] Error launching pwnagotchi using setup.py install

Describe the bug
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior:

1. Install pwnagotchi using setup.py (or "pip3 install .")
2. run "/usr/local/bin/pwnagotchi"
3. Returns error: Traceback (most recent call last):
   File "/usr/local/bin/pwnagotchi", line 8, in
   import pwnagotchi
   ModuleNotFoundError: No module named 'pwnagotchi'

Expected behavior
Start pwnagotchi software

Screenshots
If applicable, add screenshots to help explain your problem.

Environment (please complete the following information):

• Pwnagotchi version - Latest git pull as of 9pm CST 5 Oct 2019
• OS version - Rasbian Buster
• Type of hardware - RPi0w
• Any additional hardware used - N/A

Additional context
Add any other context about the problem here.

render epoch statistics in the web ui

we can render the epoch statistics over time in a chart in the web ui

simple plugin engine for users to add their own data to the UI

Develop a simple plugin engine for users to add their own data to the UI without touching the main codebase, for instance:

#
# UPS Lite v1.1
#
# funtions for get UPS status - needs enable "i2c" in raspi-config
#
# https://github.com/linshuqin329/UPS-Lite
#
# For Raspberry Pi Zero Ups Power Expansion Board with Integrated Serial Port S3U4
# https://www.ebay.de/itm/For-Raspberry-Pi-Zero-Ups-Power-Expansion-Board-with-Integrated-Serial-Port-S3U4/323873804310
# https://www.aliexpress.com/item/32888533624.html
​
​
# 2do: add enable switch in config.yml an cleanup all to the best place
​
import struct
import smbus
import sys
import time
​
​
class UPSlite_v11:
    def __init__(self):
        self._bus = smbus.SMBus(1)  # 0 = /dev/i2c-0 (port I2C0), 1 = /dev/i2c-1 (port I2C1)
​
    def getVoltage(self):
        "This function returns as float the voltage from the Raspi UPS Hat"
        address = 0x36
        read = self._bus.read_word_data(address, 2)
        swapped = struct.unpack("<H", struct.pack(">H", read))[0]
        voltage = swapped * 1.25 /1000/16
        return voltage
​
    def getCapacity(self):
        "This function returns as a float the remaining capacity of the battery connected to the Raspi UPS Hat"
        address = 0x36
        read = self._bus.read_word_data(address, 4)
        swapped = struct.unpack("<H", struct.pack(">H", read))[0]
        capacity = swapped/256
        return capacity
​
​
# for pwnagotchi view.py
#
# from pwnagotchi.ui.upslite.v1_1.upslite import UPSlite_v11
#
#class View:
 
# add in View.__init__:
#   self._usv = UPSlite_v11()
# ...
#            'ups': LabeledValue(color=BLACK, label='UPS', value='0%/0V', position=(self._width/2 - 25, 0),
#                                   label_font=fonts.Bold,
#                                   text_font=fonts.Medium),
​
# add in update(self):
#            self.set('ups', "%4.2fV/%2i%%" % (self._usv.getVoltage(bus),self._usv.getCapacity(bus)))````

The list of available translations is incomplete

The list of translations in config.yml is incomplete.

implement automatic line breaking for voice texts

the idea that users need to format the texts manually with newlines is nuts, that should be done automatically by the rendering algorithm

use websockets instead of polling

currently bettercap's /api/event is polled every second, since bettercap supports websockets we should be using that to receive the events

simple plugin engine/hook for users on capturing a handshake

Develop a simple plugin engine for users to add their own functions after capturing a handshake.

for example:

• get a GPS position from a GPS module and save the position to root/handshakes/ap.pcap.gps
• save names of nearly APs
• ...

example handshake:
192.168.2.0/24 > 192.168.2.2 » [13:57:31] [wifi.client.handshake] captured 84:d6:d0:b4:67:74 -> EasyBox-474250 (e0:60:66:23:61:79) WPA2 handshake (half) to /root/handshakes/EasyBox474250_e06066236179.pcap

create file:
/root/handshakes/EasyBox474250_e06066236179.pcap.gps

[BUG] Python OSError 105 (ENOBUFS)

Traceback (most recent call last):
  File "/root/pwnagotchi/scripts/pwnagotchi/mesh/advertise.py", line 89, in _sender
    sendp(self._frame, iface=self._iface, verbose=False, count=5, inter=self._period)
  File "/usr/local/lib/python3.7/dist-packages/scapy/sendrecv.py", line 338, in sendp
    realtime=realtime, return_packets=return_packets)
  File "/usr/local/lib/python3.7/dist-packages/scapy/sendrecv.py", line 291, in __gen_send
    s.send(p)
  File "/usr/local/lib/python3.7/dist-packages/scapy/arch/linux.py", line 559, in send
    return SuperSocket.send(self, x)
  File "/usr/local/lib/python3.7/dist-packages/scapy/supersocket.py", line 49, in send
    sent = self.outs.send(sx)
OSError: [Errno 105] No buffer space available

After about an hour of running I started getting this error repeatedly, only fixed with a reboot. Left her running over night then came back to check logs in the morning and found this 😛

I'm not sure if this more a unique / device specific bug (I'm running on an RPi3b+), but there's some suggestions to limit number of concurrent threads in this thread where someone was having the same issue: https://stackoverflow.com/questions/31746401/python-loop-causing-error-errno-105-no-buffer-space-available

NN wifi card portability should be documented somewhere

Somewhere we should document the fact that a neural network trained on a WiFi card will not be compatible with another card which supports a different number of channels (for instance, if it's been trained on a 2.4Ghz only card and then used with a 5Ghz one).

document / explain the reward function

the reward function should be documented and explained clearly so people can understand exactly what they need to do in order for the AI to improve :D

[Guide]Use a Wavehare 3.5In SPI TFT Screen

• First, SSH into your pwnagotchi, and give it some internet! Don't forget to check your default gateway and apt-get update
• Follow Guide here: https://www.waveshare.com/wiki/3.5inch_RPi_LCD_(A)#Method_1._Driver_installation
• At the step with ./LCD35-show add lite to the command prompt (./LCD35-show lite)
• Reboot
• as root, make three symlinks, cd ~; ln -s pwnagotchi.png pwnagotchi_1.png; ln -s pwnagotchi.png pwnagotchi_2.png; ln -s pwnagotchi.png pwnagotchi_3.png;
• apt install fbi
• change display type to "inky" in config.yml
• add "modules-load=dwc2,g_ether" to your kernel command line ( /boot/cmdline.txt ) or it will break!
• Also must add "dtoverlay=dwc2" to the bottom of ( /boot/config.txt )
• edit /etc/rc.local and add
  fbi -T 1 -a -noverbose -t 15 -cachemem 0 /root/pwnagotchi_1.png /root/pwnagotchi_2.png /root/pwnagotchi_3.png &

reboot and you should be good, some of this guide will work with other framebuffer based displays!

plugins should be searchable

each plugin should have (optionally) a markdown file with specific documentation, plus there should be a separate repo of user plugins that the main binary should be able to search into apt-style (pwnagotchi search whatever, pwnagotchi install whatever, pwnagotchi enable whatever, ...)

pwnchinko! esp based pwnagotchi companion

We should do something very simple but effective. An ESP should listen for management frames and reinject them as they are, this will effectively boost their rssi levels and, if the pwnagotchi is in range, it will detect them from the ESP itself, which would add as kind of a bridge.

The ESP should keep a list of the APs being "proxied".

Whenever pwnagotchi will deauthenticate or associate to one of those stations, the ESP will detect this packets as well, "remember" that they contain elements that they previously proxied and perform the same operation, reinject the deauths and association frames, along with the resulting (if any) handshake packets.

In a second iteration of this, given that pwnagotchi's identity is RSA based, we might want to experiment and see if ESP can do RSA encryption at the firmware level, so that only the target pwnagotchi would be able to decrypt the proxied frames.

The install guide references ready-built images that doesn't exist

In the install guide here: https://github.com/evilsocket/pwnagotchi/blob/master/docs/install.md there's a reference to downloading the latest images from the release page.

Looking at https://github.com/evilsocket/pwnagotchi/releases there are no files available for download.

I'm not sure if that is due to the files being too large to upload to GitHub or if there's any other reason but should this be removed from the install guide for now?

In case there's agreement to removing it - please let me know and I can try and get a PR in which instead updates the install.md to use the create_sibling.sh to generate the image etc.