Conversation
vagrantfile: Improve audio support on non-windows (QEMU/VBOX)
The BSSID allowlist added in 0eca0c7 never took effect as deployed: there is no /root/wlan_config file (docker-compose passes wlan_config via env_file, so the MAC_*/WLAN_* vars live only in the environment), and ns-inet.sh runs the module build as `sudo bash install.sh`. With the AP image's default sudoers env_reset, sudo stripped MAC_DOWNGRADE/MAC_6GHZ/MAC_OWE, so PATCH_ALLOW_BSSIDS came out ",," and dragondrain.sh fell back to detect-all -- re-exposing wifi-management (wacker) and wifi-campus (PMKID) to the self-DoS. - ns-inet.sh: drop the redundant sudo (the script already requires root) so install.sh inherits the env_file MAC_* vars. - install.sh: strip stray quotes/space from the joined value defensively, and make the empty-allowlist warning explicit about the consequence. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…bump Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ey selectable
FLAG_MGT_RELAY_TABLETS decoded to "flag{...}\r\n". Both templates interpolated
the decoded flag straight into onclick="copyFlagToClipboard('<flag>')", so the
trailing CRLF landed inside a JS string literal and the parser threw
"'' string literal contains an unescaped line break" -- the copy button was dead
on 192.168.18.1 (IP_MGT_RELAY_TABLETS) only. Scanned every FLAG_*/PASS_* in
wlan_config and wlan_config_challenge; that was the only corrupted value.
- wlan_config: re-encode FLAG_MGT_RELAY_TABLETS without the trailing CRLF.
- login.php.tmp / index.php.tmp: stop inlining the key into JS. trim() +
htmlspecialchars() and emit <div class="flag"><code class="flag-text">key
</code><button class="flag-copy">, so no flag content can break the page.
- script.js: delegated .flag-copy listener reads the key from .flag-text
textContent; keeps the execCommand fallback (lab is plain HTTP, so
navigator.clipboard is undefined) and reports COPIED / SELECT + CTRL-C.
- style.css: the key is now a <code> with user-select: text so it can be
drag-selected by hand; COPY is a separate control beside it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…builds The BSSID allowlist that keeps the flood/DoS detector off wifi-management (wacker) and wifi-campus (PMKID) is a compile-time constant in the module, but MODULE_VERSION is the fixed string "2.5.1-WiFiChallengeLab-version" and doesn't change when the allowlist changes. install.sh skips the build whenever the installed version matches, and /lib/modules is a host bind-mount, so the first detect-all build (from before the a2b63e4 env fix took effect) stuck on the host and every container start since then early-exited without recompiling. Result: a stale detect-all module kept self-DoSing wifi-management -- confirmed live by "[HWSIM-PATCH][phy95] DragonDrain detected -> DoS mode" firing on wlan24's own radio during a wacker run. - install.sh: after computing PATCH_ALLOW_BSSIDS, append a hash of the (lowercased) set to MODULE_VERSION -> e.g. "...+scope-9753fbcb", or "+noscope" when empty. Any change to the scoped set now yields a new version -> forced rebuild; an empty allowlist is both force-rebuilt and visible in modinfo/sys. Idempotent, so an unchanged set still early-exits. Also fix the TARGET_VERSION_ERROR fallback typo (2.5 -> 2.5.1). - uninstall.sh: match on the "WiFiChallengeLab-version" marker instead of the exact "2.5-..." string (which never matched the installed 2.5.1, so a plain uninstall silently kept the module). Now removes any of our builds regardless of numeric version or +scope/+noscope tag. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
… a stale detect-all module can't self-DoS wifi-management
service apache2 start was a one-shot fire-and-forget call. If apache2 ever died, its stale /var/run/apache2/apache2.pid could get reused by an unrelated process, causing the sysvinit script to believe apache was "already running" and refuse to restart it - permanently wedging login.php (and the aps healthcheck) even though the container stayed Up. Replace the one-shot start with a supervise_apache() loop that health-checks http://localhost/login.php every 15s and force-restarts apache2 (stop, kill by exact process name, clear stale pidfile, start) whenever it stops responding. Uses `pkill -x` rather than `pkill -f` so the kill doesn't match the loop's own command line when invoked via bash -c. Add docker-compose.override.yml to bind-mount the patched script over the one baked into the r4ulcl/wifichallengelab-aps image, so the fix survives image pulls/recreation without needing a rebuild.
Make aps apache2 startup self-healing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changelog: WiFiChallengeLab v2.5
Added
wifi-passpoint, EAP-SIM/AKA/AKA') with two EAP-AKA' clients backed by a software HLR/AuC (hlr_auc_gw+ Milenage, no physical SIM): a leaking one (permanent IMSI in the clear, any passive sniffer) and a privacy-preserving one (anonymous outer identity + pseudonym/fast-reauth: no passive leak, yet still surrenders its IMSI to a student-built evil-twin/rogue AP that actively requests the permanent identity)wifi-campus): a lone WPA2-PSK BSSID (channel 7, no client on purpose) on radiowlan31. Capture the PMKID straight from the BSSID and crack the PSK offline (seeAPs/PMKID_TESTING.md)Modifications
wlan40-69,radios=71) and moved the nzyme WIDS tap towlan70, freeing 10 slots for new scenariosanonymous@CONTOSOREG) on the TLS and MSCHAPv2-relay networks, matching real supplicant behaviourBug Fixes
clientAuthEKU to EAP-TLS client certs, made the CA RFC 5280-conformant, corrected the server cert subject/SAN, deduplicated them into a single generated set, and removed a straywgetin the APDockerfile; extended the server cert SAN through192.168.40.1so every lab portal (including192.168.21.1) validates in Firefoxlab.phpnot showing the usernameieee80211wfrom the MSCHAPv2 relay client to match the AP; set MFP optional (ieee80211w=1) on the WPA3 downgrade AP so its SAE/WPA2-PSK transition mode works (mandatory MFP would block the WPA2-PSK downgrade path); fixed thewifi-regionalrelay client (wlan50) beingmacchanger'd to the AP's own BSSID (MAC_MGT_RELAYinstead ofMAC_CLIENT_MGT_RELAY): a station whose MAC equals its target BSSID has every authentication rejected by mac80211 (SME: Authentication request to the driver failed)ath_maskerbuild best-effort (no more aborted image builds), removed the hardcoded gcc/g++ 12, fixed a stale exit in the deauth-on-drop patch and an image-tag error in the challenge compose file, fixed the challenge flags inwlan_config_challenge, updated thepcapFilter.shhelper to the latest gist revision, and fixed thehostapd-manabuild under Vagrant while making provisioning abort ifinstallTools.shdoesn't finishMiscellaneous Improvements
login.phpand restarts the web service when it becomes unavailable2>&1)mac80211_hwsimdriver (in-kernel, deterministic per radio, no per-beacon flicker) instead of a racy userspaceiw txpowerloop that hostapd overrodefpingkeepalive