Piranha v4 itself is an OpenWrt Backfire 10.03 system pre-configured in station mode and provided for Atheros devices only! Thus, there actually isn't too much to document from a firmware perspective besides the slight modifications to a default OpenWrt distribution. Piranha is, so to speak, an auto-connecting wireless hacking drone with aircrack-ng and AAP pre-installed while providing some basic functions for users' convenience. That said, this isn't the right place to showcase OpenWrt and/or the aircrack-ng suite as both of them are very well documented at their respective wikis.
For an explanation of CIFS share capabilities shipping with Piranha by default, I assume a host system with configured CIFS share "OpenWrt" at 10.0.0.165.
root@OpenWrt:~# mkdir /tmp/share
root@OpenWrt:~# mount.cifs //10.0.0.165/OpenWrt /tmp/share/ -o user=orange,password=xy
root@OpenWrt:~# df -h
Filesystem Size Used Available Use% Mounted on
/dev/root 2.4M 2.4M 0 100% /rom
tmpfs 6.6M 152.0K 6.5M 2% /tmp
tmpfs 512.0K 0 512.0K 0% /dev
/dev/mtdblock3 4.6M 272.0K 4.3M 6% /overlay
mini_fo:/overlay 2.4M 2.4M 0 100% /
//10.0.0.165/OpenWrt 7.4G 4.5G 2.5G 65% /tmp/share
root@OpenWrt:~#
Furthermore, Piranha ships with two very simple custom scripts /bin/monitor and /bin/sta to easily switch the operating mode from sta to monitor and vice versa.
root@OpenWrt:~# monitor
madwifi-ng VAP ath0 destroyed
madwifi-ng VAP ath0 created (wlanmode monitor)
root@OpenWrt:~# sta
madwifi-ng VAP ath0 destroyed
madwifi-ng VAP ath0 created (wlanmode sta)
root@OpenWrt:~#
-----
AAP (aka AutoAP) for OpenWrt Kamikaze is an in-house development of the Piranha Project. Its current release v3 is herewith exclusively documented at the OpenWrt forum. That said, AAP v3 consists of a single shell script /bin/aap and its configuration file /etc/config/aap and thus is fully UCI configurable. AAP basically scan for surrounding networks and decides upon SNR and provided white- and blacklisting information to which networks to connect to and in what order (unencrypted networks are used without further configuration by default). Furthermore you can configure hidden SSIDs of certain networks and define valid Mac addresses AAP utilizes upon connection attempts to networks with enabled Mac filtering. AAP obfuscates its existence by using random Mac addresses upon each of its connection attempts. This is achieved with the Mac Changer package as a companion. Furthermore AAP provides various general configuration variables and toggles to adopt its operation to your specific usecase. AAP continuously verifies the connection to the connected AP and switches the network once the connection isn't alive anymore. To get a better understanding, I paste the default configuration file Piranha v4 ships with.
config 'aap'
option 'autostart' '0'
option 'checkfreq' '60'
option 'dhcptimeout' '60'
option 'ineturl' 'www.google.com'
option 'logenable' '1'
option 'prefonly' '0'
option 'rescandelay' '43200'
option 'warndelay' '120'
option 'watchinet' '1'
config '00:11:22:33:44:55'
option 'key' '00010203040506070809101112'
config '00:22:33:44:55:66'
option 'fakemac' '00:33:44:55:66:77'
config '00:44:55:66:77:88'
option 'ssid' 'default'
config '00:55:66:77:88:99'
option 'blst' '1'
IMPORTANT UPDATE 100903: Due to the behaviour of the busybox built-in grep, it's very important to leave the dummy bssid sections in /e/c/aap (see above) as is. Please, just append your custom bssid sections (ONE per bssid) to it. Otherwise AAP may fail to properly "calculate" its connection attempt list
As you can see, the configuration file is in general divided into two major parts. A general AAP configuration (please ask if you have questions) and the configuration of the various BSSIDs it connects to.
- "key" defines the known key of a WEP, WPA-PSK or WPA2-PSK encrypted network. You do not need to tell AAP the respective encryption method as it extracts the information automatically out of its scan results
- "ssid" tells AAP the known SSID of a hidden network
- "blst" is set to "1" if you'd like to blacklist a certain AP
- "fakemac" defines a valid client Mac AAP uses upon connection attempt to the configured AP
If you'd like to define more than just one of the before-mentioned options for a certain AP, you do it within one single UCI section, e.g.
config '00:11:22:33:44:55'
option 'key' '00010203040506070809101112'
option 'fakemac' '00:33:44:55:66:77'
option 'ssid' 'default'
Certainly, AAP can be directly configured with the Unified Configuration interface UCI. Let's assume, you'd like to utilize a BSSID "00:11:22:33:44:55" and configure its key "00010203040506070809101112", ssid "default" and fakemac "00:22:33:44:55:66" used upon respective connection attempt and store the configuration.
root@OpenWrt:~# uci add aap 00:11:22:33:44:55
root@OpenWrt:~# uci set aap.@00:11:22:33:44:55[0].key=00010203040506070809101112
root@OpenWrt:~# uci set aap.@00:11:22:33:44:55[0].fakemac=00:22:33:44:55:66
root@OpenWrt:~# uci set aap.@00:11:22:33:44:55[0].ssid=default
root@OpenWrt:~# uci commit aap
root@OpenWrt:~#
While I could write a really thick "novel" about AAP, I try to ensure readability and thus just cover the basics (please ask if you have further questions not explained here in detail due to space and time requirements). That all said, AAP is controlled by an easy-to-use CLI interface, providing the following functions
- enable, disable the autostart of AAP
- manually start, stop and restart it
- output the syslog messages of AAP (to verify its proper operation)
- manually skip the connection to the current network and connect to the next one in its result list
- access the connection attempt list of networks AAP connects to in descending order of scanned SNR
root@OpenWrt:~# aap
AAP v3 100813 - (C) 2009, 2010 by orange
http://piranha.pwnz.org
usage: aap [enable,disable,list,log,skip,restart,start,stop]
root@OpenWrt:~#
All that said, I hope you'll enjoy Piranha v4 and AAP v3 and have a lot of fun with it! For Piranha v4 installations instructions, please have a look at the respective OpenWrt wiki page covering your specific Atheros device.
(Last edited by orange on 3 Sep 2010, 06:49)
