weakivgen.pl

wlan的WEP密钥系统的解密,WEP为共享加密系统。更新的加密系统为WPA2

#!/usr/bin/perl

# basic RC4 keyscheduler and PRGA routine that chooses IVs known to be weak (A+3, N-1, X) and encrypts one byte with key supplied from
# command line. An output file is created in the current directory that contains IVs with a corresponding encrypted byte as well as an
# indicator for secret key size
#
# Choice of the (A+3, N-1, X) keys is based on the paper "Weakness in the Key Scheduling Algorithm of RC4" by
# Scott Fluhrer, Itsik Mantin, and Adi Shamir
#

# By : Anton T. Rager - 08/09/2001-08/12/2001
#      [e-mail]

$findhost=@ARGV[0];
if (!$findhost) {
	print("Usage:  WeakIVGen.pl <Key1:Key2:Key3:Key4:Key5...Keyn>\n\nWhere Keyx is key byte in decimal\nAnd : is delimiter for each byte [40bit=5bytes, 128bit=11bytes]\n");
	exit;
}


$i=0;
$j=0;
$ik=0;
$x=0;

@inkey=split(":", @ARGV[0]);

@IV = (3, 255, 0);

# 802.2 SNAP Header should be 1st plaintext byte of WEP packet
@text = (0xaa);

# Keysize 11 byte or 5 byte
$keysize=scalar(@inkey);
$bitsize=$keysize*8;

print("Keysize = $keysize\[$bitsize bits\]\n");

open(OUTFILE, ">IVFile.log");

print("$keysize\n");
print(OUTFILE "$keysize\n");

$keylen = $keysize+3;

for ($B=0; $B < $keysize; $B++) {
	#print("$B\n");

	

	for ($loop1=0; $loop1 < 256 ; $loop1++) {
		$IV[2]=$loop1;
	#  for ($loop2=0; $loop2 < 10; $loop2++) {
		$IV[0]=$B+3;
	#	$IV[0]=$loop2;
                for ($i=0; $i < $keylen; $i++) {
			if ($i < 3) {
				$Key[$i]=$IV[$i];
			} else {
				$Key[$i]=$inkey[$i-3];
			}

		}


		$i=0;
		$j=0;
		$ik=0;

		for ($i=0; $i<256; $i++) {
			$S[$i]=$i;
			if ($ik > $keylen-1) {
				$ik=0;
			}
			$Key[$i]=$Key[$ik];
			$ik++;
		}

		for ($i=0; $i<256; $i++) {
			$j=($j+$S[$i]+$Key[$i]) % 256;
			$temp = $S[$i];
			$S[$i] = $S[$j];
			$S[$j] = $temp;
		}

		# 1 byte thru PRGA
		$i=0;
		$j=0;
		$i=($i+1) % 256;
		$j=($j + $S[$i]) % 256;
		$temp=$S[$i];
		$S[$i]=$S[$j];
		$S[$j]=$temp;
		$t=($S[$i]+$S[$j]) % 256;
		$K=$S[$t];
		$encr=$text[0] ^ $K;
		$S3Calc = $text[0] ^ $encr;
		print("$IV[0] $IV[1] $IV[2] $encr\n");
		print(OUTFILE "$IV[0] $IV[1] $IV[2] $encr\n");



	}

}
print("\n");
close(OUTFILE);