Linux Wi-Fi Pentest Patches

A collection of patches for vanilla linux kernel, useful for pentesters and security engineers.

Supported branches:

• 5.3 (EOL: December 2019)

• 5.4 (EOL: December 2025)

Setup

• Apply the patches that correspond to your kernel branch. For example:

  Note that you may use --dry-run option to check if there is no errors before applying.

  _BRANCH=5.4
  git clone https://github.com/sighook/lwpp
  cd /usr/src/linux-$_BRANCH
  for _PATCH in /path/lwpp/$_BRANCH/*.patch; do
      patch -p1 -i $_PATCH
  done

• Build the kernel & modules. For example:

  cp /boot/config .config
  make olddefconfig
  make -j$(nproc) all
  make modules_install
  cp arch/x86/boot/bzImage /boot/vmlinuz
  cp .config /boot/config

• Update bootloader. For example (in case you're using GRUB):

  grub-mkconfig -o /boot/grub/grub.cfg

• Reboot.

• Have fun!

Description

• 0001-fix-QoS-overwriting.patch

  When injecting packets the Quality of Service (QoS) header was being overwritten by the driver.

  This patch tells to the driver to not overwrite the QoS header when the device is in the monitor mode.

  Thanks to Mathy Vanhoef.

• 0002-fix-the-channel-changing-of-the-monitor-interface.patch

  We can't change the channel when "normal" virtual interfaces are also using the device.

  So, it's unable to change the channel of the monitor interface with the error message "SET failed on device mon0 ; Device or resource busy."

  Practically this means that (if you don't apply this patch) we need to disable them by executing "ifconfig wlanX down" until we only have monitor interfaces over.

  However disabling them all the time is annoying and most of the time if you're playing with monitor mode you're not using the device in a normal mode anyway.

  Thanks to Mathy Vanhoef.

• 0003-fix-injecting-fragments-on-rtl8187-based-wifi-cards.patch

  Injecting fragments was not working properly on rtl8187: only the the first fragment was being transmitted.

  A simple test to further isolate the issue by instructing to driver to send the following frames (from a userland program):

  • Send the first fragment
  • Send an ARP request packet
  • Send the second fragment, which is the last one

  It turned out the device actually transmits the ARP request packet first, and only then sends the first fragment!

  It first waiting for ALL the fragments before it begins sending them.

  Furthermore, it would only send the next fragment once the previous one has been acknowledged (which isn't detected in monitor mode, hence only the first fragment is transmitted).

  Thanks to Mathy Vanhoef.

• 0004-skip-frame-ACKing-renumbering-handle-sequence-by-use.patch

  Packet injection may want to control the sequence number, so if an injected packet is found, skip renumbering it.

  Also make the packet NO_ACK to avoid excessive retries (ACKing and retrying should be handled by the injecting application).

  FIXME This may break hostapd and some other injectors. This should be done using a radiotap flag.

  Thanks to aircrack patches. (Original author is unknown.)

• 0005-Enable-monitoring-and-injection-for-the-Zydax-1211rw.patch

  Enable monitoring and injection for the Zydax 1211rw driver

  Thanks to aircrack patches. (Original author is unknown.)

• 0006-Override-regdomain-hardcoded-in-EEPROM-with-custom-v.patch

  Override regdomain hardcoded in EEPROM with custom value

  Usage:

  Get your country code from linux/drivers/net/wireless/ath/regd.h and supply as a parameter.

  Example:

  sudo modprobe carl9170 override_eeprom_regdomain=<CODE>

  Thanks to Paul Fertser.

• 0007-carl9170-Enable-sniffer-mode-promisc-flag-to-fix-inj.patch

  carl9170: Enable sniffer mode promisc flag to fix injection

  The removal of the AR9170_MAC_SNIFFER_ENABLE_PROMISC flag to fix an issue many years ago caused the AR9170 to not be able to pass probe response packets with different MAC addresses back up to the driver. In general operation, this doesn't matter, but in the case of packet injection with aireplay-ng it is important. aireplay-ng specifically injects packets with spoofed MAC addresses on the probe requests and looks for probe responses back to those addresses. No other combination of filter flags seem to fix this issue and so AR9170_MAC_SNIFFER_ENABLE is required to get these packets.

  This was originally caused by commit e0509d3bdd7365d06c9bf570bf9f11 which removed this flag in order to avoid spurious ack noise from the hardware.

  In testing for this issue, keeping this flag but not restoring the AR9170_MAC_RX_CTRL_ACK_IN_SNIFFER flag on the rc_ctrl seems to solve this issue, at least with the most current firmware v1.9.9.

  Thanks to Steve deRosier

• 0008-mac80211-ignore-AP-power-level-when-tx-power-type-is.patch

  mac80211: ignore AP power level when tx power type is "fixed"

  In some cases a user might want to connect to a far away access point, which announces a low tx power limit. Using the AP's power limit can make the connection significantly more unstable or even impossible, and mac80211 currently provides no way to disable this behavior.

  To fix this, use the currently unused distinction between limited and fixed tx power to decide whether a remote AP's power limit should be accepted.

  Usage:

  iw dev XXX set txpower fixed YYY

  Thanks to Felix Fietkau

• 0009-ath9k-override-regdomain-hardcoded-in-EEPROM-with-cu.patch

  ath9k: override regdomain hardcoded in EEPROM with custom value

  Get your country code from linux/drivers/net/wireless/ath/regd.h and supply as a parameter:

  modprobe ath9k_hw override_eeprom_regdomain=<CODE>; modprobe ath9k