aanarchyy / bully Goto Github PK

Can you please tag a new release. I am making linux packages for Pisi Linux and i need a updated download link from your repos releases archive.
Thank you =)

here's my input
bully wlan0mon -b -c 11 -d -v 3
my wifi card is a intel 8265/8275, monitor mode is on, and driver is iwlwifi
please let me know if you need more information, thanks in advance.

When the "make" command is ran, theres an issue which reads, "tls/bignum.c:14:10: fatal error: includes.h: No such file or directory
14 | #include "includes.h"
"
Thus, I cannot compile the library or install it.

Can you provide a list of supported client wlan cards? I'm running ubuntu 15.04 with this network card:
03:00.0 Network controller: Qualcomm Atheros AR9287 Wireless Network Adapter (PCI-Express) (rev 01)

I'm getting this output which suggests that my network card is not compatible

root@monitor03:~/src/bully-master/src# ./bully -b 88:41:FC:56:4C:C9 wlan0
[!] Bully v1.1 - WPS vulnerability assessment utility
[P] Modified for pixiewps by AAnarchYY([email protected])
[X] Unknown frequency '681831424' reported by interface 'wlan0'
[!] Using '60:d8:19:26:94:e5' for the source MAC address
[+] Datalink type set to '1', radiotap headers not present
[+] Scanning for beacon from '88:41:fc:56:4c:c9' on channel 'unknown'
[+] Switching interface 'wlan0' to channel '1'
[!] ioctl(SIOCSIWFREQ) on 'wlan0' failed with '-1'
[X] Unable to set channel on 'wlan0', exiting

And even better, will you support that network card?

I'm trying to run bully in a chroot environment on termux.
I can run airodump-ng on fixed channel with `--ignore-negative-one" option but I don't see such option in bully nor reaver , reaver just keeps segfault

root@localhost:~# bully   -b 08:40:F3:E9:D2:A1 wlan0
[!] Bully v1.4-00 - WPS vulnerability assessment utility
[P] Modified for pixiewps by AAnarchYY([email protected])
[!] ioctl(SIOCGIWFREQ) on 'wlan0' failed with '0'
Segmentation fault

root@localhost:~# bully   -b 08:40:F3:E9:D2:A1 -c 4 wlan0
[!] Bully v1.4-00 - WPS vulnerability assessment utility
[P] Modified for pixiewps by AAnarchYY([email protected])
[+] Switching interface 'wlan0' to channel '4'
[!] ioctl(SIOCSIWFREQ) on 'wlan0' failed with '-1'
[X] Unable to set channel on 'wlan0', exiting

I don't see any patch for fixed channel for qcacld3.0

Python 2.x will no longer be supported by their upstream developers in 2020. Thus Debian developers are actively removing Python 2 support in Debian Testing with the goal of getting rid of Python 2 in Debian 11 (bullseye).

It would be nice if src/bully.py could be ported to Python 3 so that we can get rid of python 2 usage in bully. Please update the shebang line to indicate that Python 3 is preferred.

Actually looking at the code, it seems to have provisions to run with Python 3... unfortunately, it needs to import "bully_support" but that module is only available as pre-compiled Python 2 bytecode (src/bully_support.pyc). Please add the sourcce code for that module.

Thank you very much.

========BEGIN ERROR LOG========
root@i-BrokeIT:/master/bully-master/src# make
cc -Ipwd -Ipwd/utils/ -Ipwd/tls/ -Ipwd/wps/ -Ipwd/crypto/ -Ipwd/common/ -o bully bully.c -lpcap -lssl -lcrypto
In file included from bully.c:65:0:
crypto/crypto_openssl.c: In function ‘openssl_digest_vector’:
crypto/crypto_openssl.c:81:13: error: storage size of ‘ctx’ isn’t known
EVP_MD_CTX ctx;
^~~
crypto/crypto_openssl.c: In function ‘rc4_skip’:
crypto/crypto_openssl.c:148:17: error: storage size of ‘ctx’ isn’t known
EVP_CIPHER_CTX ctx;
^~~
crypto/crypto_openssl.c: At top level:
crypto/crypto_openssl.c:301:17: error: field ‘enc’ has incomplete type
EVP_CIPHER_CTX enc;
^~~
crypto/crypto_openssl.c:302:17: error: field ‘dec’ has incomplete type
EVP_CIPHER_CTX dec;
^~~
crypto/crypto_openssl.c: In function ‘dh5_init’:
crypto/crypto_openssl.c:426:4: error: dereferencing pointer to incomplete type ‘DH {aka struct dh_st}’
dh->g = BN_new();
^
In file included from bully.c:89:0:
80211.c: In function ‘reassoc’:
80211.c:328:16: warning: implicit declaration of function ‘set_chan’ [-Wimplicit-function-declaration]
G->chanx = set_chan(G, tag->data[0]);
^~~~~~~~
80211.c:356:16: warning: implicit declaration of function ‘next_chan’ [-Wimplicit-function-declaration]
G->chanx = next_chan(G);
^~~~~~~~~
In file included from bully.c:91:0:
iface.c: In function ‘set_chan’:
iface.c:28:9: warning: implicit declaration of function ‘set_chanx’ [-Wimplicit-function-declaration]
return set_chanx(G, G->index[chan]);
^~~~~~~~~
bully.c: In function ‘main’:
bully.c:969:4: warning: ‘return’ with no value, in function returning non-void
return;
^~~~~~
bully.c:95:5: note: declared here
int main(int argc, char *argv[])
^~~~
Makefile:19: recipe for target 'bully' failed
make: *** [bully] Error 1
========END ERROR LOG========

Additional info:

1. installed latest Kali-rolling versions of libpcap-dev, libssl-dev, build-essential, aircrack-ng, and pixiewps.
2. Pixiewps built successfully from required Git host Wiire, and installed before Bully's make attempt.
3. Using GNU make v 4.1 as provided with Kali 4.8.0-amd64.
4. Bully cloned from Git master on 26 Jan 2017, 11 PM CST.
5. Make was run as root (as can be seen in the log).

I will try running make as a non-root admin user to see if that makes a difference, and post a pass/fail or new errors.

Hello

I was using Bully in combination with airgeddon to do a WPS Pixie attack (option 7 in airgeddon). It guessed the PIN and it worked all fine. After i was done using it i closed airgeddon and wanted to do something else, so i opened another terminal windows where the issue is (see picture). And then when i try to type something in the terminal always more errors show up. Import is that i never pressed enter. It always pushed it by itself or something. I'm running Kali Linux on a VMware VM. My Kali Linux version is 2023.1.

Note: A reboot fixes it but it's quite annoying always to reboot.

since this repo started guerilla-style with a commit that mixed up the existing bully with @aanarchyy's changes, and i was curious to know what his changes were, i couldnt resist to put the whole history together (properly based on the git repo his initial version was based on).
i hope someone else will find it interesting, too.
it's available here https://github.com/rofl0r/bully branch "aanarchyy"

--- bully/src ‹master› » make
cc -Ipwd -Ipwd/utils/ -Ipwd/tls/ -Ipwd/wps/ -Ipwd/crypto/ -Ipwd/common/ -DUSE_INTERNAL_CRYPTO -DCONFIG_NO_RANDOM_POOL -o bully bully.c -lpcap
bully.c:27:10: fatal error: 'linux/if_ether.h' file not found
#include <linux/if_ether.h>
^~~~~~~~~~~~~~~~~~
1 error generated.
make: *** [bully] Error 1

Hi. since the commits seem quite static now and nothing is seriously broken it would be awesome to get a new release tag that drops the openssl dependency. that would be super awesome for packaging.
cheers

Hi! I'm try to build bully with clang and this fails due to:
bully.c:968:4: error: non-void function 'main' should return a value [-Wreturn-type] return;
Seems like zero(?) is missed.
Full build log here.

Good afternoon

I am doing a security test and the bully pin generator keeps repeating the same pin number indefinitely, not generating a new pin.
Do you know if there is a configuration problem, is it missing a patch?
I'm using a version of Bully.

Here is the error:

[!] Restoring session from '/root/.bully/4432c8a1d2f2.run'
[+] Index of starting pin number is '0000000'
[+] Last State = 'NoAssoc' Next pin '35150039'
[!] Received disassociation / deauthentication from the AP
[+] Rx (M1) = 'NoAssoc' Next pin '35150039'
[!] Received disassociation / deauthentication from the AP
[+] Rx (Auth) = 'NoAssoc' Next pin '35150039'
[!] Received disassociation / deauthentication from the AP
[+] Rx (M1) = 'NoAssoc' Next pin '35150039'
[!] Received disassociation / deauthentication from the AP
[+] Tx (DeAuth) = 'NoAssoc' Next pin '35150039'
[!] Received disassociation / deauthentication from the AP
[+] Rx (M1) = 'NoAssoc' Next pin '35150039'

Please help me.

Hi, this is not an issue... is a suggestion. Is not there available an option to set max-attempts per pin?

Is useful if you are going to try a single pin. I'm developing a script which has every wps attack based on bully and reaver (sorry for mention reaver here)... and performing a "custom pin" attack on which the users set only one pin to test, on reaver attack we have the "-g" argument for max-attempts to set 1 for this. On bully there is no argument for this and after fail a pin, it keeps looping trying an trying the same pin and the user must press Ctrl+C to stop it.

I saw the "-r" argument on bully but is not the same... Is only a suggestion. I know it is not matter of life and death but it could be useful. Thank you.

Just wanted to install bully but received 'Make' error . I did install the repo for the software.

/bully/src# apt-get -y install build-essential libpcap-dev libssl-dev aircrack-ng pixiewps
Reading package lists... Done
Building dependency tree
Reading state information... Done
aircrack-ng is already the newest version (1:1.2-0rc4-1).
build-essential is already the newest version (12.2).
libpcap-dev is already the newest version (1.8.1-3).
libssl-dev is already the newest version (1.1.0c-2).
pixiewps is already the newest version (1.2.2-1).
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

:/bully/src# make
cc -Ipwd -Ipwd/utils/ -Ipwd/tls/ -Ipwd/wps/ -Ipwd/crypto/ -Ipwd/common/ -o bully bully.c -lpcap -lssl -lcrypto
In file included from bully.c:65:0:
crypto/crypto_openssl.c: In function ‘openssl_digest_vector’:
crypto/crypto_openssl.c:81:13: error: storage size of ‘ctx’ isn’t known
EVP_MD_CTX ctx;
^~~
crypto/crypto_openssl.c: In function ‘rc4_skip’:
crypto/crypto_openssl.c:148:17: error: storage size of ‘ctx’ isn’t known
EVP_CIPHER_CTX ctx;
^~~
crypto/crypto_openssl.c: At top level:
crypto/crypto_openssl.c:301:17: error: field ‘enc’ has incomplete type
EVP_CIPHER_CTX enc;
^~~
crypto/crypto_openssl.c:302:17: error: field ‘dec’ has incomplete type
EVP_CIPHER_CTX dec;
^~~
crypto/crypto_openssl.c: In function ‘dh5_init’:
crypto/crypto_openssl.c:426:4: error: dereferencing pointer to incomplete type ‘DH {aka struct dh_st}’
dh->g = BN_new();
^
In file included from bully.c:89:0:
80211.c: In function ‘reassoc’:
80211.c:328:16: warning: implicit declaration of function ‘set_chan’ [-Wimplicit-function-declaration]
G->chanx = set_chan(G, tag->data[0]);
^~~~~~~~
80211.c:356:16: warning: implicit declaration of function ‘next_chan’ [-Wimplicit-function-declaration]
G->chanx = next_chan(G);
^~~~~~~~~
In file included from bully.c:91:0:
iface.c: In function ‘set_chan’:
iface.c:28:9: warning: implicit declaration of function ‘set_chanx’ [-Wimplicit-function-declaration]
return set_chanx(G, G->index[chan]);
^~~~~~~~~
bully.c: In function ‘main’:
bully.c:969:4: warning: ‘return’ with no value, in function returning non-void
return;
^~~~~~
bully.c:95:5: note: declared here
int main(int argc, char *argv[])
^~~~
Makefile:19: recipe for target 'bully' failed
make: *** [bully] Error 1

$ tsudo make install
install -d /usr/local/bin
install: cannot create directory ‘/usr’: Read-only file system
make: *** [Makefile:31: install] Error 1
I tried to edit Makefile, doesn`t help

Debian and some other distros by default have installed the latest version of libssl-dev (1.1.0x).

Some API changes in the newer versions of the OpenSSL library break compatibility with Bully, which won't compile.

To successfully get it to compile, downgrade libssl-dev to the previous version (libssl1.0-dev) while a fix is being worked on.

Hello
would be nice to know the time in the log file that a certain event occurred, so i suggest an option to do that

can't install if you using android app termux
/data/data/com.termux/files/usr/bin/
https://play.google.com/store/apps/details?id=com.termux

:/bully/src$ make
cc -Ipwd -Ipwd/utils/ -Ipwd/tls/ -Ipwd/wps/ -Ipwd/crypto/ -Ipwd/common/ -o bully bully.c -lpcap -lssl -lcrypto
In file included from bully.c:65:0:
crypto/crypto_openssl.c: In function ‘openssl_digest_vector’:
crypto/crypto_openssl.c:81:13: error: storage size of ‘ctx’ isn’t known
EVP_MD_CTX ctx;
^
crypto/crypto_openssl.c: In function ‘rc4_skip’:
crypto/crypto_openssl.c:148:17: error: storage size of ‘ctx’ isn’t known
EVP_CIPHER_CTX ctx;
^
crypto/crypto_openssl.c: At top level:
crypto/crypto_openssl.c:301:17: error: field ‘enc’ has incomplete type
EVP_CIPHER_CTX enc;
^
crypto/crypto_openssl.c:302:17: error: field ‘dec’ has incomplete type
EVP_CIPHER_CTX dec;
^
crypto/crypto_openssl.c: In function ‘dh5_init’:
crypto/crypto_openssl.c:426:4: error: dereferencing pointer to incomplete type ‘DH {aka struct dh_st}’
dh->g = BN_new();
^
OS : Ubuntu
sudo apt-get install build-essential libssl-dev libpcap-dev aircrack-ng
Reading package lists... Done
Building dependency tree
Reading state information... Done
build-essential is already the newest version (12.1ubuntu2).
libpcap-dev is already the newest version (1.7.4-2).
aircrack-ng is already the newest version (1:1.2-0beta3-4).
libssl-dev is already the newest version (1.0.2g-1ubuntu4.5).
0 to upgrade, 0 to newly install, 0 to remove

One of the problems i found with bully is that some APS do not allow Brute force association , and by this it mean that the association to AP must be made with aireplay-ng , this option should be implemented in bully because bully will stay on loop with this message :
[!] Received disassociation/deauthentication from the AP

In reaver that option is implemented , but on bully i was unable to find it .

Hi sir, I'm getting an error where it says "WPS PIN not found". So I just wanna ask u where is all the information saved if I want to check all the received hashes.

Just like the title says. Reaver supports mac, would be nice to have bully support it too

Option "-l N" doesn't work at all. I have router locking for 120 secs. Somehow with -l 120 or any other time bully keeps attacking the router every 1-2 secs.
Ex.: bully -c 1 -b MAC -l 120 mon0
or bully -b MAC -l 120 -1 3,3 -2 3,3 -l 60 mon0
or
bully -c 1 -b MAC -l 120 -l 120 mon0
Every time i start bully with options like these i get router locked cs of instant attacking without break after routers get locked.

Didnt get a single hit searching. I installed the dependencies via apt, built the master of pixie, and reinstalled libpcap for kicks.

#make
cc -Ipwd -Ipwd/utils/ -Ipwd/tls/ -Ipwd/wps/ -Ipwd/crypto/ -Ipwd/common/ -o bully bully.c -lpcap -lssl -lcrypto
In file included from bully.c:65:0:
crypto/crypto_openssl.c: In function ‘openssl_digest_vector’:
crypto/crypto_openssl.c:81:13: error: storage size of ‘ctx’ isn’t known
EVP_MD_CTX ctx;
^~~
crypto/crypto_openssl.c: In function ‘rc4_skip’:
crypto/crypto_openssl.c:148:17: error: storage size of ‘ctx’ isn’t known
EVP_CIPHER_CTX ctx;
^~~
crypto/crypto_openssl.c: At top level:
crypto/crypto_openssl.c:301:17: error: field ‘enc’ has incomplete type
EVP_CIPHER_CTX enc;
^~~
crypto/crypto_openssl.c:302:17: error: field ‘dec’ has incomplete type
EVP_CIPHER_CTX dec;
^~~
crypto/crypto_openssl.c: In function ‘dh5_init’:
crypto/crypto_openssl.c:426:4: error: dereferencing pointer to incomplete type ‘DH {aka struct dh_st}’
dh->g = BN_new();
^~
In file included from bully.c:89:0:
80211.c: In function ‘reassoc’:
80211.c:328:16: warning: implicit declaration of function ‘set_chan’ [-Wimplicit-function-declaration]
G->chanx = set_chan(G, tag->data[0]);
^~~~~~~~
80211.c:356:16: warning: implicit declaration of function ‘next_chan’ [-Wimplicit-function-declaration]
G->chanx = next_chan(G);
^~~~~~~~~
In file included from bully.c:91:0:
iface.c: In function ‘set_chan’:
iface.c:28:9: warning: implicit declaration of function ‘set_chanx’ [-Wimplicit-function-declaration]
return set_chanx(G, G->index[chan]);
^~~~~~~~~
bully.c: In function ‘main’:
bully.c:969:4: warning: ‘return’ with no value, in function returning non-void
return;
^~~~~~
bully.c:95:5: note: declared here
int main(int argc, char *argv[])
^~~~
Makefile:19: recipe for target 'bully' failed
make: *** [bully] Error 1

Hello,

It would be interesting to implement the null pin attack in bully, It can be used against Access Points that do not follow the WPS checksum on the last digit of the PIN.

As for reaver 1.6.1 : https://github.com/t6x/reaver-wps-fork-t6x/wiki/Introducing-a-new-way-to-crack-WPS:-Option--p-with-an-Arbitrary-String