Skip to content

v2.5

Choose a tag to compare

View all tags
@r4ulcl r4ulcl released this 24 Aug 12:38
· 4 commits to main since this release
v2.5
201cfcc

Changelog: WiFiChallengeLab v2.5

Added

  • Host-only RDP networks (VirtualBox, VMware) and Start/Stop Nzyme desktop launchers
  • EAP-TLS identity-leak scenario (hardened vs. leaking client certificates)
  • SIM/USIM AP (wifi-passpoint, EAP-SIM/AKA/AKA') with two EAP-AKA' clients backed by a software HLR/AuC (hlr_auc_gw + Milenage, no physical SIM): a leaking one (permanent IMSI in the clear, any passive sniffer) and a privacy-preserving one (anonymous outer identity + pseudonym/fast-reauth: no passive leak, yet still surrenders its IMSI to a student-built evil-twin/rogue AP that actively requests the permanent identity)
  • Client-less PMKID AP (wifi-campus): a lone WPA2-PSK BSSID (channel 7, no client on purpose) on radio wlan31. Capture the PMKID straight from the BSSID and crack the PSK offline (see APs/PMKID_TESTING.md)
  • WPA3 Cookie Guzzler airgeddon plugin and Vagrant audio support (QEMU, VirtualBox)

Modifications

  • Consolidated host networking on NetworkManager + systemd-resolved (VirtualBox, VMware, QEMU, Hyper-V) and made the Nzyme web UI reachable from other computers (auto-detects host IP)
  • Grew the client radio pool 20 → 30 (wlan40-69, radios=71) and moved the nzyme WIDS tap to wlan70, freeing 10 slots for new scenarios
  • Management EAP-TLS AP now offers both TLS 1.3 and legacy TLS 1.2; updated wifi_db to v1.6
  • Clients now carry a realm in the EAP anonymous outer identity (e.g. anonymous@CONTOSOREG) on the TLS and MSCHAPv2-relay networks, matching real supplicant behaviour

Bug Fixes

  • Networking: fixed DNS on networks that block public resolvers and AP internet sharing (name-independent uplink detection); fixed host DHCP service startup failures
  • Certificates: added the missing clientAuth EKU to EAP-TLS client certs, made the CA RFC 5280-conformant, corrected the server cert subject/SAN, deduplicated them into a single generated set, and removed a stray wget in the AP Dockerfile; extended the server cert SAN through 192.168.40.1 so every lab portal (including 192.168.21.1) validates in Firefox
  • Web portals: fixed PHP errors and session handling across the AP and client portals, plus lab.php not showing the username
  • MGT/EAP: fixed a regional/locale error connecting to MGT (EAP relay) networks and the MSCHAP/GTC simulated logins using a MAC instead of the gateway IP; removed ieee80211w from the MSCHAPv2 relay client to match the AP; set MFP optional (ieee80211w=1) on the WPA3 downgrade AP so its SAE/WPA2-PSK transition mode works (mandatory MFP would block the WPA2-PSK downgrade path); fixed the wifi-regional relay client (wlan50) being macchanger'd to the AP's own BSSID (MAC_MGT_RELAY instead of MAC_CLIENT_MGT_RELAY): a station whose MAC equals its target BSSID has every authentication rejected by mac80211 (SME: Authentication request to the driver failed)
  • Build/misc: made the ath_masker build best-effort (no more aborted image builds), removed the hardcoded gcc/g++ 12, fixed a stale exit in the deauth-on-drop patch and an image-tag error in the challenge compose file, fixed the challenge flags in wlan_config_challenge, updated the pcapFilter.sh helper to the latest gist revision, and fixed the hostapd-mana build under Vagrant while making provisioning abort if installTools.sh doesn't finish

Miscellaneous Improvements

  • network self-heal service to recover the uplink on boot; disabled Debian automatic updates
  • Added automatic Apache portal recovery that monitors login.php and restarts the web service when it becomes unavailable
  • Removed email/PII and legacy Netscape fields from generated certificates
  • Reworked healthchecks and compose files across all variants; hostapd per-SSID logs now capture stderr (2>&1)
  • Gave each AP/client a distinct, stable signal via per-radio RSSI jitter (~±3 dB) in the mac80211_hwsim driver (in-kernel, deterministic per radio, no per-beacon flicker) instead of a racy userspace iw txpower loop that hostapd overrode
  • Ran each MGT relay supplicant in its own loop (a stall no longer blocks the others) and backgrounded the client fping keepalive
  • Stopped the GNOME session from locking on inactivity (system-wide dconf no-idle-lock) for both RDP and local desktop sessions, so long-running attacks aren't interrupted
  • New AP web console (login and recovered-flag pages): Dracula theme, animations, single sign-out, flag on top and pink username with placeholder
  • Gave the lab user access to the compiled tool tree so the tools run without extra permissions
  • Updated OPEN_SOURCE_REFERENCES.md

New Contributors

  • @g0tmi1k made their first contribution in #31, improving the Vagrant setup with grub-pc and debconf-set-selections.
  • @xmahdiesta made their first contribution in #37, making the APs' Apache2 startup more robust and self-healing.

Full Changelog: v2.4.2...v2.5

Contributors

g0tmi1k and xmahdiesta
Assets 10
Loading