https://github.com/jo-m/linux-wifi-ota-crash Skip to content Toggle navigation Sign up * Product + Actions Automate any workflow + Packages Host and manage packages + Security Find and fix vulnerabilities + Codespaces Instant dev environments + Copilot Write better code with AI + Code review Manage code changes + Issues Plan and track work + Discussions Collaborate outside of code + Explore + All features + Documentation + GitHub Skills + Blog * Solutions + By Plan + Enterprise + Teams + Compare all + By Solution + CI/CD & Automation + DevOps + DevSecOps + Case Studies + Customer Stories + Resources * Open Source + GitHub Sponsors Fund open source developers + The ReadME Project GitHub community articles + Repositories + Topics + Trending + Collections * Pricing [ ] * # In this repository All GitHub | Jump to | * No suggested jump to results * # In this repository All GitHub | Jump to | * # In this user All GitHub | Jump to | * # In this repository All GitHub | Jump to | Sign in Sign up {{ message }} jo-m / linux-wifi-ota-crash Public forked from Jeija/esp32-80211-tx * Notifications * Fork 55 * Star 9 Send arbitrary IEEE 802.11 frames with Espressif's ESP32 9 stars 55 forks Star Notifications * Code * Pull requests 0 * Actions * Projects 0 * Security * Insights More * Code * Pull requests * Actions * Projects * Security * Insights jo-m/linux-wifi-ota-crash This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. master Switch branches/tags [ ] Branches Tags Could not load branches Nothing to show {{ refName }} default View all branches Could not load tags Nothing to show {{ refName }} default View all tags Name already in use A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch? Cancel Create 1 branch 0 tags Code * Clone HTTPS GitHub CLI [https://github.com/j] Use Git or checkout with SVN using the web URL. [gh repo clone jo-m/l] Work fast with our official CLI. Learn more. * Open with GitHub Desktop * Download ZIP Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Launching Xcode If nothing happens, download Xcode and try again. Launching Visual Studio Code Your codespace will open once ready. There was a problem preparing your codespace, please try again. This branch is 3 commits ahead of Jeija:master. Contribute * This branch is 3 commits ahead of Jeija:master. Open a pull request to contribute your changes upstream. * Open pull request Latest commit @jo-m jo-m cleanup ... 1a486bc Oct 15, 2022 cleanup 1a486bc Git stats * 10 commits Files Permalink Failed to load latest commit information. Type Name Latest commit message Commit time main works Oct 15, 2022 .gitignore works Oct 15, 2022 CMakeLists.txt Add support for idf.py build system Jun 28, 2022 Makefile Initial upload with rickrolling sample code Apr 8, 2017 README.md cleanup Oct 15, 2022 demo.gif add demo Oct 15, 2022 sdkconfig works Oct 15, 2022 View code ESP32 Linux WiFi OTA Crasher Attributions and Licenses README.md ESP32 Linux WiFi OTA Crasher This is a small POC running on an ESP32, exploiting CVE-2022-42722 to crash Linux devices over the air. Demo Prerequisites: * You need a WiFi P2P device set up. This is usually the case if you have NetworkManager running. You can also create one manually, see here. The exact config I tested (works reliably): * ESP32-WROOM-32D board * Linux 5.15.0-48-generic #54~20.04.1-Ubuntu SMP This code is only for exploiting CVE-2022-42722. Most of the other vulnerability payloads consist of fragmented frames, which ESP32 does not support sending. Instructions: * Install ESP-IDF SDK * Turn off WiFi on your build machine * Build and flash this to an ESP32 * Plug the ESP32 to power * Turn on WiFi * Crash! Attributions and Licenses Raw WiFi frames are from https://github.com/PurpleVsGreen/beacown. Code to send raw frames on ESP32 is forked off https://github.com/ Jeija/esp32-80211-tx. MIT License Copyright (c) 2022 Jeija Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. This code is under MIT license: MIT License Copyright (c) 2022 jo-m Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. About Send arbitrary IEEE 802.11 frames with Espressif's ESP32 Resources Readme Stars 9 stars Watchers 1 watching Forks 55 forks Releases No releases published Packages 0 No packages published Languages * C 79.2% * CMake 18.1% * Makefile 2.7% Footer (c) 2022 GitHub, Inc. Footer navigation * Terms * Privacy * Security * Status * Docs * Contact GitHub * Pricing * API * Training * Blog * About You can't perform that action at this time. You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.