evilsocket / evilsocket/pwnagotchi
[BUG] If using a RTL8812AU chipset, no packets are visible on mon0
- Dominant language
- Python
- Stars
- 9.2k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
I'm using a Raspberry Pi 3B with an Alfa AWUS036ACH NIC. Also connected: a DS100 GPS Dongle (PL2303 Serial Port) and a DS3231 RTC over I2C. Installed is the default pwnagotchi 1.5.3 image. In the default configuration, the onboard wifi module is recognized as wlan0 and the RTL8812AU as wlan1. The /usr/bin/pwnlib script is setting up the onboard wifi as mon0 and don't touch the RTL8812AU NIC. For better performance and also 5Ghz, i want to use the RTL8812AU.
**To Reproduce**
First i disable the onboard NIC in the /boot/config.txt.
Then i boot up the pwanagotchi as normal. But no Access Points are shown in bettercap or the pwnagotchi UI.
If i try to bring the monitor interface up manualy, it shows me the device is in use.
`sudo iwconfig wlan0 mode monitor
Error for wireless request "Set Mode" (8B06) :
SET failed on device wlan0 ; Operation not permitted.`
then i shut down bettercap and pwnagotchi
`sudo systemctl stop bettercap.service
sudo systemctl stop pwnagotchi.service`
I get the same error:
`sudo iwconfig wlan0 mode monitor
Error for wireless request "Set Mode" (8B06) :
SET failed on device wlan0 ; Operation not permitted.
`
Now i try to shutdown mon0 and get a Kernel Panic, but mon0 is gone:
`sudo ifconfig mon0 down && sudo iw dev mon0 del`
> Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.917683] Internal error: Oops - BUG: 0 [#1] SMP ARM
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.930690] Process iw (pid: 2369, stack limit = 0x4378296f)
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.931396] Stack: (0xa7e8bbe0 to 0xa7e8c000)
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.932089] bbe0: baec7ac0 baec7800 80d03d00 00008400 a7e8bc54 a7e8bc00 8074b2f4 80740164
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.933453] bc00: 80adc02c 80adc050 80d08d48 80adb8c8 80d87778 a7e8bc14 a7e8bc14 a7e8bc28
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.934824] bc20: 7f4e6b24 fdb88add 00000000 7f3ffae4 ba214600 7f3ffae4 80d08d48 ba214600
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.936201] bc40: 80d86080 00000000 a7e8bc64 a7e8bc58 80759474 8074b0c0 a7e8bc7c a7e8bc68
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.937586] bc60: 7f3b9ba0 80759468 7f40d000 7f3b9aec a7e8bd0c a7e8bc80 80792874 7f3b9af8
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.939043] bc80: 7f3fee68 a7e8bd14 a7e8bc84 fdb88add bb8ef800 00000000 00000097 80e22ca0
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.940604] bca0: 80d08d48 00000001 a7e8be68 00000000 a7e8bcd4 5fb060c7 27800941 b9a51b00
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.942225] bcc0: b9a51b10 b9a51b14 bb8ef800 80d86080 b8c74800 bc775c00 a7e8bd14 fdb88add
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.943921] bce0: a7e8bd04 ba214600 80d08d48 80792638 b9a51b00 0000001c 80d08d48 00000000
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.945653] bd00: a7e8bd5c a7e8bd10 807918ac 80792644 a7e8bd34 00000000 00000000 00000000
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.947433] bd20: 00000000 00000000 00000000 00000000 00000000 fdb88add a7e8bd5c 80d8a32c
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.949237] bd40: ba214600 0000001c ba214600 00000000 a7e8bd74 a7e8bd60 80792628 807917f0
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.951043] bd60: bce5d800 a7f10c00 a7e8bda4 a7e8bd78 80790fdc 80792600 7fffffff fdb88add
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.952847] bd80: a7e8bf44 80d08d48 a7f10c00 ba214600 006000c0 0000001c a7e8be04 a7e8bda8
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.954652] bda0: 807912e4 80790e54 a7e8bf4c 80d08d48 00000000 a7e8be18 00000008 00000000
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.956456] bdc0: b5f9a080 00000000 00000941 00000000 00000000 fdb88add 019d71d4 a7e8bf44
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.958259] bde0: 80d08d48 00000000 00000000 a4f9bc00 00000000 a7e8bedc a7e8be14 a7e8be08
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.960061] be00: 80721e38 80791134 a7e8bf2c a7e8be18 80722708 80721e20 00000000 019d72a0
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.961865] be20: 0000001c a7e8be30 802ef044 802eeeb0 bcc3b800 a4f9bde0 8094e680 a7e81c00
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.963669] be40: 00000054 006200ca 00000021 00031000 9b600000 9b600000 00000000 00000010
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.965473] be60: 00000000 00000000 00000000 bdb66f84 00000000 fdb88add a7e8bea4 a7e8bfb0
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.967276] be80: bba8ad00 bc064c00 00031098 00000017 a7e81c00 80875200 a7e8bef4 a7e8bea8
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.969079] bea0: 80875200 8017869c a7e8bed4 a7e8beb8 80205244 802063ec be5bbb80 00000000
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.970882] bec0: 00000000 00000054 a7e8bf04 80d08d48 00000017 80d0e61c 00031098 a7e8bfb0
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.972686] bee0: 7eadf905 00000028 a7e8bfac a7e8bef8 801166f4 802f1bcc a7e8bf14 fdb88add
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.974491] bf00: 802f1bcc 80d08d48 7eadf588 00000000 a4f9bc00 801011c4 a7e8a000 00000128
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.976297] bf20: a7e8bf94 a7e8bf30 8072382c 807224d8 00000000 00000000 a7e8bf64 00000000
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.978100] bf40: fffffff7 a7e8be5c 0000000c 00000001 00000000 00000000 a7e8be24 00000000
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.979904] bf60: a7e8bf8c 00000000 00000000 00000000 00000000 fdb88add 019d71c8 019dc448
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.981707] bf80: 019dc500 00000128 a7e8bfa4 a7e8bf98 80723884 807237d8 00000000 a7e8bfa8
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.983511] bfa0: 80101000 80723874 019d71c8 019dc448 00000003 7eadf588 00000000 00000000
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.985314] bfc0: 019d71c8 019dc448 019dc500 00000128 76f64000 7eadf905 019dc500 7eadf804
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 637.987118] bfe0: 0000006c 7eadf540 76f495bc 76ec4980 60000010 00000003 00000000 00000000
Message from syslogd@pwnagotchi at Nov 14 22:57:10 ...
kernel:[ 638.017664] Code: e19500b3 e0450000 ebed0cd4 e89da8f0 (e7f001f2)
Segmentation fault
Now i try it again:
`sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor`
And now frezz the pi I need to pull the power to reset the Pi
I try some diffrent drivers for the RTL8812AU chipset:
https://github.com/gnab/rtl8812au
https://github.com/aircrack-ng/rtl8812au
and also update the kernel to 4.19.118-Re4son-v7+
I tested the Alfa AWUS036ACH on a Kali machine with the dkms driver, works without a problem (on a amd64 machine)
**Expected behavior**
Bring up the RTL8812AU NIC in monitor mode as mon0 and feed my pwnagotchi :)
**Environment (please complete the following information):**
- pwnagotchi-raspbian-lite-v1.5.3
- RTC DS3231
- Alfa AWUS036ACH
- 18W power supply
**Additional context**
`lsusb`
> Bus 001 Device 005: ID 0bda:8812 Realtek Semiconductor Corp. RTL8812AU 802.11a/b/g/n/ac 2T2R DB WLAN Adapter
Bus 001 Device 004: ID 067b:2303 Prolific Technology, Inc. PL2303 Serial Port
Bus 001 Device 003: ID 0424:ec00 Standard Microsystems Corp. SMSC9512/9514 Fast Ethernet Adapter
Bus 001 Device 002: ID 0424:9514 Standard Microsystems Corp. SMC95
`lsmod `
> Module Size Used by
cmac 16384 1
bnep 20480 2
hci_uart 40960 1
btbcm 16384 1 hci_uart
serdev 20480 1 hci_uart
bluetooth 385024 24 hci_uart,bnep,btbcm
ecdh_generic 28672 2 bluetooth
lz4 16384 8
lz4_compress 45056 1 lz4
zram 28672 1
zsmalloc 28672 1 zram
fuse 110592 3
88XXau 1806336 0
cfg80211 643072 1 88XXau
rfkill 28672 4 bluetooth,cfg80211
pl2303 20480 0
usbserial 40960 1 pl2303
rtc_ds1307 24576 0
spidev 16384 2
i2c_dev 20480 0
usb_f_ecm 16384 1
g_ether 16384 0
usb_f_rndis 28672 2 g_ether
u_ether 24576 3 usb_f_ecm,g_ether,usb_f_rndis
libcomposite 57344 3 usb_f_ecm,g_ether,usb_f_rndis
raspberrypi_hwmon 16384 0
hwmon 16384 2 rtc_ds1307,raspberrypi_hwmon
bcm2835_codec 36864 0
bcm2835_v4l2 45056 0
v4l2_mem2mem 24576 1 bcm2835_codec
bcm2835_mmal_vchiq 32768 2 bcm2835_codec,bcm2835_v4l2
videobuf2_dma_contig 20480 1 bcm2835_codec
v4l2_common 16384 1 bcm2835_v4l2
videobuf2_vmalloc 16384 1 bcm2835_v4l2
videobuf2_memops 16384 2 videobuf2_dma_contig,videobuf2_vmalloc
videobuf2_v4l2 24576 3 bcm2835_codec,bcm2835_v4l2,v4l2_mem2mem
i2c_bcm2835 16384 0
videobuf2_common 45056 4 bcm2835_codec,bcm2835_v4l2,v4l2_mem2mem,videobuf2_v4l2
spi_bcm2835aux 16384 0
spi_bcm2835 20480 0
videodev 200704 6 bcm2835_codec,v4l2_common,videobuf2_common,bcm2835_v4l2,v4l2_mem2mem,videobuf2_v4l2
media 36864 3 bcm2835_codec,videodev,v4l2_mem2mem
vc_sm_cma 36864 1 bcm2835_mmal_vchiq
uio_pdrv_genirq 16384 0
fixed 16384 0
uio 20480 1 uio_pdrv_genirq
dwc2 159744 0
udc_core 53248 5 usb_f_ecm,dwc2,u_ether,usb_f_rndis,libcomposite
ip_tables 24576 0
x_tables 32768 1 ip_tables
ipv6 458752 34
`usb-devices`
> T: Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=480 MxCh= 1
D: Ver= 2.00 Cls=09(hub ) Sub=00 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=1d6b ProdID=0002 Rev=04.19
S: Manufacturer=Linux 4.19.118-Re4son-v7+ dwc2_hsotg
S: Product=DWC OTG Controller
S: SerialNumber=3f980000.usb
C: #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=0mA
I: If#=0x0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub
> T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 5
D: Ver= 2.00 Cls=09(hub ) Sub=00 Prot=02 MxPS=64 #Cfgs= 1
P: Vendor=0424 ProdID=9514 Rev=02.00
C: #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=2mA
I: If#=0x0 Alt= 1 #EPs= 1 Cls=09(hub ) Sub=00 Prot=02 Driver=hub
> T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ff(vend.) Sub=00 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0424 ProdID=ec00 Rev=02.00
C: #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=2mA
I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=ff Driver=smsc95xx
> T: Bus=01 Lev=02 Prnt=02 Port=01 Cnt=02 Dev#= 4 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=067b ProdID=2303 Rev=04.00
S: Manufacturer=Prolific Technology Inc.
S: Product=USB-Serial Controller D
C: #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=100mA
I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=pl2303
> T: Bus=01 Lev=02 Prnt=02 Port=04 Cnt=03 Dev#= 5 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=0bda ProdID=8812 Rev=00.00
S: Manufacturer=Realtek
S: Product=802.11n NIC
S: SerialNumber=123456
C: #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=500mA
I: If#=0x0 Alt= 0 #EPs= 5 Cls=ff(vend.) Sub=ff Prot=ff Driver=rtl88XXau
kern.log:
> Nov 14 22:57:10 pwnagotchi kernel: [ 637.915979] ------------[ cut here ]------------
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916003] WARNING: CPU: 1 PID: 2369 at net/core/xdp.c:120 xdp_rxq_info_unreg+0x1f4/0x274
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916005] Driver BUG
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916008] Modules linked in: cmac bnep hci_uart btbcm serdev bluetooth ecdh_generic lz4 lz4_compress zram zsmalloc fuse 88XXau(O) cfg80211 rfkill pl2303 usbserial rtc_ds1307 spidev i2c_dev$
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916091] CPU: 1 PID: 2369 Comm: iw Tainted: G C O 4.19.118-Re4son-v7+ #1
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916094] Hardware name: BCM2835
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916110] [<801120b0>] (unwind_backtrace) from [<8010d3fc>] (show_stack+0x20/0x24)
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916120] [<8010d3fc>] (show_stack) from [<80858bb0>] (dump_stack+0xd8/0x11c)
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916130] [<80858bb0>] (dump_stack) from [<80121764>] (__warn.part.3+0xcc/0xe8)
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916138] [<80121764>] (__warn.part.3) from [<801217f8>] (warn_slowpath_fmt+0x78/0x94)
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916147] [<801217f8>] (warn_slowpath_fmt) from [<80770f28>] (xdp_rxq_info_unreg+0x1f4/0x274)
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916157] [<80770f28>] (xdp_rxq_info_unreg) from [<807401a8>] (free_netdev+0x50/0xf4)
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916167] [<807401a8>] (free_netdev) from [<8074b2f4>] (netdev_run_todo+0x240/0x2b0)
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916175] [<8074b2f4>] (netdev_run_todo) from [<80759474>] (rtnl_unlock+0x18/0x1c)
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916317] [<80759474>] (rtnl_unlock) from [<7f3b9ba0>] (nl80211_post_doit+0xb4/0xc4 [cfg80211])
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916441] [<7f3b9ba0>] (nl80211_post_doit [cfg80211]) from [<80792874>] (genl_rcv_msg+0x23c/0x438)
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916451] [<80792874>] (genl_rcv_msg) from [<807918ac>] (netlink_rcv_skb+0xc8/0x120)
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916460] [<807918ac>] (netlink_rcv_skb) from [<80792628>] (genl_rcv+0x34/0x44)
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916468] [<80792628>] (genl_rcv) from [<80790fdc>] (netlink_unicast+0x194/0x210)
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916476] [<80790fdc>] (netlink_unicast) from [<807912e4>] (netlink_sendmsg+0x1bc/0x3b0)
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916486] [<807912e4>] (netlink_sendmsg) from [<80721e38>] (sock_sendmsg+0x24/0x34)
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916495] [<80721e38>] (sock_sendmsg) from [<80722708>] (___sys_sendmsg+0x23c/0x250)
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916504] [<80722708>] (___sys_sendmsg) from [<8072382c>] (__sys_sendmsg+0x60/0x9c)
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916513] [<8072382c>] (__sys_sendmsg) from [<80723884>] (sys_sendmsg+0x1c/0x20)
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916522] [<80723884>] (sys_sendmsg) from [<80101000>] (ret_fast_syscall+0x0/0x28)
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916526] Exception stack(0xa7e8bfa8 to 0xa7e8bff0)
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916532] bfa0: 019d71c8 019dc448 00000003 7eadf588 00000000 00000000
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916539] bfc0: 019d71c8 019dc448 019dc500 00000128 76f64000 7eadf905 019dc500 7eadf804
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916543] bfe0: 0000006c 7eadf540 76f495bc 76ec4980
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916548] ---[ end trace 49c56f7d6fbdf17e ]---
Nov 14 22:57:10 pwnagotchi kernel: [ 637.916569] ------------[ cut here ]------------
Contributor guide
Research direction
Start with /usr/bin/pwnlib and the bettercap.service and pwnagotchi.service setup described in the report, then inspect how the monitor interface is selected. Reproduce the iw commands on the listed Raspberry Pi and RTL8812AU environment while collecting the kernel output. Done means the external NIC is used as mon0, access points appear in the UI, and changing or removing the interface does not panic the system.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, python, raspberry-pi
- Domain
- embedded-iot, networking, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100