Run aircrack-ng without external “wifi card” [UPDATED]

Note: This is updated version of my previous blog, which goes by the similar title.

I wanted to use pentesting tools provided in Kali-Linux. I use a Fedora machine as my primary desktop, I can install some of those tools locally, but then I wanted to keep these things separate. So I use Kali Linux in a VM. It was all good, until the point when I was not able to run wireless pentesting tools from VM.

This is because VM does not get direct access to the host’s wifi card. The way it works VMs get connected to a bridge setup by your hypervisor via ethernet interface. So VM never deals with how the host is connected to outside world, be it wired or wireless connection.

The VM can get a wireless interface using USB connected wifi device. But then you need to have one to utilize it. To get around this problem, and use your host machine’s interface, we can use containers. Containers give you isolation similar to VM(not exactly) and since container is again a process mapped onto your operating system it has access to everything on your machine(if run in privileged mode) and container can also see the host’s network stack if run with specific flag(--net="host").

So lets get started

Install docker for your system:

• For Fedora instructions.
• For CentOS instructions.
• For Ubuntu instructions.
• For Debian instructions.
• Others locate your OS here.

Create Dockerfile which looks like this:

$ cat Dockerfile

FROM kalilinux/kali-linux-docker

RUN apt-get -y update && \
apt-get -y upgrade && \
apt-get install -y aircrack-ng pciutils

Here we are using official kali-linux docker image, then installing tools required.

Create a docker image using above Dockerfile

$ docker build -t mykali .

Now that you have all the bits required to get started, spin up the container:

$ docker run -it --net="host" --privileged --name aircrack mykali bash
root@user:/#

Once inside the container, identify your wireless interface:

# ip a
[SNIP]
3: wlp9s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 40:f0:2f:57:3d:37 brd ff:ff:ff:ff:ff:ff
inet 10.9.68.109/23 brd 10.9.69.255 scope global dynamic wlp9s0
valid_lft 1373sec preferred_lft 1373sec
inet6 fe80::bf7e:dc5d:337:131c/64 scope link
valid_lft forever preferred_lft forever
[SNIP]

On my machine it is wlp9s0.
Enable monitor mode on that wireless interface.

# airmon-ng start wlp9s0
Your kernel supports rfkill but you don't have rfkill installed.
To ensure devices are unblocked you must install rfkill.
PHY Interface Driver Chipset

phy0 wlp9s0 ?????? Qualcomm Atheros AR9485 Wireless Network Adapter (rev 01)

(mac80211 monitor mode vif enabled for [phy0]wlp9s0 on [phy0]wlp9s0mon)
(mac80211 station mode vif disabled for [phy0]wlp9s0)

Observe the new interface created wlp9s0mon

# ip a
[SNIP]
9: wlp9s0mon: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UNKNOWN group default qlen 1000
link/ieee802.11/radiotap 40:f0:2f:57:3d:37 brd ff:ff:ff:ff:ff:ff

Start capturing raw 802.11 frames on the newly created interface running on monitor mode:

# airodump-ng wlp9s0mon

Let this process continue to run here.

Start another terminal window, we need another bash instance in container

$ docker exec -it aircrack bash
root@dhcp35-70:/#

Now that you have everything setup, start doing stuff here, in this terminal window. If you wanted more softwares in the container, edit Dockerfile above and create image accordingly.

To stop the monitoring mode:

# airmon-ng stop wlp9s0mon
Your kernel supports rfkill but you don't have rfkill installed.
To ensure devices are unblocked you must install rfkill.

PHY Interface Driver Chipset

phy0 wlp9s0mon ?????? Qualcomm Atheros AR9485 Wireless Network Adapter (rev 01)

(mac80211 station mode vif enabled on [phy0]wlp9s0)

(mac80211 monitor mode vif disabled for [phy0]wlp9s0mon)

And, finally, since wireless interface was put to monitoring mode we should stop monitoring before we exit continer. Doing this is important because the Guest OS will not get access to wireless card unless monitoring process by Docker container is not stopped. Now the interface wlp9s0 has appeared back, because airmon-ng was stopped.

# ip a
[SNIP]
8: wlp9s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 40:f0:2f:57:3d:37 brd ff:ff:ff:ff:ff:ff
inet 10.9.68.109/23 brd 10.9.69.255 scope global dynamic wlp9s0
valid_lft 3581sec preferred_lft 3581sec
inet6 fe80::bf7e:dc5d:337:131c/64 scope link
valid_lft forever preferred_lft forever

Please comment if any doubts.

Ref:

• Using bridge devices as a connection in a KVM virtual network