-
-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
kernel panic on macOS (any) when running wifi.deauth and wifi.assoc #448
Comments
it seems caused by a bug in
|
Environment
Steps to Reproduce
Expected behavior: Actual behavior: |
can you produce a panic with the |
I can't replicate this issue, but I have Mojave 10.14.3. Try to upgrade the system .. maybe it has been fixed automagically by Apple. |
Same, cannot reproduce on 10.14.3. |
it seems clear to me this is a 10.14.2 bug rather than bettercap's, closing this since upgrading to 10.14.3 seems to fix the issue |
I'm not sure that it's a 10.14.2 bug. On my other MacBook (an older model), I ran the same stuff, and it's working great. MacBook Pro (Retina, Mid 2012) Maybe it could be an issue with 10.14.2 specifically with the newer MacBooks only? |
I believe that #429 is related. |
well, it looks like a 10.14.2 bug with newer hardware ... |
I can reproduce the kernel panic on MacBook Pro 2018 with macOS Mojave 10.14.3 when running |
lol fun |
I also can reproduce on |
I haven't been able to test it on my 2018 retina with an external Wifi yet, as OSX doesn't seem to recognize my normal adapter. I have an alfa arriving soon, so I'll try it to see. I can report that using a Kali VM on a 2018 Macbook worked fine, with a TP-Link TL-WN722N v1. |
Same here :c I can reproduce the kernel panic on MacBook Pro 15 2018 with macOS Mojave 10.14.3 when running wifi.assoc all or when trying to wifi.deauth @evilsocket Maybe reopen? |
@logichard evilsocket has already pinpointed the error here this issue should be raised with Apple instead, so a patch can be made |
Unfortunately, I can reproduce this in 10.14.5. I'm almost 100% certain that this only happens on Macs equipped with T2 chips. To determine if your machine has a T2 chip click the Apple menu, About This Mac, System Report, and under Hardware click on Controller. If you see "Apple T2 Security Chip" you're probably experiencing kernel panics when deauthing. Apple's recommendation for a fix: wipe and reload MacOS from scratch, disable FileVault, and disable Power Nap. I'm going to see if disabling Power Nap alone helps. If it doesn't, I'll use a $30 Odroid instead of this $3500 brick. |
Disabling Power Nap did not help. |
Still happening on MacOS 10.14.6 (2018 MBP with T2). |
Also happening on 2019 MBP with T2 running Mojave 10.14.6. (Yes, I see that this is an Apple issue, not a Bettercap issue, but just in case others stumble across this thread...) |
@elbowdonkey Do you have a link to the issue with Apple so that we can +1? |
MacBook Pro (15-inch, 2019) Mac OS Version 10.14.6 (18G87) same issue here. I can reproduce and report that apple multiple times. |
Also still happening on 2019 T2 Macbook Pro on 10.14.6. Anyone find a fix yet? |
this might be associated with the same problem I saw running |
This also happens for me. on 10.15.1, with the new Macbook Pro 16". I'll see if Apple can help out and update here.
|
M1 MacBooks do not have a T2 chip yet they still crash
Best regards, Dennis
… On Apr 4, 2021, at 10:28, schrammalama ***@***.***> wrote:
I think this is a problem with the T2 macbooks
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or unsubscribe.
|
Using M1 Macbook running 11.2.3, Bettercap can still put WIFI card in monitor mode, still crashes on injection. Also M1's don't have the T2 chip because it was moved inside the M1. |
yeah i highly doubt this is T2 |
can anyone paste the panic stack trace on M1? |
Also I should note the crashing happens when you do wifi.ap as well. |
Same problem on startup: "wifi.assoc all" kernel panic.
|
You can also get Karnal panic by turning on the fake AP too. wifi.ap
…On May 8, 2021, at 04:31, Sakuya ***@***.***> wrote:
Same problem on startup: "wifi.assoc all" kernel panic.
MacBook Pro (16-inch, 2019)
Version: 11.3 (20E232)
Bettercap: v2.31.0
en0:
Card Type: AirPort Extreme (0x14E4, 0x7BF)
Firmware Version: wl0: Feb 16 2021 03:05:58 version 9.30.444.10.32.5.67 FWID 01-3d719d60
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or unsubscribe.
|
@evilsocket I have some potentially good news! I am on the newest macOS Monterey (21A5248p) and deauth, assoc, and ap no longer cause the machine to crash. However, the requests don't do actually deauth or do anything. To test it, I scanned the area and selected my wifi with |
thanks @dennis777, it looks like the way they fixed the issue is just by removing the capability to inject frames :/ |
Wow that is truly a shame...hate to hear that these machines are so capable. Thank you |
it is, macOS would be great for WiFi pentesting if it wasn't for this single issue |
Also for some reason looks like the |
weird, will check, thanks |
Same error on BigSur 11.2.3 |
Still present on Big Sur 11.5.2 (kernel panic after running mass deauth caplet) using bettercap 2.32.0 |
Same here😭😭😭 |
+1 |
+1 Mac Air BigSur 11.6 (M1) |
MacBook Air 2020 (Apple Silicon/M1) Monterey |
Can confirm same thing is happening to the new 14" and 16" MacBook Pro's. It doesn't crash but it also doesn't inject any frames either. Is there nobody who we can reach out to at Apple? This has been an issue ever since MacBooks with the T2 chip were made. |
MacBook Pro 16" 2019 |
+1 MacBook Pro (13-inch, M1, 2020) |
M1 Pro Mac deauthentication works only visually (devices are not disconnect) |
Could this issue be because M1 Macbooks do not support package injection? |
@SlickSlime what is package injection? BTW this issue happens also on Mac Intel |
I think it's macOS as a whole ever since macOS Monterey (12.0) disabled frame injection which is truly tragic 😩 see this comment by the man @evilsocket himself 2 years ago when I reported on my finding to him
|
Frame injection causing Kernel Panic's before MacOS 12 Monterey and Apple decided to disable it altogether from then onwards. More info here: bettercap/bettercap#448 (comment)
Environment
Steps to Reproduce
Expected behavior:
This should start performing a deauth attack and capturing handshakes
Actual behavior:
The fan on the macbook spins at 100% for a second, screen flickers, then blacks out, and finally reboots.
The text was updated successfully, but these errors were encountered: