Drone Hack

[Dionysis3]

I am trying to packet-capture with wireshark my drone. It seems it creates a subnet for my phone (172.16.152.171) when connected with the app. But when i try to ping and eventually sniff the traffic the before mentioned ip is unreachable.
I copy paste ip route command so as you to have more clues.
$$ ip route
default via 172.16.10.1 dev wlp6s0 proto static metric 20600
169.254.0.0/16 dev wlp6s0 scope link metric 1000
172.16.0.0/16 dev wlp6s0 proto kernel scope link src 172.16.10.2 metric 600
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown
192.168.56.0/24 dev vboxnet0 proto kernel scope link src 192.168.56.1 linkdown
Any ideas???

[markszabo]

Hi! Are you running wireshark on the phone or on your computer?

If you are running it on the computer:

• Is your computer connected to the drone's wifi? Can you ping and nmap the drone? It should likely be on a 192.168.1.1, but it could have changed.
• Have you enabled promiscuous mode in Wireshark?
• If there is a password on the drone's wifi, have you configured that in Wireshark? https://wiki.wireshark.org/HowToDecrypt802.11

[Dionysis3]

Hello, thanks for the reply.
I am running wireshark on my computer. Of course i am connected on drone's wifi. Also, i can ping drone (Access point) with my computer. I cannot ping the phone that is connected to the drone. Phone runs an app that can guide the drone.
Finally i run wireshark in promiscuous mode. I checked Edit/preferences/Promiscuous Mode . Drone 's security is Open, checked by terminal.

[markszabo]

Hm, so what exactly is your issue? You can't see the phone-drone communication in the Wireshark capture?

[Dionysis3]

Yes, that's exactly my issue!

[markszabo]

I see, hm. My next guess is that your computer can't capture packages. Not all drivers support promiscuous mode. Can you check if you see any communication not coming from or going to the computer you are running Wireshark on?

[Dionysis3]

Ok, so after a lot of searching i found out that arpspoof would fit for our situation. I created a Mitm condition and i was able to see movement on wireshark. But, always the phone was the destination ip, never the source. Why so? The next step now is finding the udp packet movement, which does not appear in wireshark. Any ideas?

[markszabo]

If you can see it in Mitm, but not otherwise, then I think it's the wifi driver or the wifi hardware that can't be set to promiscuous mode properly. Unfortunately not all hardware supports that