monitor mode interface mac address

[mel0n]

Hi all, new to the forums. Anyways in short, why can I not change the mac address of mon0? I can change the mac address of wlan1 and wlan0 successfully. But when put in monitor mode, mon0 still has the original mac address of the interface.

Say on wlan0 my real mac is 11:11:11:11:11:11 and my spoofed address is 00:11:22:33:44:55. When I put wlan0 into monitor mode it will have the address 11:11:11:11:11:11:00:00:00:00:00... ect. which is normal. But in linux when i run:

ifconfig mon0 down
macchanger -m 00:11:22:33:44:55 mon0
ifconfig mon0 up

I have no problems and my new mac address for mon0 shows up as 00:11:22:33:44:55:00:00:00:00:00:00 etc. (this is on linux with an atheros chipset usb wifi adapter)

However on my pineapple if I try to run this same set of commands over ssh i get:

Current MAC: 11:11:11:11:11:11 (unknown)ERROR: 
Can't change MAC: interface up or not permission: Device or resource busy

And when I use the network advanced setting on the web interface to change mac address of mon0, it will say it has been set, and it will show the same mac as wlan0 but when i run ifconfig over ssh it still shows me the 11:11:11:11:11:11:00:00:00:00:00 address. Or it shuts down my mon0 completely.

Am I missing something here? I looked around and could not find anything. Thank you for any help.

[mel0n]

So I killed any application that could have possibly been touching wlan0 or mon0(wlan0) and still couldnt get it to change. I guess I should note that there doesnt seem to be an issue with wlan1 and mon0(wlan1) changing the mon0 mac address. I just think it is strange I cannot do this on wlan0 in monitor mode.

It might be something dumb, I am not sure still new to the pinapple.

[mel0n]

ok sorry for another post but now I am having the same issues as in the first post but with wlan1 as well now... I have no idea what is causing this. I have run airmon-ng check but as expected theres a ton of services running that would interfere.

I have successfully changed my mon0 mac address 1 time, I have no idea how/why it worked but multiple reboots and can not get it to work again.

[alexl83]

you need to bring the interface down before changing mac address:

ifconfig mon0 down
macchanger -r mon0
ifconfig mon0 up

[mel0n]

That is literally exactly what I put in my first post...

Thank you for replying though

[mel0n]

I have actually figured out since last night that the following process seems to work:

reboot
ifconfig wlan0 down
ifconfig wlan1 down (just incase it is up for some reason)
macchanger -m 11:22:33:44:55:66 wlan1
ifconfig wlan1 up
airmon-ng start wlan1
ifconfig mon0 down
macchanger -m 11:22:33:44:55:66 mon0
ifconfig mon0 up

So it seems that upon a fresh boot, if I make sure both interfaces are down, and change wlan1, then put it up, then start mon0 then bring it down and change it. it seems to work. Though if I run any commands or anything before doing this upon boot. I get the error mentioned above. So I just have to do it from a fresh boot as soon as I can. I have watched ps closely and havent found anything running that would hold mon0 up or anything. It is really strange.

I will report back if I find anything else.

[alexl83]

Sorry, I misread; to have both mac addresses matching, you need a little scripting; just feed your wlan* spoofed mac address to macchanger and have it change mon* addr for you.

I encountered the same problem on my Linux distribution sometime ago; resorted to some script hooked from an udev rule; let me search for it and I'll get back; the scripting part should be doable on the pineappl, it involved some grep/awk, nothing fancy.