Very bizarre behavior when using USB WiFi

[Aaron Outhier]

Somehow, my Wlan1 and Wlan2 devices are being somehow switched! When I plug in a NetGear USB Wifi device using the rtl8192cu chipset, everything works great for a while. After that my Nano  starts to be unable to put wlan1 into monitor mode. When I check, Wlan 1 has the MAC address of my NetGear device, while Wlan2 has a MAC address of 00:C0:CA:91:XX:XX. I'm no expert on this, but something seems a bit off here...

Also, when I unplug my USB WiFi adapter, Wlan1 disappears. @Darren Kitchen: What on earth is going on??

After a factory reset, it goes back to normal for a few days. I have not figured out yet what triggers the reversal of the network IFs as of yet.

 

br-lan    Link encap:Ethernet  HWaddr 00:C0:CA:91:36:B7  
          inet addr:172.16.42.1  Bcast:172.16.42.255  Mask:255.255.255.0
          inet6 addr: fe80::2c0:caff:fe91:36b7/64 Scope:Link
          inet6 addr: fde3:7467:10a7::1/60 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:861 errors:0 dropped:0 overruns:0 frame:0
          TX packets:768 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:186885 (182.5 KiB)  TX bytes:598534 (584.5 KiB)

eth0      Link encap:Ethernet  HWaddr 00:C0:CA:91:36:B7  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:861 errors:0 dropped:0 overruns:0 frame:0
          TX packets:768 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:198939 (194.2 KiB)  TX bytes:598534 (584.5 KiB)
          Interrupt:4 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:220 errors:0 dropped:0 overruns:0 frame:0
          TX packets:220 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:25802 (25.1 KiB)  TX bytes:25802 (25.1 KiB)

wlan0     Link encap:Ethernet  HWaddr 00:C0:CA:91:07:1A  
          inet6 addr: fe80::2c0:caff:fe91:71a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:79 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:14922 (14.5 KiB)

wlan0-1   Link encap:Ethernet  HWaddr 02:C0:CA:91:07:1A  
          inet6 addr: fe80::c0:caff:fe91:71a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:77 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:14502 (14.1 KiB)

wlan1     Link encap:Ethernet  HWaddr 00:E0:4C:81:92:B2  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wlan2     Link encap:Ethernet  HWaddr 02:C0:CA:91:1A:34  
          inet addr:XXX.XXX.XXX.XXX  Bcast:XXX.XXX.XXX.255  Mask:255.255.255.0
          inet6 addr: fe80::c0:caff:fe91:1a34/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1143 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1106 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:701250 (684.8 KiB)  TX bytes:251759 (245.8 KiB)

 

[DangerAnt]

I noticed the same thing on my Signal Owl, but not yet on my Nano. My solution (again for the owl) was to boot the device up, and then plug in the USB wireless card. This caused the Owl to assign the internal card as wlan1, and when i plugged in the external card it would get wlan1

 

Now i have done the same with my Nano just out of habit at this point. I let the device boot up, then plug in my external card and it always get wlan2 (3rd wifi card) that i can then use in client mode without affecting PineAP. Hope you found this helpful. 

 

P.S. My Signal Owl has been deemed damaged and is being replaced by the fine people at Hak5 so its possible the kind of thing i noticed with the owl is due to this damage and might not apply (but i don't think so).

[Aaron Outhier]

Great work-around, but not very practical if I ever need to do an actual pen test where I need to leave the pineapple at a site for a few days on end, and need to issue a remote reboot command via C2.

I have yet to do my first pen test, so time will tell if this will be an issue.