From 78424b4a352624adf9be68cce809c8141e02915b Mon Sep 17 00:00:00 2001 From: c4ch3c4d3 Date: Tue, 18 Aug 2026 19:22:36 -0500 Subject: [PATCH] docs: design spec for attacks page, state sync, MCP harness --- .../2026-08-18-attacks-sync-harness-design.md | 102 ++++++++++++++++++ 1 file changed, 102 insertions(+) create mode 100644 docs/superpowers/specs/2026-08-18-attacks-sync-harness-design.md diff --git a/docs/superpowers/specs/2026-08-18-attacks-sync-harness-design.md b/docs/superpowers/specs/2026-08-18-attacks-sync-harness-design.md new file mode 100644 index 0000000..133da72 --- /dev/null +++ b/docs/superpowers/specs/2026-08-18-attacks-sync-harness-design.md @@ -0,0 +1,102 @@ +# Mark VIII Night Sprint — Attacks, Sync, Harness + +Date: 2026-08-18 +Status: Approved (user: "Approved, go build") + +## Problem + +The Mark VIII web UI (Pager firmware `Pineapple Pager 24.10.1`) is rough and +desyncs from the device. Interrogation (2026-08-18, live device `172.16.52.1`) +found: + +1. **pineapd crash-loop**: 34+ `SIGSEGV`s in logread; stock daemon restarts + pineapd every ~30s. Root cause: SSID-pool broadcast (68 SSIDs, `disable='0'`) + segfaults pineapd; `wlan1mon` repeatedly fails to come up + ("That device is not up" / "interface sysfs directory does not exist" every 5s). +2. **State desync**: `GET /api/pineap/mode` returns `mode: "unknown"` while the + device is effectively Active; mode is a UI-stored preference, never derived + from live state. +3. **Wrong-band AP cards**: `get_ap` reads radio1 (`wlan1wpa`/`wlan1open`) + whenever those UCI sections exist (even disabled leftovers), so the 2.4GHz + Evil WPA card silently shows 5GHz state. +4. **Evil Enterprise is dead code**: `views.pineap_enterprise` exists but has no + route in `app.js` routes map and no tab. +5. **Fire-and-forget writes**: UI toasts success without verifying device state. +6. **Hop hygiene**: radio1-AP feature pauses `wlan1mon` hop and leaves it paused + with leftover AP sections. + +## Research findings (verified on device) + +- Enterprise AP recipe: create `wireless.wlan0ent` (device `radio0`, mode `ap`, + encryption `wpa2`, key = passphrase), then + `PUT /api/settings/wifi/set_ap` over unix socket `/tmp/api.sock` with + `{"configs":[{"interface":"wlan0ent","ssid":...,"enctype":"wpa2", + "enabled":true,"key":...,"channel":1}]}`. Result: `wlan0ent` AP live with + `ieee8021x=1`, `wpa=2`, `wpa_key_mgmt=WPA-EAP` (PineAPE internal EAP server). + Daemon-side hostapd reload is async (poll for iface in `iw dev`). +- `hcxpcapngtool`, `tcpdump`, `sqlite3`, `aircrack-ng` present on device. +- MCP Streamable HTTP transport (2025-06-18): single endpoint, POST JSON-RPC, + respond `application/json` or SSE; Origin validation + auth required. +- Daemon unix-socket API (`/tmp/api.sock`) carries `/api/pineap/*`; TCP :1471 + carries `/api/settings/*` and `/api/login`. + +## Design + +### Phase 1 — Attacks (top-level menu item) + +New side-menu section **Attacks** with three launchers: + +- **Evil WPA (PSK)**: SSID, passphrase, enctype (psk2/sae/owe), band+channel + (2.4 → `wlan0wpa`, 5/6 → `wlan1wpa` via radio1 feature), hidden. Deploy = + UCI write + hop pause + `wifi reload` + PineAP response engine + karma on + + handshake logging on. Stop = disable AP + hop resume. Live AP status from + `iw dev`/UCI (never UI cache), live handshake table (`hostap_handshake`), + **Export .hc22000** (on-device `hcxpcapngtool`) + hashcat command, per-client + deauth with band-aware inject interface. +- **Evil Open**: same shape for `wlan0open` / radio1 open AP. +- **Evil Enterprise**: SSID, encryption (wpa2/wpa3 enterprise), passphrase. + Deploy = verified recipe above + PineAPE on + auth-pass capture on. Live cred + tables (`hostap_basic`, `hostap_chalresp`) with Clear. + +All three: verification banner ("applied & verified" vs "device state differs"), +Stop button, and a post-write poll (UCI + `iw dev`) before success toast. + +### Phase 2 — Stabilize + sync + +- SSID pool broadcast disabled on deploy of this build; server-side health + monitor: `_pineap PING` every 15s; two failures → check SIGSEGV growth in + logread → disable pool, restart pineapd, `ip link set wlan1mon up`. +- Mode derived from live `enabled` + `collect` + `advertise`; never "unknown" + when state is readable. +- `get_ap` returns `radio0` + `radio1` + `enterprise` APs as separate objects. +- All writes verified by re-read; success only on match. +- Hop resumed when no radio1 AP active; leftover radio1 sections reported. + +### Phase 3 — Local Harness (MCP) + +- `POST /mcp` on server.py: Streamable HTTP MCP server (JSON-RPC 2.0, pure + socket, no deps), auth via session cookie/Bearer + Origin validation. +- Tools: `recon.query`, `attack.deploy_evil_wpa` / `deploy_evil_open` / + `deploy_evil_enterprise` / `stop_attack`, `attack.deauth`, + `attack.capture`, `loot.handshakes`, `loot.export_hc22000`, + `loot.enterprise_creds`, `device.state`, `pineap.set_filter`, + `pineap.kick_client`. +- Resources: recon DB tables (ssid, wifi_device, handshake, hostap_handshake, + hostap_basic, hostap_chalresp), handshake files, loot listing, and the + opencode skills (pineapple-control, wifi-deauth, aircrack-suite) as + markdown resources. +- Prompts: attack playbooks (evil-wpa, evil-enterprise, recon). +- **Harness UI page**: endpoint + client config snippets (opencode/Claude/ + Cursor), capability explorer, "prompt for pi.dev" generator, live state + snapshot. +- Optional stdio wrapper `scripts/harness_stdio.py` for stdio-only agents. + +## Constraints + +- Authorized target: `` only (intermittent). Non-client + environment; no deauth blasts; verify on-wire via monitor capture when needed. +- SSID pool stays disabled (stock bug; re-enabling re-crashes pineapd). + +## Out of scope + +`1471` takeover, Cloud C2, campaigns, physical display mirroring.