Tips on how to automatically start hcxdumptool at boot

[vertexgamer]

Hi again, i successfully added a led and a switch to the rpi, and i'm auto-logging in with the default user kali.
I tried using cronotab to automatically execute a bash script as root after 120s from boot, hcxdumptool succesfully run but after 5 min it stops (the led stops blinking and the button does nothing)
What was your solution to automatically start hcxdumptool?

[ZerBea]

It is hard to answer this questions, because I don't know your basic knowledge.
Your default user is KALI, so I assume you're an experienced user?

[ZerBea]

A good starting point:

cmdline.txt:
root=/dev/mmcblk0p2 rw rootwait console=serial0,115200 console=tty1 selinux=0 plymouth.enable=0 smsc95xx.turbo_mode=N dwc_otg.lpm_enable=0 kgdboc=serial0,115200

config.txt:

# See /boot/overlays/README for all available options

gpu_mem=64
initramfs initramfs-linux.img followkernel
max_usb_current=1
hdmi_blanking=1
dtoverlay=pi3-disable-bt
dtoverlay=pi3-disable-wifi
dtparam=audio=off
dtparam=watchdog=on
disable_splash=1
dtparam=act_led_trigger=none
dtparam=pwr_led_trigger=none

bash_profile:

#!/bin/bash

sleep 10
chmod 777 -R /home
cd /home
iw reg set IN
#hcxdumptool --gpio_button=4 --gpio_statusled=17 --onsigterm=exit --ongpiobutton=poweroff --ontot=reboot --onerror=reboot --onwatchdog=reboot --bpf=own.bpfc --essidlist=standard.essidliste --beacontx=5
hcxdumptool --gpio_button=4 --gpio_statusled=17 --onsigterm=exit --ongpiobutton=poweroff --ontot=reboot --onerror=reboot --onwatchdog=reboot --bpf=own.bpfc --essidlist=standard.essidliste --beacontx=5 -c 1a,6a,11a,2a,1a,6a,11a,13a,1a,6a,11a,3a,1a,6a,11a,12a,1a,6a,11a,4a,1a,6a,11a,10a,1a,6a,11a,5a,1a,6a,11a,9a,1a,6a,11a,7a,1a,6a,11a,8a
#hcxdumptool --gpio_button=4 --gpio_statusled=17 --onsigterm=exit --ongpiobutton=poweroff --ontot=reboot --onerror=reboot --onwatchdog=reboot --bpf=own_ext.bpfc --essidlist=standard.essidliste --beacontx=5 -c 1a,6a,11a,2a,1a,6a,11a,13a,1a,6a,11a,3a,1a,6a,11a,12a,1a,6a,11a,4a,1a,6a,11a,10a,1a,6a,11a,5a,1a,6a,11a,9a,1a,6a,11a,7a,1a,6a,11a,8a,1a,6a,11a,36b,1a,6a,11a,40b,1a,6a,11a,44b,1a,6a,11a,48b
#hcxdumptool --gpio_button=4 --gpio_statusled=17 --onsigterm=exit --ongpiobutton=poweroff --ontot=reboot --onerror=reboot --onwatchdog=reboot --bpf=own_ext.bpfc --essidlist=standard.essidliste --tot=8640 --attemptclientmax=2 --beacontx=5 -t 120 -c 1a,8a,3a,6a,4a,7a,2a,5a --disable_deauthentication --disable_proberequest --disable_association --disable_reassociation
#hcxdumptool --gpio_button=4 --gpio_statusled=17 --onsigterm=exit --ongpiobutton=poweroff --ontot=reboot --onerror=reboot --onwatchdog=reboot --bpf=own.bpfc --essidlist=standard.essidliste --attemptapmax=1000 --attemptclientmax=20 --beacontx=5 -c 1a,6a,11a,2a,1a,6a,11a,13a,1a,6a,11a,3a,1a,6a,11a,12a,1a,6a,11a,4a,1a,6a,11a,10a,1a,6a,11a,5a,1a,6a,11a,9a,1a,6a,11a,7a,1a,6a,11a,8a
#systemctl start ssh.service
poweroff

All services that take access to the interface have been disabled. This are the remaining ones:

$ systemctl --type=service --state=running
  UNIT                         LOAD   ACTIVE SUB     DESCRIPTION                                   
  [email protected]       loaded active running Getty on tty1
  dbus.service                 loaded active running D-Bus System Message Bus
  [email protected] loaded active running Serial Getty on ttyAMA0
  systemd-journald.service     loaded active running Journal Service
  systemd-logind.service       loaded active running User Login Management
  systemd-timesyncd.service    loaded active running Network Time Synchronization
  systemd-udevd.service        loaded active running Rule-based Manager for Device Events and Files
  [email protected]               loaded active running User Manager for UID 0
  watchdog.service             loaded active running watchdog daemon

RPI's internal watchdog has been enabled:

nano /etc/watchdog.conf
watchdog-device	= /dev/watchdog
watchdog-timeout = 15
max-load-1 = 24

$ systemctl enable watchdog.service

auto login has been enabled:

cp /usr/lib/systemd/system/[email protected] /etc/systemd/system/[email protected]
nano /etc/systemd/system/[email protected]
ExecStart=-/sbin/agetty  -a root --noclear %I $TERM
Type=simple

Hide kernel messages from terminal (to avoid spamming the temrinal with this messages):

/etc/sysctl.d/20-quiet-printk.conf
kernel.printk = 3 3 3 3

The real time display of hcxdumptool has been disabled, because my RPI is too slow to handle it:
hcxdumptool Makefile

# comment to disable STATUS display (headless operation)
#DEFS		+= -DHCXSTATUSOUT

Internal Bluetooth and WLAN module have been disabled to avoid that they interfere with the attack device.

OS is Rasbian Lite because my RPI is too slow to handle a GUI while running hcxdumptool.
The LInux kernel is 6.1 and listed in the official kernel list:
https://www.kernel.org/
Th driver of the attack device is part of the official Linux kernel (e.g. Mmt76 and mt7601):
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/mediatek?h=v6.1.76

[vertexgamer]

Solution was using bash scripts like Zer suggested, but since kali uses Zsh instad of Bash, i had to create and edit ~/.zshenv.
If you are having an issue getting bash scripts to work like i had, do echo $0 and check if you are instead using Zsh