{"id":2255,"date":"2018-10-25T05:31:31","date_gmt":"2018-10-25T05:31:31","guid":{"rendered":"https:\/\/miloserdov.org\/?p=2255"},"modified":"2021-05-15T16:15:47","modified_gmt":"2021-05-15T16:15:47","slug":"hacking-wi-fi-without-clients-on-windows-using-wireshark-and-npcap-to-capture-pmkid","status":"publish","type":"post","link":"https:\/\/miloserdov.org\/?p=2255","title":{"rendered":"Hacking Wi-Fi without clients on Windows (using Wireshark and Npcap to capture PMKID)"},"content":{"rendered":"<div class=\"0b20205ac99e89c6cabdb919fd9d1a8a\" data-index=\"1\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block; text-align:center;\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-layout=\"in-article\"\r\n     data-ad-client=\"ca-pub-7219829351026140\"\r\n     data-ad-slot=\"9942251718\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\r\n\r\n\n<\/div>\n<h2 style=\"text-align: justify;\">\n\tNpcap is WinPcap for Windows 10<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/github.com\/nmap\/npcap\" target=\"_blank\" rel=\"noopener\">Npcap<\/a> is a project from <a href=\"https:\/\/en.kali.tools\/?p=1433\" target=\"_blank\" rel=\"noopener\">Nmap<\/a> programmers, a library designed for sniffing (and sending) packages. Is is Windows-based programm. It is based on the WinPcap\/Libpcap libraries, but it has improved speed, portability, and security. At its core, Npcap is a new version of WinPcap, with new features and support for modern versions of Windows 10.\n<\/p>\n<p style=\"text-align: justify;\">\n\tClassic WinPcap can capture raw 802.11 frames, but only supports one hardware solution &#8211; AirPcap. Npcap can also capture raw 802.11 frames, but supports various wireless adapters.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIn addition, Npcap includes related utilities that can set wireless cards into monitor mode in Windows (if the wireless adapter driver supports it).\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tMonitor Mode in Windows<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tAs in Linux, in Windows you can set some wireless cards into Monitor Mode. For example, it works for many Alfa. But there are several problems at once:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\tprograms from the Aircrack-ng package do not know how to work with these interfaces &#8211; that is, Airodump-ng is not able to capture any data\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tthere are almost no programs that can do wireless injections, that is, there is no way to perform the most popular attacks.\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tNevertheless, there is a more or less working combination: Wireshark is able, through Npcap, to set wireless interfaces into monitor mode and capture raw frames of Wi-Fi networks (at least this is written in the official Npcap documentation). Again, it is impossible to do wireless injections, but in clientless attacks (details here and here) we don&rsquo;t need to do wireless injections, to capture PMKID we need monitor mode, as well as a second wireless interface from which a typical connection attempt will be made (with any password).\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tHow to set up Npcap to capture raw Wi-Fi frames<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tSo, we need Npcap itself. You can download it <a href=\"https:\/\/nmap.org\/npcap\/#download\" target=\"_blank\" rel=\"noopener\">here<\/a> (this is the official site).\n<\/p>\n<p style=\"text-align: justify;\">\n\tPlease note that Npcap and WinPcap should not be installed simultaneously. Therefore, if you already have WinPcap, first remove it. Npcap completely replaces WinPcap and has additional features. If you uninstall WinPcap during the Npcap installation, when prompted whether to restart the computer now, select a manual restart to complete the Npcap installation.\n<\/p>\n<p style=\"text-align: justify;\">\n\tAlthough it is not written anywhere, but for Npcap, apparently, you need <a href=\"https:\/\/www.microsoft.com\/ru-RU\/download\/details.aspx?id=40784\" target=\"_blank\" rel=\"noopener\">Microsoft Visual C ++ Redistributable 2013<\/a>.\n<\/p>\n<p style=\"text-align: justify;\">\n\tWhen installing Npcap, select options:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t<strong>Support raw 802.11 traffic<\/strong>\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>Install Npcap in WinPcap API-compatible Mode<\/strong>\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/998.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-2263\" height=\"426\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/998.png\" width=\"539\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tWe also need the Wireshark program, which can be downloaded <a href=\"https:\/\/www.wireshark.org\/download.html\" target=\"_blank\" rel=\"noopener\">here<\/a>. If Npcap is installed correctly, then the option to install WinPcap should be inactive:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/997.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-2262\" height=\"430\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/997.png\" width=\"546\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tTo work with wireless cards in monitor mode, Npcap uses the &lsquo;Native 802.11 WLAN&rsquo; interface, which is obsolete in Windows 10. And although there is evidence that in Windows 10 you can still use Native 802.11 WLAN, you also can try to install all this in Windows 8 for better results.\n<\/p>\n<p style=\"text-align: justify;\">\n\tYou may also need drivers for your wireless card, for example, for Alfa I downloaded drivers here:&nbsp;<a href=\"https:\/\/www.alfa.com.tw\/files\/?dir=[1]%20WiFi%20USB%20adapter\" target=\"_blank\" rel=\"noopener\">alfa.com.tw\/files\/?dir=%5B1%5D%20WiFi%20USB%20adapter<\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tExamples of adapters tested by the authors of the program:&nbsp;<a href=\"https:\/\/secwiki.org\/w\/Npcap\/WiFi_adapters\" target=\"_blank\" rel=\"noopener\">https:\/\/secwiki.org\/w\/Npcap\/WiFi_adapters<\/a>\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tHow to capture PMKID in Windows<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tPlug your Wi-Fi adapter.\n<\/p>\n<p style=\"text-align: justify;\">\n\tRun Wireshark as administrator:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/994.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-2261\" height=\"466\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/994.png\" width=\"414\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tNow find the <strong>Capture<\/strong> menu and select <strong>Options<\/strong> there:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/999.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-2264\" height=\"501\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/999.png\" width=\"976\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/999.png 976w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/999-768x394.png 768w\" sizes=\"(max-width: 976px) 100vw, 976px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tIf your adapter supports monitor mode and if you have installed everything correctly before, then you should have a checkbox in the <strong>Monitor Mode<\/strong> column opposite the wireless interfaces.\n<\/p>\n<p style=\"text-align: justify;\">\n\tI have it for my Wi-Fi interfaces (as you can see in the screenshot), but as soon as I select checkbox, a tick disappears. I tried three Wi-Fi adapters with different chipsets, tried virtual machines, tried on a real computer, even installed Windows 8 specifically and tried there. The result is always the same &#8211; the check mark disappears immediately. One can begin to doubt whether it works at all, but <a href=\"https:\/\/nmap.org\/npcap\/guide\/npcap-users-guide.html#npcap-installation-options\" target=\"_blank\" rel=\"noopener\">here<\/a> the authors write very confidently what works.\n<\/p>\n<p style=\"text-align: justify;\">\n\tTherefore, we will proceed from the assumption that this also worked for you.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIn order for the access point to send Message 1 of a handshake (which can contain PMKID), you need to connect to it from another wireless interface &mdash; you can choose any password, since the password does not affect the Message 1 of a handshake.\n<\/p>\n<p style=\"text-align: justify;\">\n\tAfter the data is captured, you can filter the desired frame directly in Wireshark, for this use a filter (for details on working with wireless frames, see the article &ldquo;<a href=\"https:\/\/miloserdov.org\/?p=1047\" target=\"_blank\" rel=\"noopener\">How to extract all handshakes from a capture file with several handshakes<\/a>&rdquo;):\n<\/p>\n<pre class=\"brush:plain;\">\r\n(wlan.fc.type_subtype == 0x08 || wlan.fc.type_subtype == 0x05 || (eapol &amp;&amp; wlan.rsn.ie.pmkid))<\/pre>\n<p style=\"text-align: justify;\">\n\tAfter extracting the PMKID, brute-force can be started into Windows, into Aircrack-ng (as shown <a href=\"https:\/\/miloserdov.org\/?p=2122\" target=\"_blank\" rel=\"noopener\">here<\/a>) or into Hashcat (as shown <a href=\"https:\/\/miloserdov.org\/?p=2100\" target=\"_blank\" rel=\"noopener\">here<\/a>).\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tHow to set a Wi-Fi adapter into monitor mode in Windows<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tIf you also have problems with capturing raw Wi-Fi frames, then as a consolation prize, you can switch your Alfa to monitor mode in Windows &#8211; there are no problems with that. The problem is that any use of this monitor mode is completely missing: Airodump-ng does not understand these interfaces. And even Wireshark, which seems to be working with Npcap, does not understand this monitor mode &#8211; it is necessary that Wireshark sets the card into monitor mode.\n<\/p>\n<p style=\"text-align: justify;\">\n\tTherefore, for those who, like me, did not succeed, this monitor mode comes as a consoling (and useless) prize.\n<\/p>\n<p style=\"text-align: justify;\">\n\tTo enable it, open a command prompt from the administrator and go to the folder <strong>C:\\Windows\\System32\\Npcap\\<\/strong>:\n<\/p>\n<pre class=\"brush:bash;\">\r\ncd C:\\Windows\\System32\\Npcap\\<\/pre>\n<p style=\"text-align: justify;\">\n\tSee the names of the wireless interfaces:\n<\/p>\n<pre class=\"brush:bash;\">\r\nnetsh wlan show interfaces<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/993.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-2260\" height=\"601\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/993.png\" width=\"597\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/993.png 597w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/993-150x150.png 150w\" sizes=\"(max-width: 597px) 100vw, 597px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tI renamed my interface to awus052nh, by default it may be called &ldquo;Wireless Network&rdquo; or something similar. As it is written in the help, the <strong>WlanHelper.exe<\/strong> program must understand both the Interface Name and the GUID, which is shown a couple of lines lower. But my WlanHelper.exe categorically does not accept the name of the interface, an error appears\n<\/p>\n<pre class=\"brush:plain;\">\r\nError: makeOIDRequest::strAdapterGUID error, the adapter name is incorrect.\r\nFailure<\/pre>\n<p style=\"text-align: justify;\">\n\tAlthough it accepts GUID normally.\n<\/p>\n<p style=\"text-align: justify;\">\n\tTherefore, in the subsequent commands, instead of the name, I will use the GUID (replace it with your own).\n<\/p>\n<p style=\"text-align: justify;\">\n\tTo view the current monitor mode, enter:\n<\/p>\n<pre class=\"brush:bash;\">\r\nWlanHelper.exe 1eff05d6-56c5-4a12-bb4b-d96a7ef0af2f mode<\/pre>\n<p style=\"text-align: justify;\">\n\tTo put in monitor mode:\n<\/p>\n<pre class=\"brush:bash;\">\r\nWlanHelper.exe 1eff05d6-56c5-4a12-bb4b-d96a7ef0af2f mode monitor<\/pre>\n<p style=\"text-align: justify;\">\n\tChecking:\n<\/p>\n<pre class=\"brush:bash;\">\r\nWlanHelper.exe 1eff05d6-56c5-4a12-bb4b-d96a7ef0af2f mode<\/pre>\n<p style=\"text-align: justify;\">\n\tEverything worked out:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/992.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-2259\" height=\"163\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/10\/992.png\" width=\"643\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tAs simple as it&rsquo;s useless &#8230;\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tConclusion<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tAs I said, I did not manage to capture PMKID. If someone succeeds according to this instruction &#8211; please write in the comments. Maybe someone saw what was done wrong by me and why Wireshark cannot use the monitor mode? I would be grateful for any advice.<\/p>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>Npcap is WinPcap for Windows 10 Npcap is a project from Nmap programmers, a library designed for sniffing (and sending) packages. Is is Windows-based programm. It is based on the WinPcap\/Libpcap libraries, but it has improved speed, portability, and security. At its core, Npcap is a new version of WinPcap,<a href=\"https:\/\/miloserdov.org\/?p=2255\" class=\"read-more\">Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":2264,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[195,191,192,16,193,5,194],"class_list":["post-2255","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wireless-attacks","tag-clientless-attack","tag-npcap","tag-pmkid","tag-windows","tag-winpcap","tag-wireless","tag-wireshark"],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/2255"}],"collection":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2255"}],"version-history":[{"count":5,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/2255\/revisions"}],"predecessor-version":[{"id":6210,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/2255\/revisions\/6210"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/media\/2264"}],"wp:attachment":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2255"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2255"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2255"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}