WIFI
Introduction
The WIFI section of the Information gathering phase explained how to discover the company's wireless Access Points and their clients. So, in this section, you will find some methods about how to crack them.
MAC address access control
Despite having authentication methods, some networks also have access control lists based on the MAC address of the devices. Nevertheless, this can be bypassed pretty easily by changing the attacker's MAC address by one of the network's stations.
Authentication tests
Depending on the authentication mechanisms implemented by the wireless networks, exists different methods to retrieve the password to access the network. However, all these mechanisms require of brute force attacks.
WPS Attacks
In order to obtain the PIN we can use reaver or bully.
K: Run pixiedust attackvv: VerboseN: Do not send NACK messages when out-of-order packets are receivedw: Mimic a W7 registrarf: Disable channel hopping
Note: I have not been able on any a single AP to obtain the PIN
If the WPS pin has been found we can ask the AP to provide the WPA key.
Capture and Handshake cracking
Wired Equivalent Privacy (WEP)
After detecting the WEP target network, the attacker can use besside-ng (It also works for WPA -W) which does the job pretty easily, returning the WEP key in hexadecimal (It can be converted using a HEX to ASCII converter). Nonetheless, you can always use aircrack-ng to obtain the ASCII version aircrack-ng <WEP.PCAP>.
Note: The application can crash while attacking the AP; keep trying until obtaining the WEP key.
Wi-Fi Protected Access (WPA2-PSK)
WPA2 replaced WEP due to its several weaknesses. However, WPA2-PSK still has flaws because the encrypted Pre-Shared Key (PSK) is shared during the process 4-way handshake. Hence, an attacker could sniff those network packets for password cracking in the future.
The attack process is the following:
1. Capture the target's AP traffic.
2. Deauthenticating a client or the entire network (More changes to obtain a handshake). keep doing this step until you get the "WPA handshake: XXXXX" message on airodump.
3. Cracking the password with dictionary attacks can be done with aircrack-ng or hashcat, being the latter faster.
Note: If you want to perform a brute force attack to crack the password, you can use the following command.
EAP-MD5
EAP-MD5 is a legacy authentication mechanism that does not provide sufficient protection for user authentication credentials. Users who authenticate using EAP-MD5 subject themselves to an offline dictionary attack vulnerability.
The tool eapmd5pass can be used to retrieve the EAP-MD5 authentication exchange and start a dictionary attack against the user's password.
EAP live brute force
The WPA-EAP APs require of a user and a password to authenticate against the network. You can use the following tools for wireless networks to brute force some credentials.
Note: These tools are sometimes hard to set up in updated environments and, depending on the authentication protocol, might not work.
Furthermore, another test that could be performed is to try to block user accounts using a user provided by the company and make a lot of failed login attempts.
Phishing
The wireless phishing attack consists of creating an evil twin AP while performing a deautentication attack against the target AP, to trick the victim into login into our fake AP and obtaining some credentials.
WPA-PSK
For environments that use WPA/2 with Pre-Shared key authentication, like a house or a small business, several tools can be used to create a fake access point, tricking the victim into providing the key. These tools are:
eaphammer creates an evil twin in order to retrieve the handshake for later cracking.
After obtaining the handshake needs several transformations before being cracked with HashCat. You need to use hcxhash2cap and hcxpcapngtool from hcxtools to transform the hccapx file into a hash.
Wifiphisher in a very simple way creates a fake access point with a phishing webpage (it can be changed), inducing the victim to enter the wireless AP key. Furthermore, if a second wireless network interface is provided, it also makes a deautentication attack against the victim AP.
WIFI-Enterprise
In order to obtain some credentials to access the network, you can create fake access points such as evil-twins, making the client connect to your AP and providing the credentials for later use.
For doing this type of attack you can choose between eaphammer or hostpad-wpe, depending on your hacking environment, if you are using WIFI pineapples or a kali machine.
Eaphammer - Kali
Installation & Configuration
Because the version that is on the Kali Linux repositories has a programming error, you need to download the one from the GitHub repositories.
Attack
To set the rogue access point use the following command and do to forget to deautenticate the original AP.
Hostpad-wpe (Pinneaple v2.1.0)
With hostpad-wpe we can create a fake radius AP where the users can log in to obtain its credentials, that will require a post cracking phase.
For the latest version of the pineapple is more challenging to install, due to there is not available modules on the repositories. So, you will need to execute the following commands.
Configuration
Then, we need to modify the hostapd-wpe.conf file setting the wireless interface that we are going to use, the name of the ssid that we want to spoof and the channel where this AP emits.
Attack
After that, we need to deautenticate the victim AP, execute hostapd-wpe and wait for users to log in. For doing so, execute the following commands.
Deautenticate the AP:
Execute hostapd-wpe:
-k: Karma Mode (Respond to all probes)-s: Return Success where possible
Note: The device is never going to be able to connect to the AP and get Internet, automatically it will be disconnected due to wrong credentials. That occurs because our fake radius server does not have the credentials that the victim is providing.
Finally, we need to put every hashcat NETNTLM into a file for offline cracking.
Simple Radius AP with Internet
It may be the case that you need an access point with internet access for personal reasons or for man-in-the-middle attacks. Whatever the case, here's how to do it.
Note: The environment is a VM Kali machine, it might not work on other distros or require more steps.
Note 2: Depending on your network card, you might not be able to log in despite the ESSID being broadcasted, try using another.
Installation
1. you need to install the following programs.
2. Modify the file /etc/dnsmasq.conf for dnsmasq to obtain a DHCP server.
3. Because Kali comes with systemd-resolved you avoid the conflicts with dnsmasq. To do so, change the file /etc/systemd/resolved.conf and add the following line.
4. Add a user to login into the AP. For doing so, you need to edit the file /etc/hostapd-wpe/hostapd-wpe.eap_user. Here you have some examples:
5. Configure the machine to allow IP forward persistently.
Execution
Every time, you restart your virtual machine you will need to set a static IP to your external network card and restart dnsmasq to detect the wlan0 interface with an IP.
Finally, you need to execute hostapd with the configuration file at /etc/hostapd-wpe/hostapd-wpe.conf. In there, you can change the channel, ESSID, protocols, etc.
References
WPS
Hostpad-wpe
Simple Radius AP
Last updated