Cracking WPA & WPA2

Unlike WEP cracking there is no 100% guarantee that you will successfully hack a WPA key. Hacking WPA requires patience, dedication, a good password list and a bit of luck. A successful WPA hack is reliant on the access point having a weak password. By weak password I mean dictionary words, common words with numbers appended, variations on dictionary words like h$mburgerz. The good news is that there is no difference in cracking both WPA and WPA2. As well as having a strong password list you also need the "4-way handshake" or at least some of it from the access point. The only way to obtain this handshake is to sniff it out when a client connects to the access-point.

What is the 4-way handshake? 

The 4-way handshake is the way in which a client can authenticate with the access point without revealing the key and without having to re-transmit the key after successful authentication. The process itself is very complex and the details are out of scope for this post. All you need to know when cracking WPA is that you require at least 2 parts of the 4-way handshake. This diagram shows the process and the details of each phase are explained on:

http://en.wikipedia.org/wiki/IEEE_802.11i-2004#The_Four-Way_Handshake

You will require a good password list. The list I will be using contains 185million passwords and can be downloaded from:
http://www.seedpeer.me/details/6028904/Custom-WPA-wordlist.html
There is also a 13GB wordlist containing almost 1 Billion passwords optimized for WPA that can be downloaded from:
http://www.proxybay.pw/torrent/5945498/WPA-PSK_WORDLIST_3_Final_(13_GB).rar

The software I will be using is the aircrack suit and pyrit. If you are running Backtrack or Kali Linux these come pre-installed, otherwise can be downloaded from:
http://www.aircrack-ng.org/
https://code.google.com/p/pyrit/

Capture the handshake

First step is to put your wireless interface in monitor mode. This can be achieved with the command:
sudo airmon-ng start wlan0
Replace wlan0 with your wireless interface. This will create a new interface in ifconfig called mon0.

Next start sniffing the airwaves and saving captured packets to an output file with the command:
sudo airodump-ng mon0 --write output

In order to obtain the needed 4-way handshake you can either wait for a client to connect or the much faster method is to kick an already authenticated client off the network and wait for them to re-connect. In this case I will be attacking the AP "00:04:ED:B1:02:DA"(super_happy_fun_slide) as there is already an authenticated client "00:22:43:22:23:8F" on this network.

How do we kick them off if we are not on the network? To disconnect a client we send the access point a special packet called a "de-auth". This stands for deauthentication packet and is used in wireless networks when a client wishes to disconnect. In our case we send a deauth to the AP and either choose the client to deauth or we can deauth all clients that are connected. A Few seconds later the clients auto connect kicks in and re-authenticates them. This is where we ninja the handshake required.

Make sure your airodump is still running and writing out the packets. To de-auth a single client run this command:
sudo aireplay-ng -0 1 -a 00:04:ED:B1:02:DA -c 00:22:43:22:23:8F mon0

To deauth all connect clients leave out the -c option:
sudo aireplay-ng -0 1 -a 00:04:ED:B1:02:DA mon0

Note in some versions of aircrack you may need to append --ignore-negative-one to the end of the command. Also to note is that in some cases a single de-auth may not work. You can send an unlimited amount by replaceing the 1 with  a higher number or use 0 to send unlimited de-auths like so:
sudo aireplay-ng -0 0 -a 00:04:ED:B1:02:DA -c 00:22:43:22:23:8F mon0 --ignore-negative-one

Taken from the aircrack website these command options are:

• -0 means deauthentication
• 1 is the number of deauths to send (you can send multiple if you wish); 0 means send them continuously
• -a 00:14:6C:7E:40:80 is the MAC address of the access point
• -c 00:0F:B5:34:30:30 is the MAC address of the client to deauthenticate; if this is omitted then all clients are deauthenticated
• mon0 is the interface name

In my case I needed to send 5 de-auths to receive a reply:

We see the de-auth received a reply so now we can check airodump for the handshake:

As you can see in the top right corner we can see the line:
WPA handshake: 00:04:ED:B1:02:DA

Cracking the key

Now that we have the handshake we can begin cracking it. The first thing I like to do is check that the handshake is actually valid and good to perform an attack with. Pyrit can do this with the command:

pyrit -r output-02.cap analyze

Note: Airodump appends -01.cap to the end of you filenames. If you have the same filename in your directory you are outputting to then it will increment the number to be -02.cap and so on. In my cause I already had output-01.cap in my directory hence the name output-02.cap.

As you can see out capture file has 1 valid handshake from the AP we de-authed. The reason I like to use pyrit to crack keys is that is supports GPU processing. This means we can go from 1000 password attempts a second to around 100,000 with a decent GPU. In my case I am using a Radeon 5870. It takes a bit of playing around to get pyrit working with your GPU but for ATI cards the OpenCL drivers should work and for NVIDIA the CUDA drivers should work. Run a pyrit benchmark with the command:

pyrit benchmark

As you can see, all 4 of my CPU cores pull about 500 a second and my GPU computes a massive 80,000 a second. I have pushed this up to 95,000 before by closing all running programs. 

There are two options to cracking with a wordlist with pyrit. The first is to simply run the handshake through the wordlist. For each word pyrit needs to calculate what is called the Pairwise Master Key or PMK. This is fine if you have a unique access point name like Super happy fun slide. By say you have a generic name like netgear. You can pre-compute all of these PMKs and put them in a database so you dont have to pre-compute them for the next netgear you crack. In the past I have computed 900,000,000 passwords and it took about 4 - 5 hours. Once they where in the DB it took about 5 minutes to get through all of them. That is an excellent time payoff if there are a lot of APs with the same name in your area. I might cover pre-computing the PMKs into a DB in a later post. 

Start the cracking process with the command:

pyrit -r output-02.cap -i Custom-WPA attack_passthrough

-r = your file containing the handshake

-i = input file. AKA the wordlist

attack_passthrough = compute pmks on the fly directly from the wordlist and dont use a database.

One thing to note is that if you have multiple handshakes in the one file pyrit will ask you which one to you wish to crack. You can also specify an access point manually with the command:

pyrit -r output-02.cap -i Custom-WPA  -b 00:04:ed:b1:02:da attack_passthrough

Speeding up WEP cracking using arp-replay attack

WEP cracking works by sniffing out encrypted data packets that contain what is called "initialization vectors". These IVs are used to randomize the RC4 cipher that is used to encrypt the WEP key. The flaw lies in the size of the IV. The IV required to reveal the RC4 cipher is only 24 bits long. With enough IVs flying around the air it is possible to gather enough of them to decode the WEP key. At least that is my understanding of it. More information on how WEP works can be found at:

http://en.wikipedia.org/wiki/Wired_Equivalent_Privacy#Flaws

The key to cracking WEP is gathering a lot of IV packets. If there are authenticated users browsing the web or generating a lot of data then it usually only a matter of minutes or even seconds before you have enough. Generally 5,000 or more packets are enough to break a key. The problem that one may face when hacking a WEP key is that there is no activity on the network. You may receive 1 or 2 packets here and there and at that speed it may take days of sniffing to gather enough needed to break the key.

How can we generate more packets without being authenticated? The answer lies in the trusty ARP protocol. ARP is required on ethernet networks to know what interface to send the packet out of and what interface on the other end should receive it. Say you need to send data to 192.168.1.1. You need to hardware address of the network card at the destination(Also called MAC address). If you do not have that address in your arp-cache then your computer sends out a broadcast request for it. The packet looks like "who has 192.168.1.1?, tell 66:55:44:33:22:11:00" and 192.168.1.1 replies with "192.168.1.1 is at 00:11:22:33:44:55:66". so now you can create your packet and send it to 00:11:22:33:44:55:66. the network card at the other end knows its for him and processes it.

Addresses in your arp-cache expire if they are not used for a certain time. ARP requests are also the same size. Knowing the size of an arp request we can listen for any that my fly through the air even if they are encrypted. If we see a packet that could be a request we simply catch it and repeatedly send it to the access point. For every request we send, the AP will be sending back its reply. These ARP replies contain the needed IVs to crack the key. Hence the name "Arp-replay attack". Replay the same request over and over.

Before you can sniff packets that are not destined for you, you need to put your network card in monitor mode. Most cards i have used can do this but I prefer using the Alpha Neworks - AWUS036H
http://www.alfa.com.tw/products_show.php?pc=34&ps=92

This card is powerful and can be turned up to cover large areas. It does not support Wireless-N though so it may be time for an upgrade.

To put your card in monitor mode issue the command:

sudo ifconfig

This will show your network cards. The one you want is your wireless card. In my case it is "wlan0". Yours may be named differently. Next you need to put it in monitor mode with the command:
sudo airmon-ng start wlan0

Your card is now in monitor mode and you will have a new card in your ifconfig called mon0. This is the interface we will be using to sniff on. 

This is where the fun begins. Run the command:

sudo airodump-ng mon0 --write output

This will list information on all the Access Points around your location and what their hardware addresses are(BSSIDS), what encryption they are using and so on. We are also writing out all the gathered packets to a file called "output" Under the Station menu. you can see authenticated users and what AP they are connected to. We will need this information when launching our attack. Also take note of the Data tab. 

If you have enough data packets from a WEP network (10,000 or so) you can start cracking it immediatly by using the command:

aircrack-ng output-01.cap

You can see in the above screenshot, the AP "Test_Wifi_No_Internet" has an authenticated station "00:22:43:22:23:8F" and has generated 117 data packets. These packets are being saved to our output file we specified with the --write command.

If the data packets are trickling in and there is an authenticated station you can launch the replay attack to speed it up.

Leave this running and gather both the associated station "00:22:43:22:23:8F" and the BSSID of the AP "00:04:ED:B1:02:DA". Issue the command:

sudo aireplay-ng -3 -b 00:04:ED:B1:02:DA -h 00:22:43:22:23:8F mon0

Note: some versions of the aircrack suite have a bug that requies the --ignore-negative-one command to be appended. Also to note the -3 is used to specify the attack type and can be replaced with --arpreplay. In that case the command would look like:

sudo aireplay-ng --arpreplay -b 00:04:ED:B1:02:DA -h 00:22:43:22:23:8F mon0 --ignore-negative-one

Now you simply wait for the arp-replay to catch a request. This may take a few minutes but as soon as a station sends a request, arp-replay will take off and begin generating 1000s of data packets a minute. I have gathered over 1 million packets in a few minutes using this attack. When you have over 5000 or 10000 packets leave both tools running and start trying to crack the key. if it does not work the first time, wait for 20,000 packets and so on. 

 

Crack the key using the command:

aircrack-ng output-01.cap

If you have not filtered your airodump command you may have to choose a network from a list. In a few minutes or seconds you will have cracked the key. In this case it only took 7127 IVs.