Open GoogleCodeExporter opened 9 years ago
You will find that pin harvesting ?MAY? eventually start even though the router
is showing a locked state. This will proceed for a period and then stop. We
suggest 300 to 500 seconds as a reaver live time setting. Keep the mdk3 live
time low at first around 30 to 45 seconds. If you run it too long the router
disappears or freezes but does not reset.
7. The router may jump channels so you could set the channel to 0 (i.e. zero) in the maclistreavermdk config file. This will cause reaver to channel hop till it finds the target.
Before running the script open the maclistreavermdk file with a text editor like leafpad and enter the information required. There is help embedded in this file for each entry.
If you place both files in root you can just run the script and watch it for a while to get the sequence of events. You will need to plug in a wifi device supporting packet injection or the script will not run.
You can monitor the attack and fine tune the settings as the program is running. Just open the maclistreavermdk file, adjust the setting and save the file. At the end of each run this configuration file is reloaded whereupon these new settings take effect.
We wish to Thank the following kali-linuc forum members soxrox2212 for starting this adventure., Wn722 for the vision of this attack and for shoving our collective heads back into the WPS rabbit hole again. And the author of auto-reaver for the valuable reaver suggestions provided.
Original comment by muskette...@gmail.com
on 1 Nov 2014 at 11:39
[deleted comment]
Musket Teams have released the latest WPS intrusion device.
For details go to:
http://www.kalilinux.net/community/threads/new-wps-locked-intrusion-script-using-reaver-mdk3-and-wash.1599/
Download VMR-MDK009.zip at
http://www.axifile.com/en/5C34EBC933
MTeams
Original comment by muskette...@gmail.com
on 15 Nov 2014 at 5:56
All the links appear to be dead, but this thread is quite current - what gives?
I'm concerned, because this is great work!
Original comment by velkrosm...@gmail.com
on 3 Dec 2014 at 12:24
All the links appear to be dead, but this thread is quite current - what gives?
I'm concerned, because this is great work!
Original comment by velkrosm...@gmail.com
on 3 Dec 2014 at 12:24
First thanx for the heads up. We are trying to find another site to host
these files. Furthermore we have a VAR-MDK009x.sh about ready for release.
We will send you a copy directly when completed.
If you have any ideas about places to post these files please suggest.
MTeams
Original comment by muskette...@gmail.com
on 12 Dec 2014 at 11:24
I could put these on my mega upload account and share the link here. I also
have a few Google drive accounts I could use.
I just need the 3 downloads first! Please email to Dr.hennessey1@gmail.com
Thank you!
Original comment by DR.henne...@gmail.com
on 12 Dec 2014 at 11:31
Again our team did not know the link was broken so thanks for the heads up. We
are slowly reposting older files.
Here is a link to VMR-MDK009j.sh
http://www.datafilehost.com/d/ec0c478c
However check here again in a week or two we are testing x version as we speak. And this can work just not on every router. If the router gives up some pins then stops and then when hit with mdk3 again provides pins the router is susceptible to this approach. Pay no attention to the locked state just test the router for pin harvesting.
Adjust the -r x:y mdk3 time and pause times. To much mdk3 can bury these routers.
Musket Teams
Original comment by muskette...@gmail.com
on 12 Dec 2014 at 12:38
One correction to the above we find mdk3 time in the 10 to 20 sec range many times freezes the router just enough to allow pin collection while 30 to 45 second buries some routers
MTeams
Original comment by muskette...@gmail.com
on 12 Dec 2014 at 12:41
The link to varmacreaversav99-3.sh is listed below. The program is not meant to
break routers when the router is in a locked state.
http://www.datafilehost.com/d/88864143
Original comment by muskette...@gmail.com
on 12 Dec 2014 at 1:00
Great job! tell me if these scripts Musket Teams replace:
atrophy.sh
ReVdK3-r2.sh
ryreaver-reverse.sh
FrankenScript2
thanks you!
Original comment by deltomaf...@gmail.com
on 13 Dec 2014 at 8:53
The VMR-MDK009 was written to take advantage of a small subset of routers
which show a locked WPS state BUT still provide a small number of pins.
Atrophy was written by us BUT it was an attempt to reset a router thus
unlocking the WPS system. We never had much luck with this approach and
abandoned the idea as impracticable in our areas of operation.
To our knowledge ReVdK3-r2.sh and FrankenScript2 also attempts to reset the
router thus unlocking the WPS system,
We are not sure where to place ryreaver-reverse.sh It doesnot save its work
so testing it is difficult. It is on our list of things to do. It also
seems to only work with i386 version of kali-linux. We hoped the author
would finish the work but that has not happened
We are about to release VMR-MDK009x.sh just as soon as we can get all
the help files and configuration files cleaned up. The program itself has
been tested and ready to go. Maybe a week or two.
We are also hoping someone will code in pixie-dust so we can play with
this approach at the field level.
We have seen some interesting results with our 99:99% reaver replay
attack and are running test as we speak. If the results are positive we
will publish said results. We know the 99.99% works so we are now trying to
induce it in WPS locked routers.
MTeams
Original comment by muskette...@gmail.com
on 14 Dec 2014 at 12:42
Musket Teams wish to RETRACT the following statement concerning the inability
of ryreaver-reverse to save sessions and provide the solution.
Using Kali-linux1.09a i386 Hardrive install
Placing ryreaver-reverse in root
Run
./ryreaver-reverse -i mon0 -c 11 -b 55:44:33:22:11:00 -vv -x 60
--mac=00:11:22:33:44:55 --session=55:44:33:22:11:00
In this case the --session= command will look for the existance of a file named
55:44:33:22:11:00 in root. If no file name seen it will write a file of same
name.
On restart if file seen in root it will state:
Restored previous session and start the attack from the last pin.
MTeams
Original comment by muskette...@gmail.com
on 15 Dec 2014 at 1:30
[deleted comment]
For using script had to change the Eterm by xterm and remove --cmod parameter,
and worked correctly on my Debian Jessie. The question is where is saved the
session Reaver? When finished cycles what happens?
Original comment by deltomaf...@gmail.com
on 16 Dec 2014 at 12:52
The program writes a log file of the reaver screen output in the VARMAC_LOG
folder which is made at program start.
You should find three(3) folders
VARMAC_LOGS
VARMAC_CONFIG
VARMAC_WASH
You might just try installing Eterm. Better yet just make a persistent usb
install of kali-1.09a.
The --cmod is just an easy way to remove all the crazy ant screens Eterms
uses that take you back to the 60,s
Original comment by muskette...@gmail.com
on 16 Dec 2014 at 1:11
yes, i install Eterm still did not process anything. with Xterm is going well!
just like find way to force xterm to open in workspace 2 or 1 not in active
workspace, i am studying this with devilspie. VARMAC_WASH not find here. if I
cancel the script restore session?
Original comment by deltomaf...@gmail.com
on 16 Dec 2014 at 2:59
There is any invalid parameter on the ifconfig line. Always occurs the output:
Assigning a random mac address to wlan0.
Current MAC: 5e:bd:82:f4:1f:b8 (unknown)
Permanent MAC: 00:16:44:13:0f:61 (LITE-ON Technology Corp.)
New MAC: 26:55:d5:ad:77:42 (unknown)
Usage:
ifconfig [-a] [-v] [-s] <interface> [[<AF>] <address>]
[add <endereço>[/<tam_prefixo>]]
[del <endereço>[/<tam_prefixo>]]
[[-]broadcast [<endereço>]] [[-]pointopoint [<endereço>]]
[netmask <endereço>] [dstaddr <endereço>] [tunnel <endereço>]
[outfill <NN>] [keepalive <NN>]
[hw <HW> <endereço>] [metric <NN>] [mtu <NN>]
[[-]trailers] [[-]arp] [[-]allmulti]
[multicast] [[-]promisc]
[mem_start <NN>] [io_addr <NN>] [irq <NN>] [media <tipo>]
[txqueuelen <NN>]
[[-]dynamic]
[up|down] ...
<HW>=Tipo de Hardware.
Lista dos tipos possíveis de hardware:
loop (Loopback Local) slip (SLIP) cslip (SLIP VJ)
slip6 (SLIP 6 bits) cslip6 (SLIP VJ 6 bits) adaptive (SLIP Adaptativo)
ash (Ash) ether (Ethernet) ax25 (AX.25 AMPR)
netrom (NET/ROM AMPR) rose (AMPR ROSE) tunnel (Túnel IPIP)
ppp (Protocolo Ponto-a-Ponto) hdlc ((Cisco)-HDLC) lapb (LAPB)
arcnet (ARCnet) dlci (Frame Relay DLCI) frad (FRAD - Dispositivo de Acesso a Frame Relay)
sit (IPv6 sobre IPv4) fddi (FDDI - Fibra Ótica) hippi (HIPPI)
irda (IrLAP) ec (Econet) x25 (generic X.25)
eui64 (Generic EUI-64)
<AF>=Família de endereços. Default: inet
Lista de famílias de endereços possíveis:
unix (UNIX Domain) inet (DARPA Internet) inet6 (IPv6)
ax25 (AX.25 AMPR) netrom (NET/ROM AMPR) rose (AMPR ROSE)
ipx (Novell IPX) ddp (Appletalk DDP) ec (Econet)
ash (Ash) x25 (CCITT X.25)
Assigning wlan0 mac address to mon0.
GNU MAC Changer
Original comment by deltomaf...@gmail.com
on 16 Dec 2014 at 4:57
Gives the output of ifconfig but it is working!
Original comment by deltomaf...@gmail.com
on 16 Dec 2014 at 7:32
First the program was written using kali-linux1-09a which was updated and
upgraded.
There are approx 10 to 20 ifconfig commands used to spoof and add random mac
addresses to wlan0 mon0 mon1 and mon2. Also there is a rather convuluted
process to circumvent the neg one issue. Reaver also relies on these random,
spoofed mac addresses.
The spoofed mac address can be seen in the program menu when reaver stage one and two is running. You might just type ifconfig in a terminal window while stage one or two reaver is running and see if the mac in the terminal window theu ifconfig is the same as shown in the program menu. It they are different mac addresses seen reaver probably will not run.
All these processes work fine in kali-linux
Original comment by muskette...@gmail.com
on 17 Dec 2014 at 9:55
the reaver was not automatically reload a previous session when the reaver
stage begins, installed Reaver version 1.5 resolved!
Original comment by deltomaf...@gmail.com
on 18 Dec 2014 at 11:59
The following VMR-MDK009x2.sh has been written to take advantage of a flaw in
some WPS locked routers allowing the collection of pins even though reaver and
wash show the router is locked.
The downloaded includes extensive helpfiles and has been tested against
numerous routers showing this flaw. All were cracked.
Also included in the help files is how to handle the 99.99% problem which
occurs in almost half of the successful attacks against routers providing small
numbers of pins when the WPS system is locked. Details are also included
in the help files.
Download the zip package at
http://www.datafilehost.com/d/b6af2928
MusketTeams
Original comment by muskette...@gmail.com
on 7 Jan 2015 at 12:04
Reference the download VMR-MDK009x2.sh above
We have found an error in one configuration file named:
configfiledetailed1x2
You can REM/COMMENT out with a # the following two(2) variables
USE_PIN1= should read #USE_PIN1=
WPS_PIN1= should read #WPS_PIN1=
or you can download the corrected version
New Download
http://www.datafilehost.com/d/18156813
Musket Teams
Original comment by muskette...@gmail.com
on 8 Jan 2015 at 12:18
[deleted comment]
The program was written in kali-linux 1-09a. We downloaded the file and
checked it and it ran fine. Go to the bottom of the thread and download
the latest but this should no affect that part of the program. Give us more
info and maybe we can help you.
MTeams
Original comment by muskette...@gmail.com
on 27 Jan 2015 at 9:06
This program requires awk and maybe gawk be installed in your linux distro
Original comment by muskette...@gmail.com
on 31 Jan 2015 at 3:00
Hi, can you pls explain step by step how to use it. I downloaded the latest
version but i don't know which file to run. I run a file called VMR-MDK009y2.sh
and i follow what the option says there, but at the end i don't quite
understand what is doing, it seems like its associating with the AP but i don't
see it trying pins.
Original comment by 00ReMeD...@gmail.com
on 10 Feb 2015 at 7:26
Hi muskett do you know if this will run in xiaopan? So. Some scaled down
syndrome version of Linux?
Original comment by phraze2a...@gmail.com
on 19 Feb 2015 at 9:29
How do I run the scripts :P Im new.
I have kali linux
Thank you !
Original comment by fraf...@gmail.com
on 25 Feb 2015 at 9:41
Hey Musket Team, I have a couple of suggestions / errors i want to mention for
the betterment of the future program. First, the Random mac assigned to wlanX
and monX do not work as in every time reaver tries to connect to a router using
the random mac assigned, it gives an error of "WARNING: Failed to associate
with XX:XX:XX:XX:XX:XX". I've always encountered this problem when i try to
assign a random mac manually and using reaver or even when using ReVdK3-r2.sh,
which also contained random mac assign. I took the time and edit some lines in
ReVdK3 so it does not assign random macs, and everything works perfect, which
is the closest i got to cracking a router that experiences WPS lock. I'm
willing to try and test your program but first, please add the option if the
user wants to change the mac to random or not. And about the error part (I
don't know if this is because my reaver does not even advance into the first
pin because of random mac error i mentioned or if its just a program error) but
it mentions "Reading VARMAC_LOGS/"Essid Name"-150306-20:47-00005: No Such File
or directory". Ive used the "VMR-MDK009y2.sh" with Bash command to start it.
The additional file I've used was "configfiledetailed1x2". My wireless stick is
"TP-Link TL-WN321G". My OS is "kali-linux-1.0.6-amd64". Thanks in advance.
-Killz
Original comment by killzal...@gmail.com
on 7 Mar 2015 at 2:07
compatible with kali 1.10?
Original comment by deltomaf...@gmail.com
on 20 Mar 2015 at 12:23
VMR-MDK009 not compatible with new version aircrack 1.2.RC2. Airmon-ng create
wlan0mon and phy0, script not work.
Original comment by deltomaf...@gmail.com
on 6 Jun 2015 at 11:13
Musket Teams have voted to release the following WPS Locked Intrusion Script
for General Use:
Included in the VMR-MDK.zip file
1. mdk3-v6 folder
2. configfiledetailed
3. Help Files VMR-MDK011x8.txt
4. PDDSA-06.sh
5. VMR-MDK-11x8.sh
You can download at:
http://www.datafilehost.com/d/b7e4b1d9
This program contains it own airmon-ng therefore the newer version of aircrack-ng does not affect this script. The script has been tested in and written for the kali-linux 1.10a environment.
There are several dependencies to include a modded reaver and pixiewps1.1
Addresses for download of these packages and their dependencies are given in
the help file. Instructions for installation are found within the reaver and
pixiewps1.1 packages.
A new mdk3 attack called Invalid SSID is included in the VMR-MDK.zip download package. Instructions for install are included:
Musket Teams
Original comment by muskette...@gmail.com
on 1 Aug 2015 at 4:19
[deleted comment]
cool thanks for support!
Original comment by deltomaf...@gmail.com
on 7 Aug 2015 at 12:15
This script is made in the kali-linux 1.1-0a i386 enviornment
The only bug we can find so far was that if the user made a monitor with the newer airmon-ng ie wlan0mon etc the user needs to manually remove it thru the terminal window:
airmon-ng stop wlan0mon
before you the run VMR-MDK program.
As we mention in the help files the new airmon-ng limits the number of virtual monitors made against a specific device.
Original comment by muskette...@gmail.com
on 11 Aug 2015 at 1:35
Original issue reported on code.google.com by
muskette...@gmail.com
on 1 Nov 2014 at 11:06