search

Koala633 / hostbase

A Python and ruby script to automate rogue AP process
GNU General Public License v3.0
51 stars 12 forks source link

"Victim" not getting an IP #2

Closed Mrtlsn64r02a662n closed 7 years ago

Mrtlsn64r02a662n commented 7 years ago

Hi Koala, i'm running hostbase on my fresh Kali 2016.2 hard-disk installation. It runs on an IBM ThinkPad with dual boot Windows7 + Kali2016.2 When i launch hostbase everything seems starting fine but when i try to connect to the fakeAp using my Android smartphone is not able to get an ip. I'm trying 2 attacks: 1) Airbase + Wep 2) Hostapd + Wps button and in both cases the smartphone can't get an ip. I also add that running another penetration testing tool (Airgeddon) the IP is assigned with no problem, so i think that the DHCP server is fine.

Koala633 commented 7 years ago

Hi, i saw that, it was because this line 447 was wrong on dhcp interface wlan0; instead of interface ${myinterfacevariable}

Sorry for that, try it again and it will work

Mrtlsn64r02a662n commented 7 years ago

Thanks Koala, i changed that line but still no ip... I think inside the script there are some errors in regard of dhcpd.conf file: often it is referenced as /etc/dhcpd.conf instead of /etc/dhcp/dhcpd.conf I have tryed to fix them but still no ip: i do not see the message which says that Dhcp is starting.. I'm running Airbase+Wep attack.

Koala633 commented 7 years ago

You don't need to use dhcp with airbase+wep attack, the cafe-latte attack not need a dhcp.If you don't get an IP with this attack it's normal, airbase will not give you an ip because it's a cafe-latte attack

Mrtlsn64r02a662n commented 7 years ago

Ok, it's not mandatory to get an IP, BUT i think it would help to increase sensibly the number of IV , making easier to crack the password. I've made some test and i saw that the IV number does not increase enough to crack the password, so i think that giving the victim an IP should help.

2017-05-02 6:27 GMT+02:00 Koala633 notifications@github.com:

You don't need to use dhcp with airbase+wep attack, the cafe-latte attack not need a dhcp.If you don't get an IP with this attack it's normal, airbase will not give you an ip because it's a cafe-latte attack

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/Koala633/hostbase/issues/2#issuecomment-298494539, or mute the thread https://github.com/notifications/unsubscribe-auth/Aa8YGmBsAeXzbPIt_j21Nsu637mkyN4Qks5r1rC0gaJpZM4NM5tL .

Koala633 commented 7 years ago

I've made some test and i saw that the IV number does not increase enough to crack the password, so i think that giving the victim an IP should help.

Yes but i try it, i experimented a lot of segmentation error, i think it's not possible to give an IP when airbase is acting for -L (cafe-late) or -N (hirte attack). About the IVS all depend on wich windows is used for the test, for example with windows 7 ivs increase very slowly and can stop sometines but with win 10 it's quickly.If IVS doesn't increase apply kill airbase and leave the script then relaunch airbase on another console without leave airodump-ng , that will force the victim to conenct again when the network appear and generate some IVS more, each IVS is also generated when the victim open his browser.Also you can try the -N -W 1 option with airbase (hirte-attack) and see if it is better or not.In this case let me konw what happen.On my win10 the -N doesn't work well so i put the -L (cafe-latte) on the script.

Mrtlsn64r02a662n commented 7 years ago

Hi, this is what i have done this morning, always working from cmd line (not using the script), running Kali inside VMWare Player under Win7 and using my Android smartphone as client:

1) setup and started Dhcp server then started a "simple" Airbase (no Wep, no cafelatte, no hirte): the client got the Ip immediately. Reboot to clear everything.

2) setup and started Dhcp server then started Airbase -L -W 1 : the client got NO Ip; the IVS shown in Airodump increased slowly. Reboot to clear everything.

3) setup and started Dhcp server then started Airbase -N -W 1: the client got no ip BUT in Airbase window a message appeared saying: "Starting Hirte attack against ...." and the IV's shown in Airodump increased very very FAST (about 4000 IV in 10 seconds) !!! Then I connected to the same AP my Windows7 PC instead of Android: in this case IVs increase was slow.

So, looking at all this, can I modify your script using "Airbase -N" instead of "Airbase -L" or the script works only with Cafe-latte attack ?

2017-05-03 0:04 GMT+02:00 Koala633 notifications@github.com:

I've made some test and i saw that the IV number does not increase enough to crack the password, so i think that giving the victim an IP should help.

Yes but i try it, but i experimented a lot of segmentation error, i think it's not possible to give an IP when airbase is acting for -L (cafe-late) or -N (hirte attack). About the IVS all depend on wich windows is used for the test, for example with windows 7 ivs increase very slowly and can stop sometines but with win 10 it's quickly.If IVS doesn't increase apply kill airbase and leave the script then relaunch airbase on another console without leave airodump-ng , that will force the victim to conenct again when the network appear and generate some IVS more, each IVS is also generated when the victim open his browser.Also you can try the -N -W 1 option with airbase (hirte-attack) and see if it is better or not.In this case let me konw what happen.On my win10 the -N doesn't work well so i put the -L (cafe-latte) on the script.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/Koala633/hostbase/issues/2#issuecomment-298774949, or mute the thread https://github.com/notifications/unsubscribe-auth/Aa8YGg1the2LCMMRXbV3kbQqxTjntSgZks5r16hrgaJpZM4NM5tL .

Koala633 commented 7 years ago

So, looking at all this, can I modify your script using "Airbase -N" instead of "Airbase -L" or the script works only with Cafe-latte attack ?

Of course you can, it is open source.Yes i put the -L option instead of the -N option because win10 work great with the -L option, the -N is more like for win7.

kcdtv commented 7 years ago

Ok, it's not mandatory to get an IP, BUT i think it would help to increase sensibly the number of IV , making easier to crack the password.

It is not you who gets an IP. But you are the one who would have to attribute one IP to the WEP client (the victim) The thing is that you need to decipher first the key he uses to use the same for doing a correct ipv4 negotiation. Correct me if I am wrong, but I would say that you need the key you search for to attribute a correct IP. And so I don't see a way to bypass this...