Implement PMKID attack with aircrack

[dibiex]

Hello i've been trying to integrate in wifite the PMKID attack using the aircrack suite. This will eliminate the Hashcat, HcxDumpTool, HcxPcapTool dependencies being used right now in the pmkid attack. A problem that appears is that I don't know how to trigger the M1 message, where the pmkid is located, using aircrack.

Any suggestions?

[kimocoder]

M1 messages? This might be something @rofl0r may point you too.

[rofl0r]

i've been using https://github.com/rofl0r/wpakey to send a wrong password, but the tool doesnt support all routers yet (those that use TKIP, to be precise). you might have to use wpa_supplicant for those, but that requires to leave monitor mode...

[kimocoder]

@dixi3 this issue has been resolved. please close it :+1: thanks

[rofl0r]

@kimocoder link to commit pls ?

[kimocoder]

@rofl0r ref. https://github.com/aircrack-ng/aircrack-ng/issues/1937

It can read (bruteforce hashes), but it isn't a pure attack vector so to speak..

wifite2 removed hashcat as a dependency and stick with aircrack, since hashcat doesn't support to many mobile devices and other development boards

[rofl0r]

@kimocoder so there's still no complete attack to get M1 containing the PMKID ? (as wpakey still doesn't support TKIP)

[kimocoder]

M1..M2.. M4.. not really mye street 😏 sorry, never had time to lea... :+1:

[rofl0r]

well i mean whether there's now an "attack that gets you the PMKID", without having to deassociate clients and waiting for their handshake, just like e.g. when you send a bogus password with wpakey (but including routers using TKIP).

[kimocoder]

here's the commits from it was added, and extended/improved (https://github.com/derv82/wifite2/search?p=1&q=PMKID&type=Commits)

The attack (as it is in wifite at least, is similar to WPA handshake more or less :+1:

Find me at Telegram, https://t.me/kimocoder if your using it, got some reaver/bully stuff on my mind :+1:

[RaduNico]

@rofl0r as of now there is still no way to get the M1 message from a AP by using aircrack.

Right now aircrack supports cracking PMKID hashes (not yet implemented in wifite with aircrack - just with hashcat), detecting PMKID in capture files (implementing this in wifite would fix #218 ), but not retrieving the M1 without a client. I've created an issue regarding this here aircrack-ng/aircrack-ng#1981.

hcxdumptool however does attack APs trying to retrieve the PMKID. There could be some interesting speedups for wifite if we would give up trying the PMKID attack after a number of M1 are received (ZerBea noted that sometimes the first M1 could have a zeroed out PMKID field), or if we try both the handshake attack along with the PMKID attack. I haven't tested yet but I believe hcxdumptool tries to do them both at the same time.

[rofl0r]

@rofl0r as of now there is still no way to get the M1 message from a AP by using aircrack.

thanks for clarification.

Right now aircrack supports cracking PMKID hashes (not yet implemented in wifite with aircrack - just with hashcat)

one could also use john the ripper, which (unlike hashcat) can be built without opencl (i.e. CPU-only): wpapcap2john and john itself support PMKID since roughly one week after the attack was discovered.

ZerBea noted that sometimes the first M1 could have a zeroed out PMKID field

that sounds like a bug in the tools zerbea uses. i don't see any good reason why this would happen (especially that it would suddenly work on the second try). i've been able to get the PMKID on first try with wpakey on all affected router models using AES-CCMP instead of TKIP (the majority).

[RaduNico]

ZerBea is the developer of hcxdumptool which wifite currently uses. The original discussion is here https://github.com/aircrack-ng/aircrack-ng/issues/1937:

Also RSN-IE doesn't have a fixed len and some ap's deliver a zeroed PMKID on the first connect attempt.

It it something that access points seem to do, no idea why.

ne could also use john the ripper, which (unlike hashcat) can be built without opencl (i.e. CPU-only): wpapcap2john and john itself support PMKID since roughly one week after the attack was discovered.

Both aircrack and john can be used to attack PMKIDs and should be integrated to do so at some point. Hashcat can be a bit of a pain to install correctly (and outright not doable on some devices) despite way more powerful in terms of hashes/second.

[kimocoder]

@ZerBea @aircrack-ng me and another if ZerBea's guy Alex has a dialog per mail. We suggest @rofl0r you join into the communication :1st_place_medal:

@rofl0r mail me at christian@aircrack-ng.org and tag along us

Bet we all may learn something from it :+1:

[rofl0r]

despite way more powerful in terms of hashes/second.

that's a myth. john the ripper's WPA2 CPU code is roughly 5% faster than hashcat in CPU mode, at least last time i checked. there's a reason aircrack-ng stole john's WPA cracking code, not hashcat's. :)

@rofl0r mail me

sorry, i'm neither into email nor proprietary-webchat-platform-of-the-day. we can meetup on IRC though.

[kimocoder]

Freenode? And channel or Nick then

[rofl0r]

Freenode #pmkid