Open GoogleCodeExporter opened 9 years ago
You will find that pin harvesting ?MAY? eventually start even though the router
is showing a locked state. This will proceed for a period and then stop. We
suggest 300 to 500 seconds as a reaver live time setting. Keep the mdk3 live
time low at first around 30 to 45 seconds. If you run it too long the router
disappears or freezes but does not reset.
7. The router may jump channels so you could set the channel to 0 (i.e. zero) in the maclistreavermdk config file. This will cause reaver to channel hop till it finds the target.
Before running the script open the maclistreavermdk file with a text editor like leafpad and enter the information required. There is help embedded in this file for each entry.
If you place both files in root you can just run the script and watch it for a while to get the sequence of events. You will need to plug in a wifi device supporting packet injection or the script will not run.
You can monitor the attack and fine tune the settings as the program is running. Just open the maclistreavermdk file, adjust the setting and save the file. At the end of each run this configuration file is reloaded whereupon these new settings take effect.
We wish to Thank the following kali-linuc forum members soxrox2212 for starting this adventure., Wn722 for the vision of this attack and for shoving our collective heads back into the WPS rabbit hole again. And the author of auto-reaver for the valuable reaver suggestions provided.
Original comment by muskette...@gmail.com
on 1 Nov 2014 at 11:39
[deleted comment]
Musket Teams have released the latest WPS intrusion device.
For details go to:
http://www.kalilinux.net/community/threads/new-wps-locked-intrusion-script-using-reaver-mdk3-and-wash.1599/
Download VMR-MDK009.zip at
http://www.axifile.com/en/5C34EBC933
MTeams
Original comment by muskette...@gmail.com
on 15 Nov 2014 at 5:56
All the links appear to be dead, but this thread is quite current - what gives?
I'm concerned, because this is great work!
Original comment by velkrosm...@gmail.com
on 3 Dec 2014 at 12:24
All the links appear to be dead, but this thread is quite current - what gives?
I'm concerned, because this is great work!
Original comment by velkrosm...@gmail.com
on 3 Dec 2014 at 12:24
First thanx for the heads up. We are trying to find another site to host
these files. Furthermore we have a VAR-MDK009x.sh about ready for release.
We will send you a copy directly when completed.
If you have any ideas about places to post these files please suggest.
MTeams
Original comment by muskette...@gmail.com
on 12 Dec 2014 at 11:24
I could put these on my mega upload account and share the link here. I also
have a few Google drive accounts I could use.
I just need the 3 downloads first! Please email to Dr.hennessey1@gmail.com
Thank you!
Original comment by DR.henne...@gmail.com
on 12 Dec 2014 at 11:31
Again our team did not know the link was broken so thanks for the heads up. We
are slowly reposting older files.
Here is a link to VMR-MDK009j.sh
http://www.datafilehost.com/d/ec0c478c
However check here again in a week or two we are testing x version as we speak. And this can work just not on every router. If the router gives up some pins then stops and then when hit with mdk3 again provides pins the router is susceptible to this approach. Pay no attention to the locked state just test the router for pin harvesting.
Adjust the -r x:y mdk3 time and pause times. To much mdk3 can bury these routers.
Musket Teams
Original comment by muskette...@gmail.com
on 12 Dec 2014 at 12:38
One correction to the above we find mdk3 time in the 10 to 20 sec range many times freezes the router just enough to allow pin collection while 30 to 45 second buries some routers
MTeams
Original comment by muskette...@gmail.com
on 12 Dec 2014 at 12:41
The link to varmacreaversav99-3.sh is listed below. The program is not meant to
break routers when the router is in a locked state.
http://www.datafilehost.com/d/88864143
Original comment by muskette...@gmail.com
on 12 Dec 2014 at 1:00
Great job! tell me if these scripts Musket Teams replace:
atrophy.sh
ReVdK3-r2.sh
ryreaver-reverse.sh
FrankenScript2
thanks you!
Original comment by deltomaf...@gmail.com
on 13 Dec 2014 at 8:53
The VMR-MDK009 was written to take advantage of a small subset of routers
which show a locked WPS state BUT still provide a small number of pins.
Atrophy was written by us BUT it was an attempt to reset a router thus
unlocking the WPS system. We never had much luck with this approach and
abandoned the idea as impracticable in our areas of operation.
To our knowledge ReVdK3-r2.sh and FrankenScript2 also attempts to reset the
router thus unlocking the WPS system,
We are not sure where to place ryreaver-reverse.sh It doesnot save its work
so testing it is difficult. It is on our list of things to do. It also
seems to only work with i386 version of kali-linux. We hoped the author
would finish the work but that has not happened
We are about to release VMR-MDK009x.sh just as soon as we can get all
the help files and configuration files cleaned up. The program itself has
been tested and ready to go. Maybe a week or two.
We are also hoping someone will code in pixie-dust so we can play with
this approach at the field level.
We have seen some interesting results with our 99:99% reaver replay
attack and are running test as we speak. If the results are positive we
will publish said results. We know the 99.99% works so we are now trying to
induce it in WPS locked routers.
MTeams
Original comment by muskette...@gmail.com
on 14 Dec 2014 at 12:42
Musket Teams wish to RETRACT the following statement concerning the inability
of ryreaver-reverse to save sessions and provide the solution.
Using Kali-linux1.09a i386 Hardrive install
Placing ryreaver-reverse in root
Run
./ryreaver-reverse -i mon0 -c 11 -b 55:44:33:22:11:00 -vv -x 60
--mac=00:11:22:33:44:55 --session=55:44:33:22:11:00
In this case the --session= command will look for the existance of a file named
55:44:33:22:11:00 in root. If no file name seen it will write a file of same
name.
On restart if file seen in root it will state:
Restored previous session and start the attack from the last pin.
MTeams
Original comment by muskette...@gmail.com
on 15 Dec 2014 at 1:30
[deleted comment]
For using script had to change the Eterm by xterm and remove --cmod parameter,
and worked correctly on my Debian Jessie. The question is where is saved the
session Reaver? When finished cycles what happens?
Original comment by deltomaf...@gmail.com
on 16 Dec 2014 at 12:52
The program writes a log file of the reaver screen output in the VARMAC_LOG
folder which is made at program start.
You should find three(3) folders
VARMAC_LOGS
VARMAC_CONFIG
VARMAC_WASH
You might just try installing Eterm. Better yet just make a persistent usb
install of kali-1.09a.
The --cmod is just an easy way to remove all the crazy ant screens Eterms
uses that take you back to the 60,s
Original comment by muskette...@gmail.com
on 16 Dec 2014 at 1:11
yes, i install Eterm still did not process anything. with Xterm is going well!
just like find way to force xterm to open in workspace 2 or 1 not in active
workspace, i am studying this with devilspie. VARMAC_WASH not find here. if I
cancel the script restore session?
Original comment by deltomaf...@gmail.com
on 16 Dec 2014 at 2:59
Original issue reported on code.google.com by
muskette...@gmail.com
on 1 Nov 2014 at 11:06