HOWTO : Protect from being attacked by PMKID attack

On Aug 04, 2018, the developer of hashcat discovers a new way to attack WPA/WPA2 Wifi, namely PMKID attacks, when he is going to find a new way to attack new WPA3. This attack requires no Wifi user attached to the Wifi router and no need 4-way handshake. Meanwhile, almost all modern Wifi routers are vulnerable to this attack.

I conducted a quick test on my living area recently and found all Wifi routers (including mine) are vulnerable to this attack. If working with hashcat and/or good dictionaries properly, the WPA PSK (pre-Shared Key) password can be obtained without any problem.

Comes to the conclusion, WPA2 is no longer safe!

However, we can protect our Wifi by following methods :

(1) Make the WPA PSK password as complex and as long as possible (mine is 26 characters long);
(2) Make sure the WPA PSK password cannot be found in the available dictionaries (such as rockyou);
(3) Make sure your Wifi router can prevent ARP spoofing (Address Resolution Protocol) or apply MAC address filtering when possible;
(4) If possible, change your WPA PSK password at least once a month; and
(5) Keep your Wifi signal as weak as possible. Yes, makes it as weak as possible.

Reference

[1] New attack on WPA/WPA2 using PMKID
[2] Youtube PMKID attack Demo

That's all! See you.

HOWTO : nVidia and HashCat on Kali Linux 2018.4

CPU : Intel i7-8750H (6-core with HyperThreading and Graphic Display)
Extra Graphic Display : nVidia GTX 1060 (laptop)

There are two display graphic cards on the same system, namely Optimus on laptop. The installation of nVidia display driver on Kali Linux 2018.4 is difference to Ubuntu 18.04.1 on the same system. You can refer to the link here for Ubuntu 18.04.1 even they are using the same version of nVidia display driver - Version 390.87 at the time of this writing.

Step 1 :

apt updaate
apt install nvidia-kernel-dkms primus bumblebee bbswitch-dkms nvidia-smi

Step 2 :

Reboot the system.

To confirm the installation.

nvidia-smi

Step 3 :

Install HashCat which does not require CUDA.

apt install hashcat-nvidia

Step 4 (optional) :

To install CUDA.

apt install nvidia-cuda-toolkit

To run program that requires CUDA.

bumblebeed --daemon
optirun [program]

That's all! See you.

HOWTO : Wifi Penetration Testing Without Tears

Wifi everywhere! There are a lot of private and public wifi access points around you. Almost everyone will use wifi at anytime. The security of wifi should be taken into account.

The most common wifi frequencies are 2.4GHz and 5GHz at the time of this writing. 2.4GHz frequency channel range is between 1 and 14 while 5GHz frequency channel range is between 34 and 165. That's include a/b/g/n/ac modes.

You can even find some access points still using WEP but it is not common. Almost all access points are using WPA/WPA2. To get passphrase of WEP from access point is very easy. However, WPA/WPA2 is not very hard indeed.

When access point and client communicate, they will carrying out a four-way handshake in which the encrypted passhrase will also be transmitted between them. When attacker captures the four-way handshake, the encrypted passphrase is also captured in which it can get the passphrase by wordlists brute forcing.

To complete the capture steps, you need a tool namely Aircrack-ng. It is a very powerful wifi auditing tool. Furthermore, there is a good tool to brute forcing WPA/WPA2 key, it is Hashcat. Hashcat is very powerful tool for password recovery. Hashcat requires GPU to do the brute forcing job. The more powerful the GPU, the faster the process of brute forcing.

However, to carry out the wifi penetration testing is somehow very hard for some people. It is because it will involve a lot of steps and procedure to complete. In addition, you also need a workable wifi USB dongle or card to make the job done.

Current version of Aircrack-ng 1.2 RC4 does not fully compatible to 5GHz frequency. It is required to patch it and compile it yourself in Kali Linux.

Realtek 8812au chipset wifi USB dongle is ready for 5GHz frequency and penetration testing. The driver is required to compile and install on Kali Linux yourself too.

One of the automated tools for penetration testing wifi is WAIDPS. It also can act as intrusion detection and prevention system for wifi. It just a few keystrokes to complete the wifi penetration testing.





Reference

[1] List of WLAN channels
[2] Kali Linux
[3] Aircrack-ng Official Site
[4] WAIDPS - Wireless Auditing, Intrusion Detection and Prevention System
[5] Install Realtek 8812au Linux Driver
[6] Patch Aircrack-ng For 5GHz Band On Kali Linux 2017.3
[7] Hashcat Official Site
[8] Install Hashcat on Ubuntu 16.04.3
[9] TP-Link Archer T4UHP (Realtek 8812au chipset)
[10] ALFA AWUS036NH (Realtek 8812au chipset)
[11] D-Link DWA-171 Nano USB Adapter (Realtek 8812au chipset)

That's all! See you.

HOWTO : Install HashCat on Ubuntu 16.04.3

hashcat is the world's fastest and most advanced password recovery utility, supporting five unique modes of attack for over 200 highly-optimized hashing algorithms. hashcat currently supports CPUs, GPUs, and other hardware accelerators on Linux, Windows, and macOS, and has facilities to help enable distributed password cracking.




Step 1 :

sudo apt install ocl-icd-libopencl1 git build-essential

mkdir ~/infosec
cd infosec

git clone https://github.com/hashcat/hashcat
cd hashcat
git submodule update --init

make

cd ~/infosec
git clone https://github.com/hashcat/hashcat-utils
cd hashcat-utils/src

make

cp *.bin ../bin

Step 2 :

To crack WPA/WPA2 passphrase, convert cap to hccapx :

If using WAIDPS, copy the "cap" file to "~/infosec" :

cp /.SYWorks/Saved/Handshake_F92A673ED5C2_hihi_StrictFull.cap ~/infosec

cd ~/infosec
hachcat-utils/bin/cap2hccapx.bin Handshake_F92A673ED5C2_hihi_StrictFull.cap hihi.hccapx

If you are using Kali Linux 2017.3, "cap2hccapx.bin" is located at the following :

/usr/lib/hashcat-utils/cap2hccapx.bin

Step 3 :

The following are the example usgaes of hashcat to crack WPA/WPA2 passphrase:

To crack with rockyou dictionary :

cd ~/infosec/hashcat
./hashcat -m 2500 ~/infosec/hihi.hccapx ~/rockyou.txt

To crack up to 8 digits :

./hashcat -m 2500 ~/infosec/hihi.hccapx -a 3 ?d,?d?d?d?d?d?d?d?d --increment-min 1 --increment-max 8 --increment

To crack up to 8 characters for all available characters including space :

./hashcat -m 2500 ~/infosec/hihi.hccapx -a 3 ?a,?a?a?a?a?a?a?a?a --increment-min 1 --increment-max 8 --increment

To crack with rules and rockyou dictionary :

./hashcat -m 2500 -r rules/best64.rule ~/infosec/hihi.hccapx ~/rockyou.txt

The WPA/WPA2 crack on MacBook Pro (Retina Mid 2012 - NVIDIA GeForce GT 650M and Intel HD Graphics 4000) with hashcat required about half an hour for captioned first 2 examples. The third example requires over 305 years to complete on my MacBook Pro. The forth example requires 1 day and 13 hours to complete on my MacBook Pro.

Reference

How to Perform a Mask Attack Using hashcat

That's all! See you.

HOWTO : Hashcat on Ubuntu Desktop 12.04 LTS

hashcat is an advanced password recovery.

Step 1 :

sudo apt-get install p7zip

sudo -sH
cd /opt

wget http://hashcat.net/files/oclHashcat-plus-0.14.7z

p7zip -d oclHashcat-plus-0.14.7z

mv /opt/oclHashcat-plus-0.14 /opt/oclHashcat-plus
cd /opt/oclHashcat-plus

Step 2 :

To run it. If you have nVidia display card and CUDA drivers installed, you can run the example script.

sudo -sH
cd /opt/oclHashcat-plus
./cudaExample0.sh

That's all! See you.