Pentest Vista WLAN with airbase-ng

[pho_bos]

Hello,

while doing a pentest against Windows Vista SP1 I tried to get connected via WLAN to a Station which is in the LAN an has WLAN switched on. Is there a possible way to get airbase-ng connect to any SSID configured on the Vista machine with the auto-connect feature enabled. Tried several options like -P an -0 but with no luck.

Is there a need to patch the drivers when using airbase-ng like in karma or is there a way to use karma on Backtrack 4 by patching die madwifi drivers with karma and diginija extensions.

The goal of the pentest is to connect to a wide range of Clients in the LAN with WLAN enabled to do further penting on the client and use them as "bridge" to the LAN.

Thanks

phobos

[brtw2003]

Hi,

not 100% sure what you are writing, little bit confusing. Concerning Vista : Connecting to non-broadcast wireless networks in Windows Vista
So the 'karma-style' attack works as long the wlan-client is looking (broadcasting) for his known/configured SSID-list (e.g. wireless zero config looks through the saved configuration profiles in a sequential order).

BT4 is working fine to play the role of a fake access point, read through the forum, there are dozens of threads concerning setting up a this kind of rogue AP (incl. ready-to-go shell scripts).
If you wanna setup something more reliable, I'd recommend Jasager/Karma on the fon
good reference can be found in this thread: http://www.backtrack-linux.org/forum...ve-looked.html

Airbase-ng/aircrack-ng is not running on Vista, besides you have the commercial AirPcap drivers/hardware ;-)


/brtw2003

[xX_Spiidey_Xx]

Is there a possible way to get airbase-ng connect to any SSID configured on the Vista machine with the auto-connect feature enabled. Tried several options like -P an -0 but with no luck.

this sounds to be like you're trying to use a fake ap to connect to other aps, which afaik cannot be done using airbase-ng.

check the wiki page @ airbase-ng [Aircrack-ng]

-M MITM Attack

This option is not implemented yet. It is a man-in-the-middle attack between specified clients and BSSIDs.