WPS Pixie Dust Attack (Offline WPS Attack)

[frafri]

awesome, keep it up guys. I am hoping to become a tester for the script

[wiire]

@soxrok2212
First of all, thank you for your time and effort.

I have been looking by myself about all 'this' but there's something I can't seem to undestand just yet.

On the pdf slides (pag. 24) there's written:
- Upon reception of M1 the Registrar generates PKR and N2
- The Registrar can then compute the DHKey: DHKey= SHA-256 (zeropad(g^{AB} mod p, 192))

DHKey is needed in order to get AuthKey which is used as key of the HMAC-SHA-256 (for both E-Hash1 and E-Hash2).

How is the DHKey actually calculated? Could you make an example? How do we know A?

Sorry if I am missing something.

I know a little C, not enough to develop a modified version of reaver but hopefully enough to help testing or making some PoC kinda code.
I also have a capture of a TP-LINK router which is apparently Ralink, so ES1 = ES2 = 0, right?

Thank you again.

[soxrok2212]

@soxrok2212
First of all, thank you for your time and effort.

I have been looking by myself about all 'this' but there's something I can't seem to undestand just yet.

On the pdf slides (pag. 24) there's written:
- Upon reception of M1 the Registrar generates PKR and N2
- The Registrar can then compute the DHKey: DHKey= SHA-256 (zeropad(g^{AB} mod p, 192))

DHKey is needed in order to get AuthKey which is used as key of the HMAC-SHA-256 (for both E-Hash1 and E-Hash2).

How is the DHKey actually calculated? Could you make an example? How do we know A?

Sorry if I am missing something.

I know a little C, not enough to develop a modified version of reaver but hopefully enough to help testing or making some PoC kinda code.
I also have a capture of a TP-LINK router which is apparently Ralink, so ES1 = ES2 = 0, right?

Thank you again.

The math behind calculating the DH Keys is not important, only the actual PKE, PKR and Public keys are. I will explain though.

So we have the formula g^AB mod p right? In here, both g and p are "variables" (the generator and prime modulus). These two variables are agreed upon by the Registrar (Access Point) and Enrollee (Client) before the WPS transaction starts. However, A and B are different. They are secret numbers known only by the Enrollee and Registrar respectively (PKE knows A, PKR knows B, they don't know each other's secret numbers). Now, both the Enrollee and the Registrar will will run their secret numbers through the generator (PKE > g^A mod p, PKR > g^b mod p).

Now that that each side has generated a new "public" number with their secret number, they exchange and run a new function (in this case we'll call Ca the PKE public number and Cb the PRK public number). The Enrollee runs: g^ACb mod p, and the Registrar runs: g&BCa mod p.

There is a full version of the video on youtube, just google Diffle-Hellman Key Exchange and click the youtube link... its by Art of the Problem. I'd post it but we can't post youtube links. Hopefully that makes sense.

The TP-Link router may be vulnerable, but I can't say for sure. I've never done testing. It is likely that it is but until there is a tool I can't say for sure. You could try looking in the source but you may not find a certain answer there. Good luck!

[kcdtv]

@ qolund
Hello