Implement new WPS Pixie Dust Attack into Reaver

Printable View

2014-10-23
six

Implement new WPS Pixie Dust Attack into Reaver

As some of you may have read, another flaw was found in router chip makers implementation of WPS which allows for offline bruteforcing of the 11,000 possible pins, making WPS attacks against some of the biggest router chip makers even faster. The attack is called the Pixie Dust attack and the security researcher showed this at Defcon. I am not a programmer, but having this implemented into Kali 1.1.0 would make pentesting alot easier. One of the affected vendors is Broadcom, and I believe there are more affected. Atheros is unaffected. Tweet from said security researcher https://twitter.com/Reversity/status/506383041502408704
Defcon slides http://www.slideshare.net/0xcite/off...rotected-setup
News articles:http://nakedsecurity.sophos.com/2014...ore-dangerous/
http://threatpost.com/wps-implementa...-attack/108011
http://arstechnica.com/security/2014...ll-vulnerable/
2014-10-25
g0tmi1k

The tool isn't (yet?) public - so it can't be added into Kali.

If/when it is - and you want it part of Reaver and/or any other tools (e.g. aircrack-ng), you'll need to contact them about it.
If you want the authors tool to be added into Kali if/when its release, you'll need to submit a bug report -> https://bugs.kali.org
2014-11-04
soxrok2212

Anyone figure out those magical "couple lines" that need to be added to reaver in order to make this attack work?
2014-11-19
mmusket33

In the meantime you might try ryreaver-reaver. Stands for reverse reaver. It does run in kali-linux regardless of commentary. Unfortunately it doesnot save its work so if you stop the process it starts all over. We downloaded the rar file converted it and ran from root ./ryreaver-reverse. We will do some tests to write the output to text and screen thru tee and Eterm windows and post here when finished.

We suggest you run this program a bit and see if the WPS pin and WPA code drop out.

There are old threads in these forums concerning this program search reverse reaver.

The direct download is:

http://sethioz.com/forum/download/fi...034b82f22693d5

Commentary
http://sethioz.com/forum/viewtopic.php?p=9757
2014-11-19
slim76

Quote:

Originally Posted by mmusket33

In the meantime you might try ryreaver-reaver. Stands for reverse reaver. It does run in kali-linux regardless of commentary. Unfortunately it doesnot save its work so if you stop the process it starts all over. We downloaded the rar file converted it and ran from root ./ryreaver-reverse. We will do some tests to write the output to text and screen thru tee and Eterm windows and post here when finished.

We suggest you run this program a bit and see if the WPS pin and WPA code drop out.

There are old threads in these forums concerning this program search reverse reaver.

The direct download is:

http://sethioz.com/forum/download/fi...034b82f22693d5

Commentary
http://sethioz.com/forum/viewtopic.php?p=9757

It doesn't work for me on kali 109-64bit, I get the following error message:
error while loading shared libraries: libpcap.so.0.8: cannot open shared object file: No such file or directory
2014-11-20
mmusket33

To Slim76
We only have 32 bit. This program works for us. You might try running a kali-linux-1.0.9a-i386 persistent usb install of kali1-09a. We would test it for you if we had a 64 bit computer.

MTeams
2014-11-21
slim76

Quote:

Originally Posted by mmusket33

To Slim76
We only have 32 bit. This program works for us. You might try running a kali-linux-1.0.9a-i386 persistent usb install of kali1-09a. We would test it for you if we had a 64 bit computer.

MTeams

I needed to use my usb device for something so I had to reformat it, I'll setup kali 109-32bit on my usb device again soon and will let you know how it goes.
Many thanks for replying matey.
2014-12-01
wn722

Quote:

Originally Posted by slim76

It doesn't work for me on kali 109-64bit, I get the following error message:
error while loading shared libraries: libpcap.so.0.8: cannot open shared object file: No such file or directory

yup same story.
so what does it do different compared to regular reaver?
2014-12-09
crypts3c

Guys...take some initiative!!!

I have been working on this for awhile. No one seems to want to roll up their sleeves and figure out the details of the flaw Bongard/0xcite presented last September. It's not easy, but I have confirmed the flaw. I will write something...but If there is a hashcat guru around here....please talk to me.
2014-12-09
flyinghaggis

Quote:

Originally Posted by crypts3c

Guys...take some initiative!!!

I have been working on this for awhile. No one seems to want to roll up their sleeves and figure out the details of the flaw Bongard/0xcite presented last September. It's not easy, but I have confirmed the flaw. I will write something...but If there is a hashcat guru around here....please talk to me.

Look forward to reaping the benefit of your efforts.

Thanks

Rab.
2014-12-15
mmusket33

Musket Teams wish to RETRACT the following statement concerning the inability of ryreaver-reverse to save sessions and provide the solution.

Using Kali-linux 9a -386 Hardrive install

Placing ryreaver-reverse in root

Run

./ryreaver-reverse -i mon0 -c 11 -b 55:44:33:22:11:00 -vv -x 60 --mac=00:11:22:33:44:55 --session=55:44:33:22:11:00

In this case the --session= command will look for the existance of a file named 55:44:33:22:11:00 in root. If no file name seen it will write a file of same name.

On restart if file seen in root it will state:

Restored previous session and start the attack from the last pin.

MTeams
2014-12-15
Resistor

If I had the money I'd ship you guys a 64 bit computer.

Cheers!
2014-12-17
Cyb3rg0d

is there a major different between ryreaver and just plain old reaver or bully, I am unable to execute it in terminal same libpcap error
2014-12-18
mmusket33

All we can say is that we are testing ryreaver-reverse on four different computers all running kali-linux 1-09a -i386. The program is running fine, saving its work and collecting pins. We are using AWUSO36H wifi devices and all kali installs have been fully updated and upgraded. If you are not running this version of kali-linux the easiest solution is to make a persistent usb install. We can punch one out in less then 45 minutes not counting the update.

MTeams
2014-12-19
clone

Quote:

Originally Posted by Cyb3rg0d

I am unable to execute it in terminal same libpcap error

because libpcap is 64bit compiled. http://seclists.org/tcpdump/2010/q1/7

this attack vector seems "neat" or even "botique" imho. I do not see the amount of required effort resulting in a good return on time invested. wps attacks will follow their course similar to WEP; just much faster to that conclusion.
2015-01-02
Cyb3rg0d

Is pixie dust just dead in the water. I have been reading everywhere and it seems no progress has been made anywhere. And the founder clearly is not releasing the source.
2015-01-03
ping

Quote:

Originally Posted by Cyb3rg0d

Is pixie dust just dead in the water. I have been reading everywhere and it seems no progress has been made anywhere. And the founder clearly is not releasing the source.

found this https://code.google.com/p/reaver-wps.../detail?id=675 but can some one pleas give me updated download links!
2015-01-03
Cyb3rg0d

There is a link http://www.datafilehost.com/d/88864143 just need to look a little harder. I hope some implementation occurs with pixie dust. For Varmacreaver is there a guide anywhere on it?
2015-01-07
mmusket33

The following VMR-MDK009x2.sh has been written to take advantage of a flaw in SOME WPS locked routers allowing the collection of pins even though reaver and wash show the router is locked.

The downloaded includes extensive helpfiles and has been tested against numerous routers showing this flaw. All were cracked.

Also included in the help files is how to handle the 99.99% problem which occurs in almost half of the successful attacks against routers providing small numbers of pins when the WPS system is locked. Details are also included in these help files.

We have found an error in one(1) configuration file named:

configfiledetailed1x2

You can REM/COMMENT out with a # the following two(2) variables

USE_PIN1= should read #USE_PIN1=
WPS_PIN1= should read #WPS_PIN1=

OR you can download the corrected version

New Download Package VMRMDK150108

http://www.datafilehost.com/d/18156813

Musket Teams
2015-01-07
Quest

Thanks m33!

I've read the included help file. Could you confirm that VMR-MDK009x does not reboot APs?
2015-01-07
phantom1bc

thanks mmusket33
2015-01-07
Calamita

Nice work MT.

I'll be sure to test this out later on my router which I didn't have much luck with due to it locking!
2015-01-08
mmusket33

Reference the download VMR-MDK009x2.sh

We have found an error in one configuration file named:

configfiledetailed1x2

You can REM/COMMENT out with a # the following two(2) variables

USE_PIN1= should read #USE_PIN1=
WPS_PIN1= should read #WPS_PIN1=

or you can download the corrected version

New Download

http://www.datafilehost.com/d/18156813

Musket Teams
2015-01-08
ping

Quote:

Originally Posted by mmusket33

Reference the download VMR-MDK009x2.sh

We have found an error in one configuration file named:

configfiledetailed1x2

You can REM/COMMENT out with a # the following two(2) variables

USE_PIN1= should read #USE_PIN1=
WPS_PIN1= should read #WPS_PIN1=

or you can download the corrected version

New Download

http://www.datafilehost.com/d/18156813

Musket Teams

Thanks for the update ill be sure to test this out.
2015-01-28
g0tmi1k

No and this thread is starting to turn into something that isn't Kali support.

Closing.

All times are GMT. The time now is 18:23.

Kali Linux