As aanarchyy also said, it's just a zip file.
Have you tried with Bully 1.1? What kind of problems happened.
Printable View
To aanarchyy
Our associate C++ programmer wrote an additional mdk3 attack type. He was in contact with soxrok2212 on the matter and it might be posted on github not sure?
We can post the latest VMR-MDK script in raw format if you wish. If you wish to post it fine by us.
Reference Bully it did not function for us at all compared to Reaver. We embedded bully in varmacscan, it ran first then reaver ran against all targets seen. Bully did not function well in xterm windows. We then tried it from the command line. Against our targets reaver ran fine while bully did nothing.
We did these tests for over a month thinking we were doing something wrong. After a month we just gave up.
Again we will check the Bully version and retest. The test scripts are stored. You might give us your favorite bully command line to test again.
MTeams
as mmusket33, also in my area bully doesn't work. i believe it might be a lil too intrusive. all aps cracked with reaver +K 1, bully wasn't able to do it. the ap locks itself or even timeout on me while bully tries it's features. and another thing.. reaver reaches -70dbm and more maybe working a little slow(but it does), while bully tells that those(far away) aps are not in range or wps locked etc.
if bully gets a little too aggressive, then just increase the time per pin (it defaults to 0). And I've had bully work just fine for me even in the -80's whereas reaver can't even associate with AP's in the -40's. Obviously I'm talking about the version i made, not the one that comes with kali.
But to each their own, I prefer bully as it actually works on Openwrt and several other pieces of hardware that reaver fights with.
and mmusket33, why wouldn't you just make mdk3 it's own separate repo? It is a separate tool. ;-) Then just add in the readme that it requires that to be installed.
Just like how reaver says that it requires pixiewps to be installed to use the pixiedust attack.
I was hesitant to switch to Bully but I've found the same exact results. Distance is no longer a problem with Bully and everything runs much, much quicker.
Also, I do have the modified version of MDK3 if you'd like me to put it back on GitHub, though I didn't have any success with the extra modifications.
Bob, the other one is 3D modeling. The reason is, there are very talented ppl that already do an amazing job at coding and modeling, so I do not see why I should do that, ontop of doing everything else. So coding and modeling is a definite niope :)
To aanarchyy
When approaching WPS locked routers the processes must be automated due to the complex series of steps required to extract pins. Using keyboard output to the commandline is not practicable.
As you have written a bully version maybe you can tell us why bully does not function well when in an xterm window or when outputting to a file thru tee"
For example the following with reaver runs well however bully output to the screen and tee is intermittent and no pins are ever collected.
xterm -g 80x15-1+1 -T "bully" -e "bully wlan0mon -b 55:44:33:22:11:00 -c 1 -B --force -v 3 -L -d -s 00:11:22:33:44:55 2>&1 | tee logfile" &
It could be xterm but we got the same results when we tried the commandline thru a terminal window.
what results were you expecting and what results did you get?
running the command you just posted seemed to work just fine for me. All output ended up in "logfile" and posted in the xterm... bully went on as usual... (slightly altered)
http://postimg.org/image/h5ebomytz/
This would be far easier(and litter your thread less) if you and i could arrange some other means of communication...
To aanarchyy:
MTeams is currently tied up with Pwnstar9.0 rewrite for kali 1.10, 2.0 and 2016. We would very much like you to alter VMR-MDK as you see fit. Second opinions are always welcome. You could post your rework on Github.
in behalf of us dropouts... Thanks for supporting KL1 in everything that you do ;)
i have to give credit to Quest.. KL1 rocks.. KL2 asks some time and.. there's others :D
@mmusket33:
As tempting as it is to wade through and rewrite +8k lines of code... I think i may pass on this one...
There is far too little structure to the code for me to make sense of it...
Then why would you make a program that is DESIGNED to work off "keyboard output to the commandline"????
Something with command line arguments; you type in your command, hit enter, and WALK AWAY!
I don't want to have to babysit a program in case it wants more input...
The whole concept of "input based" scripts(as opposed to command line arguments) is, by design ,NOT AUTOMATED!!!!
Plus i just find them seriously annoying and bloated with ****(read: slow!)
It also completely eliminates versatility in how it can be reused(no way for anyone to add it to anything, like how bully and reaver added support for pixiewps,
or how scripts like wifite added support for aircrack/reaver/wash/etc...)
It would take far more time than justifiable to basically "reverse engineer" everything this script is doing, especially since i don't see a reason for
a great deal of what it's doing... Perhaps if you were to lay-out exactly what you want this to do, i could make something that does what you are
looking for(in a better suited language, using bash sucks for this)
Especially since mdk3 has never done anything useful for me in any of the tests I've run...
I'm not trying to publicly trash your teams code(a GREAT deal of why I've been trying to get into a private conversation with you, so we could discuss
some of this more privately, but apparently you opted for this) just have some suggestions to improve your programs efficiency, effectiveness, and versatility.
To Quest
MTeams will continue to support Kali 1.10. For us Kali 1.10 works all the time, Kali 2.0 can work and Kali 2016 well we will check it again in a month or two.
MTeams
ah! Was wondering where this thread went. Either it was moved from the kitchen, or I need a doctor asap. Anyways just to give you a little feedback,
- it works well on KL 1.1.0a (probly already knew).
- would like to see both, aanarchyy-bully and reaver-t6x as starting options eventually.
- would like to see all the (y/Y) confirmations, axed, shredded and then cremated at 5452 degrees c.
thank you can you please add a download link + the command to install it
okay so ive been on this particular router for quite some time now...and i dont really seem to get whats going...ive used the vmr tool to pwn mr A, and now mr B is using the same kinda router mr A uses. but ive noticed one strange behaviour with the router, after some time of trying to pwn it , it duplicates its bssid example...
aa:aa:aa:aa:aa:aa gets two brothers aa:aa:aa:aa:aa:bb and aa:aa:aa:aa:aa:cc . i doubt it that someone would be running an evil twin attack cloning his mac and changing the last octets...so
bottom line when this guys are created sometyms vmr wouldnt be able to perform the fake association - aireplay attack for pin collection.sometyms i try to attack them one after the other to see who are the decoys and who is real.
i dunno if its some sorta IDS.
i should also add that mr A's router had none of such issues. and also mr B's router is seldom connected to...but still, i just want in!
and dont worry about my safety i know who and what am dealing with.
please if you've got any ideas, help a bro out.
tnx in advance.
Hey guys im new here and fairly new (2 years) to pentesting routers. I managed to successfully penetrate a few networks last year using both reaver with pixiedust and through dictionary attacks. Recently ive been on the move again and found your awesome tool. I understand that it is intended sprcofocally for locked wps intrusion, however, i seem to have made no progress. The tool is working as it should (tested against a few ap's that i already have the psk for), but for any new ap's, specifically locked ap's, the script doesnt seem to give up any more pins. On top of that, it seems to have locked the ap's for over 48 hour. Is this normal?
Finally, somebody mentioned earlier in the thread that hey have identified an ap which is listed as unlocked wps, but reaver treats it as though it is locked. I have a similar ap and would LOVE to breach it. It says wps is not locked, but reaver, nor vmr-mdk, manage to get past the initial sending identity response. Have you guys ever encountere a router like this? If so, how did you work around it.
I believe its a zyxel chipset, 5c:f4:ab
P.s. awesome that someone released a script to run this process, my fingers were not fast enough!
As MTeams notes in the help files the VMR-MDK process only works on a small subset of routers.
If the routers WPS system is Open but simply not responding. You can try these techniques.
Method One
Use varmacscan for a few days
https://forums.kali.org/showthread.p...released/page5
Method Two
If you wish to focus your reaver attack specifically at one target that is not responding use reaver from the command line then:
Open a second terminal window run this from the command line.
while true; do aireplay-ng -0 10 -a 55:44:33:22:11:00 mon0; sleep 2; aireplay-ng -1 10 -a 55:44:33:22:11:00 mon0; sleep 5; done
The mac address here would be the mac address of your target.
mon0 is your monitor mon0 or wlan0mon etc
If you get a complete pixiedust data sequence use PDDSA-06.sh. Capture the text from the screen, save to the VARMAC_LOGS directory and check it with PDDSA-06.sh MTeams broke a non respondng router this way two days ago.
MTeams
Great. Thanks for your feedback guys. Ill try this out after work today (already had varmascan running for around 12 hours). The second method is basically a deauth-fakeauth process in aireplay right? Is it worth using a known client mac aswell or shall i just let it go with a random spoof
@mmusket33.
Thank you very much for your great work!
I used VMR-MDK script for kali 2016 and it started to collect pins like a charm against a tecnicolor AP 582n.
The problem is that after a variable amount of pins, reaver count suddently restart from the beginning.
The access point is always responsive to the attack, but i can't figure out Why reaver count restart.
To Stem83
The program has a retest pin 12345670 every x cycles feature. When the program retests it includes a --session= in the reaver command line so the brute force count is not upset. The program will test the pin for 120 seconds and then return to the brute force count on the next cycle.
Try turning off the retest feature in the configuration file during program setup. Change the y to n. However in the end it is best to use this feature. Read the help files for reasons which include getting a complete pixie dust data sequence.
The only other way the count can be upset to our knowledge is if you jump between using --dh-small and not using.
To test turn off the restest pin feature and the brute force count should return to the previous brute force setting. If you still have problems please advise.
MTeams
@mmusket33.
Thank you very much for your prompt reply. :-)
I already have tried to turn off the retest pin feature yesterday and retest frequency to 99999, but after it collected about 3000 pins it restarted again with 12345670, without storing any previous session. It's really strange, i never modified the --dh-small option so, yesterday l tryed to brutally delete from the script lines from 7287 to 7745 with retest functions.
Now it collected about 1500 pins, I'll soon let you know soon how it goes.
To Stem83
Please keep us advised. We are not encountering this with kali1.1 or 2.0. We do know that for reaver to save its pin count, reaver, has to be shut down in a certain manner. But since your program is saving its pin counts the shutdown procedure works.
1. What version are you using ?
2. What type of operating system ie Harddrive Install, Persistent USB, Virtual etc
We will try and induce this failure.
Note we do not support any Virtual mode installs or Persistent usb using luks encryption. However hardrive installs and Persistent USB installs are fine. Live installs will not work as you cannot save between reboots.
MTeams
To mmusket33:
I use kali-linux-2016.1x64 persitent live usb with LUKS encryption.
Here are some useful info :
root@kali:~# uname -a
Linux kali 4.3.0-kali1-amd64 #1 SMP Debian 4.3.3-5kali4 (2016-01-13) x86_64 GNU/Linux
root@kali:~# reaver
Reaver v1.5.2 WiFi Protected Setup Attack Tool Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <cheffner@tacnetsol.com> mod by t6_x <t6_x@hotmail.com> & DataHead & Soxrok2212
root@kali:~# mdk3
MDK 3.0 v6(mod-musket-r1) - "**** the censorship" by ASPj of k2wrlz, using the osdep library from aircrack-ng And with lots of help from the great aircrack-ng community: Antragon, moongray, Ace, Zero_Chaos, Hirte, thefkboss, ducttape, telek0miker, Le_Vert, sorbo, Andy Green, bahathir and Dawid Gajownik THANK YOU! MDK is a proof-of-concept tool to exploit common IEEE 802.11 protocol weaknesses. IMPORTANT: It is your responsibility to make sure you have permission from the network owner before running MDK against it. This code is licenced under the GPLv2
root@kali:~# lspci | grep Network
02:00.0 Network controller: Qualcomm Atheros QCA9565 / AR9565 Wireless Network Adapter (rev 01)
root@kali:~/VARMAC_LOGS# cat TNCAPXXXXXX-XXXXXX-XX:XX-XXXXXX Reaver v1.5.2 WiFi Protected Setup Attack Tool Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <cheffner@tacnetsol.com> mod by t6_x <t6_x@hotmail.com> & DataHead & Soxrok2212 [+] Switching mon0 to channel 6 [+] p1_index set to 3129 [+] p2_index set to 0 [+] Restored previous session [+] Waiting for beacon from XX:XX:XX:XX:XX:XX [+] Associated with XX:XX:XX:XX:XX:XX (ESSID: TNCAPXXXXXX) [+] Starting Cracking Session. Pin count: 3129, Max pin attempts: 11000 [+] Trying pin 31225670. [+] Sending EAPOL START request [+] Received identity request [+] Sending identity response [+] Received identity request [+] Sending identity response [P] E-Nonce: XX:XX:XX:XX:XX:XX [P] PKE:XX:XX:XX:XX:XX:XX [P] WPS Manufacturer: Technicolor [P] WPS Model Name: Technicolor TG [P] WPS Model Number: 582n [P] Access Point Serial Number: XXXXXXXXX [+] Received M1 message [P] R-Nonce: XX:XX:XX:XX:XX:XX [P] PKR:XX:XX:XX:XX:XX:XX [P] AuthKey: XX:XX:XX:XX:XX:XX [+] Sending M2 message [P] E-Hash1: XX:XX:XX:XX:XX:XX [P] E-Hash2: XX:XX:XX:XX:XX:XX [+] Received M3 message [+] Sending M4 message [+] Received WSC NACK [+] Sending WSC NACK [+] p1_index set to 3130 [+] Pin count advanced: 3130.
--------------------------------------------------------
[+] Pin count advanced: 3136. Max pin attempts: 11000 [+] Trying pin 31295673. [+] Sending EAPOL START request [+] Received identity request [+] Sending identity response [P] E-Nonce: XX:XX:XX:XX:XX:XX [P] PKE: XX:XX:XX:XX:XX:XX [P] WPS Manufacturer: Technicolor [P] WPS Model Name: Technicolor TG [P] WPS Model Number: 582n [P] Access Point Serial Number: XXXXXXXXX [+] Received M1 message [P] R-Nonce: XX:XX:XX:XX:XX:XX [P] PKR:XX:XX:XX:XX:XX:XX [P] AuthKey: XX:XX:XX:XX:XX:XX [+] Sending M2 message
root@kali:~/VARMAC_CONFIG# cat TNCAPXXXXXX-XXXXXXXXXXXX
###========================= CHANNEL1=6 ###========================= ###========================= USE_R1=y ###=========================
###=========================
RX1=9
RY1=2
###=========================
###========================= LIVE1=240 ###=========================
###========================= USE_LONG1=y ###=========================
####========================= MDKTYPE1=3 ####========================= ###========================= MDKLIVE=1 ###======================= ###========================= PAUSE=1 ###========================= ###========================= REAVER_COUNT=y ###=========================
###========================= MDK3_COUNT=y ###========================= ###========================= WASH_COUNT=y ###=========================
###========================= DAMP_MDK=y ###========================= ###========================== ADVAN_TIME=120 ###========================= ###========================= USE_AIRE1=y ###========================= ###========================= USE_AIRE0=n ###========================= ###========================= USE_DHSMALL=y ###========================= ###========================= MACSEL=n ###========================= ###========================= ASSIGN_MAC=XX:XX:XX:XX:XX:XX ###========================= ###========================= USE_PIXIE=n ###========================= ###========================= USE_FIRSTPIN=n ###========================= ###========================= RETESTPIN=999999 ###=========================
To Stem 83
Thanks for the info:
First you might set the
RETESTPIN=50
As we never tested such a long cycle. But we doubt the problem is there.
VMR-MDK was developed against real targets using kali-i386. It has never been tested using AMD or luks encryption.
MTeams tried luks encryption but the encryption process took too long to complete causing other program processes to fail. We remove the encryption feature and programs ran normally again. So if we were to take a guess, the problem is there.
Suggest you make a persistent usb install of kali not using luks and maybe not amd and see what occurs. If you can just turn off luks try that. We gave up on luks a while ago. We know nothing about AMD.
MTeams
Heloo Mteam,
I have been trying to crack a wps locked router and have been trying ur script for past few weeks and always get a same error
[!] Found packet with bad FCS, skipping...
[!] Found packet with bad FCS, skipping... and it goes on
i gt this line after i specify mon0
I have not installed kali on my windows i am live booting it from my pendrive version : kali-linux-2016.1-amd64.iso
I have Dell Inspiron N4030 WITH INTEL i3 processor
Network card : BCM43XX
Please help me out
To Stem83
To find where your .wpc files are stored try typing:
locate .wpc
The storage folder moved around when the first pixiedust moded reaver programs were installed over the existing reaver but current versions store in the /etc/reaver folder as you note or maybe /usr/local/etc/reaver.
As you can see the .wpc file is just a mac address stripped of colons. You could copy the file to another folder or copy to existing folder and place an XX at the beginning.
To avoid conflict in the VMR-MDK series when the --pin= command is used a --session= command to another location to include using a text string at the beginning of the file name is included in the command line to avoid any later brute force session using the file. So even if reaver sends the --session files to the same folder thru internal default it cannot use them for any brute force sessions as there is a text string at the beginning. If you see a file testpin- or startpin- these were written by the --session= command when a specific pin is used or the default pin is tested.
We will run some tests on wpc storage of session files again and see what occurs.
Is it possible to run this on arm-64 bit?
I'm running kali rolling on odroid c2 with 64-bit cpu.
Thank you!
root@kali-arm64:~/mdk3-v6# make
make -C osdep
make[1]: Entering directory '/root/mdk3-v6/osdep'
Building for Linux
make[2]: Entering directory '/root/mdk3-v6/osdep'
make[2]: '.os.Linux' is up to date.
make[2]: Leaving directory '/root/mdk3-v6/osdep'
make[1]: Leaving directory '/root/mdk3-v6/osdep'
root@kali-arm64:~/mdk3-v6# make install
make -C osdep install
make[1]: Entering directory '/root/mdk3-v6/osdep'
Building for Linux
make[2]: Entering directory '/root/mdk3-v6/osdep'
make[2]: '.os.Linux' is up to date.
make[2]: Leaving directory '/root/mdk3-v6/osdep'
make[1]: Leaving directory '/root/mdk3-v6/osdep'
install -D -m 0755 mdk3 //usr/local/sbin/mdk3
root@kali-arm64:~/mdk3-v6# /root/mdk3-v6/mdk3
-bash: /root/mdk3-v6/mdk3: cannot execute binary file: Exec format error
To mmusket33.
The mistery continue..
As you suggested I used kali 2.0 i386 persistent USB WITHOUT LUKS encryption and pin count advanced without restarts as expected, but after some days of work i had this unexpected log:
Reaver v1.5.2 WiFi Protected Setup Attack Tool Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <cheffner@tacnetsol.com> mod by t6_x <t6_x@hotmail.com> & DataHead & Soxrok2212 [+] Switching mon0 to channel 1 [+] p1_index set to 6904 [+] p2_index set to 999 [+] Restored previous session [+] Waiting for beacon from XX:XX:XX:XX:XX:XX [+] Associated with XX:XX:XX:XX:XX:XX (ESSID: TNCAPXXXXXX) [+] Starting Cracking Session. Pin count: 10999, Max pin attempts: 11000 [+] Trying pin 69019982. [+] Sending EAPOL START request [+] Received identity request [+] Sending identity response [P] E-Nonce: XXXXXXXXXXXXXXXXXXXX [P] PKE: XXXXXXXXXXXXXXXXXXXX [P] WPS Manufacturer: Technicolor [P] WPS Model Name: Technicolor TG [P] WPS Model Number: 582n [P] Access Point Serial Number: XXXXXXXXX [+] Received M1 message [P] R-Nonce: XXXXXXXXXXXXXXXXXXXX [P] PKR: XXXXXXXXXXXXXXXXXXXX [P] AuthKey: XXXXXXXXXXXXXXXXXXXX [+] Sending M2 message [P] E-Hash1: XXXXXXXXXXXXXXXXXXXX [P] E-Hash2: XXXXXXXXXXXXXXXXXXXX [+] Received M3 message [+] Sending M4 message [+] Received M3 message [+] Received M3 message [+] Received M3 message [+] Received M3 message [+] Received M3 message [!] WARNING: Receive timeout occurred [+] Sending WSC NACK [+] p2_index set to 1000 [+] Pin count advanced: 11000. Max pin attempts: 11000 [+] Checksum mode was not successful. Starting exhaustive attack [+] p2_index set to 0 [+] Trying pin 69011234. [+] Sending EAPOL START request [+] Received identity request [+] Sending identity response [+] Received identity request [+] Sending identity response [P] E-Nonce: XXXXXXXXXXXXXXXXXXXX [P] PKE: XXXXXXXXXXXXXXXXXXXX [P] WPS Manufacturer: Technicolor [P] WPS Model Name: Technicolor TG [P] WPS Model Number: 582n [P] Access Point Serial Number: XXXXXXXXX [+] Received M1 message [P] R-Nonce: XXXXXXXXXXXXXXXXXXXX [P] PKR: XXXXXXXXXXXXXXXXXXXX [P] AuthKey: XXXXXXXXXXXXXXXXXXXX [+] Sending M2 message [+] Received M1 message [+] Received M1 message [P] E-Hash1: XXXXXXXXXXXXXXXXXXXX [P] E-Hash2: XXXXXXXXXXXXXXXXXXXX [+] Received M3 message [+] Sending M4 message [+] Session saved.
And p2 index restarted from 0.
I'm a Little bit confused now ..What it means exhaustive attack? And, according the log file it discovered only the first part (6901) of the pin right?
To sslx
MTeams does not use arm hence we cannot test. Furthermore our weekly HD test install of Kali-rolling seems to finally been successful after update/upgrade so we will recommence work with the Operating System.
To Stem83
It looks like removing the luks has stopped the pin count restart. You have simply checked all the WPS pins. The only thing we could do in this case is:
1. Restart the attack from the beginning. Remove the -a from the reaver command line and you should get asked if you want to restart.
2. Try Kali 1.10a and reaver 1.3 we have found the older program sometimes works better. We used to keep a persistent usb install using reaver 1.3 for such cases.
Reaver 1.3 was available search the web for the download page and install instructions.
Note in reaver 1.3 wash is called something else maybe walsh and you will have to use airodump-ng to obtain the channel.
MTeams
I gota error, and o need a help ti solve this.
Arquivo ou diretório não encontrado = File or directory not foundQuote:
Enter Line Number of Selected TargetAP Here: 1
You have chosen:
1. xxxxxxxxx as the targetAPs' name.
2. xxxxxxxxx as the targetAPs' mac address.
Enter (y/Y) to confirm or (n/N) to try again.
Y
./VMR-MDK-K2-2016R-011x9.sh: line 666: /root/VARMAC_CONFIG/configfiledetailed: Arquivo ou diretório não encontrado
./VMR-MDK-K2-2016R-011x9.sh: line 673: /root/VARMAC_CONFIG/xxxxxx-xxxxxxx: Arquivo ou diretório não encontrado
ls: não é possÃ*vel acessar /root/VARMAC_CONFIG: Arquivo ou diretório não encontrado
Configuration files listed in the VARMAC_CONFIG folder.
Select the config file to be used.
A Configuration file xxxxxxxxxx-xxxxxxxx has been made for use
with this target BUT any config file listed can be used.
After selection the config file parameters will appear. You can review
settings and make changes which will be written to the file choosen.
Once the program is running, open the config file with leafpad,
make any changes and save. The config file is loaded at the start of
Stages II, III & IV.
Enter Line Number of Config File Here:
You have chosen as your configuration file.
Enter (y/Y) to confirm or (n/N) to try again.
y
./VMR-MDK-K2-2016R-011x9.sh: line 1142: /root/VARMAC_CONFIG/: Arquivo ou diretório não encontrado
Não é possÃ*vel acessar =is not possible to access
How o solve this?
To renan*
MTeams looked at your problem. For some reason the config file is not being written to the folder. It is possible your script is corrupted as all these processes are automatic. If you are using one of the Spanish versions it is possible it got altered. MTeams corrected a previous version.
Go thru the setup very carefully. You should see your config file in a drop down menu list.
MTeams
To Renan,
Even I was facing the same issue,
You can fix this by copying all the folder that VMR-MDK creates for example VARMAC_CONFIG, LOGS etc
and paste them to root/home folder and then run the script. I hope this helps.
I'am Also Facing Some Problems On Kali 2016 i cant get this script to work ive read everything even after 3 hours of searching for some reason it doesn't scan for networks or show me the airodump and wash tabs would realy apreciate some help thanks !
I'm having pretty much the same problem, I installed it successfully tho but the script stops at:
usage: VMR-MDK-K2-2016R-011x9.sh <start|stop|check> <interface> [channel or frequency]"
It seemed to me that the script isn't resuming as how it should.
And also 2 questions, first, does installing the mdk3 required/mandatory?
second, do you suggest to have multiple wlan adapters to use? if yes, please recommend to me the latest and greatest in the range of $50 and below.
Would appreciate the reply to be here or to my email: marsrolled@gmail.com
Thank you very much! :o