WPS Pixie Dust Attack (Offline WPS Attack)

[soxrok2212]

soxrok2212, I tried messaging you on the Google Drive sheet but it looked as though you couldn't respond...

Another one to add to the list as vulnerable:-

Zyxel P-2812HNU - Wikidevi here

[P] WPS Manufacturer: ZyXEL Technology, Corp.
[P] WPS Model Number: V3.11(TUJ.3)
[+] Received M1 message
[P] AuthKey: 85:5f:fc:cb:b8:...
[+] Sending M2 message
[P] E-Hash1: 66:29:ae:09:ab:...
[P] E-Hash2: 81:a4:d5:58:f3:...
[+] Received M3 message
[+] Sending M4 message
[+] Received M5 message
[+] Sending M6 message
[+] Received M7 message
[+] Sending WSC NACK
[+] Sending WSC NACK
[+] Pin cracked in 3 seconds
[+] WPS PIN: '37********'
[+] WPA PSK: '**********'
[+] AP SSID: '**********'
[+] Nothing done, nothing to save.

Sorry I just leave that page open because I'm constantly editing it... don't really check the chat. Thanks for posting!

[Calamita]

Sorry I just leave that page open because I'm constantly editing it... don't really check the chat. Thanks for posting!

Ahh ok - no worries! Thanks for your hard work on this.

I'll report back with some more vulnerable devices soon hopefully

[soxrok2212]

Ahh ok - no worries! Thanks for your hard work on this.

I'll report back with some more vulnerable devices soon hopefully

If you find any Realtek AP's please post all the info you can about them.. especially the PKe! Thanks!

[aanarchyy]

If you find any Realtek AP's please post all the info you can about them.. especially the PKe! Thanks!

Is that helping you work on that flaw you mentioned you found?

BTW heres the one for that Encore i posted the other day

[P] E-Nonce: 0f:2f:e4:f3:ed:a6:74:d5:97:d6:33:b9:0b:e2:4c:21
[P] PKE: ef:80:72:86:a3:e9:5e:11:ac:93:cf:68:2f:d6:75:ad:d1:b8:eb:b9:b4:b4:0a:2b:72:e4:f5:ca:70:76:6f:70:25:76:9a:f2:34:75:31:07:b8:24:36:2d:28:b1:8f:47:bb:d5:a5:d9:e7:6f:30:f6:ce:c5:80:55:ae:ba:0a:e9:22:67:22:b9:69:27:71:a1:8b:2d:a6:ff:55:52:de:5d:95:ff:50:e3:eb:e8:d9:a3:f8:7a:cd:d0:d2:ec:a0:ec:5f:6f:87:de:56:28:80:d5:68:c6:c3:c2:0d:55:8d:43:8a:fd:b8:5c:d0:35:0c:13:28:32:27:18:17:89:a8:4c:44:45:04:8b:1b:ba:0a:b2:c3:17:e4:80:73:00:6a:6c:fd:9b:fb:97:83:84:76:a8:22:77:fc:c3:84:78:00:76:2d:1d:74:f5:02:f6:5d:b3:d4:d5:9a:e0:df:f8:19:b3:db:6d:75:c1:3b:13:f8:b3:86:9f:a4:09:ff:82:d6:c1
[P] WPS Manufacturer: ENCORE Technologies, Inc.
[P] WPS Model Number: ENHWI-3GN3
[P] AuthKey: c3:d9:55:00:ba:6c:b1:1f:fc:d1:eb:68:e1:1a:30:52:de:ef:a2:ca:ca:be:eb:78:c9:3b:df:0a:02:03:9f:e1
[P] E-Hash1: 1b:25:bf:af:80:54:60:aa:b9:c6:22:34:2d:f7:c3:20:6b:ef:fe:09:d6:97:17:56:bb:4b:e0:38:ed:38:9a:96
[P] E-Hash2: 62:b5:b4:d2:17:32:c8:00:33:65:2e:a1:83:8b:2b:e7:68:b3:3e:fb:76:4f:6c:5f:7e:bb:16:71:56:8e:04:ac

[nuroo]

Cisco Linksys RE1000 v2, vulnerable.

ES-1, ES-2 00:00:00:00:00............................. ralink chipset. wikidevi here

[soxrok2212]

Is that helping you work on that flaw you mentioned you found?

BTW heres the one for that Encore i posted the other day

[P] E-Nonce: 0f:2f:e4:f3:ed:a6:74:d5:97:d6:33:b9:0b:e2:4c:21
[P] PKE: ef:80:72:86:a3:e9:5e:11:ac:93:cf:68:2f:d6:75:ad:d1:b8:eb:b9:b4:b4:0a:2b:72:e4:f5:ca:70:76:6f:70:25:76:9a:f2:34:75:31:07:b8:24:36:2d:28:b1:8f:47:bb:d5:a5:d9:e7:6f:30:f6:ce:c5:80:55:ae:ba:0a:e9:22:67:22:b9:69:27:71:a1:8b:2d:a6:ff:55:52:de:5d:95:ff:50:e3:eb:e8:d9:a3:f8:7a:cd:d0:d2:ec:a0:ec:5f:6f:87:de:56:28:80:d5:68:c6:c3:c2:0d:55:8d:43:8a:fd:b8:5c:d0:35:0c:13:28:32:27:18:17:89:a8:4c:44:45:04:8b:1b:ba:0a:b2:c3:17:e4:80:73:00:6a:6c:fd:9b:fb:97:83:84:76:a8:22:77:fc:c3:84:78:00:76:2d:1d:74:f5:02:f6:5d:b3:d4:d5:9a:e0:df:f8:19:b3:db:6d:75:c1:3b:13:f8:b3:86:9f:a4:09:ff:82:d6:c1
[P] WPS Manufacturer: ENCORE Technologies, Inc.
[P] WPS Model Number: ENHWI-3GN3
[P] AuthKey: c3:d9:55:00:ba:6c:b1:1f:fc:d1:eb:68:e1:1a:30:52:de:ef:a2:ca:ca:be:eb:78:c9:3b:df:0a:02:03:9f:e1
[P] E-Hash1: 1b:25:bf:af:80:54:60:aa:b9:c6:22:34:2d:f7:c3:20:6b:ef:fe:09:d6:97:17:56:bb:4b:e0:38:ed:38:9a:96
[P] E-Hash2: 62:b5:b4:d2:17:32:c8:00:33:65:2e:a1:83:8b:2b:e7:68:b3:3e:fb:76:4f:6c:5f:7e:bb:16:71:56:8e:04:ac

Unfortunately, thats Ralink, not Realtek. Thanks though.

Cisco Linksys RE1000 v2, vulnerable.

ES-1, ES-2 00:00:00:00:00............................. ralink chipset. wikidevi here

Thanks! I'll add it now

[Calamita]

Will do! I saw your post on hackforums about this too PM me your details and I'll forward any info I find to you