WPS (Pixie-Dust & PIN attacks) is a mess #28

derv82 · 2017-06-04T03:06:55Z

None of my routers are susceptible to WPS Pixie-Dust attack.
All of my routers have hard rate-limits on WPS PIN attempts (requiring a router reboot after 3 failed attempts).

This means I can't test Wifite against susceptible routers.

I have the cash to buy more test routers, but I don't have the time to find routers that are still susceptible to Pixie-Dust -- and that do not rate limit PIN attacks.

If anyone knows of susceptible Wifi router models, please let me know.

derv82 · 2017-06-04T10:55:04Z

Based on the "Wireless Security Database" on Google Docs (linked on various sites around the net), I ordered:

Tp-Link Archer C20i (includes a/5ghz band)
Netgear WNDR3700 V2
F5D8236-4 V3

Now we wait.

Detailed WPS output. TODO: * Actually test that cracked PINs are detected & saved, pending #28 * Command-line options to specify max lockout/timeout/noassoc/failure

derv82 · 2017-06-12T02:11:58Z

Only got 2 routers, and none are vulnerable to Pixie-Dust (or the PIN attack for that matter).

So I'm getting 3 more. Will rinse-repeat until I get a vulnerable router.

Again, if anyone has suggestions...

MisterBianco · 2017-06-12T02:13:51Z

Older Arris routers are vulnerable. I would know I live in a lazy ass little town and every router in this area is vulnerable as long as the firmware isn't updated (never is) Other then that many old 300N routers are vulnerable

…

On Sun, Jun 11, 2017, 8:12 PM derv ***@***.***> wrote: Only got 2 routers, and none are vulnerable to Pixie-Dust (or the PIN attack for that matter). So I'm getting 3 more. Will rinse-repeat until I get a vulnerable router. Again, if anyone has suggestions... — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#28 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AbIiUaN29n5jLZ61ZnNEA5Nb-W_1dUHKks5sDJ5vgaJpZM4NvQs9> .

MisterBianco · 2017-06-12T02:14:26Z

Look at the Arris docsis 3 cable modem routers. They are the ones I like ;) On Sun, Jun 11, 2017, 8:13 PM Jacobsin Dingman <jacobsin1996@gmail.com> wrote:

…

Older Arris routers are vulnerable. I would know I live in a lazy ass little town and every router in this area is vulnerable as long as the firmware isn't updated (never is) Other then that many old 300N routers are vulnerable On Sun, Jun 11, 2017, 8:12 PM derv ***@***.***> wrote: > Only got 2 routers, and none are vulnerable to Pixie-Dust (or the PIN > attack for that matter). > > So I'm getting 3 more. Will rinse-repeat until I get a vulnerable router. > > Again, if anyone has suggestions... > > — > You are receiving this because you are subscribed to this thread. > Reply to this email directly, view it on GitHub > <#28 (comment)>, or mute > the thread > <https://github.com/notifications/unsubscribe-auth/AbIiUaN29n5jLZ61ZnNEA5Nb-W_1dUHKks5sDJ5vgaJpZM4NvQs9> > . >

vom513 · 2017-06-14T20:52:52Z

I got a Belkin N600 DB v2 that is my dedicated WPS pixie test router. F9K1102V2.

vom513 · 2017-09-23T20:15:28Z

Has anyone had any luck in debugging why WPS pixie (using bully) doesn't work ? It is working - in that bully writes out the .bully/.run file. Wifite2 is missing something in the output and crack_result is staying "None". I'm running the latest Kali - and the arguments for bully in Bully.py look good. From what I can tell - the regex looks good too in matching the lines with PIN and KEY. Feel like something process/pipe related - which is where my python skills fall off...

I'm still playing with Bully.py to see if I can see where it's bailing, but no luck yet.

kimocoder · 2017-09-23T20:23:23Z

I may confirm that WPS/PixieDust got problems, no further knowledge in python here to fix the issue either :/

kimocoder · 2017-10-07T20:40:27Z

@binarymaster got some spare time to investigate the pixiewps issue in wifite2 ? :)

alldayi420 · 2017-11-14T04:24:34Z

I know that the old Wifite works when using pixie attack ...have not been able to even get a target to even show up with the new Wifite2 -wps attack even using it in the same spot .. but the first wifite has trouble capturing a handshake while wifite2 captures that shit like a boss... Around here (red Oak ,IOwa) Rual Area centurylink (SSID =Century link xxxx)routers are vun to the pixie attack / Belkin /and
a few netgear routers are vun... How do you get wps attack to bring up target n wifite2?... and yeah little ass towns allways have old ass equip /no update...

vom513 · 2017-11-14T15:39:27Z

The current version of wifite2 - uses bully by default for WPS attacks. The current issue seems to revolve around wifite2 not interpreting the output from bully correctly. Even though wifite2 will say that pixie was unsuccessful for example, you can check the actual bully output files and see that it was indeed cracked. So it seems to be launching and driving bully correctly - but the output is getting dropped or confused.

alldayi420 · 2017-11-14T18:24:49Z

yeah ...no when i do ./Wifite.py with no options it does not even try wps attacks at all when i put the argument -wps or --pixie it scans but no clients show .. the old wifite used rever?...wps attacks?..pixie..? *Jason Weston Szymarek* *Ethical Hacking & IT Services* *PC Repair & Pentesting* *Red Oak, IA 51566 * *402-965-1174*

…

On Tue, Nov 14, 2017 at 9:39 AM, vom513 ***@***.***> wrote: The current version of wifite2 - uses bully by default for WPS attacks. The current issue seems to revolve around wifite2 not interpreting the output from bully correctly. Even though wifite2 will say that pixie was unsuccessful for example, you can check the actual bully output files and see that it was indeed cracked. So it seems to be launching and driving bully correctly - but the output is getting dropped or confused. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#28 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AUGPZfqVCNJ76TTKQYFxabBhWaed8c4iks5s2bQxgaJpZM4NvQs9> .

kimocoder · 2018-03-01T17:17:08Z

@derv82 do you still need a pixiedust vulnarable router? I May donate you one, no problem. Give me a heads up

kimocoder · 2018-03-02T13:07:05Z

Contact me private at kimocoder(at)hotmail.com I may provided a router for both this issue and this one. Thanks.

derv82 · 2018-03-03T06:00:58Z

Let me just say: I would very much appreciate a test router that is vulnerable to Pixie-Dust!

I've tried many times to find a router...

I shot you an email

derv82 · 2018-03-03T07:01:43Z

@alldayi420 The issue of WPS detection was fixed in #62

However, Wifite 2 should not be trusted with WPS attacks right now. You can run bully/reaver manually in the meantime.

# Running reaver:
reaver -i INTERFACE -vv -K -c CHANNEL -b BSSID
# Example for channel 11 and interface wlan0mon:
reaver -i wlan0mon -vv -K -c 11 -b AA:BB:CC:DD:EE:FF

# Running bully:
bully --pixiewps -c CHANNEL -b BSSID IFACE
# Example for channel 11 and interface wlan0mon:
bully --pixiewps -c 11 -b AA:BB:CC:DD:EE:FF wlan0mon

I can fix Wifite2's WPS PixieDust/PIN attacks once I get a router that is susceptible to Bully/Reaver.

Pasting what I said in #60 :

Can you (or anyone else) provide me the entire output of bully (and reaver too)? With the output, I can try to get Wifite working again. Separating stdout/stderr would help.

kimocoder · 2018-03-03T08:20:27Z

No problem. I'll check it later today and may send one after this weekend.

derv82 · 2018-03-04T03:45:47Z

Got the output for both reaver and bully from @vom513 in #60

Already I see why Wifite2 doesn't work: The output of Reaver/Pixiewps appears to have changed (again).

Here's the output of reaver, I'm assuming it's a newer version of reaver:

 Pixiewps 1.4

 [?] Mode:     3 (RTL819x)
 [*] Seed N1:  -
 [*] Seed ES1: -
 [*] Seed ES2: -
 [*] PSK1:     2c2e33f5e3a870759f0aeebbd2792450
 [*] PSK2:     3f4ca4ea81b2e8d233a4b80f9d09805d
 [*] ES1:      04d48dc20ec785762ce1a21a50bc46c2
 [*] ES2:      04d48dc20ec785762ce1a21a50bc46c2
 [+] WPS pin:  11867722

 [*] Time taken: 0 s 21 ms

Wifite2 was expecting this format (old reaver output):

wifite2/py/Reaver.py

Lines 388 to 392 in 1a063ed

    
           [Reaver Test] BSSID: AA:BB:CC:DD:EE:FF 
        
           [Reaver Test] Channel: 11 
        
           [Reaver Test] [+] WPS PIN: '12345678' 
        
           [Reaver Test] [+] WPA PSK: 'Test PSK' 
        
           [Reaver Test] [+] AP SSID: 'Test Router'

First, the regexes do not match the new format:

wifite2/py/Reaver.py

Lines 348 to 361 in 1a063ed

    
           # PIN: Printed when attack is completed. 
        
           regex = re.search("WPS PIN: *'([0-9]+)'", stdout) 
        
           if regex: 
        
               pin = regex.groups()[0] 
        
           # Check for PSK. 
        
           regex = re.search("WPA PSK: *'(.+)'", stdout) 
        
           if regex: 
        
               psk = regex.groups()[0] 
        
           # Check for SSID 
        
           regex = re.search("AP SSID: *'(.+)'", stdout) 
        
           if regex: 
        
               ssid = regex.groups()[0]

Second, Wifite fails if the PSK is not found. Apparently Reaver/Pixiewps no longer print this out:

wifite2/py/Reaver.py

Lines 78 to 81 in 1a063ed

    
           (pin, psk, ssid) = Reaver.get_pin_psk_ssid(stdout) 
        
           # Check if we cracked it. 
        
           if pin and psk and ssid:

Haven't even looked at PIN attacks yet. Hopefully helps out with #28

derv82 · 2018-03-04T04:44:58Z

Added some "tests" for the output given by vom513, and updated Wifite's regexes so it looks like Pixie-Dust attacks should work now (for both reaver & bully).

Wifite uses reaver by-default. You can run bully using the --bully switch.

Let me know if it works (or crashes 😭).

Even if Wifite2 can crack WPS using Pixie-Dust again (hopefully), I still want to clean up the entire WPS attacking method:

I added a note on the TODO.md about improving the output of WPS attacks (more-verbose but not too verbose, consistent between reaver/bully). And I want to remove WPS PIN cracking entirely from Wifite 😱 because Wifite shouldn't even try to do something that may take multiple days/weeks/months.

Unrelated to WPS: * Do not take device out of monitor mode when finished (informs user) * Do not restart NetworkManager when finished (informs user) Changes to CLI switches: * --wps-time X: Total time for WPS attack to complete * --wps-timeouts X: Max number of timeouts before failing * --wps-fails X: Max number of WPSFails before failing * Removed unused WPS switches. * Improved --help messaging for WPS switches. * Fail/Timeout threshold default is 100 Bully now outputs useful information: * Current PIN + status * Time remaining * Number of Timeout messages * Number of "WPSFail" messages * If AP is locked Better reaver output. * Looks more like Bully's output. * Timer shows time remaining for attack. * Mentions "Running pixiewps" during "M2 message" step. * pixiewps failure looks like this: "Reaver says: 'WPS pin not found'" * Counts Timeouts and "WPS Transaction Failure" (WPSFail) For #28

derv82 · 2018-04-07T23:37:54Z

Alright, the PixieDust attacks should look a whole lot better now. And behave better.

From the commit above:

--wps-time X: (-wpst) Total time for WPS attack to complete (5min)
--wps-timeouts X: (-wpsto) Max number of timeouts before failing (100 -- was 30)
--wps-fails X: (-wpsf) Max number of WPSFails before failing (100 -- was 30)

All other WPS-related switches were removed. Except for the base switches:

Specify WPS networks --wps
Specify only PixieDust attack --wps-only
Specify to not use PixieDust at all --no-wps
Specify to use bully instead of reaver: --bully

And the output is more consistent between reaver & bully:

Looking at the GIF... The attack progress line is getting kind of long. I might remove BSSID from the output (but leave power/db).

ravenphreaker · 2018-04-13T22:32:30Z

Hey derv82 long time fan and ravenphreaker from tophatsec forum. Just letting you know any ralink chipset router I have come across has been susceptible. I get the pin almost every time the only reason it fails would be signal strength usually. Atheros is hit and miss. Broadcom usually isn't if they have been updated. Hope that helps

chams1012 · 2018-05-10T11:46:34Z

Hi @ravenphreaker i dont know how you managed , I have been trying with 3 different router and nothing Dlink 850L , Dlink 803 and another tp link still nothing , however before with pixie 1.2 it used to work in all my routers no exception

twix87 · 2019-04-13T18:34:42Z

Help, i need conclusion.

First Time:

Other Time:

Failed: Reaver says "WPS pin not found"

alldayi420 · 2020-01-01T23:39:55Z

Hey, I just signed the petition "Clemency for Ross Ulbricht: Condemned to Die in Prison for a Website" and wanted to see if you could help by adding your name. Our goal is to reach 300,000 signatures and we need more support. You can read more and sign the petition here: http://chng.it/xFMz9XrxFQ Thanks! Michelle

derv82 added the Need Router label Jun 4, 2017

derv82 added a commit that referenced this issue Jun 5, 2017

Use bully instead of reaver.

c4773c6

Detailed WPS output. TODO: * Actually test that cracked PINs are detected & saved, pending #28 * Command-line options to specify max lockout/timeout/noassoc/failure

vom513 mentioned this issue Feb 27, 2018

Wifite WPS transactions issues #60

Closed

This was referenced Mar 3, 2018

Can't Detect WPS Enabled Routers #62

Closed

WPS pixxie dust attack always fails. #58

Closed

derv82 added a commit that referenced this issue Mar 4, 2018

Trying to fix bully & reaver Pixie-Dust attacks.

82f0a2a

Haven't even looked at PIN attacks yet. Hopefully helps out with #28

derv82 added enhancement and removed Need Test Router labels Mar 24, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WPS (Pixie-Dust & PIN attacks) is a mess #28

WPS (Pixie-Dust & PIN attacks) is a mess #28

derv82 commented Jun 4, 2017 •

edited

Loading

derv82 commented Jun 4, 2017

derv82 commented Jun 12, 2017

MisterBianco commented Jun 12, 2017 via email

MisterBianco commented Jun 12, 2017 via email

vom513 commented Jun 14, 2017

vom513 commented Sep 23, 2017 •

edited

Loading

kimocoder commented Sep 23, 2017

kimocoder commented Oct 7, 2017

alldayi420 commented Nov 14, 2017 •

edited

Loading

vom513 commented Nov 14, 2017

alldayi420 commented Nov 14, 2017 via email

kimocoder commented Mar 1, 2018

kimocoder commented Mar 2, 2018

derv82 commented Mar 3, 2018

derv82 commented Mar 3, 2018 •

edited

Loading

kimocoder commented Mar 3, 2018

derv82 commented Mar 4, 2018

derv82 commented Mar 4, 2018

derv82 commented Apr 7, 2018

ravenphreaker commented Apr 13, 2018

chams1012 commented May 10, 2018 •

edited

Loading

twix87 commented Apr 13, 2019

alldayi420 commented Jan 1, 2020 via email

WPS (Pixie-Dust & PIN attacks) is a mess #28

WPS (Pixie-Dust & PIN attacks) is a mess #28

Comments

derv82 commented Jun 4, 2017 • edited Loading

derv82 commented Jun 4, 2017

derv82 commented Jun 12, 2017

MisterBianco commented Jun 12, 2017 via email

MisterBianco commented Jun 12, 2017 via email

vom513 commented Jun 14, 2017

vom513 commented Sep 23, 2017 • edited Loading

kimocoder commented Sep 23, 2017

kimocoder commented Oct 7, 2017

alldayi420 commented Nov 14, 2017 • edited Loading

vom513 commented Nov 14, 2017

alldayi420 commented Nov 14, 2017 via email

kimocoder commented Mar 1, 2018

kimocoder commented Mar 2, 2018

derv82 commented Mar 3, 2018

derv82 commented Mar 3, 2018 • edited Loading

kimocoder commented Mar 3, 2018

derv82 commented Mar 4, 2018

derv82 commented Mar 4, 2018

derv82 commented Apr 7, 2018

ravenphreaker commented Apr 13, 2018

chams1012 commented May 10, 2018 • edited Loading

twix87 commented Apr 13, 2019

alldayi420 commented Jan 1, 2020 via email

derv82 commented Jun 4, 2017 •

edited

Loading

vom513 commented Sep 23, 2017 •

edited

Loading

alldayi420 commented Nov 14, 2017 •

edited

Loading

derv82 commented Mar 3, 2018 •

edited

Loading

chams1012 commented May 10, 2018 •

edited

Loading