KRACK Attack - Proof Of Concept

Key Takeaways

[Laughter] hey guys hackersploit here back again with another video and in this video we are going to be looking at the crack attack yes we are finally going to look at the crack attack more specifically we're going to be looking at how to test different android devices to see if they are vulnerable to the crack vulnerability now some of you might be saying well alexis i thought you're going to show us how to exploit the crack vulnerability well the truth is i would love to have shown you this but there aren't any crack attack um exploitation scripts they are the proof of concept scripts or the video you know released by the original author or the the person who found this vulnerability uh but you know for the purpose or the security of the industry or you know for the goodwill of the industry no attack scripts were released to the public you know uh essentially what the developer said is that he does not want to release a script that can be used negatively to affect organizations etc etc so what he did release are the proof of concept scripts that allow you to test to see if your devices are vulnerable to the key reinstallation attack all right and that's what we're going to be looking at now a lot of you actually have tried to do this but for some reason it didn't work for you all right so let me explain my environment to you uh first of all when it comes down to the wireless adapter i'm not exactly sure what adapters work and what and the ones that don't because some of you have been able to have success with the internal ones but for the most part you guys wanted me to show you how to use these scripts to test to see if the devices are vulnerable to the uh to the uh to the vulnerability all right so uh i'm using a tp-link uh t uh tp-link tl wn70 i'll i'll leave the link or i'll bring up an image of it it is the version one and uh this is pretty much the standard when it comes to w uh to it one of the best wpa2 uh wireless adapters usb wireless adapters uh you know when you talk about network penetration testing and i'm sure you know about this uh you know luckily i was able to get my hands on the version one which allows packet injection uh but i'm not exactly sure what the compatibility is in regards to wireless adapters now as for the github repository that contains the scripts uh i will be linking this in the description you can see that uh this this is the author right over here uh van hoffm i'm not sure if i pronounce that correctly but uh there you go and i'll be linking this in the description now uh when it comes down to uh to testing clients it will give you a very vague idea of how to do this and i'll show you the way that works probably in most scenarios all right and what will happen here is uh i i'm i don't know if if he did uh put the correct uh whether he did list uh the wi-fi adapters that work but in any way uh you don't need to worry about that uh i know if you have some of the the ones that support packet injection that that'll work just fine all right so what you want to do is you want to clone uh this repository and yeah you can just use the clone and git clone from the terminal so you know really really simple just open up your terminal and you want to go into your desktop like so and you know git clone and you want to paste in the link right over there now in my case i already have cloned the repository and i'm just going to change into my folder so crack and there we are we have the crack attack script so i'm going to change into the crack attack script uh scripts directory uh like so and now if i list the files uh and you do too uh pretty much nothing should should be different from the what mine is now before we actually get started we must understand what the key re uh installation attack is or what the vulnerability is all right so and to understand that we need to understand we need to understand the wpa2 handshake all right so let me just explain that for you and to do that i have the help of an image which many of you guys actually suggested that i should use images in videos where i have to explain a lot of concepts all right and this is a simple uh demons a simple image that essentially demonstrates the four-way uh handshake that goes between uh the access point and a client all right during and after authentication all right so i'm going to explain a bit of these terms so the first thing you need to understand is what does ptk stand for the ptk stands for the pairwise transient key all right and this is essentially used for the encryption process and is comprised of five attributes all right you have the uh the pairwise master key which i'm not going to explain right now probably in another video and you have the nonsense and i'm guessing you know that their mac addresses are involved as the mac addresses essentially have to do with media access control all right so let me explain a few things here uh the ap stands for access point sta sh essentially stands for station or you can say client whatever you want to call it uh the nonce i'll explain that in a second uh what else do i need to explain yes what does uh the mic stand for the mic stands for the message identification codes and again i used to prove uh or actually used for the uh for authentication and to prove authenticity of the packets that are being sent back and forth all right they're not they don't have anything to do with the encryption process all right so uh the ptk stands for the pairwise transient key i've already explained and then uh you can see it tells you that in the first case the station constructs the ptk which is then sent uh we we then have the message identification which is then sent with the nonce created by the client all right so i'll explain that in a second now what's happening here let me explain the process so the access point is going to transmit the access point nonce to the station or the client all right the client then constructs the pairwise transient key and sends it with an announce of its own that it generated and it sends it with the uh it's it essentially sends it with the message identification code for authentication all right the access point uh let me just enlarge this uh if kali linux will let me do that the access point then creates or constructs the pairwise transient key and sends it back to the client with a gtk so what is the gtk i'm not going to explain what it does but the gt case is essential is essentially uh stands for the group temporal key all right which essentially allows the client to air to um to uh what's the correct word to view unauthenticated traffic i'll i'll make a few videos explaining all of this but for now just let's keep it to that and then finally the client sends back to the access point and of the on acknowledgement packet and the authentication is complete and the client is then free uh to to use the network and you know to do whatever he or she wants to i'm guessing there's a user behind the client all right so that is essentially the four-way handshake now when it comes down to the where the crack attack comes into play here is the the crack attack is essentially a sort of man in the middle attack that during the authentication process that allows uh the blocking of the uh the negotiated pairwise transient key and allows attackers to install their own to install their own pairwise transient key and essentially it involves a lot of blocking of packets and essentially the attacker is is really forcing a a key reinstall in the network essentially cheating the access point or the client or whatever you look at it with the pairwise transient key now as i mentioned no attack scripts for this vulnerability have been released uh you know thankfully the developers of these scripts or the the person who found out about the researchers uh you know for the for the betterment of you know the world we live in did not release any attack scripts because there would be a lot of irresponsible people out there who would actually you know go and start attacking networks you know for the wrong purposes all right in our case we are going to be testing our devices or you know you can test your devices to see if they are vulnerable to the key reinstallation attack all right so we are finally done explaining the four-way handshake now let me just close that up and uh we want to make sure we are in the terminal so the first thing you need to do or you must do is you need to install uh you need to install the prerequisites or the dependencies for the script to run or for everything to run smoothly now they do post them in the github repository so you can actually do that right now you have it right over here so you can install these dependencies i already have them installed but i can just do it uh to show you that i do it'll probably just tell me to reinstall a few because there aren't any updates so apt-get install uh updated my repository and there we are so i'm just gonna hit yes and it's going to install uh it's going to install the the two newly uh yeah so it's just upgrading them so i'll wait for that to complete and uh once you've installed the dependencies we now need to uh we now need to start working with the the host apd all right so i'll show you how to do that right now uh and when working with the host apd we obviously also have to compile it uh this is where people had a few issues and i'll show you what worked for me and hopefully it does for you all right and uh in in addition i have a few devices that are vulnerable to the key reinstallation attack some android devices i'll be posting screenshots of me connecting and i'll show you that in a second they are older android devices that are running you know old versions of android like kitkat lollipop marshmallow etc all right i haven't got the chance to try it on an oreo device yet uh probably because my nexus crashed on me and uh yeah it's it's just you know it's in a boot loop and i haven't had a chance to fix that so yeah that's also something that i'll be looking to fix uh but that's for another video if i do eventually uh make a video on that so now we have installed the dependencies so let me just clear that up and let's list the file so the first thing we need to do is we need to compile the host apd so we're going to change our directory into the host apd uh for some reason kali froze on me there so uh host apd and once in there we're going to list the files and i've already compiled my files now to compile it is really very simple uh all we need to focus on first is the def config we need to copy that into the config file so if i list all the files here uh and i just go to the top uh we need to copy it into the config file right over here and to do that is really very simple so what we need to do first is we need to say config sorry we need to copy and we're going to say def config into the uh we need to copy it into the config file itself so config and once you hit enter it's just gonna copy it there so don't worry about that and once that's copied you can then start compiling and to compile we simply type in make uh and j make j and two and we hit enter and it's gonna compile now of course you you are not going to have as many files as i do over here that's fine all right but once it's compiled you're gonna have all of these files just give it a few seconds to compile and you should be done all right so once the host apd is configured you now need to work with the configuration file and i'll show you that in a second but before we do that we now need to talk about your wireless adapter all right so your wireless adapter is going to be extremely important all right so we'll go back and i'll show you what i'm talking about all right so uh let's just go back here and i'm just going to list the files in there we want to go into the crack attack folder right over here so change folder crack attack like so and i'm just going to clear the terminal list the files in there and now when we talk about the files that we will be using we'll be using the crack test client or python file now depending on the uh network adapter the wireless adapter that you are using you will face a a few errors that you know might be uh demoralizing but don't worry if you are using any tp-link adapter i encourage you to run this script right over here they disable hw crypto dot uh dot dot shell file all right or hardware uh cryptography the the hardware cryptography shell script so i want you to run that script it's very simple just run disable uh oops they disable our cryptoscript and uh once you've uh you've run it it's gonna tell you to reboot your computer all right make sure you reboot it now you can see that if i type in ifconfig or actually sorry um iwconfig you can see that um i have my uh i have my lan zero here and for forget about this adapter i'll explain that in a second i have my land zero um i have my land zero there i have my land zero inserted or it's active uh on my computer and if you look at my network manager i do not have it i do not have it active so that's the second thing you need to do is to avoid interference you want to make sure that your network manager so manager you want to stop that so network service network manager stop or you can use the the service control manager to stop it and now once it's stopped now you need to actually change the interface you want to use in the host apd configuration file to do that i'm just going to open up the crack folder here because i want to show you the the actual editing i'm going to go to host apd and i'm just going to go to the host apd uh configuration file and uh now you want to change your your interface which will be at the top right over here you you you you do not need to use the interface in monitor mode or you do not need to change it you know using m1 ng simply change the interface uh right over here to your interface name to your wireless interface name in my case it's wlan0 and once that is done you just want to hit save and once and once that's done you're good now and it comes down to the access point that it is going to create uh it's going to call it a test network right over here and i believe the password is a b c d e f g h uh which i'm not sure where it was printed anyway that is the default password which i believe you can change if you just go through the script uh through the configuration file right over here all right so uh you can configure the uh the host apd configuration file uh the way you want it and once you've configured and changed the interface name there we are now almost ready to go all right so uh we've successfully installed the dependencies we have compiled the host apd files uh we have now changed the host apd configuration file and uh if you're running a tp-link uh adapter make sure you have run the disable uh the script right over here the disable hw cryptos dot shell script if you're running an alpha device an alpha wireless adapter you do not need to run that script all right so once we are ready to go uh we essentially simply need to to get started and we can get started by uh essentially running the crack test client.python file right over here so again make sure your service uh your network manager is stopped and we're good to go all right so i have my device on in my hands right now and what i'm going to do is i'm going to just run the script the python script so crack test uh crack uh test client.python file i'm gonna hit enter all right and give that a few seconds to start running and uh it should start telling that the access point has been created so you can see that um yeah there we are the access point has been created and if it gives you the error in uh if it gives you an error essentially telling you that uh telling you to reset the uh the pn 4 to reset the pn4 gtk uh don't worry about that as i mentioned the whole idea or the whole process is to do with the uh well with the authentication process but again do not worry about what that means right now if you want to know what the gtk means essentially the gtk is is to do with the group temporal key and the fact that uh you are able to access the network after uh after authentication in this case this wireless access point does not have any internet connection okay so yeah it'll keep on giving you the error reset pn for the group temporal key so don't worry about that if you do get that error all right so i'm just i'm on my device now and i can see the test network and i've connected to it and as you can see uh it's going to tell me that yes dhcp reply it was able to connect and uh you can see that it's going to tell me over here we have a reuse detected which means that the client reinstalled the pairwise key so i guess this device is not vulnerable to the uh to the to to the crack attack or the key installation attack let me now connect with my other device which is my android tablet which i believe was vulnerable to this attack but let me just confirm that right now all right so i'm just going to connect to it right now i'll probably post a screenshot in fact let me do that right now uh i'm just i'm just going to post the screenshot right over here from my tablet and i'm just gonna post it as i connect to it uh by the way the password for the test network is abcdefgh and i've connected and as you can see we have it over here the client does not reinstall the group uh the group key in the four uh in the four-way handshake which again is a good sign which means this device isn't vulnerable as well uh now when it comes down to the device being vulnerable as i've mentioned this is different for every device and it's going to keep on sending the four-way message as you can see where the gtk forget about the group temporal key that is really dependent on uh on your access point and whether or not you are using uh you are using an internet or you are providing internet access through the through the access point itself all right so this is a fantastic way of testing your devices to see whether they are vulnerable to the key reinstallation attack let me know what you guys are able to find or are able to to deduce from the script if you any of devices are and what the patterns are in regards to the operating system what is the most vulnerable operating system do this you can also test your linux uh you can also test your linux devices and yeah so uh you know uh fantastic so if i just connect here and browse again i think i have one of my devices is vulnerable so uh hopefully i can get to demonstrate that yes there are some devices that are vulnerable to this so i'm just gonna try and connect and browse here uh one second let's see if this does work uh for some reason uh yeah let me just connect um let me just see here why this is i'm gonna just disconnect and connect one once more with uh the device uh for some reason yeah the script failed and i'm just gonna run it one more time uh it's probably because i exited i'm actually emulating a device here so just give me a second i'm just gonna connect it to it right now apologies for the delay and we'll wait for this so essentially what we're looking for is the uh the reuse it's essentially going to detect a reuse and that will mean that your device is vulnerable so i've connected and yeah for some reason it doesn't seem to be vulnerable right now which is weird because i actually tested this device or i'm not sure what error i got uh again let me let me just test the other device that i have here uh which is weird again as i mentioned because one of these was actually vulnerable to the attack but if they aren't well i guess that that means that i have some really good secure devices here anyway that is simply how to test your devices uh you know for the key reinstallation attack let me know what you guys are able to find out or let me know what you guys are able to find with the script yourselves and uh yeah if you have any issues just let me know in the comment section and i'll be sure to help you with configuring the script that being said that's gonna be it for this video guys if you found value in this video please leave a like down below if you have any any questions or suggestions let me know in the comment section or on my social networks and i'll be seeing you in the next video peace guys [Music] you