Уязвимость в протоколе Wi-Fi Protected Setup

Discussion in 'Беспроводные технологии/Wi-Fi/Wardriving' started by gpuhash, 30 Dec 2011.

  1. TOX1C

    TOX1C Elder - Старейшина

    Joined:
    24 Mar 2012
    Messages:
    1,135
    Likes Received:
    1,931
    Reputations:
    24
    В таблице не увидел, но этот девайс скорее всего тоже к уязвимым относится. Просьба проверить на живом примере.
    74:d0:2b:84:41:d7 13850319 ASUS DSL-N10E
     
  2. Felis-Sapiens

    Felis-Sapiens Reservists Of Antichat

    Joined:
    21 Jul 2015
    Messages:
    616
    Likes Received:
    3,833
    Reputations:
    171
    Не подходит. В таблице все устройства из базы 3wifi, у которых WPSPIN соответствует этому алгоритму.
     
    dopetik and TOX1C like this.
  3. TOX1C

    TOX1C Elder - Старейшина

    Joined:
    24 Mar 2012
    Messages:
    1,135
    Likes Received:
    1,931
    Reputations:
    24
    Значит у асусов какой-то свой алгоритм. Тоже на базе мак-адреса, заметил, что у них пин-коды идут блоками, в одном блоке много пинов, начинающихся на 0, у других на 4 и т.д.
     
  4. VladimirV

    VladimirV Well-Known Member

    Joined:
    1 Apr 2013
    Messages:
    1,130
    Likes Received:
    6,150
    Reputations:
    57
    Вот таблица начало BSSID и модель к которым подходит данный алгоритм:
    Code:
    00:07:26:2F    Airocon WJ747, firmware: BroadKam_V1.0
    00:0B:2B:4A    Airocon Acorp Sprinter@ADSL W510N, firmware: R8676 IPv6 Acp 4WNE1 5.7R
    00:0B:2B:4A    Airocon Acorp Sprinter@ADSL W520N, firmware: R8676 IPv6 Acp 4WNE2 5.7R
    00:0E:F4:E7    Airocon RTL867x ADSL Modem, firmware: RTK V2.1.1
    00:13:33:AD    Airocon WR4-DP9110, firmware: RTK V2.1.1
    00:13:33:B0    Airocon WELL DA-150N, firmware: RTK V2.1.1
    00:13:33:B1    Airocon AD1501-1T1R, firmware: RTK V2.1.1
    00:13:33:B1    Airocon WR4-DP9110, firmware: RTK V2.1.1
    00:13:33:B5    Airocon AD1504-1T1R, firmware: RTK V2.1.1
    00:13:33:B6    Airocon AD1501-1T1R, firmware: RTK V2.1.1
    00:13:33:B7    Airocon AD1501-1T1R, firmware: RTK V2.1.1
    00:13:33:B8    Airocon AD1501-1T1R, firmware: RTK V2.1.1
    00:13:33:B8    Airocon AD1504-1T1R, firmware: RTK V2.1.1
    00:13:33:B9    Airocon AD1504-1T1R, firmware: RTK V2.1.1
    00:13:33:BB    Airocon AM241W, firmware: RNR4-A1-2x16_v2110831_DS1W_02_130628
    00:13:33:BB    Airocon WELL DA-150N, firmware: RTK V2.1.1
    00:17:7C:24    Airocon DG-BG4300N, firmware: R8676 IPv6 Dgs 4WNE2 5.8R
    00:17:7C:2E    Airocon DG-BG4300N, firmware: R8676_IPv6_DIGISOL_4PWNE2_5CR_16M_1017_1523
    00:17:7C:2F    Airocon DG-HR3400
    00:17:7C:30    Airocon DG-HR1400
    00:17:7C:31    Airocon DG-HR1400
    00:17:7C:31    Airocon DG-HR3400
    00:17:7C:36    Airocon DG-HR3400
    00:17:7C:3D    Airocon DG-HR1400
    00:17:7C:3D    Airocon DG-HR3400
    00:17:7C:41    Airocon DG-HR1400
    00:17:7C:41    Airocon DG-HR3400
    00:17:7C:43    Airocon DG-HR3400
    00:17:7C:44    Airocon DG-HR3400
    00:17:7C:4A    Airocon DG-HR1400
    00:17:7C:4B    Airocon DG-HR3400
    00:17:7C:4D    Airocon DG-HR1400
    00:17:7C:50    Airocon DG-HR1400
    00:17:7C:5A    Airocon DG-HR3400
    00:1A:EF:3D    Airocon Wireless Router
    00:1A:EF:3F    Airocon Wireless Router
    00:1A:EF:40    Airocon Wireless Router
    00:1A:EF:4A    Airocon Wireless Router
    00:1A:EF:4B    Airocon Wireless Router
    00:1A:EF:4C    Airocon Wireless Router
    00:1A:EF:51    Airocon Wireless Router
    00:E0:4B:B3    Airocon Wireless Router
    02:10:18:01    Airocon RTL867x ADSL Modem, firmware: RTK V2.1.1
    08:10:73:47    Airocon Wireless Router
    08:10:73:48    Airocon Wireless Router
    08:10:77:10    Airocon RTL867x ADSL Modem, firmware: RTK V2.1.1
    10:13:EE:01    Airocon JDR4150WN, firmware: RTK V2.1.1
    10:13:EE:05    Airocon WLAN ADSL2+ Router, firmware: RTK V2.1.1
    10:13:EE:06    Airocon WLAN ADSL2+ Router, firmware: RTK V2.1.1
    2C:AB:25:C7    Airocon MC-AWR11, firmware: MODECOM_V1.0
    38:2C:4A:C2    ASUS RT-N12VP Black
    78:8C:54:25    Airocon Eltek A7900, firmware: R8672_IPv6_HADARA_4PWNE1_5CR_16M_0520_1541
    78:8C:54:25    Airocon ENKOM A7900/A7901, firmware: R8672 IPv6 Hdr 4WNE1 5.5R
    78:8C:54:25    Airocon ENKOM A7900/A7901, firmware: R8672 IPv6 Hdr 4WNE1 5.6R
    78:8C:54:29    Airocon Eltek A7900, firmware: R8672_IPv6_HADARA_4PWNE1_5AR_16M_0322_1530
    78:8C:54:29    Airocon Eltek A7900, firmware: R8672_IPv6_HADARA_4PWNE1_5AR_16M_0409_1444
    78:8C:54:29    Airocon Eltek A7900, firmware: R8672_IPv6_HADARA_4PWNE1_5CR_16M_0520_1541
    78:8C:54:29    Airocon ENKOM A7900/A7901, firmware: R8672 IPv6 Hdr 4WNE1 5.6R
    78:8C:54:32    Airocon Eltek A7900, firmware: R8672_IPv6_HADARA_4PWNE1_5AR_16M_0409_1444
    78:8C:54:32    Airocon Eltek A7900, firmware: R8672_IPv6_HADARA_4PWNE1_5AR_16M_0409_1531
    78:8C:54:32    Airocon Eltek A7900, firmware: R8672_IPv6_HADARA_4PWNE1_5CR_16M_0520_1541
    80:3F:5D:F6    Airocon RTL8671 ADSL Modem, firmware: RTK V2.1.1
    94:FB:B2:37    Airocon Wireless Router
    94:FB:B2:3D    Airocon Wireless Router
    94:FB:B2:58    Airocon Wireless Router
    94:FB:B2:5E    Airocon Wireless Router
    94:FB:B2:6F    Airocon Wireless Router
    A8:32:9A:00    Airocon Wireless Router
    BC:96:80:14    Airocon Wireless Router
    BC:96:80:39    Airocon Wireless Router
    BC:96:80:45    Airocon Wireless Router
    BC:96:80:51    Airocon SpeedSurf 504AN, firmware: GAN9.8U26-4-TX-R4B016-PH.EN
    F4:3E:61:0D    Airocon Intercross 4PW, firmware: V2.1
    F4:3E:61:38    Airocon GD-W710G, firmware: GOLDWEB_V1.0
    F4:3E:61:4B    Airocon WIFI-2000 N150-A, firmware: V2.1.1
    F4:3E:61:55    Airocon GD-W810N/ND, firmware: GOLDWEB_V1.0
    F4:3E:61:8C    Airocon Intercross 4PW, firmware: V2.1
    F4:3E:61:8E    Airocon Intercross 4PW, firmware: GAW9.5Z97-4-IC.MGTS-R3B112-RU.EN
    F4:3E:61:8F    Airocon Intercross 4PW, firmware: V2.1
    F4:3E:61:D1    Airocon Intercross 4PW, firmware: GAW9.5Z97-4-IC.MGTS-R3B112-RU.EN
    F4:3E:61:D1    Airocon Intercross 4PW, firmware: V2.1
    F4:3E:61:F7    Airocon TAD-110, firmware: V2.1.1
    FC:8B:97:27    Airocon SpeedSurf 504AN, firmware: GAN9.8U26-4-TX-R4B016-PH.EN
    FC:8B:97:35    Airocon SpeedSurf 504AN, firmware: GAN9.8U26-4-TX-R4B016-PH.EN
    FC:8B:97:38    Airocon SpeedSurf 504AN, firmware: GAN9.8U26-4-TX-R4B016-PH.EN
    
    P.S. К ASUS 38:2C:4A:C2:BC:18 - просто совпало.
     
    #3344 VladimirV, 19 Apr 2016
    Last edited: 19 Apr 2016
  5. henri2002

    henri2002 Active Member

    Joined:
    25 Sep 2013
    Messages:
    379
    Likes Received:
    282
    Reputations:
    3
    можете отдельно выложить компаньон.
     
    TOX1C likes this.
  6. Sves

    Sves Active Member

    Joined:
    7 Dec 2015
    Messages:
    33
    Likes Received:
    186
    Reputations:
    1
    Подскажите, пожалуйста, как правильно подобраться к скрытой точке Reaver-ом?
    Code:
    root@2016:~# wash -i wlan0mon -C
    Wash v1.5.2 WiFi Protected Setup Scan Tool
    Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <[email protected]>
    mod by t6_x <[email protected]> & DataHead & Soxrok2212
    
    BSSID  Channel  RSSI  WPS Version  WPS Locked  ESSID
    --------------------------------------------------------------------------------------
    58:6D:8F:63:ХХ:ХХ  1  -63  1.0  No  (null)
    
    root@2016:~# airodump-ng wlan0mon -a --channel 1
     CH  1 ][ Elapsed: 12 s ][ 2016-04-19 23:49   
     BSSID  PWR RXQ  Beacons  #Data, #/s  CH  MB  ENC  CIPHER AUTH WPS  ESSID
     58:6D:8F:63:ХХ:ХХ  -62  0  2  1  0  1  54e  WPA2 CCMP  PSK  1.0  <length:  7>
    
     
  7. atlas28

    atlas28 Active Member

    Joined:
    23 May 2015
    Messages:
    224
    Likes Received:
    173
    Reputations:
    1
    По BSSID не работает? Тогда для начала попробуй узнать ESSID. Просто запусти airodump и слушай эту точку, пока к ней кто-нибудь не подключится. А потом уже добавишь этот параметр в ривер.
     
    startless and Sves like this.
  8. Sves

    Sves Active Member

    Joined:
    7 Dec 2015
    Messages:
    33
    Likes Received:
    186
    Reputations:
    1
    По BSSID не соединяется. ESSID знаю, но тоже не может соединиться ([!] WARNING: Failed to associate with 58:6D:8F:63:ХХ:ХХ (ESSID: Touareq)).
     
  9. binarymaster

    binarymaster Elder - Старейшина

    Joined:
    11 Dec 2010
    Messages:
    4,717
    Likes Received:
    10,195
    Reputations:
    126
    Я скорее на JS перепишу, и впихну в 3WiFi. В качестве бонуса, так сказать.
    См. https://forum.antichat.ru/posts/3975583
     
  10. startless

    startless Member

    Joined:
    20 Jun 2015
    Messages:
    135
    Likes Received:
    96
    Reputations:
    0
    Из неизданного, так сказать:

    Ne Podklyuchaisya Ko mne@
    mne_ne_zjalko))
    Hren wam\ a ne wi-fi
     
  11. atlas28

    atlas28 Active Member

    Joined:
    23 May 2015
    Messages:
    224
    Likes Received:
    173
    Reputations:
    1
    Попробуй выполнить ассоциацию при помощи aireplay-ng (--fakeauth), а в ривере указать ключ -A.
    А вообще WPS то там точно включен?
     
  12. atlas28

    atlas28 Active Member

    Joined:
    23 May 2015
    Messages:
    224
    Likes Received:
    173
    Reputations:
    1
    Пока не проверял, но автор написал, что исправил баг в pixiewps 1.2 с роутерами SERCOMM https://github.com/wiire/pixiewps/issues/25

    UPD: проверил, работает, однако приходится очень долго ждать, если явно не указать дату (--start --end). В 1.1 такого не было. Отписал автору.
     
    #3352 atlas28, 23 Apr 2016
    Last edited: 23 Apr 2016
  13. CRACK211

    CRACK211 Elder - Старейшина

    Joined:
    16 Sep 2009
    Messages:
    1,050
    Likes Received:
    1,128
    Reputations:
    11
    подскажите пожалуйста , есть ли алгоритмы для zte? билайн 4g.
    ZTE 4G Wi-Fi Router MF65M
     
    #3353 CRACK211, 27 Apr 2016
    Last edited: 27 Apr 2016
  14. binarymaster

    binarymaster Elder - Старейшина

    Joined:
    11 Dec 2010
    Messages:
    4,717
    Likes Received:
    10,195
    Reputations:
    126
    Заходил в админку подобного девайса, но по WPS ничего не нашёл.
    [​IMG]
     
    Payer and paulo like this.
  15. TOX1C

    TOX1C Elder - Старейшина

    Joined:
    24 Mar 2012
    Messages:
    1,135
    Likes Received:
    1,931
    Reputations:
    24
    Какие же там мерзкие пароли с завода стоят. Нужен и для них алгоритм, благо не в них одних он используется.
    в укротелекомовских старых роутерах zte тоже нет пина впс в админке, но пин то есть, и для всех одинаковый
     
    #3355 TOX1C, 27 Apr 2016
    Last edited: 27 Apr 2016
  16. CRACK211

    CRACK211 Elder - Старейшина

    Joined:
    16 Sep 2009
    Messages:
    1,050
    Likes Received:
    1,128
    Reputations:
    11
    и какой же если не секрет?
     
  17. TOX1C

    TOX1C Elder - Старейшина

    Joined:
    24 Mar 2012
    Messages:
    1,135
    Likes Received:
    1,931
    Reputations:
    24
    94229882
     
    dopetik, 4Fun and quite gray like this.
  18. Felis-Sapiens

    Felis-Sapiens Reservists Of Antichat

    Joined:
    21 Jul 2015
    Messages:
    616
    Likes Received:
    3,833
    Reputations:
    171
    Мне наконец-то удалось составить алгоритм генерации WPSPIN для некоторых моделей ASUS (и, как оказалось, Airocon). Итак, держите:

    [​IMG]

    Airocon 1.00
    Airocon 150Mbps Wireless N ADSL2/2+ Modem Router, firmware: RTK V2.1.1
    Airocon ADN-4101, firmware: V1.9
    Airocon ADSL Modem, firmware: V2.1.1
    Airocon ADSL Modem, firmware: V2.11
    Airocon ADSL Router, firmware: GAN9.9W7-4-VO-R6B011-VN.EN
    Airocon ADSL Router, firmware: V2.1.2
    Airocon AIRDSL A1144, firmware: RTK V2.1.1
    Airocon ASUS DSL-N10E, firmware: V2.1.14
    Airocon ASUS DSL-N10E, firmware: V2.1.15_EU
    Airocon ASUS DSL-N10E, firmware: V2.1.15_TR
    Airocon ASUS DSL-N10E, firmware: V2.1.16_APAC
    Airocon ASUS DSL-N10E, firmware: V2.1.16_EU
    Airocon ASUS DSL-N10E, firmware: V2.1.19_EU
    Airocon ASUS DSL-N10E, firmware: V2.1.20_EU
    Airocon CNet Wireless-N ADSL Router, firmware: CNet V1.1
    Airocon DIR-600
    Airocon DIR-612
    Airocon D-Link DIR-600M
    Airocon DR-820, firmware: Across DR-820 _V1.0
    Airocon DR-921, firmware: Across DR-921 _V1.0
    Airocon DSL-2730E, firmware: SEA_1.00
    Airocon DSL-N10S, firmware: V2.1.16_APAC
    Airocon DSL-N10S, firmware: V2.1.17_APAC
    Airocon DSL-N12E, firmware: V2.1.15_EU
    Airocon DSL-N12E, firmware: V2.1.15_TR
    Airocon DSL-N12E, firmware: V2.1.16_APAC
    Airocon DSL-N12E, firmware: V2.1.16_EU
    Airocon DSL-N12E, firmware: V2.1.17_APAC
    Airocon DSL-N12E, firmware: V2.1.19_EU
    Airocon DSL-N12E, firmware: V2.1.20_EU
    Airocon F9J1004v1/F9J1005v1, firmware: 1.00.02
    Airocon F9J1004v2/F9J1005v2, firmware: 1.00.01
    Airocon GD-W809N, firmware: Goldweb GD-W809N _V1.0
    Airocon GD-W810N/ND, firmware: GOLDWEB_V1.0
    Airocon GD-W810ND, firmware: Goldweb GD-W810ND _V1.0
    Airocon GD-W910ND, firmware: Goldweb GD-W910ND _V1.0
    Airocon IP-WDL-RT150-P4, firmware: V02.01 Build.131031 Rel.0643670
    Airocon IP-WDL-RT150-P4, firmware: V02.02 Build.140304 Rel.0651388
    Airocon IP-WDL-RT150-P4, firmware: V02.02 Build.140721 Rel.0637816
    Airocon IP-WDL-RT1T1R-B, firmware: V02.01 Build.131101 Rel.0653054
    Airocon IP-WDL-RT2T2R, firmware: V02.02 Build.140728 Rel.0655111
    Airocon JCG, firmware: JWS-N530R
    Airocon LEO-150N-AD, firmware: LEO-150N-AD_V1.0.0.1_18082014
    Airocon LKW150-21A2, firmware: V2.1.2
    Airocon LKW300-21A3, firmware: V2.1.2
    Airocon MC-AWR11, firmware: MODECOM_V1.0
    Airocon Netis Modem Router, firmware: RTK V2.1.1
    Airocon Realtek Wireless Router, firmware: RTK V2.1.1
    Airocon Realtek Wireless Router, firmware: RTK V2.2.2
    Airocon RTA04N, firmware: RTA04N_GVT_009
    Airocon RTL8671 ADSL Modem, firmware: V01.10 Build.120329 Rel.0656648
    Airocon RTL867x ADSL Modem
    Airocon RTL867x ADSL Modem, firmware: BL V2.1.1
    Airocon RTL867x ADSL Modem, firmware: RTK V2.1.1
    Airocon RTL867x ADSL Modem, firmware: SEA_1.00
    Airocon RTL867x ADSL Modem, firmware: SEA_1.01
    Airocon RTL867x ADSL Modem, firmware: V01.11 Build.130424 Rel.0653855
    Airocon RTL867x ADSL Modem, firmware: V01.11 Build.131217 Rel.0648017
    Airocon RTL867x ADSL Modem, firmware: V01.12 Build.140115 Rel.0638469
    Airocon RTL867x ADSL Modem, firmware: V02.00 Build.121109 Rel.0653605
    Airocon RTL867x ADSL Modem, firmware: V02.01 Build.130218 Rel.0658357
    Airocon SWARAJ, firmware: SW200 V2.1.1
    Airocon SWARAJ, firmware: SW200 V2.1.2
    Airocon TD854W, firmware: V01.09 Build.111122 Rel.0657362
    Airocon TD854W, firmware: V01.11 Build.131227 Rel.0660914_TTNET
    Airocon TEW-719BRM, firmware: V1.02.B10
    Airocon Virtual Web Router
    Airocon WL-P-D408, firmware: V2.1.2
    Airocon ZE-W810ND, firmware: ZENET ZE-W810ND _V1.0
    Airocon ZW444, firmware: ZW444_V1.0
    Airocon ZW888, firmware: ZW888_V1.0
    Airocon ZW919, firmware: ZW919_V1.0
    ASUS DSL-N10_C1 ADSL
    ASUS DSL-N10-C1 ADSL
    ASUS DSL-N12E_C1 ADSL
    ASUS DSL-N12E-C1 ADSL
    ASUS DSL-N12U_C1 ADSL
    ASUS DSL-N12U-C1 ADSL
    ASUS DSL-N14U ADSL
    ASUS RT-AC1200, firmware: 2.0
    ASUS RT-AC1200G+, firmware: 2.0
    ASUS RT-AC51U Black
    ASUS RT-AC51U, firmware: 2.0
    ASUS RT-G32
    ASUS RT-G32
    ASUS RT-G32 Rev.C1
    ASUS RT-N10
    ASUS RT-N10
    ASUS RT-N10 Rev.B1
    ASUS RT-N10 Rev.C1
    ASUS RT-N10+
    ASUS RT-N10E
    ASUS RT-N10LX
    ASUS RT-N10P Black
    ASUS RT-N10P, firmware: 2.0
    ASUS RT-N10PV2 Black
    ASUS RT-N10U
    ASUS RT-N10U Black
    ASUS RT-N11
    ASUS RT-N11P
    ASUS RT-N11P Black
    ASUS RT-N11P, firmware: 2.0
    ASUS RT-N12
    ASUS RT-N12 Black
    ASUS RT-N12 Rev.C1 Black
    ASUS RT-N12 Rev.D1 Black
    ASUS RT-N12+ Black
    ASUS RT-N12+, firmware: 2.0
    ASUS RT-N12D1, firmware: 2.0
    ASUS RT-N12E
    ASUS RT-N12E_B1, firmware: 2.0
    ASUS RT-N12HP_B1, firmware: 2.0
    ASUS RT-N12LX
    ASUS RT-N12VP
    ASUS RT-N12VP Black
    ASUS RT-N12VP, firmware: 2.0
    D-Link DIR-615
    Virtual Web 0.9 (proxy server)

    Ибо картинки на хостингах не вечны:
    Code:
    BSSID = b0:b1:b2:b3:b4:b5
    WPSPIN = p0 p1 p2 p3 p4 p5 p6 s
    p_i = (b_(i mod 6) + b5) mod (10 - (i + b1 + b2 + b3 + b4 + b5) mod 7)
     
    dopetik, 4Fun, quite gray and 30 others like this.
  19. CRACK211

    CRACK211 Elder - Старейшина

    Joined:
    16 Sep 2009
    Messages:
    1,050
    Likes Received:
    1,128
    Reputations:
    11
    Спасибо вам большое за ваш подарок!!))) дай вам бог здаровья и благополучия) 119 устройств))
     
    #3359 CRACK211, 27 Apr 2016
    Last edited: 27 Apr 2016
    4Fun, sha9 and TOX1C like this.
  20. binarymaster

    binarymaster Elder - Старейшина

    Joined:
    11 Dec 2010
    Messages:
    4,717
    Likes Received:
    10,195
    Reputations:
    126
    Красота-то какая! :rolleyes:
     
    #3360 binarymaster, 27 Apr 2016
    Last edited: 27 Apr 2016
    4Fun, sha9, startless and 5 others like this.