2

I recently played a bit with my hardware pocket size IV WEP sniffer. It's a 5v tool that i use in my lab when bored:

https://www.youtube.com/watch?v=jJyRaWrnbJg

In my tests i figured out one of my MIFI routers is sending data packets as QOS_DATA, while the other one is sending DATA.

I wrote a bruteforcer years ago for WEP, that does the magic by generating wordlist on the fly and doing the decryption ( later ).

I noticed however that it doesn't work on QOS_DATA packets, even though they are no different than DATA but prefixed with 2 bytes header.

So i added 2 bytes forward for QOS_DATA frames - in order to position for the IV, DATA and ICV properly.

And went with the testing, where

a) MIFI is 64bit encrypted (24b for IV, 40b for KEY: ola13) sending QOS

b) MIFI is 64bit encrypted (24b for IV, 40b for KEY: MYKEY) sending DATA

And just for the sake of clarity, i add snapshots from WireShark too.

TEST A - Cracking WEP QOS

enter image description here

Unfortunately the cracker does not work even though KEY has been provided.

WEPCracker (c) Codemaster 2015
Using userkey: ola13
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 121 0/248

IV: 32 0E 32 

DATA: 9B 0C 9E 85 D0 4E 45 3A C1 0A 4A 70 6A 39 C1 76 0E D8 24 9C A6 28 DF A5 A0 2D D9 1B F5 B5 6D 50 1F B8 06 86 FA 5D 5C 14 FC FE 23 66 2A 30 79 A9 D0 32 8E BF 3D 7A 7D 87 36 5A 96 F7 5F 98 F7 C9 F3 93 4B 69 22 06 37 93 92 A4 B1 02 29 88 4D 81 1C F0 76 E1 32 63 81 

ICV: 4D D7 6D 5E 
CRC Check: 8a6d3411 / 1cdf4421 [ola13]
Not found, tried with key ola13

TEST B - Cracking WEP DATA

enter image description here

For DATA it works without a problem.

WEPCracker (c) Codemaster 2015
Using userkey: MYKEY
- Found Data packet for BSSID 00:23:cd:1f:73:b0, Length 108 0/5

IV: CE A2 6F 

DATA: FC 98 7D DD CA 59 74 19 2A A5 79 B6 20 BC 61 89 75 E3 31 EC 27 E8 2D 6D 28 3E 87 1B 25 41 0A A5 F5 21 CB 11 D2 57 FF 09 69 48 6C 41 69 37 87 98 30 F9 A2 34 38 FC 5C 7E F3 FB DB 03 6B 68 25 3A CA C0 03 07 ED AF 08 8C 23 25 28 91 

ICV: CD 24 FF 64 

CRC Check: 4c627c0d / 4c627c0d [MYKEY]
[!] Potential KEY found (MYKEY)

Additional thing i noted for QOS

Whatever the packet, it seems i get always the same CRC32 calculated 1cdf4421

QOS CRC32 DUMP ON ALL PACKETS

WEPCracker (c) Codemaster 2015
Using userkey: ola13
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 121 0/248
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 106 1/248
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 106 2/248
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 106 3/248
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 106 4/248
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 106 5/248
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 106 6/248
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 106 7/248
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 106 8/248
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 106 9/248
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 106 10/248
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 106 11/248
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 106 12/248
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 106 13/248
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 106 14/248
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 106 15/248
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 106 16/248
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 106 17/248
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 106 18/248
- Found Data packet for BSSID f8:01:13:c9:15:25, Length 106 19/248
CRC Check: 203ad131 / 1cdf4421 [ola13]
CRC Check: 2ea421c8 / 1cdf4421 [ola13]
CRC Check: 2a4cbe7f / 1cdf4421 [ola13]
CRC Check: ba9ff515 / 1cdf4421 [ola13]
CRC Check: e9ad711c / 1cdf4421 [ola13]
CRC Check: eac88ae5 / 1cdf4421 [ola13]
CRC Check: 3b8b1585 / 1cdf4421 [ola13]
CRC Check: 5db4c3de / 1cdf4421 [ola13]
CRC Check: 5e729189 / 1cdf4421 [ola13]
CRC Check: 952ee95f / 1cdf4421 [ola13]
CRC Check: fbb93926 / 1cdf4421 [ola13]
CRC Check: b343645f / 1cdf4421 [ola13]
CRC Check: 32e27718 / 1cdf4421 [ola13]
CRC Check: 57d1cb67 / 1cdf4421 [ola13]
CRC Check: 7b0aa646 / 1cdf4421 [ola13]
CRC Check: d88dbc28 / 1cdf4421 [ola13]
CRC Check: a10c8c1b / 1cdf4421 [ola13]
CRC Check: 2dcd9381 / 1cdf4421 [ola13]
CRC Check: 26e6c087 / 1cdf4421 [ola13]
CRC Check: ec9e9cae / 1cdf4421 [ola13]
CRC Check: c5c4ae8b / 1cdf4421 [ola13]
CRC Check: 974c8ff6 / 1cdf4421 [ola13]

DATA CRC32 DUMP ON ALL PACKETS

 WEPCracker (c) Codemaster 2015
Using userkey: MYKEY
- Found Data packet for BSSID 00:23:cd:1f:73:b0, Length 108 0/5
- Found Data packet for BSSID 00:23:cd:1f:73:b0, Length 86 1/5
- Found Data packet for BSSID 00:23:cd:1f:73:b0, Length 86 2/5
- Found Data packet for BSSID 00:23:cd:1f:73:b0, Length 86 3/5
- Found Data packet for BSSID 00:23:cd:1f:73:b0, Length 86 4/5
Total number of Words: 11881376
CRC Check: 4c627c0d / 4c627c0d [MYKEY]
CRC Check: db260e81 / db260e81 [MYKEY]
CRC Check: db260e81 / db260e81 [MYKEY]
CRC Check: db260e81 / db260e81 [MYKEY]
CRC Check: db260e81 / db260e81 [MYKEY]

DECRYPTION PROCESS

Let me also explain the process of encryption.

KEY = WEP passphrase (either ola13 or MYKEY as seen above)

IV = Initialisation Vector

ICV = Integrity Check Value

  1. I Get [IV][DATA][ICV] out of the QOS or DATA WEP encrypted packet
  2. I Run RC4 on the [DATA][ICV] with [IV][KEY]
  3. From that moment i have a decrypted [DATA][ICV]
  4. I Run CRC32 on [DATA]
  5. I Compare the CRC32 output with decrypted [ICV]
  6. If they match, the [KEY] is a hit
  7. If they don't match, they [KEY] is wrong

Is there any difference in decrypting WEP Protected QOS and DATA or i am missing some bit here..

Thanks in advance.

1

Fault on not taking into consideration some drivers do not provide Radiotap header so no FCS was counted.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.