My apartment complex uses PPPoE CHAP authentication for internet (Mikrotik router), I want to switch their provided router with my own, however they aren't willing to give me my password.

I have fooled the router by connecting it's WAN port to my computer and running a PPPoE server on it, however, the router does not answer PPPoE PAP requests, so I am unable to recover the password that way.

That said, I can provide any PPPoE CHAP id and challenge value, and the way I understand it, CHAP uses MD5(id . password . challenge), are there any id and challenge values I could provide that would speed up cracking it via hashcat?


Probably Not Feasible


In CHAP, the authenticator sends a challenge, and then the client responds by hashing the secret plus some other data from that challenge.

This is comparable to sending a new salt every time, and it does not represent the scenario hashcat was designed for.

That said, the response contains an MD5 hash of challenge ID + secret + challenge value. Two of those values are transmitted over the wire. The resulting MD5 hash is also transmitted, so you have everything you need to recover the secret in theory.

The problem is getting the existing tools to work in this scenario.


You could take three approaches.

  1. You could generate a wordlist consisting of randomly-generated secret candidates and concatenate them with the ID + challenge using rules. (Extremely slow)
  2. You could create custom character sets for each character in the ID + challenge and run a bruteforce mask attack. (Fairly slow)
  3. You could attack similar to option 1, but with a regular wordlist; however, this will only succeed if the secret is in your dictionary. (Fairly fast)


Typical CHAP secret lengths are 12-16 bytes/characters. You could probably run #2 for 8- or 9-character secrets in a reasonable time frame, but longer secrets would be problematic even with high end hardware. You are looking at years, even with dedicated multi-GPU rigs.

This leaves #3 as the only feasible option, which means your efforts are tied directly to the quality of your wordlist and the CHAP secret.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.