802.11r Fast Transition Roaming (FT-PSK)

[Rozin14]

The AP I'm trying has 802.11r enabled. (Fast BSS something). First of all I'm amazed to say its only Hcxdumptool that manages to capture something. All other dumptools only managed to capture half handshake (which was found to be useless later) or sometimes nothing at all. (Bettercap and airodump)

But Hcxdumptool always capture handshake that contains FT using PSK. It doesn't capture handshake containing just normal PSK. Hashcat doesn't support FT PSK as of now. I'm asking how can such an AP be attacked for successful results?

[ZerBea]

As you noticed that, hcxdumptool is able to attack an AP running FT-PSK and to capture the entire handshake, because PSKs are easy to recover.
This applies to all PSK related modes, even if the big open source hash crackers hashcat and john (JtR) can't do it yet.
You'll see a "+" in the S column if AKM PSK is detected:
S = + AP display : AUTHENTICATION KEY MANAGEMENT PSK

As long as hashcat or (JtR) haven't implemented this hash mode, hcxpcapngtool will not convert this hashes.
Luckily hcxdumptool is able to downgrade CLIENTs to WPA2 and on a successful attack (M1M2ROGUE) hcxpcapngtool convert this MESSAGE PAIR (M1M2E2) to a hc22000 line.

hcxdumptool show a successful attack on a CLIENT on the bottom of the spit screen (column 2):
2 = + CLIENT display : got EAPOL M1M2 (ROGUE CHALLENGE) hashcat / (JtR) can work on.

On option --rds=1 successful attacks are sorted to the top.

BTW:
I added an example to (including all calculated session keys) to your feature request here:
hashcat/hashcat#3887 (comment)

[Rozin14]

Sorry for the dumb question. I'm a noobie learning all this crypt stuff.

Is it possible to calculate, manually by us, all the required data as shown in your example and convert it into usable 22000 hash or any other hash that hashcat can work on??

[ZerBea]

No, that is not possible. It is mandatory that the new hash line contain MD-ID, R0KH-ID and R1KH-ID, because this values are part of the formula.

I have edited my comment on hashcat forum and added a suggestions of the new hash lines:

WPA*03 == FT-PSK PMKID
WPA*04 == FT-PSK EAPOL

BTW:
Once you got a PSK, Wireshark is able to decode the entire traffic.

[Rozin14]

Right. About the M1M2Rogue of Hcxdumptool. Do i have to give any extra parameter command to make Hcxdumptool give priority/focus on M1M2Rogue attack than doing the handshake attack??

[ZerBea]

Due to possible MAC randomization of the CLIENTs, we can't set target filter options.

$ sudo hcxdumptool -i INTERFACE -c AP_CHANNEL --bpf=protect_own.bpf --attemptapmax=100000
To protect own devices it is mandatory to add them to a BPF.
It is not guaranteed that this attack is working as expected, because it is mandatory that the user types the PSK.

[Rozin14]

I have seen about bpf filters in other discussions. But i may have got it wrong (the parameters). What is addr1,2 and 3 really mean basically? What would be the best bpf filter params in my case for m2rogue attack? I'm attacking 3 different bssid of the same router hardware. Right now I'm using three" wlan addr3 bssid" of those bssids seperated by "or". Is that enough?

[ZerBea]

A good explanation is here:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-1/Enterprise-Mobility-8-1-Design-Guide/Enterprise_Mobility_8-1_Deployment_Guide/Chapter-11.pdf

[ZerBea]

First of all, there is no way to filter a CLIENT that is running MAC RANDOMIZATION.

The MAC header (containing the address fields) isn't easy to understand, because the addresses depend on the frame typ.
Basically you can say (e.g. on management frames):

ADDR1 == to station
ADDR2 == from station
ADDR3 == ACCESS POINT

Let's say you want to protect your ACCESS POINT, just add "not wlan addr 3 xx:xx:xx:xx:xx:xx" to you BPF.
Once the filter is active all frames that have this ADDR3 are disregarded.

[ZerBea]

If you want to attack three different APs:

wlan addr1 11:11:11:11:11:11 or wlan addr2 11:11:11:11:11:11 or wlan addr3 11:11:11:11:11:11
or wlan addr1 22:22:22:22:22:22 or wlan addr2  22:22:22:22:22:22 or wlan addr3  22:22:22:22:22:22
or wlan addr1 33:33:33:33:33:33 or wlan addr2  33:33:33:33:33:33 or wlan addr3  33:33:33:33:33:33
or wlan addr3 ff:ff:ff:ff:ff:ff

That makes sure that all frames addressed to the APs (addr1), all frames coming from the APs (addr2) and all frames in which the APs are mentioned (addr3) are captured.
It also makes sure that you get undirected PROBEREQUEST frames (ff:ff:ff:ff:ff:ff:) which may contain a PSK in the clear.

That sounds complicate, but once you understand it, you'll get benefit of an extreme fast filtering directly inside kernel space.