Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

WPA Enterpise (WPA-MGT)

1. Finding WPA-MGT networks

You can find these on the 2.4ghz and 5ghz signals:

# dump 2.4ghz
sudo airodump-ng wlan0mon

# dump 5ghz
sudo airodump-ng -b a wlan0mon

In the "auth" column of airodump-ng, check for "MGT".

2. Finding the certificate information

To attack WPA Enterprise we build build our own rogue AP, but to do so, we need to create a certificate. We need to make the certificate with the same information as our target. To capture the information, we need to capture a handshake like in WPA2 attacks.

Use airodump-ng to capture the handshake:

Do a deauth attack:

If successful, you will see "WPA handshake: X"

Open the wpamgt.cap file with WireShark and set the filter to tls.handshake.certificate:

Now extract the certificate with:

Save it as "cert.der" and extract the info using:

The info we need:

3. Setting up Rogue AP

To attack a mistrusted client on an MGT network we have to create a RogueAP with the same ESSID and configuration but with a self-signed certificate, preferably with the same data as the real one in case the client manually verifies the certificate. To do this you can use “eaphammer”.

eaphammer is not allowed on the OSWP exam, instead use freeradius with hostapd-mana.

When this is completed, setup hostapd-mana with:

3.1 Using freeradius with hostapd-mana

First of all, install freeradius

Go to /etc/freeradius/3/certs and open ca.cnf and server.cnf

Modify the underneath values to the obtained information from the certificate:

After that we do the following commands under /etc/freeradius/3.0/certs to generate Diffie Hellman key for hostapd-mana

Next, create a file called mana.eap_user

After that we create a fake access point by creating a file called network.conf under any other directory:

Make sure to point the mana.easp_user file to the right directory. Use hostapd-mana to setup the fake AP:

4. Broadcast deauth to all AP's

With “airodump-ng” we detect the MAC of the clients to perform a deauthentication attack. So we do this attack on both clients in parallel. As there are 2 APs we have to perform the attack against the 2 APs, since disconnecting from 1 may connect to the other instead of to our RogueAP..

Delete -c option if you want to do it in broadcast (Kick all clients) You need to use another interface in monitor mode, Also you need to set the interface to the same channel as the target network before performing the De-authenticate attack, As the following:

Next we sent a broadcast deauth to both AP's while our rogue AP is listening:

If succesful we receive a NETNTLM hash:

5. Crack the hash

5.1 Use asleap

If you cannot use hashcat you can use asleap to get the password instead:

6. Connect to network

Create a hostapd mana config:

Connect:

Get IP:

7. Sources

https://zeyadazima.com/notes/oswplaybook/#attacking-wpa-enterprise

https://r4ulcl.com/posts/walkthrough-wifichallenge-lab-2.0/#18-what-is-juans-wifi-corp-password

PreviousSetting up a Rogue Access PointNextTips and tricks

Last updated