hashcat Forum

Full Version: hcxtools - solution for capturing wlan traffic and conversion to hashcat formats
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
Normally we wait up to 2 minutes to get a GPX fix. If we didn't get it, we deactivate GPS.

EDIT:
I pushed another update. Now we leave the GPS fix loop if we didn't receive a GPRMC sentence within the first 120 received sentences.

If we got no fix from the device, output looks like this (after the period of at least 2 minutes):
$ sudo hcxdumptool -i wlp3s0f0u2 --filtermode=1 --filterlist_ap=$HOME/Source/raspberry/filterlistap --filterlist_client=$HOME/Source/raspberry/filterlistap -o wpatst.pcapng --enable_status=1 --gps=/dev/ttyACM0
initialization...
waiting up to 2 minutes seconds to get GPS fix
GPS failed

start capturing (stop with ctrl+c)
NMEA 0183 RMC SENTENCE..: N/A
INTERFACE NAME..........: wlp3s0f0u2
INTERFACE HARDWARE MAC..: f81a67077d0e
DRIVER..................: ath9k_htc
DRIVER VERSION..........: 5.3.7-arch1-2-ARCH
DRIVER FIRMWARE VERSION.: 1.4
ERRORMAX................: 100 errors
FILTERLIST ACCESS POINT.: 2 entries
FILTERLIST CLIENT.......: 2 entries
FILTERMODE..............: 1
PREDEFINED ACCESS POINT.: 0 entries
MAC ACCESS POINT........: 0024fb4ff852 (incremented on every new client)
MAC CLIENT..............: b025aac72741
REPLAYCOUNT.............: 62055
ANONCE..................: e40324dcb9b9756550c299aefeb303b2e9b9e5c0813022ec3b82896d0397286e
SNONCE..................: 63d1afb26a112876a5905918510f06e7b50e969ff97695f12f54b0882106ca12


If we have a fix, output looks like this:
$ sudo hcxdumptool -i wlp3s0f0u2 --filtermode=1 --filterlist_ap=$HOME/Source/raspberry/filterlistap --filterlist_client=$HOME/Source/raspberry/filterlistap -o wpatst.pcapng --enable_status=1 --gps=/dev/ttyACM0
initialization...
waiting up to 2 minutes seconds to get GPS fix

start capturing (stop with ctrl+c)
NMEA 0183 RMC SENTENCE..: 091201.00,A,5010.15472,N,00642.51819,E,0.105,,311019,,,A*77
INTERFACE NAME..........: wlp3s0f0u2
INTERFACE HARDWARE MAC..: f81a67077d0e
DRIVER..................: ath9k_htc
DRIVER VERSION..........: 5.3.7-arch1-2-ARCH
DRIVER FIRMWARE VERSION.: 1.4
ERRORMAX................: 100 errors
FILTERLIST ACCESS POINT.: 2 entries
FILTERLIST CLIENT.......: 2 entries
FILTERMODE..............: 1
PREDEFINED ACCESS POINT.: 0 entries
MAC ACCESS POINT........: 18421dd1f644 (incremented on every new client)
MAC CLIENT..............: b025aa72aee8
REPLAYCOUNT.............: 64626
ANONCE..................: 2784a27da917a4f61d5ae39b88cadd92e7db9edf0ca08fe22a84b67863e97fc6
SNONCE..................: ab5707d533d899b19258f9ea44abbb84970ad8c776b0172c3d0e9fbe43427d67

Do we get a NMEA 0183 recommended minimum sentence (starting with: $GPRMC):
$GPRMC,091201.00,A,5010.15472,N,00642.51819,E,0.105,,311019,,,A*77
running this command:
cat /dev/ttyUSB0

hcxdumptool doesn't set the device to NMEA 0183. That must be done by user.

Examples of the most common sentences can be found here:
https://en.wikipedia.org/wiki/NMEA_0183

BTW:
hcxpcaptool isn't ready for hcxdumptool v6.0.0. There is still some work to do (on both tools).
I pushed this early alfa to allow wifite2 to test the new features:
https://github.com/kimocoder/wifite2/iss...-548249943
(10-31-2019, 11:22 AM)ZerBea Wrote: [ -> ]Normally we wait up to 2 minutes to get a GPX fix. If we didn't get it, we deactivate GPS.

EDIT:
I pushed another update. Now we leave the GPS fix loop if we didn't receive a GPRMC sentence within the first 120 received sentences.

If we got no fix from the device, output looks like this (after the period of at least 2 minutes):
$ sudo hcxdumptool -i wlp3s0f0u2 --filtermode=1 --filterlist_ap=$HOME/Source/raspberry/filterlistap --filterlist_client=$HOME/Source/raspberry/filterlistap -o wpatst.pcapng --enable_status=1 --gps=/dev/ttyACM0
initialization...
waiting up to 2 minutes seconds to get GPS fix
GPS failed

start capturing (stop with ctrl+c)
NMEA 0183 RMC SENTENCE..: N/A
INTERFACE NAME..........: wlp3s0f0u2
INTERFACE HARDWARE MAC..: f81a67077d0e
DRIVER..................: ath9k_htc
DRIVER VERSION..........: 5.3.7-arch1-2-ARCH
DRIVER FIRMWARE VERSION.: 1.4
ERRORMAX................: 100 errors
FILTERLIST ACCESS POINT.: 2 entries
FILTERLIST CLIENT.......: 2 entries
FILTERMODE..............: 1
PREDEFINED ACCESS POINT.: 0 entries
MAC ACCESS POINT........: 0024fb4ff852 (incremented on every new client)
MAC CLIENT..............: b025aac72741
REPLAYCOUNT.............: 62055
ANONCE..................: e40324dcb9b9756550c299aefeb303b2e9b9e5c0813022ec3b82896d0397286e
SNONCE..................: 63d1afb26a112876a5905918510f06e7b50e969ff97695f12f54b0882106ca12


If we have a fix, output looks like this:
$ sudo hcxdumptool -i wlp3s0f0u2 --filtermode=1 --filterlist_ap=$HOME/Source/raspberry/filterlistap --filterlist_client=$HOME/Source/raspberry/filterlistap -o wpatst.pcapng --enable_status=1 --gps=/dev/ttyACM0
initialization...
waiting up to 2 minutes seconds to get GPS fix

start capturing (stop with ctrl+c)
NMEA 0183 RMC SENTENCE..: 091201.00,A,5010.15472,N,00642.51819,E,0.105,,311019,,,A*77
INTERFACE NAME..........: wlp3s0f0u2
INTERFACE HARDWARE MAC..: f81a67077d0e
DRIVER..................: ath9k_htc
DRIVER VERSION..........: 5.3.7-arch1-2-ARCH
DRIVER FIRMWARE VERSION.: 1.4
ERRORMAX................: 100 errors
FILTERLIST ACCESS POINT.: 2 entries
FILTERLIST CLIENT.......: 2 entries
FILTERMODE..............: 1
PREDEFINED ACCESS POINT.: 0 entries
MAC ACCESS POINT........: 18421dd1f644 (incremented on every new client)
MAC CLIENT..............: b025aa72aee8
REPLAYCOUNT.............: 64626
ANONCE..................: 2784a27da917a4f61d5ae39b88cadd92e7db9edf0ca08fe22a84b67863e97fc6
SNONCE..................: ab5707d533d899b19258f9ea44abbb84970ad8c776b0172c3d0e9fbe43427d67

Do we get a NMEA 0183 recommended minimum sentence (starting with: $GPRMC):
$GPRMC,091201.00,A,5010.15472,N,00642.51819,E,0.105,,311019,,,A*77
running this command:
cat /dev/ttyUSB0

hcxdumptool doesn't set the device to NMEA 0183. That must be done by user.

Examples of the most common sentences can be found here:
https://en.wikipedia.org/wiki/NMEA_0183

BTW:
hcxpcaptool isn't ready for hcxdumptool v6.0.0. There is still some work to do (on both tools).
I pushed this early alfa to allow wifite2 to test the new features:
https://github.com/kimocoder/wifite2/iss...-548249943


OK, thank vey much
Hello, hcxdumptool 5.2.2 y hcxcaptool 5.2.2 no working gps
Please try hcxdumptool v6.0.0 in combination with latest git head hcxpcapngtool.
hcxdumptool GPS options:
--use_gps_device=<device>          : use GPS device
                                    /dev/ttyACM0, /dev/ttyUSB0, ...
                                    NMEA 0183 $GPGGA $GPGGA
--use_gpsd                        : use GPSD device
                                    NMEA 0183 $GPGGA, $GPRMC
--nmea=<file>                      : save track to file
                                    format: NMEA 0183 $GPGGA, $GPRMC, $GPWPL
                                    to convert it to gpx, use GPSBabel:
                                    gpsbabel -i nmea -f hcxdumptool.nmea -o gpx -F file.gpx
                                    to display the track, open file.gpx with viking
If you use GPS, make sure GPS device is in fix, before you start hcxdumptool


hcxpcapngtool GPS options:
--nmea=<file>                      : output GPS data in NMEA format
                                    format: NMEA 0183 $GPGGA, $GPRMC, $GPWPL
                                    to convert it to gpx, use GPSBabel:
                                    gpsbabel -i nmea -f hcxdumptool.nmea -o gpx -F file.gpx
                                    to display the track, open file.gpx with viking

Test your GPS device:
$ lsusb
Bus 001 Device 009: ID 1546:01a7 U-Blox AG [u-blox 7]

Get information about the device
$ dmesg
[ 3954.212690] usb 1-3: new full-speed USB device number 9 using xhci_hcd
[ 3954.353840] usb 1-3: New USB device found, idVendor=1546, idProduct=01a7, bcdDevice= 1.00
[ 3954.353851] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 3954.353857] usb 1-3: Product: u-blox 7 - GPS/GNSS Receiver
[ 3954.353862] usb 1-3: Manufacturer: u-blox AG - www.u-blox.com
[ 3954.379328] cdc_acm 1-3:1.0: ttyACM0: USB ACM device

receive GPS data from the device (/dev/.... depend on your device/port)
$ cat /dev/ttyACM0

now GPS data should appear
$GPTXT,01,01,02,u-blox ag - www.u-blox.com*50
$GPTXT,01,01,02,HW  UBX-G70xx  00070000 *77
$GPTXT,01,01,02,ROM CORE 1.00 (59842) Jun 27 2012 17:43:52*59
$GPTXT,01,01,02,PROTVER 14.00*1E
$GPTXT,01,01,02,ANTSUPERV=AC SD PDoS SR*20
$GPTXT,01,01,02,ANTSTATUS=OK*3B
$GPTXT,01,01,02,LLC FFFFFFFF-FFFFFFED-FFFFFFFF-FFFFFFFF-FFFFFFF9*50
$GPRMC,,V,,,,,,,,,,N*53

wait until you get a fix (GPRMC and GPGGA is not longer empty)
if you don't receive GPS data running $ cat, your device isn't suitable or not working as expected.
GPWPL is calculated by hcxdumptool and hcxpcapngtool for every transmitter.

now run hcxdumptool with option:
--use_gps_device=/dev/ttyACM0
(12-27-2019, 08:13 PM)ZerBea Wrote: [ -> ]Please try hcxdumptool v6.0.0 in combination with latest git head hcxpcapngtool.
hcxdumptool GPS options:
--use_gps_device=<device>          : use GPS device
                                    /dev/ttyACM0, /dev/ttyUSB0, ...
                                    NMEA 0183 $GPGGA $GPGGA
--use_gpsd                        : use GPSD device
                                    NMEA 0183 $GPGGA, $GPRMC
--nmea=<file>                      : save track to file
                                    format: NMEA 0183 $GPGGA, $GPRMC, $GPWPL
                                    to convert it to gpx, use GPSBabel:
                                    gpsbabel -i nmea -f hcxdumptool.nmea -o gpx -F file.gpx
                                    to display the track, open file.gpx with viking
If you use GPS, make sure GPS device is in fix, before you start hcxdumptool


hcxpcapngtool GPS options:
--nmea=<file>                      : output GPS data in NMEA format
                                    format: NMEA 0183 $GPGGA, $GPRMC, $GPWPL
                                    to convert it to gpx, use GPSBabel:
                                    gpsbabel -i nmea -f hcxdumptool.nmea -o gpx -F file.gpx
                                    to display the track, open file.gpx with viking

Test your GPS device:
$ lsusb
Bus 001 Device 009: ID 1546:01a7 U-Blox AG [u-blox 7]

Get information about the device
$ dmesg
[ 3954.212690] usb 1-3: new full-speed USB device number 9 using xhci_hcd
[ 3954.353840] usb 1-3: New USB device found, idVendor=1546, idProduct=01a7, bcdDevice= 1.00
[ 3954.353851] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 3954.353857] usb 1-3: Product: u-blox 7 - GPS/GNSS Receiver
[ 3954.353862] usb 1-3: Manufacturer: u-blox AG - www.u-blox.com
[ 3954.379328] cdc_acm 1-3:1.0: ttyACM0: USB ACM device

receive GPS data from the device (/dev/.... depend on your device/port)
$ cat /dev/ttyACM0

now GPS data should appear
$GPTXT,01,01,02,u-blox ag - www.u-blox.com*50
$GPTXT,01,01,02,HW  UBX-G70xx  00070000 *77
$GPTXT,01,01,02,ROM CORE 1.00 (59842) Jun 27 2012 17:43:52*59
$GPTXT,01,01,02,PROTVER 14.00*1E
$GPTXT,01,01,02,ANTSUPERV=AC SD PDoS SR*20
$GPTXT,01,01,02,ANTSTATUS=OK*3B
$GPTXT,01,01,02,LLC FFFFFFFF-FFFFFFED-FFFFFFFF-FFFFFFFF-FFFFFFF9*50
$GPRMC,,V,,,,,,,,,,N*53

wait until you get a fix (GPRMC and GPGGA is not longer empty)
if you don't receive GPS data running $ cat, your device isn't suitable or not working as expected.
GPWPL is calculated by hcxdumptool and hcxpcapngtool for every transmitter.

now run hcxdumptool with option:
--use_gps_device=/dev/ttyACM0


Thank you, I'll try
I decided to add "raw" NMEA support, because I noticed that, if you use GPSD and GPSD hangs, hcxdumptool will hang too.
On the other side, NMEA sentences can be converted to every format, by GPSBabel and displayed by Viking

Overview of NMEA:
https://www.gpsinformation.org/dale/nmea.htm
http://aprs.gids.nl/nmea/

Overview GPSBabel:
https://www.gpsbabel.org/

Overview Viking:
https://sourceforge.net/projects/viking/

if you're using Arch Linux, the tools can be installed by pacman -S viking gpsbabel
(12-27-2019, 10:04 PM)strike1953 Wrote: [ -> ]
(12-27-2019, 08:13 PM)ZerBea Wrote: [ -> ]Please try hcxdumptool v6.0.0 in combination with latest git head hcxpcapngtool.
hcxdumptool GPS options:
--use_gps_device=<device>          : use GPS device
                                    /dev/ttyACM0, /dev/ttyUSB0, ...
                                    NMEA 0183 $GPGGA $GPGGA
--use_gpsd                        : use GPSD device
                                    NMEA 0183 $GPGGA, $GPRMC
--nmea=<file>                      : save track to file
                                    format: NMEA 0183 $GPGGA, $GPRMC, $GPWPL
                                    to convert it to gpx, use GPSBabel:
                                    gpsbabel -i nmea -f hcxdumptool.nmea -o gpx -F file.gpx
                                    to display the track, open file.gpx with viking
If you use GPS, make sure GPS device is in fix, before you start hcxdumptool


hcxpcapngtool GPS options:
--nmea=<file>                      : output GPS data in NMEA format
                                    format: NMEA 0183 $GPGGA, $GPRMC, $GPWPL
                                    to convert it to gpx, use GPSBabel:
                                    gpsbabel -i nmea -f hcxdumptool.nmea -o gpx -F file.gpx
                                    to display the track, open file.gpx with viking

Test your GPS device:
$ lsusb
Bus 001 Device 009: ID 1546:01a7 U-Blox AG [u-blox 7]

Get information about the device
$ dmesg
[ 3954.212690] usb 1-3: new full-speed USB device number 9 using xhci_hcd
[ 3954.353840] usb 1-3: New USB device found, idVendor=1546, idProduct=01a7, bcdDevice= 1.00
[ 3954.353851] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 3954.353857] usb 1-3: Product: u-blox 7 - GPS/GNSS Receiver
[ 3954.353862] usb 1-3: Manufacturer: u-blox AG - www.u-blox.com
[ 3954.379328] cdc_acm 1-3:1.0: ttyACM0: USB ACM device

receive GPS data from the device (/dev/.... depend on your device/port)
$ cat /dev/ttyACM0

now GPS data should appear
$GPTXT,01,01,02,u-blox ag - www.u-blox.com*50
$GPTXT,01,01,02,HW  UBX-G70xx  00070000 *77
$GPTXT,01,01,02,ROM CORE 1.00 (59842) Jun 27 2012 17:43:52*59
$GPTXT,01,01,02,PROTVER 14.00*1E
$GPTXT,01,01,02,ANTSUPERV=AC SD PDoS SR*20
$GPTXT,01,01,02,ANTSTATUS=OK*3B
$GPTXT,01,01,02,LLC FFFFFFFF-FFFFFFED-FFFFFFFF-FFFFFFFF-FFFFFFF9*50
$GPRMC,,V,,,,,,,,,,N*53

wait until you get a fix (GPRMC and GPGGA is not longer empty)
if you don't receive GPS data running $ cat, your device isn't suitable or not working as expected.
GPWPL is calculated by hcxdumptool and hcxpcapngtool for every transmitter.

now run hcxdumptool with option:
--use_gps_device=/dev/ttyACM0


Thank you, I'll try


Working!!!!!!!
Nice to hear that.
Please try the new hasline, too (latest git head on all tools -option 22000):
hcxdumptool -> hcxpcangtool -o new.22000 -> hashcat -m 22000 new.22000 wordlist
It works like a charm. Atom did an amazing job.
(12-28-2019, 01:14 PM)ZerBea Wrote: [ -> ]Nice to hear that.
Please try the new hasline, too (latest git head on all tools -option 22000):
hcxdumptool -> hcxpcangtool -o new.22000  -> hashcat -m 22000 new.22000 wordlist
It works like a charm. Atom did an amazing job.

Wonderfull, amazing job.
Congratulatios
Can some one explain to me what is in help_crack.py how it works exactly and what it is doing to better understand how I might integrate this into subsequent processes carried out by Wifite 2. It is my understanding it runs hashcat but because the process is not independently ran by hcxtools itself the scan, capture and dump files are polluted in a sense and limit effect cracking using the online API to onlinehashcrack AWS servers running GPU driven attack vectors.