(02-28-2021, 06:07 PM)ZerBea Wrote: Some IoT devices transmit the PSK in the clear.
If a user made a type (PSK instead ESSID), the device transmit the PSK in the clear.
A misconfigured device can cause that the PSK is transmitted in the clear.
-E will store them to a list
-I will store received identities (that include IMEIs) to a list
-U will store received usernames to a list

All this lists can be used to create new wordlists.

BTW:
I decided to make my test tool (hcxpmktool) public.
It provide various tests on a single hash line (-m 22000 WPA 01 and WPA 02) in combination with ESSIDs, PSKs and PMKs. It will help you to understand better how things (PBKDF2) relate. Nearly every PBKDF2 combination (used in WPA) is possible:
ESSID + PSK
ESSID + PMK
ESSID + PSK + 22000 hash line
PSK + 22000 hash line
PMK + 22000 hash line

Some examples (22000 example hash taken from here: https://hashcat.net/wiki/doku.php?id=example_hashes)

Code:

$ hcxpmktool -i WPA*01*4d4fe7aac3a2cecab195321ceb99a7d0*fc690c158264*f4747f87f9f4*686173686361742d6573736964*** -p 'hashcat!'

ESSID.............: hashcat-essid
PSK  .............: hashcat!
PMK...............: 88f43854ae7b1624fc2ab7724859e795130f4843c7535729e819cf92f39535dc
PMKID (calculated): 4d4fe7aac3a2cecab195321ceb99a7d0
PMKID (hash line).: 4d4fe7aac3a2cecab195321ceb99a7d0 (equal)

$ hcxpmktool -i WPA*01*4d4fe7aac3a2cecab195321ceb99a7d0*fc690c158264*f4747f87f9f4*686173686361742d6573736964*** -m 88f43854ae7b1624fc2ab7724859e795130f4843c7535729e819cf92f39535dc

ESSID.............: hashcat-essid
PMK...............: 88f43854ae7b1624fc2ab7724859e795130f4843c7535729e819cf92f39535dc
PMKID (calculated): 4d4fe7aac3a2cecab195321ceb99a7d0
PMKID (hash line).: 4d4fe7aac3a2cecab195321ceb99a7d0 (equal)

$ hcxpmktool -e hashcat-essid -m 88f43854ae7b1624fc2ab7724859e795130f4843c7535729e819cf92f39535dc

ESSID............: hashcat-essid
PMK..............: 88f43854ae7b1624fc2ab7724859e795130f4843c7535729e819cf92f39535dc
PBKDF2-HMAC-SHA1.: sha1:4096:aGFzaGNhdC1lc3NpZA==:iPQ4VK57FiT8KrdySFnnlRMPSEPHU1cp6BnPkvOVNdw=

use hashcat -m 12000 to recover the PSK

$ hashcat -m 12000 sha1:4096:aGFzaGNhdC1lc3NpZA==:iPQ4VK57FiT8KrdySFnnlRMPSEPHU1cp6BnPkvOVNdw= -a 3 'hashcat!'
hashcat (v6.1.1-120-g15bf8b730) starting...

sha1:4096:aGFzaGNhdC1lc3NpZA==:iPQ4VK57FiT8KrdySFnnlRMPSEPHU1cp6BnPkvOVNdw=:hashcat!
                                               
Session..........: hashcat
Status...........: Cracked
Hash.Name........: PBKDF2-HMAC-SHA1
Hash.Target......: sha1:4096:aGFzaGNhdC1lc3NpZA==:iPQ4VK57FiT8KrdySFnn...OVNdw=
Time.Started.....: Sun Feb 28 17:03:42 2021 (0 secs)
Time.Estimated...: Sun Feb 28 17:03:42 2021 (0 secs)
Guess.Mask.......: hashcat! [8]
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:      49 H/s (0.22ms) @ Accel:16 Loops:64 Thr:1024 Vec:1
Recovered........: 1/1 (100.00%) Digests
Progress.........: 1/1 (100.00%)
Rejected.........: 0/1 (0.00%)
Restore.Point....: 0/1 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:4032-4095
Candidates.#1....: hashcat! -> hashcat!
Hardware.Mon.#1..: Temp: 50c Fan: 34% Util: 31% Core:1506MHz Mem:5005MHz Bus:16

Started: Sun Feb 28 17:03:41 2021
Stopped: Sun Feb 28 17:03:44 2021

(02-28-2021, 11:12 PM)ZerBea Wrote: Regarding your example, there is nothing to extract. It is a proprietary ESSID.
To get a feeling for PSKs in the clear, get this example:
https://github.com/evilsocket/pwnagotchi/files/4328457/nctest.zip
Decompress it, convert it and run hashcat:

Code:

$ hcxpcapngtool -o eapol.22000 -E wordlist test.pcap
$ hashcat -m 22000 --nonce-error-corrections=8 eapol.22000 wordlist

and you'll know what I mean.

Open the pcap with Wireshark and take a look at frame 2, to get a feeling how this frames could look like.
It wiil take a while, but I'm sure you'll get a sense for it.

Please notice:
The example is from a feature request and was converted to pcap format, because there are still some tools in the wildness which are not able to read the new pcapng format.
That does not apply to tools like Wireshark and tshark. They use pcapng as default format:
https://www.wireshark.org/docs/wsug_html_chunked/ChIOSaveSection.html
https://wiki.wireshark.org/FileFormatReference

BTW:
It is definitely not a good idea to ignore this frames (e.g. by filter options) or to remove them from a capture file.
hcxpcapngtool will print a warning, if the absence of this frame types is detected:
https://hashcat.net/forum/thread-9908-post-51792.html#pid51792

(02-28-2021, 11:23 PM)pr0ph3t Wrote:

(02-28-2021, 11:12 PM)ZerBea Wrote: Regarding your example, there is nothing to extract. It is a proprietary ESSID.
To get a feeling for PSKs in the clear, get this example:
https://github.com/evilsocket/pwnagotchi/files/4328457/nctest.zip
Decompress it, convert it and run hashcat:

Code:

$ hcxpcapngtool -o eapol.22000 -E wordlist test.pcap
$ hashcat -m 22000 --nonce-error-corrections=8 eapol.22000 wordlist

and you'll know what I mean.

Open the pcap with Wireshark and take a look at frame 2, to get a feeling how this frames could look like.
It wiil take a while, but I'm sure you'll get a sense for it.

Please notice:
The example is from a feature request and was converted to pcap format, because there are still some tools in the wildness which are not able to read the new pcapng format.
That does not apply to tools like Wireshark and tshark. They use pcapng as default format:
https://www.wireshark.org/docs/wsug_html_chunked/ChIOSaveSection.html
https://wiki.wireshark.org/FileFormatReference

BTW:
It is definitely not a good idea to ignore this frames (e.g. by filter options) or to remove them from a capture file.
hcxpcapngtool will print a warning, if the absence of this frame types is detected:
https://hashcat.net/forum/thread-9908-post-51792.html#pid51792

Ah thank you will read up on it now.
Confirmed your pmktool works from start to finish without any problems (5.10.0-k*ali3-amd64). That's a nice assembly line you've got there.
Now for the live exercise though. This time "I don't know the key" so I need to revert to the prior step to get that hash but this time once we get that hash string to put it through your tool. Meanwhile going to read the links you posted.

(02-28-2021, 11:12 PM)ZerBea Wrote: Regarding your example, there is nothing to extract. It is a proprietary ESSID.
To get a feeling for PSKs in the clear, get this example:
https://github.com/evilsocket/pwnagotchi/files/4328457/nctest.zip
Decompress it, convert it and run hashcat:

Code:

$ hcxpcapngtool -o eapol.22000 -E wordlist test.pcap
$ hashcat -m 22000 --nonce-error-corrections=8 eapol.22000 wordlist

and you'll know what I mean.

(03-01-2021, 09:21 AM)ZerBea Wrote: Well, no problem. I have become a little bit "occupationally blind", too. Worked too long in that business.

BTW: Some words about hcxdumptool and hcxtools.
They are designed to be a WiFi pre-processor to hashcat (because hashcat doesn't provide this feature) and JtR (because JtR doesn't provide this feature, too).
They are more analysis tools than "cracking" tools and you must(!) have more than only basic technical knowledge. That include RF technology, 802.11 protocol (and protocol analyzer Wireshark/tshark), Linux (device driver and device handling, system services) and hash algorithms.

They are definitely not designed to be used by beginners or "script kiddies". If someone needs a script of about 1500 lines to do such a simple thing like setting monitor mode (installing pure  K A L I  and/or running 50.000 stupid deauthentications against an ACCESS POINT is far, far from enough, here) - he/she shouldn't use hcxdumptool/hcxtools.

But if you really know, what to do (starting from an attack vector tailored to the target, converting/and filtering the results tailored to the target and feeding them to hashcat/JtR), they can do magic.