New attack on WPA/WPA2 using PMKID

[Superninja]

Hello,

after i read about problems with The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali), i installed ubuntu in virtual box.

I am using Awus036NHR with RTL8188RU Chipeset

For monitor mode i use iplink now.

and "sudo iw dev" show me that i am in monitor mode

Also changed enable_status=3

targed AP is in range.

But now more bad, it look like it doesnt scan, after start, the main message "start capturing" comes, but thats all, no scan results, nothing.

Maybe  RTL8188RU chipset is not compatible?

see you

maybe this help

whoismac -p 69d4ec91a19657d64d4ccc869c229bbe*9e3dcf272236*f0a225dab76d*53696c7665724d61676e6f6c6961

ESSID..: SilverMagnolia
MAC_AP.: 9e3dcf272236
VENDOR.: unknown
MAC_STA: f0a225dab76d
VENDOR.: Private

or:

for i in $(cat 16800.txt ); do whoismac -p $i; done

ESSID..: Fibertel WiFi1
MAC_AP.: 8c10d4fc55xx
VENDOR.: Sagemcom Broadband SAS
MAC_STA: 58c5cbe342xx
VENDOR.: Samsung Electronics Co.,Ltd


ESSID..: Fibertel WiFi2
MAC_AP.: 0025f1859exx
VENDOR.: ARRIS Group, Inc.
MAC_STA: a49a5846aaxx
VENDOR.: Samsung Electronics Co.,Ltd


ESSID..: Fibertel WiFi3
MAC_AP.: 4c72b952fexx
VENDOR.: PEGATRON CORPORATION
MAC_STA: 60427fa493xx
VENDOR.: SHENZHEN CHUANGWEI-RGB ELECTRONICS CO.,LTD

I appreciate it thanks.

Hi Superninja
wlan0mon is a typical  logical  interface type, created by airmon-ng for broadcom devices.
Do you use a broadcom interface?
read more here:
"You are using the Broadcom STA (wl) official driver; this does not support monitor or promiscuous modes (regardless of whatever airmon-ng tells you.)"
https://askubuntu.com/questions/155528/w...eless-card

How do you set monitor mode? hcxdumptool doesn't like logical interfaces while the physical interface is leaving managed. So, do not set monitor mode by airmon-ng!
I added this to the help menu on latest commit:
do not run hcxdumptool on logical interfaces (monx, wlanxmon)
do not use hcxdumptool in combination with other 3rd party tools, which take access to the interface
Read more why I did it that way here:
https://github.com/ZerBea/hcxdumptool/co...t-30554020


Is the interface really in monitor mode?
$ sudo iw dev <your physical interface>  info
Interface wlp3s0f0u2
ifindex 3
wdev 0x1
addr c8:3a:35:xx:xx:xx
type monitor
wiphy 0
channel 3 (2422 MHz), width: 20 MHz (no HT), center1: 2422 MHz
txpower 20.00 dBm

--enable_status=2 doesn't show EAPOL messages!
--enable_status=<digit>            : enable status messages
                                    bitmask:
                                     1: EAPOL
                                     2: PROBEREQUEST/PROBERESPONSE
                                     4: AUTHENTICATON
                                     8: ASSOCIATION
                                    16: BEACON

So if you like to see EAPOL messages (this includes PMKIDs) and PROBEREQUEST/PROBERESPONSE messages use:
--enable_status=3  ( 1 + 2)

Is the target access point in transmit range?
hcxdumtool -i <physical interface> --do_rcascan -t 5

[18:26:00] xxxxxxxxxxxx networkname [CHANNEL 1, AP IN RANGE]

If you still don't get a PMKID, the access point might not be vulnerable.