You're absolutely right. PBKDF2 is a slow process.
The cap file is damaged at the end. It looks like your capturing tool was terminated "hard".
You don't have to care about this, because you got all the information to recover the PSK before this happened:
But you have to improve your attack vector, because injecting tons of DAUTHENTICATION frames into AUTHENTICATION sequences may lead to uncrackable MESSAGE PAIRs:
BTW:
If you take a look at the converted hc22000 hash line, you'll see 2 entries for your target:
A PMKID starting with identifier WPA*01 and an EAPOL MESSAGE PAIR, starting with WPA*02.
In this case, to speed up hashcat, you can remove the EAPOL MESSAGE PAIR (WPA*02 line) from your hash file.
You can confirm that the PMKID within the hash file is correct by running tshark:
The shown PMKID should be identical to the PMKID within the WPA*01 hash line.
The cap file is damaged at the end. It looks like your capturing tool was terminated "hard".
You don't have to care about this, because you got all the information to recover the PSK before this happened:
Code:
$ tshark -r handshake_si_2C-56-DC-4F-EF-A8_2021-11-03T13-36-56.cap
tshark: The file "handshake_si_2C-56-DC-4F-EF-A8_2021-11-03T13-36-56.cap" appears to have been cut short in the middle of a packet.But you have to improve your attack vector, because injecting tons of DAUTHENTICATION frames into AUTHENTICATION sequences may lead to uncrackable MESSAGE PAIRs:
Code:
1397 17:36:53,921712 7c:76:35:15:44:4c → 2c:56:dc:4f:ef:a8 802.11 190 Reassociation Request, SN=10, FN=0, Flags=........, SSID=si
1398 17:36:53,924834 2c:56:dc:4f:ef:a8 → 68:3e:34:29:8e:42 802.11 26 Deauthentication, SN=58, FN=0, Flags=........
1399 17:36:53,928903 68:3e:34:29:8e:42 → 2c:56:dc:4f:ef:a8 802.11 26 Deauthentication, SN=59, FN=0, Flags=........
1400 17:36:53,932083 2c:56:dc:4f:ef:a8 → 7c:76:35:15:44:4c 802.11 33 Action, SN=756, FN=0, Flags=........
1401 17:36:53,932408 → 2c:56:dc:4f:ef:a8 (RA) 802.11 10 Acknowledgement, Flags=........
1402 17:36:53,935831 2c:56:dc:4f:ef:a8 → 68:3e:34:29:8e:42 802.11 26 Deauthentication, SN=60, FN=0, Flags=........
1403 17:36:53,937099 2c:56:dc:4f:ef:a8 → 68:3e:34:29:8e:42 802.11 26 Deauthentication, SN=58, FN=0, Flags=........
1404 17:36:53,937906 68:3e:34:29:8e:42 → 2c:56:dc:4f:ef:a8 802.11 26 Deauthentication, SN=59, FN=0, Flags=........
1405 17:36:53,937965 → 68:3e:34:29:8e:42 (RA) 802.11 10 Acknowledgement, Flags=........
1406 17:36:53,938482 7c:76:35:15:44:4c → 2c:56:dc:4f:ef:a8 802.11 33 Action, SN=11, FN=0, Flags=........
1407 17:36:53,938796 → 7c:76:35:15:44:4c (RA) 802.11 10 Acknowledgement, Flags=........
1408 17:36:53,939800 68:3e:34:29:8e:42 → 2c:56:dc:4f:ef:a8 802.11 26 Deauthentication, SN=61, FN=0, Flags=........
1409 17:36:53,943700 2c:56:dc:4f:ef:a8 → 68:3e:34:29:8e:42 802.11 26 Deauthentication, SN=60, FN=0, Flags=........
1410 17:36:53,944702 68:3e:34:29:8e:42 → 2c:56:dc:4f:ef:a8 802.11 26 Deauthentication, SN=61, FN=0, Flags=........
1411 17:36:53,944707 → 68:3e:34:29:8e:42 (RA) 802.11 10 Acknowledgement, Flags=........
1412 17:36:53,946284 2c:56:dc:4f:ef:a8 → 7c:76:35:15:44:4c EAPOL 155 Key (Message 1 of 4)
1413 17:36:53,946531 → 2c:56:dc:4f:ef:a8 (RA) 802.11 10 Acknowledgement, Flags=........
1414 17:36:53,947080 2c:56:dc:4f:ef:a8 (TA) → 7c:76:35:15:44:4c (RA) 802.11 20 802.11 Block Ack Req, Flags=........
1415 17:36:53,947538 7c:76:35:15:44:4c (TA) → 2c:56:dc:4f:ef:a8 (RA) 802.11 28 802.11 Block Ack, Flags=........
1416 17:36:53,949132 7c:76:35:15:44:4c → 2c:56:dc:4f:ef:a8 EAPOL 157 Key (Message 2 of 4)
1417 17:36:53,949407 → 7c:76:35:15:44:4c (RA) 802.11 10 Acknowledgement, Flags=........
1418 17:36:53,951864 2c:56:dc:4f:ef:a8 → 68:3e:34:29:8e:42 802.11 26 Deauthentication, SN=62, FN=0, Flags=........
1419 17:36:53,953794 2c:56:dc:4f:ef:a8 → 7c:76:35:15:44:4c EAPOL 189 Key (Message 3 of 4)
1420 17:36:53,954039 → 2c:56:dc:4f:ef:a8 (RA) 802.11 10 Acknowledgement, Flags=........
1421 17:36:53,955821 68:3e:34:29:8e:42 → 2c:56:dc:4f:ef:a8 802.11 26 Deauthentication, SN=63, FN=0, Flags=........
1422 17:36:53,958579 2c:56:dc:4f:ef:a8 → 68:3e:34:29:8e:42 802.11 26 Deauthentication, SN=62, FN=0, Flags=........
1423 17:36:53,959565 68:3e:34:29:8e:42 → 2c:56:dc:4f:ef:a8 802.11 26 Deauthentication, SN=63, FN=0, Flags=........
1424 17:36:53,959569 → 68:3e:34:29:8e:42 (RA) 802.11 10 Acknowledgement, Flags=........
1425 17:36:53,961085 7c:76:35:15:44:4c → 2c:56:dc:4f:ef:a8 EAPOL 133 Key (Message 4 of 4)
1426 17:36:53,961350 → 7c:76:35:15:44:4c (RA) 802.11 10 Acknowledgement, Flags=........
1427 17:36:53,963874 2c:56:dc:4f:ef:a8 → 68:3e:34:29:8e:42 802.11 26 Deauthentication, SN=64, FN=0, Flags=........
1428 17:36:53,967897 68:3e:34:29:8e:42 → 2c:56:dc:4f:ef:a8 802.11 26 Deauthentication, SN=65, FN=0, Flags=........
1429 17:36:53,972935 2c:56:dc:4f:ef:a8 → 68:3e:34:29:8e:42 802.11 26 Deauthentication, SN=64, FN=0, Flags=........
1430 17:36:53,973811 68:3e:34:29:8e:42 → 2c:56:dc:4f:ef:a8 802.11 26 Deauthentication, SN=65, FN=0, Flags=........BTW:
If you take a look at the converted hc22000 hash line, you'll see 2 entries for your target:
A PMKID starting with identifier WPA*01 and an EAPOL MESSAGE PAIR, starting with WPA*02.
In this case, to speed up hashcat, you can remove the EAPOL MESSAGE PAIR (WPA*02 line) from your hash file.
You can confirm that the PMKID within the hash file is correct by running tshark:
Code:
$ tshark -r handshake_si_2C-56-DC-4F-EF-A8_2021-11-03T13-36-56.cap -T fields -e wlan.ta -e wlan.sa -e wlan.rsn.ie.pmkid | sort | uniq