hashcat & hcxdumptool ioctl(SIOCSIWMODE)

[ZerBea]

Looks like some tools still use WEXT. But that has nothing to do with the driver.

A quick and dirty test of the aircrack-ng driver:

Complies and inserts fine running Linux kernel 6.8.1:

Code:

$ uname -r 6.8.1-arch1-1 $ make make ARCH=x86_64 CROSS_COMPILE= -C /lib/modules/6.8.1-arch1-1/build M=/tmp/git_rtl8812au_aircrack-ng modules make[1]: Entering directory '/usr/lib/modules/6.8.1-arch1-1/build' make[1]: Leaving directory '/usr/lib/modules/6.8.1-arch1-1/build' --------------------------------------------------------------------------- Visit https://github.com/aircrack-ng/rtl8812au for support/reporting issues or check for newer versions (branches) of these drivers. --------------------------------------------------------------------------- $ insmod 88XXau.ko

Running hcxdumptool latest git head:

Code:

$ hcxdumptool -v hcxdumptool 6.3.4-14-g3693e77 (C) 2024 ZeroBeat running on Linux kernel 6.8.1-arch1-1 running GNU libc version 2.39 compiled by gcc 13.2.1 compiled with Linux API headers 6.7.0 compiled with GNU libc headers 2.39 enabled REALTIME DISPLAY enabled GPS support enabled BPF compiler

Driver information:

Code:

$ hcxdumptool -l 3 6 74da3876251a c8aacc43f6fd + wlp22s0f0u4 rtl88XXau NETLINK

Test target has been (successful) attacked in 6,403s (that include the time to init the device - this device is really slow):

Code:

$ time hcxdumptool -i wlp22s0f0u4 --bpf=target.bpfc -c 10a --rds=1 --exitoneapol=7 -w test.pcapng 0 ERROR(s) during runtime 128 Packet(s) captured by kernel 0 Packet(s) dropped by kernel 1 SHB written to pcapng dumpfile 1 IDB written to pcapng dumpfile 1 ECB written to pcapng dumpfile 5 EPB written to pcapng dumpfile exit on EAPOL M1M2 real 0m6,403s user 0m0,000s sys 0m0,008s

Successful converted by hcxpcapngtool:

Code:

$ hcxpcapngtool -o test.hc22000 test.pcapng hcxpcapngtool 6.3.4-6-gb7886cb reading from test.pcapng... summary capture file -------------------- file name.................................: test.pcapng version (pcapng).........................: 1.0 operating system.........................: Linux 6.8.1-arch1-1 application..............................: hcxdumptool 6.3.4-14-g3693e77 ... EAPOL pairs written to 22000 hash file...: 1 (RC checked)

PSK has been sucessful recovered by hashcat:

Code:

$ hashcat -m 22000 test.hc22000 -a 3 12345678 hashcat (v6.2.6-848-gc1a10518f) starting ... Session..........: hashcat Status...........: Cracked Hash.Mode........: 22000 (WPA-PBKDF2-PMKID+EAPOL) Hash.Target......: test.hc22000 Time.Started.....: Tue Mar 19 18:32:22 2024 (0 secs) Time.Estimated...: Tue Mar 19 18:32:22 2024 (0 secs) Kernel.Feature...: Pure Kernel Guess.Mask.......: 12345678 [8] Guess.Queue......: 1/1 (100.00%) Speed.#1.........: 40 H/s (0.65ms) @ Accel:64 Loops:256 Thr:32 Vec:1 Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) Progress.........: 1/1 (100.00%) Rejected.........: 0/1 (0.00%) Restore.Point....: 0/1 (0.00%) Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1 Candidate.Engine.: Device Generator Candidates.#1....: 12345678 -> 12345678 Hardware.Mon.#1..: Temp: 49c Util: 6% Core:1875MHz Mem:4001MHz Bus:8 Started: Tue Mar 19 18:32:00 2024 Stopped: Tue Mar 19 18:32:22 2024

That is the way as described in hashcat wiki:
https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2