After converting a dumpfile.pcapng to .22000 no record
#2
Can you please add the dump file (zip compressed).

The screenshot doesn't show an EAPOL M2 from a CLIENT. Only M1 and M3 from the AP are recorded.
Due to the missing M2 a valid MESSAGE PAIR can't be converted.

I see the the PMKID, too, but you screenshot doesn't provide information about the AUTHENTICATION KEY MANAGEMENT (AKM).
hashcat is only able to recover the PSK from from a PMKID using AKM PSK (WPA2) or AKM PSK256 (WPA2 key version 3).

RSN Information from BEACON or ASSOCIATIONREQUEST or REASSOCIATIONREQUEST:
Code:
Tag: RSN Information
    Tag Number: RSN Information (48)
    Tag length: 20
    RSN Version: 1
    Group Cipher Suite: 00:0f:ac (Ieee 802.11) AES (CCM)
    Pairwise Cipher Suite Count: 1
    Pairwise Cipher Suite List 00:0f:ac (Ieee 802.11) AES (CCM)
    Auth Key Management (AKM) Suite Count: 1
    Auth Key Management (AKM) List 00:0f:ac (Ieee 802.11) PSK
    RSN Capabilities: 0x0000

Hashcat is not able to recover e.g. AKM FT-PSK. This PMKIDs will not be converted:
Code:
Tag: RSN Information
    Tag Number: RSN Information (48)
    Tag length: 24
    RSN Version: 1
    Group Cipher Suite: 00:0f:ac (Ieee 802.11) AES (CCM)
    Pairwise Cipher Suite Count: 1
    Pairwise Cipher Suite List 00:0f:ac (Ieee 802.11) AES (CCM)
    Auth Key Management (AKM) Suite Count: 2
    Auth Key Management (AKM) List 00:0f:ac (Ieee 802.11) PSK 00:0f:ac (Ieee 802.11) FT using PSK
    RSN Capabilities: 0x0000

To figure out, what went wrong, please add the dump file (zip compressed).
Please also comment the complete status output of hcxpcapngtool. It shows what kind of AKMs are in use.

This frames are mandatory to convert a PMKID
Code:
ASSOCIATIONREQUEST, REASSOCIATIONREQUEST or BEACON to get the ESSID & the AKM)
EAPOL MESSAGE M1 to get the PMKID (AKM must be supported by hashcat)
or
Code:
ASSOCIATIONREQUEST, REASSOCIATIONREQUEST or BEACON to get the ESSID & the AKM)
EAPOL MESSAGE M1 & M2 or M2 & M3 or M1 & not zeroed M4 to get a MESSAGE PAIR  (AKM must be supported by hashcat)

If these conditions do not meet hcxpcapngtool doesn't convert the dump file to a hc22000 file.
Reply


Messages In This Thread
RE: After converting a dumpfile.pcapng to .22000 no record - by ZerBea - 07-23-2024, 07:33 AM