hashcat & hcxdumptool ioctl(SIOCSIWMODE)

[ZerBea]

Looks like some tools still use WEXT. But that has nothing to do with the driver.

A quick and dirty test of the aircrack-ng driver:

Complies and inserts fine running Linux kernel 6.8.1:

Code:

$ uname -r
6.8.1-arch1-1

$ make
make ARCH=x86_64 CROSS_COMPILE= -C /lib/modules/6.8.1-arch1-1/build M=/tmp/git_rtl8812au_aircrack-ng  modules
make[1]: Entering directory '/usr/lib/modules/6.8.1-arch1-1/build'
make[1]: Leaving directory '/usr/lib/modules/6.8.1-arch1-1/build'
---------------------------------------------------------------------------
Visit https://github.com/aircrack-ng/rtl8812au for support/reporting issues
or check for newer versions (branches) of these drivers.                  
---------------------------------------------------------------------------

$ insmod 88XXau.ko

Running hcxdumptool latest git head:

Code:

$ hcxdumptool -v
hcxdumptool 6.3.4-14-g3693e77 (C) 2024 ZeroBeat
running on Linux kernel 6.8.1-arch1-1
running GNU libc version 2.39
compiled by gcc 13.2.1
compiled with Linux API headers 6.7.0
compiled with GNU libc headers 2.39
enabled REALTIME DISPLAY
enabled GPS support
enabled BPF compiler

Driver information:

Code:

$ hcxdumptool -l
  3      6    74da3876251a    c8aacc43f6fd    +    wlp22s0f0u4         rtl88XXau    NETLINK

Test target has been (successful) attacked in 6,403s (that include the time to init the device - this device is really slow):

Code:

$ time hcxdumptool -i wlp22s0f0u4 --bpf=target.bpfc -c 10a --rds=1 --exitoneapol=7 -w test.pcapng

0 ERROR(s) during runtime
128 Packet(s) captured by kernel
0 Packet(s) dropped by kernel
1 SHB written to pcapng dumpfile
1 IDB written to pcapng dumpfile
1 ECB written to pcapng dumpfile
5 EPB written to pcapng dumpfile

exit on EAPOL M1M2

real    0m6,403s
user    0m0,000s
sys     0m0,008s

Successful converted by hcxpcapngtool:

Code:

$ hcxpcapngtool -o test.hc22000 test.pcapng
hcxpcapngtool 6.3.4-6-gb7886cb reading from test.pcapng...

summary capture file
--------------------
file name.................................: test.pcapng
version (pcapng).........................: 1.0
operating system.........................: Linux 6.8.1-arch1-1
application..............................: hcxdumptool 6.3.4-14-g3693e77
...
EAPOL pairs written to 22000 hash file...: 1 (RC checked)

PSK has been sucessful recovered by hashcat:

Code:

$ hashcat -m 22000 test.hc22000 -a 3 12345678
hashcat (v6.2.6-848-gc1a10518f) starting
...                                                          
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 22000 (WPA-PBKDF2-PMKID+EAPOL)
Hash.Target......: test.hc22000
Time.Started.....: Tue Mar 19 18:32:22 2024 (0 secs)
Time.Estimated...: Tue Mar 19 18:32:22 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Mask.......: 12345678 [8]
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:       40 H/s (0.65ms) @ Accel:64 Loops:256 Thr:32 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 1/1 (100.00%)
Rejected.........: 0/1 (0.00%)
Restore.Point....: 0/1 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: 12345678 -> 12345678
Hardware.Mon.#1..: Temp: 49c Util:  6% Core:1875MHz Mem:4001MHz Bus:8

Started: Tue Mar 19 18:32:00 2024
Stopped: Tue Mar 19 18:32:22 2024

That is the way as described in hashcat wiki:
https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2