hcxtools - solution for capturing wlan traffic and conversion to hashcat formats

[ZerBea]

The major reason to use HEX_ASCII within hash lines:
"Unlike basic service set identifiers, SSIDs are usually customizable. These SSIDs can be zero to 32 octets (32 bytes) long, and are, for convenience, usually in a natural language, such as English. The 802.11 standards prior to the 2012 edition did not define any particular encoding or representation for SSIDs, which were expected to be treated and handled as an arbitrary sequence of 0–32 octets that are not limited to printable characters. IEEE Std 802.11-2012 defines a flag to express that the SSID is UTF-8-encoded and could contain any Unicode text. Wireless network stacks must still be prepared to handle arbitrary values in the SSID field."

Due to my analyses of wpa-sec submissions, I've seen almost everything within SSID IE_TAG.

And the script (one liner) you're looking for:

Code:

$ printf hashline | awk 'BEGIN { FS = "*" } ; { print $6 }' | perl -pe 's/(..)/chr(hex($1))/ge'

From hashcat example hashes
https://hashcat.net/wiki/doku.php?id=example_hashes

Code:

$ printf "WPA*01*4d4fe7aac3a2cecab195321ceb99a7d0*fc690c158264*f4747f87f9f4*686173686361742d6573736964***" | awk 'BEGIN { FS = "*" } ; { print $6 }' | perl -pe 's/(..)/chr(hex($1))/ge'
hashcat-essid

or

Code:

$ whoismac -x 686173686361742d6573736964
hashcat-essid

or

Code:

$ whoismac -x `printf "WPA*01*5ce7ebe97a1bbfeb2822ae627b726d5b*27462da350ac*accd10fb464e*686173686361742d6573736964***" | awk 'BEGIN { FS = "*" } ; { print $6 }'`
hashcat-essid

or (if you know the PSK)

Code:

$ hcxpmktool -i "WPA*01*4d4fe7aac3a2cecab195321ceb99a7d0*fc690c158264*f4747f87f9f4*686173686361742d6573736964***" -p 'hashcat!'

ESSID.............: hashcat-essid
PSK  .............: hashcat!
PMK...............: 88f43854ae7b1624fc2ab7724859e795130f4843c7535729e819cf92f39535dc
PMKID (calculated): 4d4fe7aac3a2cecab195321ceb99a7d0
PMKID (hash line).: 4d4fe7aac3a2cecab195321ceb99a7d0 (equal)

or (if you know the PMK)

Code:

$ hcxpmktool -i "WPA*01*4d4fe7aac3a2cecab195321ceb99a7d0*fc690c158264*f4747f87f9f4*686173686361742d6573736964***" -m 88f43854ae7b1624fc2ab7724859e795130f4843c7535729e819cf92f39535dc

ESSID.............: hashcat-essid
PMK...............: 88f43854ae7b1624fc2ab7724859e795130f4843c7535729e819cf92f39535dc
PMKID (calculated): 4d4fe7aac3a2cecab195321ceb99a7d0
PMKID (hash line).: 4d4fe7aac3a2cecab195321ceb99a7d0 (equal)

or what ever you want.

BTW:
Magnum (JtR) is involved, too:
https://github.com/hashcat/hashcat/issue...-446117257