wpa2

[ZerBea]

That would be a good starting point to hunt for the problem.
Please begin with output of
$ pwd
followed by (we are only interested in old .hc22000 files in the working directory)
$ ls *.hc22000
to find out if there is an old hc22000 file inside, because hcxpcapngtool appends entries to an existing file.
I just added this to hcxpcapngtool --help by last commit:

Code:

$ hcxpcapngtool --help
...
Do not edit, merge or convert pcapng files! This will remove optional comment fields!
Detection of bit errors does not work on cleaned dump files!
Do not use hcxpcapngtool in combination with third party cap/pcap/pcapng cleaning tools (except: tshark and/or Wireshark)!
It is much better to run gzip to compress the files. Wireshark, tshark and hcxpcapngtool will understand this.
Output is appended to existing files.
Recommended tools to show additional 802.11 fields or to decrypt WiFi traffic: Wireshark and/or tshark
Recommended tool to filter converted hash by several options: hcxhashtool
Recommended tool to get default or standard PSKs: hcxpsktool
Recommended tool to calculate wordlists based on ESSID: hcxeiutool
Recommended tools to retrieve PSK from hash: hashcat, JtR

You may have noticed that your problem helps me to improve hcxtools.

[JamesIsLegend11]

ok so first i installed all tools using this link https://github.com/ZerBea/hcxtools
git clone https://github.com/ZerBea/hcxtools

then i stopped all wpa processes
sudo systemctl stop NetworkManager.service
sudo systemctl stop wpa_supplicant.service

then i started hcxdumptool
sudo hcxdumptool -i wlan0 -o dumpfile.pcapng --active_beacon --enable_status=1

then i started all wpa processes
sudo systemctl start NetworkManager.service
sudo systemctl start wpa_supplicant.service

then i used hcxpcapngtool to decrypt file
hcxpcapngtool -o hash.hc22000 -E essidlist dumpfile.pcapng

and then when i try to crakc it with hashcat alway got error

the both files looks exactly like David Bombal ones in this video
I just watched it and he did same as me and it worked for him so idk wheres problem
https://www.youtube.com/watch?v=Usw0IlGbkC4

[ZerBea]

Ok, thanks.
The command lines are ok.
Have you removed the old file "dumpfile.pcapng" before running hcxdumptool?
If not, hcxdumptool will create a new one with ending -x, where x is the number of tries. This prevent overwriting the old dump file and make sure that we store traffic from the current session with unique random values valid for this traffic.

Code:

first run:
$ sudo hcxdumptool -i wlan0 -o dumpfile.pcapng --active_beacon --enable_status=1
$ ls
dumpfile.pcapng

second run:
$ sudo hcxdumptool -i wlan0 -o dumpfile.pcapng --active_beacon --enable_status=1
$ ls
dumpfile.pcapng-0

third run:
$ sudo hcxdumptool -i wlan0 -o dumpfile.pcapng --active_beacon --enable_status=1
$ ls
dumpfile.pcapng-1

Have you removed the old file "hash.hc22000" before running hcxpcapngtool?
If not, all new hashes are appended to the damaged file.

To make sure, that you are not running on old files, I recommend to remove all files from your working directory, before doing a new attempt.


To make sure, your installation is ok, please run the example from here:
https://github.com/evilsocket/pwnagotchi...-598597214
This are the command lines:
$ wget https://github.com/evilsocket/pwnagotchi...nctest.zip
$ unzip -j nctest.zip
$ hcxpcapngtool -o eapol.22000 -E wordlist test.pcap
output should look like this:

Code:

$ hcxpcapngtool -o eapol.22000 -E wordlist test.pcap
hcxpcapngtool 6.2.7-1-g74374b3 reading from test.pcap...

summary capture file
--------------------
file name.................................: test.pcap
version (pcap/cap).......................: 2.4 (very basic format without any additional information)
timestamp minimum (GMT)..................: 06.02.2020 12:23:49
timestamp maximum (GMT)..................: 06.02.2020 12:24:52
used capture interfaces..................: 1
link layer header type...................: DLT_IEEE802_11_RADIO (127)
endianess (capture system)...............: little endian
packets inside...........................: 6
packets received on 2.4 GHz..............: 5
ESSID (total unique).....................: 2
BEACON (total)...........................: 1
BEACON on 2.4 GHz channel (from IE_TAG)..: 5
PROBEREQUEST.............................: 1
EAPOL messages (total)...................: 4
EAPOL RSN messages.......................: 4
EAPOLTIME gap (measured maximum usec)....: 16624455
EAPOL ANONCE error corrections (NC)......: working
REPLAYCOUNT gap (suggested NC)...........: 62482
EAPOL M1 messages (total)................: 3
EAPOL M2 messages (total)................: 1
EAPOL pairs (total)......................: 1
EAPOL pairs (best).......................: 1
EAPOL pairs written to 22000 hash file....: 1 (RC checked)
EAPOL M12E2 (challenge)..................: 1

frequency statistics from radiotap header (frequency: received packets)
-----------------------------------------------------------------------
2432: 5

$ hashcat -m 22000 --nonce-error-corrections=8 eapol.22000 wordlist
output should look similar to this:

Code:

hashcat (v6.2.5-400-gf31dcc5d1) starting
...
OpenCL info removed to keep the post small
...
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 22000 (WPA-PBKDF2-PMKID+EAPOL)
Hash.Target......: eapol.22000
Time.Started.....: Tue Apr 26 23:30:15 2022 (0 secs)
Time.Estimated...: Tue Apr 26 23:30:15 2022 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (wordlist)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:       30 H/s (1.41ms) @ Accel:8 Loops:256 Thr:512 Vec:1
Recovered.Total..: 1/1 (100.00%) Digests
Progress.........: 2/2 (100.00%)
Rejected.........: 1/2 (50.00%)
Restore.Point....: 0/2 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: v+#gqu5g9pqnp%+7jbf%2uex+8hlo3ms -> v+#gqu5g9pqnp%+7jbf%2uex+8hlo3ms
Hardware.Mon.#1..: Temp: 59c Fan: 36% Util: 46% Core:1885MHz Mem:5005MHz Bus:16
...

hashcat should have recovered the PSK:
Recovered.Total..: 1/1 (100.00%) Digests