hashcat Forum › Misc › General Talk v
Handshake timestamps do not match packets no.

Threaded Mode
Handshake timestamps do not match packets no.
fromdusktillpwn Offline
Junior Member
**
Posts: 19
Threads: 6
Joined: Jul 2017
#1
12-14-2019, 05:57 PM
I have following M1-4 EAPOL produced by aircrack, ordered by packet number according to wireshark (first column):

105686 22:43:29,145939 Key (Message 1 of 4) AP1->STA1
105692 22:43:29,145909 Key (Message 2 of 4) STA1->AP1
105694 22:43:29,145940 Key (Message 3 of 4) AP1->STA1
105696 22:43:29,145909 Key (Message 4 of 4) STA1->AP1

Timestamp is frame arrival value. Replay counter is 1/1/2/2, ANonces 1/3 are equal, no retransmission flags, no deauth, RX level is great. 

Handshake looks legit to me and yet I feel like timestamp value is more relayable than packet number so it kinda bothers me. What am I missing? Please, advice.
Find
Reply
ZerBea Offline
Moderator
*****
Posts: 1,044
Threads: 2
Joined: Jun 2017
#2
12-15-2019, 06:18 PM
You're missing nothing. Aircrack is running into several issues:
https://github.com/aircrack-ng/aircrack-ng/issues/2067
https://github.com/aircrack-ng/aircrack-ng/issues/1958
and the complete handshake detection need refactoring:
https://github.com/aircrack-ng/aircrack-ng/issues/2079
Find
Reply
fromdusktillpwn Offline
Junior Member
**
Posts: 19
Threads: 6
Joined: Jul 2017
#3
12-16-2019, 12:32 AM
Oh, I see. Thanks!

How does cap2hccapx pair those M1/2 messages with inverted timeline tho? key(STA+AP+RC)?
Find
Reply
ZerBea Offline
Moderator
*****
Posts: 1,044
Threads: 2
Joined: Jun 2017
#4
12-17-2019, 09:24 AM
cap2hccapx, hcxpcaptool and hcxpcapng tool calculating EAPOL time values (count time between EAPOL messages), because you can't trust the RC in case of a packet loss (therefore we have nonce-error-corrections, too).
If this values are outside the defined EAPOL timer values, the hash will not be converted.
Additional hcxpcaptool has options to control this behavior:
--ignore-replaycount : allow not replaycount checked best handshakes
--time-error-corrections=<digit> : maximum time gap between EAPOL frames - EAPOL TIMEOUT (default: 600s)
--nonce-error-corrections=<digit> : maximum replycount/nonce gap to be converted (default: 8)
example: --nonce-error-corrections=60
convert handshakes up to a possible packetloss of 59 packets
hashcat nonce-error-corrections should be twice as much as hcxpcaptool value

hcxpcapngtool (provide new hashmode 22000) have them too:
--eapoltimeout=<digit> : set EAPOL TIMEOUT (milliseconds)
: default: 20 ms
--nonce-error-corrections=<digit> : set nonce error correction
warning: values > 0 can lead to uncrackable handshakes
: default: 0


Read more about this timers, used by APs, here:
https://community.cisco.com/t5/wireless-...-p/3122477
Find
Reply