How this can be possible?
#1
I have a Zyxel cap file!
This file have two PMKIDS

Code:
21c6a979c865366c34101c99a5e9758f*bc99110f10d7*f099bf34a8b8*5a7958454c5f4847575f4639414141

5d61f6269e0aea5886c0f1a0ccf7a2b5*bc99110f10d7*b8b7f14164f4*5a7958454c5f4847575f4639414141

same router mac same client mac same router name but different pass hashes?

What does it mean?

Thanks
Reply
#2
Means you captured two PMKIDS  from two separate clients.  You should not post hashes however but the output you have posted is in the format of:

PKMID*AP MAC*STA MAC*ESSID
Reply
#3
(04-16-2020, 03:39 AM)slyexe Wrote: Means you captured two PMKIDS  from two separate clients.  You should not post hashes however but the output you have posted is in the format of:

PKMID*AP MAC*STA MAC*ESSID

I had two like this, on a brief test, for my own router and they cracked to the same value. You will see this with a lot of salted password hash types as well, like sha512crypt for example.
Reply
#4
(04-16-2020, 02:33 AM)Uraniumhazee Wrote: same router mac same client mac same router name but different pass hashes?

- PMKID are NOT the same
- Station mac are NOT the same (b8b7f14164f4 & f099bf34a8b8)

=> hashes are NOT similar.

Do NOT post hashes please.
Reply