Cracking WPA/WPA2 with hashcat

Since version 6.0.0, hashcat has supported hash mode 22000:

 22000 | WPA-PBKDF2-PMKID+EAPOL
 22001 | WPA-PMK-PMKID+EAPOL

Benefits of hash mode 22000:

• The hash line combines PMKIDs and EAPOL MESSAGE PAIRs in a single file
• Having all the different handshake types in a single file allows for efficient reuse of PBKDF2 to save GPU cycles
• The text format allows standard tools to filter or process the hashes
• The text format makes hashes easy to copy and paste
• The tools below capture and filter WPA handshakes and output them in hash mode 22000 format

Difference between hash mode 22000 and hash mode 22001:

• Use hash mode 22000 to recover a Pre-Shared-Key (PSK). A PSK can be 8 to 63 characters long
• Use hash mode 22001 to verify an existing (pre-calculated) Plain Master Key (PMK). A PMK is always 64 xdigits long

Two things changed for both modes in hashcat 8.0.0. The outfile and --show now carry the original hash line. This also lets --outfile-check-dir read those lines back for both PMKID and EAPOL. Mode 22001 now holds 1240 bytes of salt data per hash rather than 956 to make room for the 802.11r fields. Mode 22000 already used this size. A large hash list therefore needs more host and device memory than it did.

hashcat has supported mode 22000 since version 6.0. For the capture and conversion commands below, use current, compatible versions of hcxdumptool and hcxtools:

• hcxdumptool: https://github.com/ZerBea/hcxdumptool
• hcxpcapngtool, from hcxtools: https://github.com/ZerBea/hcxtools
• hashcat: https://github.com/hashcat/hashcat

Optionally there is hcxlabtool, which you can use as an experienced user or in headless operation instead of hcxdumptool: https://github.com/ZerBea/wifi_laboratory

For users who prefer not to compile hcxtools from source, an online converter is available: https://hashcat.net/cap2hashcat/

If you choose the online converter, you may need to remove some data from your dump file if the file size is too large. Most of the time, this happens when data traffic is also being recorded.

You can reduce the size with tshark:

tshark -r dumpfile.cap -Y "(wlan.fc.type_subtype == 0x00 || wlan.fc.type_subtype == 0x02 || wlan.fc.type_subtype == 0x04 || wlan.fc.type_subtype == 0x05 || wlan.fc.type_subtype == 0x08 || eapol)" -F pcapng -w stripped.pcapng

Do not clean up the cap / pcap file (e.g. with wpaclean), as this will remove useful and important frames from the dump file. Do not use filtering options while collecting WiFi traffic.

Do not merge pcapng dump files, because that can destroy useful metadata.

hcxdumptool and hcxlabtool offer several attack modes that other tools do not.

This includes the PMKID attack, which is described here: https://hashcat.net/forum/thread-7717.html

It also includes AP-less client attacks and a lot more.

The capture is saved in pcapng format, which Wireshark and tshark can read. It includes metadata such as nonces, replay counters and MAC addresses. hcxpcapngtool uses this metadata when it extracts hashes.

In addition, the message pair field defines how hashcat handles the hash. When hcxdumptool is connected to a GPS device, it also saves the GPS coordinates of the frames.

Examples of the target and how traffic is captured:

1. Stop services that are using the WLAN device, such as NetworkManager and wpa_supplicant.service.

$ sudo systemctl stop NetworkManager.service
$ sudo systemctl stop wpa_supplicant.service

2. Start the attack and wait until you receive PMKIDs and / or EAPOL message pairs, then exit hcxdumptool

Do not set monitor mode using third-party tools.

Do not run hcxdumptool on a virtual interface.

Do not run hcxdumptool at the same time in combination with tools that take access to the interface (except Wireshark, tshark).

$ hcxdumptool -i INTERFACE_NAME -w dumpfile.pcapng --rds=1 -F

3. Restart stopped services to reactivate your network connection

$ sudo systemctl start wpa_supplicant.service
$ sudo systemctl start NetworkManager.service

4. Convert the traffic to hash format 22000

$ hcxpcapngtool -o hash.hc22000 dumpfile.pcapng

Make sure you are in the correct working directory.

5. Run hashcat with a wordlist of candidate passwords

$ hashcat -m 22000 hash.hc22000 wordlist.txt

Make sure you are in the correct working directory.

For more options, see the tools' help menus (-h or --help) or this thread.

Get more examples from here.

Run hashcat on an excellent WPA word list or check out their free online service:

Code: $ wget https://wpa-sec.stanev.org/dict/cracked.txt.gz $ hashcat -m 22000 test.hc22000 cracked.txt.gz

Get more examples from here: https://github.com/hashcat/hashcat/issues/2923

Explanation of the hc22000 hash line

WPA*01*PMKID*MAC_AP*MAC_CLIENT*ESSID***MESSAGEPAIR
WPA*02*MIC*MAC_AP*MAC_CLIENT*ESSID*NONCE_AP*EAPOL_CLIENT*MESSAGEPAIR

Explanation of the MESSAGEPAIR fields

bitmask of message pair field PMKID (WPA*01):
0: reserved
1: PMKID taken from AP
2: reserved
4: PMKID taken from CLIENT (wlan.da: possible MESH or REPEATER)
5: reserved
6: reserved
7: reserved


bitmask of message pair field EAPOL (WPA*02):
2,1,0:
 000 = M1+M2, EAPOL from M2 (challenge)
 001 = M1+M4, EAPOL from M4 (authorized) - usable if NONCE_CLIENT is not zeroed
 010 = M2+M3, EAPOL from M2 (authorized)
 011 = M2+M3, EAPOL from M3 (authorized) - unused
 100 = M3+M4, EAPOL from M3 (authorized) - unused
 101 = M3+M4, EAPOL from M4 (authorized) - usable if NONCE_CLIENT is not zeroed
3: reserved
4: ap-less attack (set to 1) - nonce-error-corrections not required
5: LE router detected (set to 1) - nonce-error-corrections required only on LE
6: BE router detected (set to 1) - nonce-error-corrections required only on BE
7: not replaycount checked (set to 1) - replaycount not checked, nonce-error-corrections mandatory

Examples to work on hc22000 hash files:

Filter hash file by PMKID

$ grep 'WPA\*01' hash.hc22000 > pmkid.hc22000
or
$ hcxhashtool -i hash.hc22000 --type=1 -o pmkid.hc22000

Filter hash file by EAPOL

$ grep 'WPA\*02' hash.hc22000 > eapol.hc22000
or
$ hcxhashtool -i hash.hc22000 --type=2 -o eapol.hc22000

Filter by authorized EAPOL MESSAGEPAIR

$ grep '2$' hash.hc22000
or
$ hcxhashtool -i hash.hc22000 --authorized -o authorized.hc22000

Filter by challenge EAPOL MESSAGEPAIR

$ grep '0$' hash.hc22000
or
$ hcxhashtool -i hash.hc22000 --challenge -o challenge.hc22000

Filter by MAC

$ grep '\*112233445566\*'  hash.hc22000 > mac.hc22000
or
$ hcxhashtool -i hash.hc22000 --mac-ap=112233445566 -o macap.hc22000
or
$ hcxhashtool -i hash.hc22000 --mac-client=112233445566 -o macclient.hc22000

Use of the original .cap and .hccapx formats is no longer supported. Files in .cap format can be converted for use with current tools. Files in .hccapx format cannot.

The following examples cover three common scenarios:

1. Dictionary attack
2. Brute-Force attack
3. Rule-based attack

• Grab a wordlist, like C-nets from wpa-sec.stanev.org.
• Put it into the hashcat folder.
• On Windows, create a batch file “attack.bat”, open it with a text editor, and paste the following:

$ hashcat -m 22000 hash.hc22000 cracked.txt.gz
on Windows add:
$ pause

Execute the attack using the batch file, which should be changed to suit your needs.

• Create a batch file “attack.bat”, open it with a text editor, and paste the following:

$ hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d
on Windows add:
$ pause

This tries every digits-only string of length 8. Replace the ?d as needed.

First, estimate the time the attack would take using a calculator.

TBD: add some example timeframes for common masks / common speed

This is similar to a dictionary attack, but the commands look a bit different:

$ hashcat -m 22000 hash.hc22000 -r rules/best66.rule cracked.txt.gz
on Windows add:
$ pause

This will mutate the wordlist with the best66 ruleset, which comes with the hashcat distribution. It used to be called best64.rule and was renamed.

Change the commands as needed. The time the attack takes to finish increases proportionally with the number of rules.

What are rules?

This page was partially adapted from this forum post, which also includes some details for developers.