1

I'm trying aircrack-ng attack like below:

crunch 1 2 -f /usr/local/Cellar/crunch/3.6/share/charset.lst mixalpha-numeric|aircrack-ng -b 90:F6:52:80:B9:E2 -w - ~/DumpLog*
⋮
Crunch will now generate the following number of lines: 221918520426688
⋮

and it can't finish. I see that it should go through Petabytes in relatively small amount of time (here's example of 10 letter pwd cracked in 30mins: Cracking WPA key with crunch | aircrack)

I've tried simply

crunch 1 2 -f /usr/local/Cellar/crunch/3.6/share/charset.lst mixalpha-numeric|aircrack-ng -b 90:F6:52:80:B9:E2 -w - ~/DumpLog*
Crunch will now generate the following amount of data: 11656 bytes
0 MB
0 GB
0 TB
0 PB
Crunch will now generate the following number of lines: 3906 
Opening /Users/msciwoj/DumpLog 16-04-19 00:02
Opening /Users/msciwoj/DumpLog 16-04-19 22:48.1
Opening /Users/msciwoj/DumpLog 16-04-20 16:06
Reading packets, please wait...
                             Aircrack-ng 1.1
Passphrase not in dictionary 

and it's taking ~30seconds (for only 4k combinations!)

  • What am I doing wrong? Is there better/faster method (than crunch) to generate all possible permutations?
  • Is there anything wrong with the capture files I have:

.

ls -l ~/DumpLog*
-rw-r--r-- 1 msciwoj 388572231 Apr 19 16:29 /Users/msciwoj/DumpLog 16-04-19 00:02
-rw-r--r-- 1 msciwoj 856313817 Apr 20 08:41 /Users/msciwoj/DumpLog 16-04-19 22:48.1
-rw-r--r-- 1 msciwoj 426269497 Apr 20 22:10 /Users/msciwoj/DumpLog 16-04-20 16:06
  • could the fact I'm on Mac OS X have to do anything with it?
msciwoj
  • 111
  • 1
  • 2

3 Answers3

1

As Daisetsu said, you're not doing anything wrong: CPU is just very slow at hashing WPA passwords. While I don't have experience on it, OSX shouldn't be a problem either.

The WPA/2 spec demands 4096 rounds of HMAC-SHA1 hashes to derive the final key. This equates to 16,384,000 general HMAC-SHA1 hashes/second at ~4k keys/second. Individually, they're rather fast. However WPA was designed in part to make brute force attacks harder (as well as more secure in general), and thus implemented many rounds of hashes instead of using just one.

Relying on CPU for cracking WPA isn't going to get you very far, as you've noticed. A much faster method would be GPU cracking. Even without a powerful GPU, you'll most likely get better results.

In my eyes, there are two major contenders in the GPU cracking game: hashcat and Pyrit;

hashcat

Site: https://hashcat.net/hashcat/
Tutorial: https://www.blackmoreops.com/2014/03/27/cracking-wpa-wpa2-with-hashcat-kali-linux/

hashcat is great if you don't have a lot of hard drive space. You can feed it input with crunch (like you're doing now), and it supports an incredible amount of algorithms; not just WPA. If you stop hashcat, you can pick it up later by specifying the start string in crunch, as hashcat gives you regular updates on its speed and current password as well as other things.

Pyrit

Site: https://github.com/JPaulMora/Pyrit
Tutorial: https://www.blackmoreops.com/2014/03/10/cracking-wifi-wpawpa2-passwords-using-pyrit-cowpatty/

Pyrit is great for precomputational attacks. Pyrit allows you to specify an SSID (since the SSID is used in the HMAC algorithm) and compute a table of keys based off of an input (be it a file or crunch) and keep them. If you knew the SSID you were after (say, Netgear; a default name) you could just compare the keys without having to recompute them over and over again. This is great because the comparison process is incredibly easy and will still use the gpu. With my SLI GTX650TI boost setup, I got about 55k hashes/second, and one-hundred million comparisons/second (if my memory is correct; this was a while ago).

Pyrit is more useful in the long run, as you have only to compute the keys once, then compare them with the captured handshake in your pcap files. With hashcat, you can get to cracking and comparing at the same time without the need to precompute everything and then compare it.

The difference is time: if you have an 8 character password, and you're going to try all possible combinations from aaaaaaaa to zzzzzzzz and your password was mmmmmmmm, Pyrit would have to compute all possible keys from aaaaaaaa to zzzzzzzz and then compare it, whereas hashcat would would get to mmmmmmmm, hash it, compare it, and tell you its found the answer without having to go through all the other possible candidates.

Now, if you then changed the password and wanted to compare another handshake, then Pyrit would be your boy, as you've already computed all the keys for aaaaaaaa to zzzzzzzz for that SSID, whereas hashcat would have to recompute them. Basically, if you will re-use an SSID many times, go for Pyrit. If its a one off, use hashcat.

As for raw speed numbers, this site has a very nice table comparing the speeds of many different graphics cards. In my experience, hashcat and Pyrit have about the same hashing speeds, so if that number is your main concern, using either GPU hashing program will yield approximately the same results. Your main concern between programs will be the re-use of that SSID.

I hope this makes sense. If not, let me know and I'll try to explain it better!

0

4 thousand keys a second isn't unexpected when using a CPU. If you want any speed at all for this kind of work you're going to need to use a GPU to run the cracking software.

source: https://forums.kali.org/showthread.php?18261-Cracking-WPA-key-with-crunch-aircrack-(almost-fullproof-but-how-speed-things-up)&s=0e25b769bc3548014f4760ff531e2898&p=25828&viewfull=1#post25828

Look at the post I linked to (#9), the output lists 4k/s crack time.

Daisetsu
  • 5,110
  • 1
  • 14
  • 24
0

While what you are doing it's OK, it's a bit uncommon, given that WPA passwords can be any length, generally are a minimum of 8 in length. You're typing:

crunch 1 2...

Which means passwords of 1 to 2 letters, any given charset wouldn't create many passwords since the 1 will only use the given charset, and 2 will use the charset to permute itself once. That's why you're getting only 4k combinations! (11656 bytes and 3906 lines)

I strongly recommend you not to pipe the result of crunch into aircrack directly if you got time and/or not much process power, try to output crunch passwords into a file and input that into aircrack in two different commands

crunch 1 2 -f /usr/local/Cellar/crunch/3.6/share/charset.lst mixalpha-numeric -o wordlist.txt

and then

aircrack-ng -b 90:F6:52:80:B9:E2 -w wordlist.txt ~/DumpLog*

Regarding the "better/faster method (than crunch) to generate all possible permutations?", that is not the bottleneck of the cracking, writing permutations isn't that process-exhaustive, it's the WPA encryption, you can do a space-time trade-off explained by Nicholas Dechert answer on creating the pre-computation with the SSID of the WPA, that will boost your time amazingly.

Azteca
  • 1,116
  • 7
  • 16