Уязвимость в протоколе Wi-Fi Protected Setup

Discussion in 'Беспроводные технологии/Wi-Fi/Wardriving' started by gpuhash, 30 Dec 2011.

  1. TOX1C

    TOX1C Elder - Старейшина

    Joined:
    24 Mar 2012
    Messages:
    1,135
    Likes Received:
    1,931
    Reputations:
    24
    В таблице не увидел, но этот девайс скорее всего тоже к уязвимым относится. Просьба проверить на живом примере.
    74:d0:2b:84:41:d7 13850319 ASUS DSL-N10E
     
    1. Felis-Sapiens

      Felis-Sapiens Reservists Of Antichat

      Joined:
      21 Jul 2015
      Messages:
      616
      Likes Received:
      3,833
      Reputations:
      171
      Не подходит. В таблице все устройства из базы 3wifi, у которых WPSPIN соответствует этому алгоритму.
       
      dopetik and TOX1C like this.
      1. TOX1C

        TOX1C Elder - Старейшина

        Joined:
        24 Mar 2012
        Messages:
        1,135
        Likes Received:
        1,931
        Reputations:
        24
        Значит у асусов какой-то свой алгоритм. Тоже на базе мак-адреса, заметил, что у них пин-коды идут блоками, в одном блоке много пинов, начинающихся на 0, у других на 4 и т.д.
         
        1. VladimirV

          VladimirV Well-Known Member

          Joined:
          1 Apr 2013
          Messages:
          1,130
          Likes Received:
          6,150
          Reputations:
          57
          Вот таблица начало BSSID и модель к которым подходит данный алгоритм:
          Code:
          00:07:26:2F    Airocon WJ747, firmware: BroadKam_V1.0
          00:0B:2B:4A    Airocon Acorp Sprinter@ADSL W510N, firmware: R8676 IPv6 Acp 4WNE1 5.7R
          00:0B:2B:4A    Airocon Acorp Sprinter@ADSL W520N, firmware: R8676 IPv6 Acp 4WNE2 5.7R
          00:0E:F4:E7    Airocon RTL867x ADSL Modem, firmware: RTK V2.1.1
          00:13:33:AD    Airocon WR4-DP9110, firmware: RTK V2.1.1
          00:13:33:B0    Airocon WELL DA-150N, firmware: RTK V2.1.1
          00:13:33:B1    Airocon AD1501-1T1R, firmware: RTK V2.1.1
          00:13:33:B1    Airocon WR4-DP9110, firmware: RTK V2.1.1
          00:13:33:B5    Airocon AD1504-1T1R, firmware: RTK V2.1.1
          00:13:33:B6    Airocon AD1501-1T1R, firmware: RTK V2.1.1
          00:13:33:B7    Airocon AD1501-1T1R, firmware: RTK V2.1.1
          00:13:33:B8    Airocon AD1501-1T1R, firmware: RTK V2.1.1
          00:13:33:B8    Airocon AD1504-1T1R, firmware: RTK V2.1.1
          00:13:33:B9    Airocon AD1504-1T1R, firmware: RTK V2.1.1
          00:13:33:BB    Airocon AM241W, firmware: RNR4-A1-2x16_v2110831_DS1W_02_130628
          00:13:33:BB    Airocon WELL DA-150N, firmware: RTK V2.1.1
          00:17:7C:24    Airocon DG-BG4300N, firmware: R8676 IPv6 Dgs 4WNE2 5.8R
          00:17:7C:2E    Airocon DG-BG4300N, firmware: R8676_IPv6_DIGISOL_4PWNE2_5CR_16M_1017_1523
          00:17:7C:2F    Airocon DG-HR3400
          00:17:7C:30    Airocon DG-HR1400
          00:17:7C:31    Airocon DG-HR1400
          00:17:7C:31    Airocon DG-HR3400
          00:17:7C:36    Airocon DG-HR3400
          00:17:7C:3D    Airocon DG-HR1400
          00:17:7C:3D    Airocon DG-HR3400
          00:17:7C:41    Airocon DG-HR1400
          00:17:7C:41    Airocon DG-HR3400
          00:17:7C:43    Airocon DG-HR3400
          00:17:7C:44    Airocon DG-HR3400
          00:17:7C:4A    Airocon DG-HR1400
          00:17:7C:4B    Airocon DG-HR3400
          00:17:7C:4D    Airocon DG-HR1400
          00:17:7C:50    Airocon DG-HR1400
          00:17:7C:5A    Airocon DG-HR3400
          00:1A:EF:3D    Airocon Wireless Router
          00:1A:EF:3F    Airocon Wireless Router
          00:1A:EF:40    Airocon Wireless Router
          00:1A:EF:4A    Airocon Wireless Router
          00:1A:EF:4B    Airocon Wireless Router
          00:1A:EF:4C    Airocon Wireless Router
          00:1A:EF:51    Airocon Wireless Router
          00:E0:4B:B3    Airocon Wireless Router
          02:10:18:01    Airocon RTL867x ADSL Modem, firmware: RTK V2.1.1
          08:10:73:47    Airocon Wireless Router
          08:10:73:48    Airocon Wireless Router
          08:10:77:10    Airocon RTL867x ADSL Modem, firmware: RTK V2.1.1
          10:13:EE:01    Airocon JDR4150WN, firmware: RTK V2.1.1
          10:13:EE:05    Airocon WLAN ADSL2+ Router, firmware: RTK V2.1.1
          10:13:EE:06    Airocon WLAN ADSL2+ Router, firmware: RTK V2.1.1
          2C:AB:25:C7    Airocon MC-AWR11, firmware: MODECOM_V1.0
          38:2C:4A:C2    ASUS RT-N12VP Black
          78:8C:54:25    Airocon Eltek A7900, firmware: R8672_IPv6_HADARA_4PWNE1_5CR_16M_0520_1541
          78:8C:54:25    Airocon ENKOM A7900/A7901, firmware: R8672 IPv6 Hdr 4WNE1 5.5R
          78:8C:54:25    Airocon ENKOM A7900/A7901, firmware: R8672 IPv6 Hdr 4WNE1 5.6R
          78:8C:54:29    Airocon Eltek A7900, firmware: R8672_IPv6_HADARA_4PWNE1_5AR_16M_0322_1530
          78:8C:54:29    Airocon Eltek A7900, firmware: R8672_IPv6_HADARA_4PWNE1_5AR_16M_0409_1444
          78:8C:54:29    Airocon Eltek A7900, firmware: R8672_IPv6_HADARA_4PWNE1_5CR_16M_0520_1541
          78:8C:54:29    Airocon ENKOM A7900/A7901, firmware: R8672 IPv6 Hdr 4WNE1 5.6R
          78:8C:54:32    Airocon Eltek A7900, firmware: R8672_IPv6_HADARA_4PWNE1_5AR_16M_0409_1444
          78:8C:54:32    Airocon Eltek A7900, firmware: R8672_IPv6_HADARA_4PWNE1_5AR_16M_0409_1531
          78:8C:54:32    Airocon Eltek A7900, firmware: R8672_IPv6_HADARA_4PWNE1_5CR_16M_0520_1541
          80:3F:5D:F6    Airocon RTL8671 ADSL Modem, firmware: RTK V2.1.1
          94:FB:B2:37    Airocon Wireless Router
          94:FB:B2:3D    Airocon Wireless Router
          94:FB:B2:58    Airocon Wireless Router
          94:FB:B2:5E    Airocon Wireless Router
          94:FB:B2:6F    Airocon Wireless Router
          A8:32:9A:00    Airocon Wireless Router
          BC:96:80:14    Airocon Wireless Router
          BC:96:80:39    Airocon Wireless Router
          BC:96:80:45    Airocon Wireless Router
          BC:96:80:51    Airocon SpeedSurf 504AN, firmware: GAN9.8U26-4-TX-R4B016-PH.EN
          F4:3E:61:0D    Airocon Intercross 4PW, firmware: V2.1
          F4:3E:61:38    Airocon GD-W710G, firmware: GOLDWEB_V1.0
          F4:3E:61:4B    Airocon WIFI-2000 N150-A, firmware: V2.1.1
          F4:3E:61:55    Airocon GD-W810N/ND, firmware: GOLDWEB_V1.0
          F4:3E:61:8C    Airocon Intercross 4PW, firmware: V2.1
          F4:3E:61:8E    Airocon Intercross 4PW, firmware: GAW9.5Z97-4-IC.MGTS-R3B112-RU.EN
          F4:3E:61:8F    Airocon Intercross 4PW, firmware: V2.1
          F4:3E:61:D1    Airocon Intercross 4PW, firmware: GAW9.5Z97-4-IC.MGTS-R3B112-RU.EN
          F4:3E:61:D1    Airocon Intercross 4PW, firmware: V2.1
          F4:3E:61:F7    Airocon TAD-110, firmware: V2.1.1
          FC:8B:97:27    Airocon SpeedSurf 504AN, firmware: GAN9.8U26-4-TX-R4B016-PH.EN
          FC:8B:97:35    Airocon SpeedSurf 504AN, firmware: GAN9.8U26-4-TX-R4B016-PH.EN
          FC:8B:97:38    Airocon SpeedSurf 504AN, firmware: GAN9.8U26-4-TX-R4B016-PH.EN
          
          P.S. К ASUS 38:2C:4A:C2:BC:18 - просто совпало.
           
          #3344 VladimirV, 19 Apr 2016
          Last edited: 19 Apr 2016
          1. henri2002

            henri2002 Active Member

            Joined:
            25 Sep 2013
            Messages:
            379
            Likes Received:
            282
            Reputations:
            3
            можете отдельно выложить компаньон.
             
            TOX1C likes this.
            1. Sves

              Sves Active Member

              Joined:
              7 Dec 2015
              Messages:
              33
              Likes Received:
              186
              Reputations:
              1
              Подскажите, пожалуйста, как правильно подобраться к скрытой точке Reaver-ом?
              Code:
              root@2016:~# wash -i wlan0mon -C
              Wash v1.5.2 WiFi Protected Setup Scan Tool
              Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <[email protected]>
              mod by t6_x <[email protected]> & DataHead & Soxrok2212
              
              BSSID  Channel  RSSI  WPS Version  WPS Locked  ESSID
              --------------------------------------------------------------------------------------
              58:6D:8F:63:ХХ:ХХ  1  -63  1.0  No  (null)
              
              root@2016:~# airodump-ng wlan0mon -a --channel 1
               CH  1 ][ Elapsed: 12 s ][ 2016-04-19 23:49   
               BSSID  PWR RXQ  Beacons  #Data, #/s  CH  MB  ENC  CIPHER AUTH WPS  ESSID
               58:6D:8F:63:ХХ:ХХ  -62  0  2  1  0  1  54e  WPA2 CCMP  PSK  1.0  <length:  7>
              
               
              1. atlas28

                atlas28 Active Member

                Joined:
                23 May 2015
                Messages:
                224
                Likes Received:
                173
                Reputations:
                1
                По BSSID не работает? Тогда для начала попробуй узнать ESSID. Просто запусти airodump и слушай эту точку, пока к ней кто-нибудь не подключится. А потом уже добавишь этот параметр в ривер.
                 
                startless and Sves like this.
                1. Sves

                  Sves Active Member

                  Joined:
                  7 Dec 2015
                  Messages:
                  33
                  Likes Received:
                  186
                  Reputations:
                  1
                  По BSSID не соединяется. ESSID знаю, но тоже не может соединиться ([!] WARNING: Failed to associate with 58:6D:8F:63:ХХ:ХХ (ESSID: Touareq)).
                   
                  1. binarymaster

                    binarymaster Elder - Старейшина

                    Joined:
                    11 Dec 2010
                    Messages:
                    4,717
                    Likes Received:
                    10,195
                    Reputations:
                    126
                    Я скорее на JS перепишу, и впихну в 3WiFi. В качестве бонуса, так сказать.
                    См. https://forum.antichat.ru/posts/3975583
                     
                    1. startless

                      startless Member

                      Joined:
                      20 Jun 2015
                      Messages:
                      135
                      Likes Received:
                      96
                      Reputations:
                      0
                      Из неизданного, так сказать:

                      Ne Podklyuchaisya Ko mne@
                      mne_ne_zjalko))
                      Hren wam\ a ne wi-fi
                       
                      1. atlas28

                        atlas28 Active Member

                        Joined:
                        23 May 2015
                        Messages:
                        224
                        Likes Received:
                        173
                        Reputations:
                        1
                        Попробуй выполнить ассоциацию при помощи aireplay-ng (--fakeauth), а в ривере указать ключ -A.
                        А вообще WPS то там точно включен?
                         
                        1. atlas28

                          atlas28 Active Member

                          Joined:
                          23 May 2015
                          Messages:
                          224
                          Likes Received:
                          173
                          Reputations:
                          1
                          Пока не проверял, но автор написал, что исправил баг в pixiewps 1.2 с роутерами SERCOMM https://github.com/wiire/pixiewps/issues/25

                          UPD: проверил, работает, однако приходится очень долго ждать, если явно не указать дату (--start --end). В 1.1 такого не было. Отписал автору.
                           
                          #3352 atlas28, 23 Apr 2016
                          Last edited: 23 Apr 2016
                          1. CRACK211

                            CRACK211 Elder - Старейшина

                            Joined:
                            16 Sep 2009
                            Messages:
                            1,045
                            Likes Received:
                            1,127
                            Reputations:
                            11
                            подскажите пожалуйста , есть ли алгоритмы для zte? билайн 4g.
                            ZTE 4G Wi-Fi Router MF65M
                             
                            #3353 CRACK211, 27 Apr 2016
                            Last edited: 27 Apr 2016
                            1. binarymaster

                              binarymaster Elder - Старейшина

                              Joined:
                              11 Dec 2010
                              Messages:
                              4,717
                              Likes Received:
                              10,195
                              Reputations:
                              126
                              Заходил в админку подобного девайса, но по WPS ничего не нашёл.
                              [​IMG]
                               
                              Payer and paulo like this.
                              1. TOX1C

                                TOX1C Elder - Старейшина

                                Joined:
                                24 Mar 2012
                                Messages:
                                1,135
                                Likes Received:
                                1,931
                                Reputations:
                                24
                                Какие же там мерзкие пароли с завода стоят. Нужен и для них алгоритм, благо не в них одних он используется.
                                в укротелекомовских старых роутерах zte тоже нет пина впс в админке, но пин то есть, и для всех одинаковый
                                 
                                #3355 TOX1C, 27 Apr 2016
                                Last edited: 27 Apr 2016
                                1. CRACK211

                                  CRACK211 Elder - Старейшина

                                  Joined:
                                  16 Sep 2009
                                  Messages:
                                  1,045
                                  Likes Received:
                                  1,127
                                  Reputations:
                                  11
                                  и какой же если не секрет?
                                   
                                  1. TOX1C

                                    TOX1C Elder - Старейшина

                                    Joined:
                                    24 Mar 2012
                                    Messages:
                                    1,135
                                    Likes Received:
                                    1,931
                                    Reputations:
                                    24
                                    94229882
                                     
                                    dopetik, 4Fun and quite gray like this.
                                    1. Felis-Sapiens

                                      Felis-Sapiens Reservists Of Antichat

                                      Joined:
                                      21 Jul 2015
                                      Messages:
                                      616
                                      Likes Received:
                                      3,833
                                      Reputations:
                                      171
                                      Мне наконец-то удалось составить алгоритм генерации WPSPIN для некоторых моделей ASUS (и, как оказалось, Airocon). Итак, держите:

                                      [​IMG]

                                      Airocon 1.00
                                      Airocon 150Mbps Wireless N ADSL2/2+ Modem Router, firmware: RTK V2.1.1
                                      Airocon ADN-4101, firmware: V1.9
                                      Airocon ADSL Modem, firmware: V2.1.1
                                      Airocon ADSL Modem, firmware: V2.11
                                      Airocon ADSL Router, firmware: GAN9.9W7-4-VO-R6B011-VN.EN
                                      Airocon ADSL Router, firmware: V2.1.2
                                      Airocon AIRDSL A1144, firmware: RTK V2.1.1
                                      Airocon ASUS DSL-N10E, firmware: V2.1.14
                                      Airocon ASUS DSL-N10E, firmware: V2.1.15_EU
                                      Airocon ASUS DSL-N10E, firmware: V2.1.15_TR
                                      Airocon ASUS DSL-N10E, firmware: V2.1.16_APAC
                                      Airocon ASUS DSL-N10E, firmware: V2.1.16_EU
                                      Airocon ASUS DSL-N10E, firmware: V2.1.19_EU
                                      Airocon ASUS DSL-N10E, firmware: V2.1.20_EU
                                      Airocon CNet Wireless-N ADSL Router, firmware: CNet V1.1
                                      Airocon DIR-600
                                      Airocon DIR-612
                                      Airocon D-Link DIR-600M
                                      Airocon DR-820, firmware: Across DR-820 _V1.0
                                      Airocon DR-921, firmware: Across DR-921 _V1.0
                                      Airocon DSL-2730E, firmware: SEA_1.00
                                      Airocon DSL-N10S, firmware: V2.1.16_APAC
                                      Airocon DSL-N10S, firmware: V2.1.17_APAC
                                      Airocon DSL-N12E, firmware: V2.1.15_EU
                                      Airocon DSL-N12E, firmware: V2.1.15_TR
                                      Airocon DSL-N12E, firmware: V2.1.16_APAC
                                      Airocon DSL-N12E, firmware: V2.1.16_EU
                                      Airocon DSL-N12E, firmware: V2.1.17_APAC
                                      Airocon DSL-N12E, firmware: V2.1.19_EU
                                      Airocon DSL-N12E, firmware: V2.1.20_EU
                                      Airocon F9J1004v1/F9J1005v1, firmware: 1.00.02
                                      Airocon F9J1004v2/F9J1005v2, firmware: 1.00.01
                                      Airocon GD-W809N, firmware: Goldweb GD-W809N _V1.0
                                      Airocon GD-W810N/ND, firmware: GOLDWEB_V1.0
                                      Airocon GD-W810ND, firmware: Goldweb GD-W810ND _V1.0
                                      Airocon GD-W910ND, firmware: Goldweb GD-W910ND _V1.0
                                      Airocon IP-WDL-RT150-P4, firmware: V02.01 Build.131031 Rel.0643670
                                      Airocon IP-WDL-RT150-P4, firmware: V02.02 Build.140304 Rel.0651388
                                      Airocon IP-WDL-RT150-P4, firmware: V02.02 Build.140721 Rel.0637816
                                      Airocon IP-WDL-RT1T1R-B, firmware: V02.01 Build.131101 Rel.0653054
                                      Airocon IP-WDL-RT2T2R, firmware: V02.02 Build.140728 Rel.0655111
                                      Airocon JCG, firmware: JWS-N530R
                                      Airocon LEO-150N-AD, firmware: LEO-150N-AD_V1.0.0.1_18082014
                                      Airocon LKW150-21A2, firmware: V2.1.2
                                      Airocon LKW300-21A3, firmware: V2.1.2
                                      Airocon MC-AWR11, firmware: MODECOM_V1.0
                                      Airocon Netis Modem Router, firmware: RTK V2.1.1
                                      Airocon Realtek Wireless Router, firmware: RTK V2.1.1
                                      Airocon Realtek Wireless Router, firmware: RTK V2.2.2
                                      Airocon RTA04N, firmware: RTA04N_GVT_009
                                      Airocon RTL8671 ADSL Modem, firmware: V01.10 Build.120329 Rel.0656648
                                      Airocon RTL867x ADSL Modem
                                      Airocon RTL867x ADSL Modem, firmware: BL V2.1.1
                                      Airocon RTL867x ADSL Modem, firmware: RTK V2.1.1
                                      Airocon RTL867x ADSL Modem, firmware: SEA_1.00
                                      Airocon RTL867x ADSL Modem, firmware: SEA_1.01
                                      Airocon RTL867x ADSL Modem, firmware: V01.11 Build.130424 Rel.0653855
                                      Airocon RTL867x ADSL Modem, firmware: V01.11 Build.131217 Rel.0648017
                                      Airocon RTL867x ADSL Modem, firmware: V01.12 Build.140115 Rel.0638469
                                      Airocon RTL867x ADSL Modem, firmware: V02.00 Build.121109 Rel.0653605
                                      Airocon RTL867x ADSL Modem, firmware: V02.01 Build.130218 Rel.0658357
                                      Airocon SWARAJ, firmware: SW200 V2.1.1
                                      Airocon SWARAJ, firmware: SW200 V2.1.2
                                      Airocon TD854W, firmware: V01.09 Build.111122 Rel.0657362
                                      Airocon TD854W, firmware: V01.11 Build.131227 Rel.0660914_TTNET
                                      Airocon TEW-719BRM, firmware: V1.02.B10
                                      Airocon Virtual Web Router
                                      Airocon WL-P-D408, firmware: V2.1.2
                                      Airocon ZE-W810ND, firmware: ZENET ZE-W810ND _V1.0
                                      Airocon ZW444, firmware: ZW444_V1.0
                                      Airocon ZW888, firmware: ZW888_V1.0
                                      Airocon ZW919, firmware: ZW919_V1.0
                                      ASUS DSL-N10_C1 ADSL
                                      ASUS DSL-N10-C1 ADSL
                                      ASUS DSL-N12E_C1 ADSL
                                      ASUS DSL-N12E-C1 ADSL
                                      ASUS DSL-N12U_C1 ADSL
                                      ASUS DSL-N12U-C1 ADSL
                                      ASUS DSL-N14U ADSL
                                      ASUS RT-AC1200, firmware: 2.0
                                      ASUS RT-AC1200G+, firmware: 2.0
                                      ASUS RT-AC51U Black
                                      ASUS RT-AC51U, firmware: 2.0
                                      ASUS RT-G32
                                      ASUS RT-G32
                                      ASUS RT-G32 Rev.C1
                                      ASUS RT-N10
                                      ASUS RT-N10
                                      ASUS RT-N10 Rev.B1
                                      ASUS RT-N10 Rev.C1
                                      ASUS RT-N10+
                                      ASUS RT-N10E
                                      ASUS RT-N10LX
                                      ASUS RT-N10P Black
                                      ASUS RT-N10P, firmware: 2.0
                                      ASUS RT-N10PV2 Black
                                      ASUS RT-N10U
                                      ASUS RT-N10U Black
                                      ASUS RT-N11
                                      ASUS RT-N11P
                                      ASUS RT-N11P Black
                                      ASUS RT-N11P, firmware: 2.0
                                      ASUS RT-N12
                                      ASUS RT-N12 Black
                                      ASUS RT-N12 Rev.C1 Black
                                      ASUS RT-N12 Rev.D1 Black
                                      ASUS RT-N12+ Black
                                      ASUS RT-N12+, firmware: 2.0
                                      ASUS RT-N12D1, firmware: 2.0
                                      ASUS RT-N12E
                                      ASUS RT-N12E_B1, firmware: 2.0
                                      ASUS RT-N12HP_B1, firmware: 2.0
                                      ASUS RT-N12LX
                                      ASUS RT-N12VP
                                      ASUS RT-N12VP Black
                                      ASUS RT-N12VP, firmware: 2.0
                                      D-Link DIR-615
                                      Virtual Web 0.9 (proxy server)

                                      Ибо картинки на хостингах не вечны:
                                      Code:
                                      BSSID = b0:b1:b2:b3:b4:b5
                                      WPSPIN = p0 p1 p2 p3 p4 p5 p6 s
                                      p_i = (b_(i mod 6) + b5) mod (10 - (i + b1 + b2 + b3 + b4 + b5) mod 7)
                                       
                                      dopetik, 4Fun, quite gray and 30 others like this.
                                      1. CRACK211

                                        CRACK211 Elder - Старейшина

                                        Joined:
                                        16 Sep 2009
                                        Messages:
                                        1,045
                                        Likes Received:
                                        1,127
                                        Reputations:
                                        11
                                        Спасибо вам большое за ваш подарок!!))) дай вам бог здаровья и благополучия) 119 устройств))
                                         
                                        #3359 CRACK211, 27 Apr 2016
                                        Last edited: 27 Apr 2016
                                        4Fun, sha9 and TOX1C like this.
                                        1. binarymaster

                                          binarymaster Elder - Старейшина

                                          Joined:
                                          11 Dec 2010
                                          Messages:
                                          4,717
                                          Likes Received:
                                          10,195
                                          Reputations:
                                          126
                                          Красота-то какая! :rolleyes:
                                           
                                          #3360 binarymaster, 27 Apr 2016
                                          Last edited: 27 Apr 2016
                                          4Fun, sha9, startless and 5 others like this.