Cracking WEP Keys Using WEPCrack

Size: px

Start display at page:

Download "Cracking WEP Keys Using WEPCrack"

Phoebe Andrews
5 years ago
Views:

1 Appendix E Cracking WEP Keys Using WEPCrack This appendix describes an experiment to crack a WEP-protected WLAN using WEPCrack, an open-source WEP cracking tool. WEPCrack implements the RC4 weak-key attack introduced in 2001 by Fluhrer, Mantin, and Shamir. It is written in the Perl language. Stephen Brinton designed and implemented the experiments. E.1 System Setup The experiment uses three computers and one WEP-enabled Linksys wireless router as an AP. One computer serves as an Apache Web server, which is connected to the router via an Ethernet cable. The second computer is a WEP-enabled wireless laptop PC connected to the router. The router and the laptop computer share a 104-bit secret WEP key K. This computer continuously requests Web pages from the Web server for the purpose of generating a large number of frames. The third computer is also a laptop PC equipped with a WEP-enabled wireless network interface card (NIC) that can monitor network traffic. This computer runs WEPCrack to crack the WEP key K. Figure E.1 shows the system setup of this experiment. The experiment uses the following AP and wireless NICs: AP The AP used in the experiment was a WEP-enabled Linksys Wireless-B Broadband Router. User s Network Card Device: Driver: Vendor: Belkin F5D g Wireless Network card ndiswrapper (Belkin: bcmwl5.inf) Broadman Introduction to Network Security: Theory and Practice, Second Edition. Jie Wang and Zachary A. Kissel. Higher Education Press. All rights reserved. Published 2015 by John Wiley & Sons Singapore Pte Ltd.

2 386 Appendix E: Cracking WEP Keys Using WEPCrack Web server Wireless router User requesting Web pages Attacker running WEPCrack Figure E.1 WEPCrack experiment system setup Attacker s Network Card Device: Device Name: Driver: Vendor: AR abg (Netgate) ath0 ath_pci Atheros Communications, Inc. E.2 Experiment Details WEPCrack cracks WEP keys by first collecting weak initialization vectors. After sufficient information about weak initialization vectors is obtained, WEP Crack deduces from it the WEP key used in the WLAN. It may take a number of hours to collect information. After that, the actual cracking part may take only a few minutes. Step 1: Initial Setup Select a 104-bit WEP key for both the AP (the router) and the STA (the laptop computer that will continuously request Web pages from the Web server). In the experiment, the WEP key is chosen as a 13-byte binary string K = Start the Apache server using the #rcapache2 start command. The STA starts the requester program requester.c (see Section E.3) using./requester GET / where is the IP address of the Apache server. This produces continuous request and sending of a web page over the wireless connection.

3 Appendix E: Cracking WEP Keys Using WEPCrack 387 Step 2: Attacker Setup The attacker s laptop runs Linux. First run the ifconfig ath0 up command to enable the laptop s NIC. Then run the iwconfig ath0 scan command to search for the AP within range and collect its MAC address, channel, and essid information. The iwconfig ath0 scan command returns the following output: ath0 Scan completed Cell Address: 00:11:F5:1D:98:04 ESSID: "Gates" Mode: Master Frequency: GHz (Channel 7) Quality = 43/94 Signal level = -52 dbm Noise level = -95 dbm Encryption Key: on Bit Rate:... Finally, configure the NIC using the following commands: ifconfig ath0 down iwconfig ath0 channel 11 iwconfig ath0 ap 00:06:25:F3:CD:89 iwconfig ath0 essid ResearchAP iwconfig ath0 mode monitor ifconfig ath0 up Step 3: Collecting Weak Initialization Vectors Start Wireshark and open the capture window to capture wireless frames. Then run the WEPCrack program pcap-getiv.pl using the following command:./pcap-getiv.pl -i ath0. This may take several hours to run to collect sufficient information. This program produces a log file named IVFile.log, which contains weak initialization vectors and encrypted outputs. They will be used to help reveal the WEP key. Step 4: Cracking Run WEPCrack.pl on IVFile.log to deduce the WEB-kep. After only a few minutes of execution, WEPCrack arrived at the correct encryption key shown as follows, where $ is the Linux prompt: $./WEPCrack.pl Keysize = 13 [104 bits]

4 388 Appendix E: Cracking WEP Keys Using WEPCrack E.3 Sample Code The STA executes the following program, written by Stephen Brinton, to keep requesting Web pages. requester.h /************************************************ Header name: requester.h *************************************************/ #include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> #include <netdb.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <sys/stat.h> #include <unistd.h> // Maximum Sizes #define BUFSIZE 1024 #define HOST_NAME_SIZE 256 #define COMMAND_NAME_SIZE 3 #define FILENAME_SIZE 256 #define PORTNUMBER_SIZE 4 #define QLEN 128 requester.c /*********************************************************** Filename: requester.c Designer: Stephen Brinton - UML Overview: This program will continuously request and print Web pages Usage: client host portnumber command filename Example:./requester GET index.html Function: make_socket() - makes a socket connection ************************************************************/ #include "requester.h" int main(int argc, char *argv[]) int sd; // socket descriptor ID

5 Appendix E: Cracking WEP Keys Using WEPCrack 389 int n; // number of characters to/from socket char msg[bufsize]; // buffer used to hold socket message char host[host_name_size]; // host address char command[command_name_size]; // command - GET or PUT char filename[filename_size]; // filename to GET/PUT char port_number[portnumber_size]; // store portnumber from command line arguments int portnumber; // portnumber to GET/PUT // **** GATHER THE ARGUMENTS FROM THE COMMAND LINE **** if (argc!= 5) // check if there are 5 arguments // print error message otherwise fprintf(stderr, "Error - Usage: client host port_number command filename\n"); sprintf(host,argv[1]); sprintf(port_number,argv[2]); portnumber = atoi(port_number); sprintf(command,argv[3]); sprintf(filename,argv[4]); while(1) if (strcmp("get",command)!=0 && strcmp("put",command)!=0) fprintf(stderr, "Error - Invalid command entered: %s (Must be either PUT or GET)\n", command); // setup command to be sent through socket to host if (strcmp("get",command)==0) // Process the GET command sprintf(msg, "GET %s HTTP/1.0\r\nHost: %s\r\n\r\n", filename,host); if ((sd = make_socket(portnumber, host))== -1) ; write(sd,msg,strlen(msg)); else // PUT command FILE* fptr; int fd; int bytes_read; struct stat file_info; char* buffer;

6 390 Appendix E: Cracking WEP Keys Using WEPCrack size_t length; if ((fptr = fopen(filename, "rb")) == NULL) fprintf(stderr, "Error - File Not Found\n"); close (sd); fd = fileno(fptr); fstat(fd, &file_info); length = file_info.st_size; if (!S_ISREG (file_info.st_mode)) fprintf(stderr, "Error - File is not regular\n"); close (fd); close(sd); sprintf(msg, "PUT /%s HTTP/1.0\r\nHost: %s\r\ncontent-type: text/plain\r\ncontent-length: %d\r\n\r\n",filename,host,length); if ((buffer=(char*)malloc(length+strlen(msg)))==null) fprintf(stderr, "Error - Insufficient memory available to send file\n"); close (fd); memcpy(buffer, msg, strlen(msg)); bytes_read=fread(buffer+strlen(msg),1,length,fptr); close (fd); if ((sd = make_socket(portnumber, host))== -1) free(buffer); ; write(sd,buffer,bytes_read+strlen(msg)); // **** READ AND DISPLAY MESSAGES FROM SOCKET **** // read from socket and keep doing it until nothing // remains in socket n = recv(sd,msg,sizeof(msg),0); while (n>0) write(1,msg,n); n = recv(sd,msg,sizeof(msg),0); close(sd); // **** CLOSE CONNECTION ****

7 Appendix E: Cracking WEP Keys Using WEPCrack 391 return(0); /***************************************************************** Function name: make_socket Overview: This function setups a socket to be used by this client *****************************************************************/ int make_socket(int portnumber, char* host) struct hostent *ptrh; // pointer used by gethostbyname struct sockaddr_in sad; int sd; // socket descriptor ID // **** PREPARE THE ADDRESS TO BE USED IN MAKING THE CONNECTION memset ((char *)&sad, 0,sizeof(sad)); sad.sin_family = AF_INET; sad.sin_port = htons((u_short)portnumber); ptrh = gethostbyname(host); if (((char *)ptrh) == NULL) fprintf(stderr,"error-invalid host entered: %s\n",host); return -1; memcpy(&sad.sin_addr, ptrh->h_addr, ptrh->h_length); // **** MAKE THE SOCKET **** sd = socket(pf_inet, SOCK_STREAM, 0); if (sd < 0) fprintf(stderr, "Error - Socket creation failed\n"); return -1; // **** CONNECT TO SERVER **** if (connect(sd, (struct sockaddr *)&sad, sizeof(sad))<0) fprintf(stderr, "Error - Connect failed\n"); return -1; return sd;

1 /* client.c - adapted from code for example client program that uses TCP / 2 /Modified by Vincent Chu, Winter

1 /* client.c - adapted from code for example client program that uses TCP */ 2 /*Modified by Vincent Chu, Winter 2004. 3 http://www.sfu.ca/~vwchu 4 chuvincent (at) gmail (dot) com 5 */ 6 7 #define closesocket