HackingRoXX

How to Crack a WEP Encrypted Wireless Network on Windows Vista

First you can only use this method to crack a WEP encrypted network. WEP has been
replaced by WPA encryption which is stronger but can still be cracked, just not as
easily. To find out if the network you want to crack is WEP encryption, simply view
the wireless networks in the Connect to a network box and hold your mouse over the
network of choice. A little box will tell you the encryption. If it say WEP - good we
can proceed, if it says anything else this tutorial wont help.
First to understand what you will be doing. You will be using a program to capture
packets and then use another program to analyze those packets and crack the key,
thus allowing you to have access to their network. To capture packets (data from the
network we are trying to crack) you must have the program running on your computer
and you must capture about 200 000 or more IV packets (a special type of packet). I
will show you how to capture the correct type of packets.
Also ONLY certain types of wireless cards can actually capture wireless packets. In
order to capture packets your wireless card must be able to go into monitor mode,
not every driver or every wireless card supports monitor mode. In most cases you will
have to download a special driver designed for your wireless card to put it into
monitor mode. I had to purchase a new wireless card because mine was not supported.
The program you will be using has a list of supported wireless cards and comes with
the drivers needed (Lucky you)
Ok, down to business. First the program you need to capture packets can be
downloaded from this link

http://www.tamos.com/download/main/ca.php

Next the program to analyze the packets and finger out the password can be
downloaded from my own site. I got it to work for windows vista and then zipped it all
into a folder for you. To get this to run all you have to do is extract it, open the
aircrack folder, then open the bin folder, then double click on Aircrack-ng GUI.exe.
Here is the download link

http://www.howtovideos.ca/images/aircrackVista.rar

click it and save the file.
Now for the dirty work, keep in mind this could take a few days to capture enough
packets. First install the Commview for Wifi program. You do this by extracting the
setup file from the file we downloaded earlier (ca6.zip) Then double click setup.exe
and follow the prompts. When Commview opens for the first time it has a driver
installations guide. This replaces the old driver with a newer, better, and more
improved version! Hooray. Follow the prompts to install your new driver and now we
are ready to capture. If everything has gone as planned when you open Commview for
Wifi the little play button in the top left corner will be blue. If it is not blue the
driver has not been installed properly. Moving on…
Click the blue button in the top left corner and then click Start Scanning. Commview
for Wifi now starts scanning each channel looking for data that is being sent. It will
list each network it finds. Now click each host until you find the name of the network
key you are trying to find. Now select the appropriate channel (my network is
broadcasting on channel 6 so I will start capturing all data on channel 6) Click
capture.
Commview for Wifi is now capturing all the packets being sent over channel 6. Once
Commview for Wifi collects enough packets aircrack can analyze them and crack the
wireless key. The thing is, you only need certain packets, and if you collect too many
unneeded packets aircrack may get confused. To help make things easier follow the
next few steps.
First of all we only want packets from one host, not all of them. As you can see from
my screenshot below I am collecting packets from 7 different network. (see
screenshot below)A few are WPA encrypted so they and a few are WEP. I really only
want to collect data being sent from one network, so in order to do this all you have
to do is right click on the wireless network you want to crack and select copy mac
address.
Now click on the rules tab. On the left side under simple rules click MAC Addresses.
For action select Capture, and for Add Record select both. Now click inside the entry
form box and hit ctrl+v (to paste the mac address) or right click and select paste.
Now hit add MAC Address.
What we just did is make a rule so that Commview for Wifi will only capture packets
coming from a certain MAC Address (the one we want) Great almost done.
Now to make things even easier for Aircrack you only want to capture DATA packets.
There are 3 types to select from Management packets, Data Packets and Control
Packets. We only want Data packets because that is where the information is that
Aircrack needs to crack the wireless encryption passkey. Simply select the D, and
unselect the M and the C.
Now Commview for Wifi is only capturing Data Packets. To be more specific
Commview for Wifi is only capturing Data Packets to and from a specific MAC
address. Now that everything is set up to capture the right types of packets we
should start saving the logs.
You have to save all of the packets into a log for Aircrack to analyze them. You can
set Commview for Wifi to save them automatically, or just save them yourself
periodically. It is a good idea to have them auto save because it splits them into nicely
sized logs, and if you accidentally close Commview for Wifi they will save and you
wont lose all your packets! To do that just go to the logging tab and enable auto
saving. You can change the settings if you would like (I recommend increasing the
maximum directory size to something like 100000).
And now we wait… We have to capture over 15000 IV packets. Because we set up
some rules most of the packets we capture will be IV packets (these are a certain
type of Data packet with information used to crack the wireless key). It took me
about 4 days to capture enough packets, but I was not running Commview for Wifi non
stop. If you are close to the network and there is heavy traffic, it may only take you
a few hours. Ok what do you do now?
Alright, so now 20000 packets (or more) later we are ready to crack the WEP
wireless key. First lets converts all of the log files to .cap format (shown in
screenshot below) When I cracked my first WEP key with this method I had 4 log
files and about 220 000 packets.Go to wherever you have your log files saved and
double click to open it. Now click on file -> Export Logs -> Tcpdump Format
Save it as 1.cap do the rest of your logs, saving them in sequential order 1.cap, 2.cap,
3.cap etc.
Now that you have all of your log files saved in .cap format lets open Aircrack. Open
the aircrack folder (wherever you extracted it) then open the Bin folder, now double
click Aircrack-ng GUI.exe. Aircrack will open, click the choose button and navigate to
where you have your log files saved. To select all of your log files ( saved in .cap
format) Hold down CTRL and click each file, Then hit open.
Now click launch, Aircrack shows you all of the different BSSID’s that it captured
data from and assigns an index number to each one, then it asks you Index number of
target network? You want to enter the number of the network you want to crack.
Mine is called CrackMePlease so I am selecting 15.
Enter the index number and then press enter, if you have enough IV’s then it should
give you the WEP key. If not go back and capture more and try again.
That’s all

There are two methods of hacking; locally, or globally. There are an infinite amount of subsets to the following ideas, but let us cover as much as we can. The following is one part of several parts of the tutorial that will later be posted. Let us start off with the first scenario.

Local Hacking

This method normally consists gaining access some way or another via the intranet. Let us test the following method. (Note, everything highlighted in YELLOW is code, what you type in the terminal)

-Wireless Hacking

Let us set up a scenario here. You are eager to gain access to a non-specific, (or specific, if you have an apparent grudge with a mean neighbor) to a local computer. Here are the tools needed to gain access before we go on our mission.

* Laptop with dual boot, (preferably BackTrack 2 for Linux, and the second boot being Windows XP Pro)
* A CD
* Deepburner, so you can burn your .ISO image to your CD.
* Supported wireless card for injection to work properly (please see the list found here >> http://www.aircrack-ng.org/doku.php?id=compatibility_drivers#which_is_the_best_card_to_buy.)
* Enough battery life to serve you well
* Kismet or netstumbler, (to each his own, preferably Kismet for Linux so you do not have to reboot back and forth so often; this comes complete in BackTrack 2)

Part 1

Gathering your materials

1. Download BackTrack 2 Final ISO image from: http://remote-exploit.org/backtrack_download.html

2. Download DeepBurner and install: http://www.deepburner.com/?r=download

3. Start up DB, and select burn ISO image file. Then, find your file, click burn.


Part 2

Beginning the project at hand

1. Start up your laptop into BackTrack 2. To do so, place the CD into the computer, turn it on, and select boot from CD, (it varies from laptop to laptop. It may have the option to hit a function key such as F10 to select boot device to boot from).







2. BT2 will ask you to put in your username and password; root/toor

3. Now, type in startx





4. Once the OS is loaded, click on the black box on the bottom left hand side, this is your shell.





5. Type in kismet and hit enter.

6. Kismet will eventually load, and pull up a fairly primitive color GUI within the shell that shows all access points within your designated area, constantly being updated.

7. After selecting your target, find out by kismet if it is WEP, WPA, etc. Preferably, WEP 64 or 128bit. It tells you in a sorted column on the right hand side.



8. Now, the fun begins. Open up a few tabs within the shell. Now type each line in each new tab. Everything within the parenthesis entails exclamations in terms of what it means, syntax, etc).

9. iwconfig wlan0 mode monitor (This places the wi-fi card in monitor mode; Syntax: iwconfig device_name_here mode command_monitor)

10. airodump-ng --ivs --write file_name --channel 11 wlan0 (Starts the monitoring, collects weak IV packets. Syntax: airodump-ng –ivs_creates_extension_type –-write any_given_filename_here –channel this specifies any specific channel you wish to listen to, so you can filter out any unnecessary data).



11. aireplay-ng -3 -b 00:16:B6:2E:C3:4E -h 00:14:A5:8A:02:CD wlan0 (Stimulates packets; injection. Syntax: aireplay-ng -3 attack level -b BSSID of router goes here, shown by kismet -h the attached computer to the bssid; the router wlan0=device that you are using, remains consistent).

12. aireplay-ng -0 wlan0 -a 00:16:B6:2E:C3:4E wlan0 (This is the deauthentication attack. Aireplay-ng -0 attack number wlan0 device type of yours -a BSSID goes here again wlan0 repeat your device here, yet again).

13. Now, watch the magic happen. To put it in layman's terms, MANY numbers will appear to be rapidly increasing. Within the airodump-ng tab you had opened, the SSID of the attacked victim will increase quite a bit. Look under the IVS column to view how many you have saved to the file. Let's for now on call this default victim SSID. Once the number hits 250,000 (if it is 64-bit encryption) or 1,000,000 for 128-bit, you will be able to execute your cracking method on the IVS file you have been continuously writing.

14. Cracking time! Cd to the directory that the file you have been saving. Then, execute the following: aircrack-ng -0 -n 128 -f 4 file_name.ivs (Syntax: aircrack-ng -0 attack type -n number of the encryption type, 64 or 128 -fudgefactor 2-18 *.cap or *.ivs depending on what file type you decided to save your file as while gathering packets).



15. After a minute or two, (possibly less) you will have your hexadecimal password so now you can connect to your noob, erm, I mean 'victim's' router.

16. Reboot your computer after jotting down the hex code, and log into your winbox on the same laptop.

17. I would recommend to now setup your 'anonymous tools.' I would suggest doing the following; download a program that IronGeek and I wrote that spoofs your MAC address and your NetBIOS each time upon startup. It is entitled MadMacs, and may be found at irongeek.com. Execute it, and reboot back into Windows.

18. Connect to SSID, and input the hex code twice WITHOUT THE COLLONS as required.





19. Hopefully, if you did not screw up, you will be connected.

Stay tuned.....

Now that we are connected, we may now try a few methods of attack. Of course there are many, but allow me to test a few, and you may choose the one that best suits your situation. (Note, everything highlighted in yellow is code, what you type in the terminal)

Now that you are apart of the network by accessing the router, we may go back to the lovely command prompt, but this time within the Win32 environment. Open up the command prompt and type: ipconfig, so you can gain information about what the router gateway is, and what your IP is automatically assigned as, (such as, 192.168.1.XXX, or 172.16.1.XXX. Simple rule of thumb is, if it is a 192 prefix, then the router address will most likely be 192.168.0.1, and for 172, it will be 172.16.0.1). So, write down the default gateway, and paste it into your browser with http:// infront of it. Odds are, there will be a password. Considering yourself lucky if it does not require one. Second best bet is going to http://www.phenoelit.de/dpl/dpl.html, which lists all of the default username and passwords for each model number of a router out there that may be purchased by the public. If all works accordingly, now you will be able to poke around with all of the glorious settings, such as opening the ports, which is the MOST important thing to hold onto. We will discuss this later. Let us poke around and try this method of attack. Go back to command prompt and type: net view. This will display all computers connected on the network that you have so rudely joined. Now, we whip out our handy dandy program called Nessus, (or any OS fingerprinting tool that you may prefer such as, GDI, etc). The point of this is to find out what OS is on each local intranet IP address. Now, as we all know, Windows XP Pro is the sweet OS. Why, you may ask? By default, XP Pro comes with remote registry enabled by default. I ask myself why everyday, but why not profit from Microsofts flaws. Also, no, you are correct, noobs do not disable this service. This may be time for you to turn off yours by going into services.msc. So, let us proceed while ignoring that last sidenote. Open up your registry editor, regedit. Click File>Connect Network Registry. (Please note that in certain scenarios, you may not connect to the remote registry if the person has a blank password. To test this theory, I hopped on a wi-fi network that I was indeed allowed to connect to, and tried to connect to a passwordless computer. Low and behold, it worked, but not all of the registry keys showed up, but enough to get yourself into trouble.) Follow the directions, click connect, etc. Now I know that you are thinking to yourself, we are riding on a lot of hope/faith here that everything the victim does fit's our needs. Well, yeah, duh. This is why this is the 'non-preffered' method of choice. But its the snowballs chance in hell, so 'never going to happen you have to try it anyway' method. Let us proceed. Now, browse to the HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server. Under the Terminal Server key, you'll find a REG_DWORD value named fDenyTSConnection. Double-click on that value to open the Edit DWORD Value box and change the value data from 1 (Remote Desktop disabled) to 0 (Remote Desktop enabled). To reboot the machine if you are impatient, go back to the command prompt shell, and type: shutdown -m \\servername_or_ip_of_server_here -r Ah, now wait for the glorious boot up. If all goes accordingly, you will now be able to connect remotely to the noobs desktop, and do whatever the hell you want. Seriously, do I need to go into FURTHER detail!?

More plausible method

Let's say you are currently connected locally to the same access point, and are eager to try another form of attack. Now, since we wish to have remote access, let us apply what we call, a 'trojan.' A trojan gives you remote access from another place. So there are a couple of ways of doing this. One, you can download a program called Sub7. This is a VERY well known trojan. To get it, go to: http://www.hackpr.net/~sub7/. Follow the directions provided. Once you have created your server.exe, (tweaked it etc. and renamed it) we can proceed to our next step. Odds are, the noob has several victims on his network with open shares. Probably consists of .txt, .doc, .jpg, etc. files within its open shares. Usually, they are accessed quite often, especially if the document is currently being edited. Your job, (for once) is to google for something what we may call, a '.exe binder.' This is a beautiful tool indeed. It binds the server.exe that you have made, and enables you to spoof it as the picture file or text document that the person has in their shares. Once you spoof this, the victim will eventually execute the file, plus the hidden file that you have stealthily implemented. I would suggest to attach this on as many files as possible found on each computer. This is probably the most direct approach. Remember when you assigned a port to the Sub7 server.exe? Well, this brings us back to the default gateway IP address that we cracked, (accessed) earlier. Browse to the open port page, and add the port you had assigned to server.exe. While you're at it, you can go to a remote place such as a library and spoof send server.exe, (preferably rename it for the following instances to game.exe, or patch.exe, setup.exe. You get the picture.) Or apply it to a .jpg as a picture of something random to the e-mail address that you could have stealthfully acquired while sniffing on the network that you had connected to. Such as, getting a packet sniffer for windows and waiting for anything that is sent out with an @. This could also be very useful to get passwords, usernames, and so on. Anyway, be creative in terms of getting the server file to some computer on that network. For the time being, go back home, and leave your Sub7 client on, and it will notify you when it is executed. Thankfully, the programmers of the Sub7 are quite brilliant, and have the server.exe copied to some ambiguous directory, without self-destructing itself. Thus eliminating the idea that the file that 'does nothing' is a trojan. Eventually, the victim will connect, and you will have some fun from there.

Stay tuned for the next tutorial to be posted that involves part 3.

I wanted to show you this program called Airowizard it is one of the fastest methods of cracking WEP keys on a Windows computer. Development on this program has been stopped sadly, but it is one of the easiest programs to use for WEP Cracking

Download:

http://rapidshare.com/files/225014638/Ai...ev.250.exe

Video on Installing the drivers for Commview:

http://www.youtube.com/watch?v=6loTwb2sN14

Video explaining how to use AiroWizard to Capture and Crack the WEP

http://www.youtube.com/watch?v=gjsm-3K2moE