When the router has been identified, press Control-C to stop the scan. Perform a targeted packet capture against the Wi-Fi router by including the --channel, --write, --bssid, and --essid options.
Aireplay-ng will de-authenticate devices connected to the router. This command is necessary to capture the WPA2 handshake data. Captured packets are only decryptable with a valid handshake.
Open a new terminal and use the following aireplay-ng command to send three "deauth" packets to the router, forcing the authenticated users to reconnect.
~# aireplay-ng -0 3 -a 00:20:91:B4:F8:33 -e "NullByte_Network" wlan0mon
05:12:46 Waiting for beacon frame (BSSID: 00:20:91:B4:F8:33) on channel 11
NB: this attack is more effective when targeting
a connected wireless client (-c <client's mac>).
05:12:46 Sending DeAuth (code 7) to broadcast -- BSSID: [00:20:91:B4:F8:33]
05:12:46 Sending DeAuth (code 7) to broadcast -- BSSID: [00:20:91:B4:F8:33]
05:12:47 Sending DeAuth (code 7) to broadcast -- BSSID: [00:20:91:B4:F8:33]
A successful attack will produce the "WPA handshake" notification in the top-right corner of the airodump-ng terminal.
At this point, the airodump-ng window should continue to capture packets for as long as possible (i.e., many hours). As time passes, security software in the target Windows 10 computer will periodically attempt to update the application and virus definition databases. These web queries are valuable to a hacker with access to the network preparing to mount a targeted attack.
Step 2Decrypt the PCAP
Airdecap-ng is packet capture decryption tool and part of the Aircrack-ng suite.
~# airdecap-ng -b "00:20:91:B4:F8:33" -e "NullByte_Network" -p "WIFI_PASSWORD_HERE" /root/Desktop/capture-01.cap
Total number of stations seen 8
Total number of packets read 32310
Total number of WEP data packets 0
Total number of WPA data packets 4555
Number of plaintext data packets 0
Number of decrypted WEP packets 0
Number of corrupted WEP packets 0
Number of decrypted WPA packets 3435
Number of bad TKIP (WPA) packets 0
Number of bad CCMP (WPA) packets 0
Airdecap-ng will use the Wi-Fi ESSID (-e) and password (-p) to decrypt and filter out packets belonging to the network. In the above example, we can see 3435 WPA decrypted packets. Airdecap-ng will create a file called "capture-01-dec.cap" in the current directory.
After decrypting the PCAP, import the new capture-01-dec.cap file into Wireshark.
Step 3Search for Antivirus Software (Avast)
Avast is one of the most popular antiviral software solutions in the world.
Known Avast domains include avast.com and avcdn.net, its primary content delivery network (CDN). On a daily basis, these domains are used to fetch virus database and software updates as well as send telemetry information. These domains can be filtered out in Wireshark with the following display filter.
ip.host ~ "(?i)(avast|avcdn)\.*"
Many antivirus domains can be added to the filter and separated by vertical bars (|).
The above results are a strong indication that the computer is using Avast antivirus software. The data can be further inspected to identify user-agent strings commonly used by this antivirus provider.
http.user_agent ~ "(?i)avast*"
This particular HTTP stream invoked a POST request and delivered some unencrypted data to an Avast server. As we can see, the request originated from the Windows 10 computer with an Avast user-agent.
The body of the HTTP stream contains some unencrypted data related to the target device. The CPU type, Windows 10 hostname, and motherboard architecture, as well as Avast version and configuration settings, are discoverable from a single HTTP stream.
This data is very valuable to an attacker on the network as it enables them to craft a payload specific to that user and operating system.
In addition to Wireshark, tshark and grep can easily print and filter DNS requests, respectively, in standard output. Append sort -u to the command to show only unique domains (i.e., no duplicates).
Comodo Firewall is a popular firewall solution designed to monitor incoming and outgoing traffic to identify threats and prevent attacks.
Its DNS server configuration makes it difficult for attackers on the network to enumerate installed applications and visited websites. Still, Comodo software will occasionally check for software updates giving an attacker all the information they need.
ip.host ~ "(?i)(comodo)\.*"
To view queried domains in standard output, examine the PCAP with tshark and filter out DNS requests.
This command will likely produce a large output containing thousands of domains, IP addresses, and duplicate entries. Append the sort and uniq commands to count the most commonly queried servers.
Notice that the 22.70.154.156.in-addr.arpa address appears 72 times in the PCAP. A quick search and IP lookup suggests 156.154.70.22 has been a Comodo DNS server for many years. While this doesn't definitively mean the target has Comodo software installed, it would suggest they're security conscious
Comments
Post a Comment