Attacking WPA/WPA2 Enterprise Networks #Hacking #Networking #Infosec #WiFi #Wireless #WPA2

Introduction:

This guide will discuss some of the security flaws regarding wireless networks implementing WPA/WPA2 Enterprise authentication as well as ways to exploit these weaknesses. Enterprise type authentication models are mostly used in corporate settings consisting of companies that typically have a lot of people. From what I have seen a lot of Universities, Colleges as well as Hospitals also use this form of authentication to verify its users. The methods discussed below are usually a result of VERY COMMON poor configuration in regards to certificate validation as well as RADIUS configuration.

DISCLAIMER: DO NOT USE ANY OF THE METHODS BELOW AGAINST NETWORKS THAT YOU ARE NOT AUTHORIZED TO AUDIT.

Homework: First and foremost if you do not know exactly how enterprise authentication works I suggest you do some reading to get yourself familiar with the process of how clients are verified. I highly suggest reading this PEAP which discussed the different types authentication types that can take place within enterprise. Also take a look at RADIUS which gives some nice detail as to how the RADIUS server works. A few things to take note of:

1. WPA/WPA2 Enterprise does NOT use a preshared key, this means that every time a user is verified on the network a random key is generated. To the best of my knowledge this cannot be cracked by capturing packets.

2. This guide will cover mainly PEAP since it accounts for 80% or more of the types used in the US (see Wikipedia page)

3. EAP is responsible for authentication NOT the access point

4. The access point handles the encryption( TKIP/CCMP)

I will try and outline how the authentication process works as simply as possible...

Okay, this diagram will hopefully help you visualize what's going on. Here is the process in order which things occur.... 1.Client sends request to access point to connect. 2. The access point responds telling the client to connect to the RADIUS server to be authenticated. 3. Client connects to the RADIUS server. 4. RADIUS sets up TLS tunnel to receive username and password from client. 4. RADIUS server verifies client . 5. RADIUS server tells access point that the client is verified and can now connect. 

Scenario 1: For our first attack we will be using a rogue access point. Due to the way enterprise is implemented this becomes essential in helping us get past the RADIUS server problem. The Radius server uses a certificate to validate the access point along with the network. Once the certificate is validated the client sends his username and password to the server to be verified. What we will be exploiting is a VERY common mistake made in configuring PEAP, where certificate validation is NOT used! If PEAP is configured this way (surprisingly a lot of the time it is..) the client will not be prompted if an invalid certificate is used and unknowingly will accept it. Step 1: Create a fake AP by matching the target networks SSID, encryption type and band (a/b/g/n).

This can very simple or very complex depending on how sophisticated you want this attack to be. For example you could take a regular Linksys home router change its settings and run it off of batteries for more stealth placement. See this link for details on running a router off of batteries Wrt54g on batteries. You can run a normal Linksys router on a lead acid battery for close to a month.

This allows for stealthy placement of the access point where it will not need a hard wired power source. Using modified antennas and/or amplifies will also be more powerful in getting users to connect. (more info on this later)

 

Step 2: Create our own fake RADIUS server.

Okay we have our fake access point that identical to our target network. Now we need our fake RADIUS server. We will be setting up our own little fake RADIUS server on a version of Backtrack4 which will be connected wirelessly to our fake access point. Download the free radius server from www.freeradius.org (You may need version 2.02 haven't tested with the newer one) . Extract freeRADIUS and go to that directory. We will be applying a patch known as Wireless Pwnage Edition created by Joshua Wright and Brad Antoniewicz. Available here WPE freeradius. What this patch does:

• Will return success for ANY authentication request regardless of who it is.
• Will create a Log of all client credentials. This includes username, password and the challenge response. (if you don't know what a challenge response is you didn't read the Wikipedia page)
• This will log credentials for PEAP, TTLS, LEAP, EAP-MD5, EAP-MSCHAPv2,PAP,CHAP

In the directory where freeRadius is extracted run the following to patch freeRADIUS. $ patch -p1 < ../freeradius-wpe-2.0.2.patch $ ./configure && make && sudo make install && sudo ldconfig Now we will create our certificates. $ cd freeradius-server-2.0.2/raddb/certs $ ./bootstrap $ sudo cp -r * /usr/local/etc/raddb/certs Start the server. # radiusd Monitor the Log File # tail -f /usr/local/var/log/radius/freeradius-server-wpe.log

Next we need to set our fake access point to use our RADIUS server.

Fill in the required fields on the fake access point. Now we need to get a client to connect to our AP. You can do this a few ways. You can simply wait until a client connects or if your impatient like me you can start deauthenticating people from legit access points. ( we all know how to do that right :p ) There's other ways as well, by having the strongest signal strength people will connect to your AP instead of others, you can do this by using antennas/amplifiers if necessary. Chances are you shouldn't have to go the amplifier route and you should have a victim connect to your AP and type in their credentials which the RADIUS server will capture. When viewing the log you should see something like this. (**NOTE** VISIBLE ACCESS POINTS TAKE PRECEDENCE OVER HIDDEN ACCESS POINTS IN WINDOWS)

The challenge and response is their password. Now we have to crack it with a dictionary attack.

Fire up Asleap This is what we will be using to crack the challenge and response. Type the following ./asleap -w "wordlistgoeshere" -C "Challenge" -R "Response" Now you wait. Depending on how good your dictionary is you will have a password. GRATZ!

Scenario 2 (excuse my lack of detail, if anyone wants I will write up a more detailed version) Now what if the certificate validation is used when configuring PEAP? This will cause the user to be prompted to accept the certificate when they join a new network. The dialog box that is presented gives VERY LITTLE DETAIL! Their certificate will verify that the network they are joining is correct and legitimate. We can apply the same attack as above and succeed as long as the user accepts the certificate and they did not specify which server the certificate is valid for which is not filled in by default. This is another very common negligence by people setting up PEAP. Now knowing end users, the chances are pretty good that they will click accept since the dialog provides minimal detail. Now before we proceed we will need to sniff the certificate that the user is using. This can be done with almost any wireless capture tool. When a user connects to their network a TLS connection will be setup up and the certificate will be able to be captured as it is not encrypted during the first request. After some very basic wireless sniffing, determine the CA of the certificate. These are usually the major vendors such as Verisign. You will need to purchase a LEGITIMATE certificate from this vendor to perform the attack. After you have purchased the certificate set the fake RADIUS server up to use it. Now because the person who configured PEAP did not specify the server that the certificate was valid for the user will not see any difference in accepting ours since its from the same vendor.

Scenario 3  Iphone exploit When you have a company that uses WPA/WPA2 enterprise chances are there's going to be some iphones around. This presents a great opportunity to infiltrate the network due to a fundamental flaw in the iphones wifi setup. The iphone does not have the options to specify what authentication type to use in regards to enterprise they simply just aren't there. The iphone also doesn't allow for a preconfigured certificates meaning they can't be tied to a legit RADIUS server. This flaw makes them susceptible even in the worst case scenario being certificate validation is enabled tied to a specific radius server. Please keep in mind that some phones do support these options, such as the Motorola droid but Iphones DO NOT.

 Conclusion When performing an audit on a WPA/WPA2 Enterprise network always check for common misconfiguration of their equipment as these may lead to insecurities. ALWAYS make sure your clients have certificate authentication enabled as well as a specific server tied to it. Special Thanks to the guys over at SecureState Well that's the end of this guide...I guess. Let me know what you think =)