possible that a certain lib is interfering with the awus036achm mt7610u drivers #375
Replies: 24 comments 18 replies
-
|
First of all: Your wireless regulatory domain is unset 00! That limits the capability of the device. To avoid this it is mandatory to set a valid regulatory domain, e.g. From now on hcxdumptool use this settings: This setting (via iw) is not persistent. To make it persistent it is mandatory to uncomment the domain in the config file. A few days ago I ran several tests on several interfaces. One of them an ALFA AWUS036ACHM: The ERROR you mentioned above always appear if the device is disconnected: This should happen only if the device is disconnected: In your case you got more than one ERROR. I suggest to check your cable connection. All attack modes are working as expected and the ERROR appears only after the device has been disconnected. I moved this report to discussions, because it is not caused by hcxdumptool. |
Beta Was this translation helpful? Give feedback.
-
|
Now the funny part: Once the device is down, it can be plugged out without causing an ERROR in dmesg log. |
Beta Was this translation helpful? Give feedback.
-
|
i set the regulatory domain on the adapter, and ive changed the usb slot, but i dont think that changed everything. first off sorry im running my test in wifite, im really new and its the only thing ive like focused on to sorta learn already, im not very good at debugging with linux im still very fresh, i just happen to be learning cybersecurity and kali was the suggested distro for this type of stuff as youd imagine, but i keep running into this issue and i keep going down rabbit holes to fix it and i cant get anywhere, so im sorry if im annoying with this. Basically the crash im getting which consists of my entire system not responding to sudo commands or rebooting or shutting down without being forced, the only reason im getting this is because of pmkid attacks that wifite and airgeddon use, which both utilize hcxdumptool and hcxtools, if i run wifite without a pmkid attack in this command using
no crashy stuff happens and everything works fine with it, when do anything pmkid related my system goes haywire
this error message doesnt always show up, usually the system just freezes, and idk if macchanger is related but this used to happen to me before i started using macchanger with wifite (ive read macchanger messes things up sometimes thats why im bringing it up) running a command after with sudo running the same command without sudo (it never does anything cause the vm is frozen) [ 71.754343] usb 1-1: new high-speed USB device number 2 using ehci-pci last but not least im sorry if this is annoying and if you want me to stop just let me know lol thank you |
Beta Was this translation helpful? Give feedback.
-
|
No, you don't annoy me and there is no need to feel sorry, but I can't help you due to several reasons: First reason: Second reason: Have you stopped all services that take access to the physical interface as mentioned in help? get information about running services: But this are the real important parts as mentioned in help:
looks like one of your scripts tried to set monitor mode via iwconfig: this is done by wifite (that possible run airmon-ng that possible run iw)
I'll say there are too many screws to turn for it to work (or to analyze what went wrong). |
Beta Was this translation helpful? Give feedback.
-
|
To discover what went wrong, I suggest Everything else is like reading from chicken bones. |
Beta Was this translation helpful? Give feedback.
-
|
from dmesg.airgeddon.hcxdumptool: exactly the same: |
Beta Was this translation helpful? Give feedback.
-
|
BTW: MediaTek mt76 devices provide a new mode called "active monitor mode". To perform ultra fast PMKID attacks, hcxdumptool use this mode (as of today, hcxdumptool is the only tool that use this mode) To identify this WEXT dinosaurs, run (on Linux kernel >= 6.3): Straight after the release of version 6.2.9 hcxdumptool moved from WEXT to RTNETLINK and NL80211 (see changelog): Since version 6.2.3 WEXT has been retired (see changelog): |
Beta Was this translation helpful? Give feedback.
-
i didnt think too much about it honestly my bad as for setting up logical interfaces for wlan0 i never have before i started using macchanger with wifite today, thats whats changing it to wlan0mon, usually wifite without macchanger would just keep it wlan0 but on monitor mode
as for this, with wifite the --kill functions does these for and when i usually want to just kill these functions and not run wifite, ill run sudo wifite --kill and terminate it after and keep them down before using a different wifi attacker script
i know i just realized that i messed up by doing all that stuff while troubleshooting, i shoulda left things how i originally used it, i never used macchanger before yesterday honestly.
at the time of that i was running them at the same time to mess around with mitm stuff but i didnt get anywhere i was testing all of this before plugging in another wifi adapter, i was only running the alfa mt76x0u
sorry for the dumb/beginner questions, but are you saying that other programs like wifite are using still wext which is probably whats crashing me, versus hcxdumptools moving to rtnetlink and nl80211 which isnt depreciated and doesnt crash me? also is this something i can configure the other programs to do or is it something the program dev sets up
this is what im getting and perhaps a stupider question but i can switch to nl80211 through a bash command or something lol one last question cause im feeling like im stepping into a zone where im not qualified to like keep asking, i need a couple of years of this stuff before i can fully get a grasp on all this stuff but i especially need to learn more about BPF and just filters in general
you mentioned this earlier, is there an easy way to find the config file? and say i do edit it and mess something up, what could it break lol thank you so much for all the help and guidance i know its not easy to be answering random questions all day lol |
Beta Was this translation helpful? Give feedback.
-
|
hcxdumptool may work inside a VM, but that depend on the configuration of the VM. It is mandatory that the VM pass everything through. NL80211 is the successor of WEXT. iwconfig is outdated and it has been replaced by iw wifite2 and airgeddon are scripts. This scripts manage other tools (e.g. iw or iwconfig, ip link or ifconfig) that set monitor mode and do the attacks (e.g. aireplay-ng or hcxdumptool) or dump the traffic (e.g. airodump-ng or tshark). There is no easy way to find the config files, because that depend on the distribution, e.g. running Arch Linux the config file is here: Instead of filtering the entire traffic itself, hcxdumptool attach a piece of code /Berkeley Packet Filter Code) to the Linux kernel that contain the filter. Once attached, the kernel does the entire filtering. That is ultra fast. the c code looks like this: and the code, accepted by hcxdumptool looks like this: That is all the same code, but different formats. There are several ways to code the filter: An explanation of the high level language is here: |
Beta Was this translation helpful? Give feedback.
-
|
start-mon.sh, airmon-ng, wifite2, airgeddon and others are really good scripts to be used by beginners. Start all tools by hand (not via a script of which you do not know what it is doing) and check log files and output of the tools to figure out what went wrong. |
Beta Was this translation helpful? Give feedback.
-
|
i just wanna start off by saying thank you so much for being amazing and providing alot of info and alot of content for me to read up on. and thats exactly where im at, im trying to not be a script kiddie and learn how the tools that wifite and airgeddon use, i do not have a networking background or any experience with linux systems at all, kali is the thing im learning on and and working without guis is so hard but i lowkey love it, i just wish i could compare between clis and guis versions of that stuff on kali, but other than wireshark i dont think theres anything that has a gui (from what ive used), as for setting up a linux distro by hand, are you talking about setting it up without a hypervisor? all in all im getting more into understand how every type of attack works in the network through the tools that use those and not wifite or whatever just like you said, the way to actually figure out whats going on is to use the proper tool for something and be able to understand the output |
Beta Was this translation helpful? Give feedback.
-
|
On the bright side: All the scripts mentioned above are excellent. But unfortunately you'll learn nothing. Correct, I'm talking about a set up without a hypervisor, only by reading some installation instructions. A first step could be playing around with a live distribution to learn the basic steps, e.g.: Next is step to read the installation guide: BTW: If you prefer a penetration testing distribution, this could be a solution, too; hcxdumptool/hcxtools are part of this distribution, too: That will work on other distributions, too, e.g.: |
Beta Was this translation helpful? Give feedback.
-
|
ive heard about archlinux but never really tried it as it seems like way above what i understand, and kali was recommended by the google cert im doing for cybersecurity/pen testing thats why, buttt i would love to dive deeper into other distros, blackarch even sounds alot cooler than kali so theres that lol how different is arch from debian, i know thats such a wide silly question that can be googled but im tryna gauge like how realistically different it is if that makes sense lol one last question: how can i use use nl80211 to turn monitor mode on, if i shouldnt be using iw or stuff like that |
Beta Was this translation helpful? Give feedback.
-
|
How can i use use nl80211 to turn monitor mode on, if i should'nt be using iw or stuff like that? First of all please take a look at iw to set monitor mode: set interface down: set active monitor mode: set interface up: check that interface is in monitor mode: The physical device has been turned into a physical monitor interface. Now hcxdumptool's way. set monitor mode, set interface up and make it operational: This step is not necessary, but useful for educational purpose. capture some packet to discover that it is really operational: |
Beta Was this translation helpful? Give feedback.
-
|
ifconfig is outdated and has been replaced by ip link hcxdumptool use RTNETLINK and NL80211 only. run tshark to monitor RTNETLINK / NETLINK traffic and in parallel hcxdumptool -m INTERFACENAME |
Beta Was this translation helpful? Give feedback.
-
|
this is gonna send me down the rtnetlink and NL80211 rabbit hole, i feel like im reading stuff i need a bunch of previous information to understand though and that hinders me alot, would it be smart to ask chatgpt to eli5 these things so i can just have a basic idea of whats going on? also after i setup nlmon0 do i need a different device for it or is it showing up as deviceless cause my device is currently on wlan0 with monitor mode |
Beta Was this translation helpful? Give feedback.
-
|
nlmon0 is an additional interface that monitor the entire RTNETLINK and NETLINK traffic between the kernel and the user space. |
Beta Was this translation helpful? Give feedback.
-
|
is this what im supposed to be looking at? im clueless to what they mean honestly, if i understand correctly im listening into the communications between the kernel of the linux machine and myself or what im doing on the machine? in what instance would this be needed for?
just to make sure radiotap means monitor mode right? |
Beta Was this translation helpful? Give feedback.
-
|
Correct, these are the packets between kernel and user space. You can store them via tshark -w option and take a look at the content later on via Wireshark or you can monitor them via Wireshark and take a look at the content directly. Radiotap does not mean monitor mode. It is a header which is added by the driver to a packet. This is the content of the radiotap header: It contain information collected by the device, e.g. used antenna, signal strength, frequency and a lot more. |
Beta Was this translation helpful? Give feedback.
-
|
Basically all distributions are Linux. If you get it (Linux kernel) it doesn't matter what distribution you use. An example. My running services (Raspberry running Raspbian OS lite): On both machines (especially on the penetration testing machine Raspberry) absolutely nothing that interfere with my workflow / procedures How about yours? |
Beta Was this translation helpful? Give feedback.
-
thats whats gonna be my next project so i can properly learn linux systems without having to depend on a prebuilt image, linux is fascinating as hell, but ive been sucha windows user my entire life its kind of a struggle and im still in my first year of this and im pretty slow lol so it takes some time im only running 1 virtual machine that i only basically use to test out the things im learning about throughout the course + whatever a question send me down a rabbit hole to lol or something piques my interest
|
Beta Was this translation helpful? Give feedback.
-
|
Do you need cron, the ModemManager or the random generator (haveged)? |
Beta Was this translation helpful? Give feedback.
-
|
i have personally never used cron but i was planning to some time in the future (lol) as for modemManager or haveged ive never really paid attention to them and just assumed modemManager is something required for me to run my wifi/eth to get internet, and before googling now i never would have thought that haveged is something related to RNG but no i havent actually, why did you point those 3 out is it something specific or just for example |
Beta Was this translation helpful? Give feedback.
-
|
No, you can stop them and/or disable them. |
Beta Was this translation helpful? Give feedback.
-
|
just a quick update that i havent encountered any lag since ive started using ip link and iw to switch to monitor mode, ive been tryna learn hcxdumptools & co and mess around with it, the fact that activebeacon and enablestatus i guess those became rcascan? also the the change from -o to -w all the guides are kinda throwing me off lol, reading -h multiple times a day have lowkey helped though lol ive been running this to do a full scan, based on your recommendation earlier, but ive been changing the reg domain on my own every boot lol (still havent gotten to finding the reg file)
do you think its missing anything important also is it using active or passive mode in that ? if i add --rcascan the pcapng wont save the file for some reason |
Beta Was this translation helpful? Give feedback.
-
|
activebeacon and enablestatus i guess those became rcascan For performance reasons enable status has been move to Makefile. On headless operation you can compile out the entire status display(or the GPS handling if not needed) by comment this line in Makefile: activebeacon changed to beacoontx rcascan now can be done active or passive. So a command line that include scan mode and attack mode will not work as expected! and |
Beta Was this translation helpful? Give feedback.
-
|
thank you so much, i actually am starting to like understand the syntax more and more, types of hashes and stuff like that its so cool lol. |
Beta Was this translation helpful? Give feedback.
-
|
No problem, you're welcome. |
Beta Was this translation helpful? Give feedback.
-
|
only if you insist lol 1 - how long do i have to attack mode scan for if im targeting 1 single bssid vs a range scan of all the bssids? i run for around 30 mins and it gets alot of essids but ive only managed to crack 2 of them cause im using a wordlist on hashcat instead of alphanumeric thingies, i wanna get into that some more but so far its been very fun, the hardest part is learning the up to date syntax to run stuff without having to go through -h a couple of times, i might be a little lazy but sometimes piecing out parts from -h doesnt get me very far, and outdated guides throw me off even more is there a common best practice for cracking hc22000 hashes with hashcat like filters and stuff (i know its not the best place to ask sorry) 2 - would i need to run a rcascan before i do attack mode if im just gonna attack everything i can reach? rcascan is just for pinpointing ever essid and bssid right? 3 - isps in the country i live in provide old shitty routers with wps enabled on them, i feel like pixie dust attacks have carried me alot so far, handshake capture attacks have lowkey sucked for me cause ive only done that with wifite and its ability to do that is very hit or miss, but from the reading ive been doing it seems like pmkid attacks are the way to go, what would you rank pmkid at (ofcourse each one is situational but i mean in a situation where theyre all options to attack a specific network) sorry if the last question is dumb and out of place |
Beta Was this translation helpful? Give feedback.
-
|
Usually it takes a few seconds to attack a target, e.g. 8 seconds here: But that depends on a lot of factors: The entire test environment is described here: You can upload your dump file to wpa-sec to discover it is vulnerable on common word lists (free service): A rcascan is useful to discover if the target is in RANGE, to get its MAC (to build the Filer Code) and to get its operating channel (use hcxdumptool -c xx to set the channel). That's all. Pixie Dust should be the first choice. If that failed try to get a PMKID. If that failed (not all routers use PMKIDs) try to get an M2M3. If that failed try to get an M2 from a CLIENT associated to the target NETWORK. The best is if you get all. Due to hashcat's reuse of PBKDF you will no waste GPPU time. Questions regarding hashcat should be asked here: |
Beta Was this translation helpful? Give feedback.
-
|
thank you so much always |
Beta Was this translation helpful? Give feedback.
-
|
where can i find the most updated doc on all hcxdumptool options ive looked everywhere but im so bad |
Beta Was this translation helpful? Give feedback.
-
|
The entire history since Atom (hashcat) has advised me to go open source is here: Information about the PMKID attack is here: Information about NC is here: Information how to recover a PSK using hashcat is here (entire basic work flow): Information about the Linux kernel is here (hard core stuff): Information about the Berkeley Packet Filter is here (hard core stuff): Information about Linux basics is here (basic stuff): Information about WPA is here (basics): Information about Arch Linux is here: |
Beta Was this translation helpful? Give feedback.
-
|
-hi, quick question, does the regulatory domain setup mess with my packet cap, finding networks on certain freqs? im not in the US but im setting it to US, the device in question was purchased from the US but i reside in the middle east, do i have to set it up to my countries reg domain or am i good with the US settings?
-also if im trying to target a client and not an ap in hcxdumptools should i use the same setting to setup a bpf ?
i try that but no bueno -sudo tcpdump -i wlan0 wlan addr1 8ce74833cbb7 -ddd > attack.bpf can i set a bpf like this if i want to attack only 1 target or do the or wlan addr1+2+3 have to be there? -also should i be deleting the attack.bpf every time i add a new client or do they just stack up if i dont delete it, or is it bad to rewrite that file. |
Beta Was this translation helpful? Give feedback.
-
|
You should use the regulatory matching to your country and you should look at the allowed frequencies. Targeting a CLIENT is different: To recover a PSK you need frames coming from an AP and you need frames coming from a CLIENT. In every case I recommend to add the BROADCAST MAC ffffffffffffto wlan addr3, too. You could create a BPF on each target AP: this can be done by a script: |
Beta Was this translation helpful? Give feedback.
-
|
i just updated my comment while you typed this but it took me an hour lol sorry "If you set e.g. wlan addr3 MAC_AP you will get frames from an AP and from the CLIENTs." so with this i wouldnt need to target a specific client from a mac right? itll automatically target the ap and client, which skips the need to add wlan addr2 right? so my filter can be i know this is a very amateur question but how do i find the broadcast mac so i can add another wlan addr3, maybe snooping in wireshark? but does hcxdumptools list them anywhere along the ap mac? |
Beta Was this translation helpful? Give feedback.
-
|
You've probably wondered why BPF FAQ doesn't exist here. The reason is simple: There are thousands of possible different ways to create a BPF that give the same result.
And now I'm going to confuse you.
I suggest to play around with these filters and to take a look at the status display what they are doing. And now I'm going to confuse you more. |
Beta Was this translation helpful? Give feedback.
-
|
i see, ive been tunnel visioning so hard on having the correct exact syntax for everything, i didnt realize you can freestyle like this lol. i was wondering btw, what do you use to randomize mac in hcxdumptool, ive been trying other things too but they all have the issue where they dont use nl80211, and they crash my driver lol. ive been setting up my monitor with hcx dump tool or if and iw when im not too lazy but but mac randomization programs also crash my device, except for hcxdumptools it works perfectly |
Beta Was this translation helpful? Give feedback.
-
|
hcxdumptool set the virtual device MAC to a randomized MAC. This MAC is used to attack ACCESS POINTs. hcxdumptool use RTNETLINK to set the randomized MAC while old school tools running old school ioctl() system calls. hcxdumptool and hcxtools allow "hard core freestyle" - especially in combination with the big GPU weapons hashcat and JtR. |
Beta Was this translation helpful? Give feedback.
-
|
ok this might be a silly question but when hcxdumptools wants to change my mac, does it input a code in the system? something i can replicate manually to randomize my mac without having to run hcxdumptools? like monitor mode for instance sorry im not very familiar with system calls or scripts |
Beta Was this translation helpful? Give feedback.
-
|
It send a RTNETLINK message to the Linux kernel: "hey kernel please change the virtual MAC of the device". Just run hcxdumptool in rcascan mode or in attack mode: and it will change the virtual MAC of the device (if the device allow that). |
Beta Was this translation helpful? Give feedback.
-
version: 6.5.0-kali3-amd64
lsusb: Bus 001 Device 002: ID 0e8d:7610 MediaTek Inc. WiFi
hcxdumptool -l : available wlan devices:
phy idx hw-mac virtual-mac m ifname driver (protocol)
0 3 00c0cab4623a 00c0cab4623a * wlan0 mt76x0u (NETLINK)
1 4 40ed007efa41 9ee7ecaba507 + wlan1 rtl8821au (NETLINK)
└─$ sudo hcxdumptool -I wlan0
Requesting interface capabilities. This may take some time.
Please be patient...
interface information:
phy idx hw-mac virtual-mac m ifname driver (protocol)
0 3 00c0cab4623a 00c0cab4623a * wlan0 mt76x0u (NETLINK)
available frequencies: frequency [channel] tx-power of Regulatory Domain: 00
2412 [ 1] 3.0 dBm 2417 [ 2] 3.0 dBm 2422 [ 3] 3.0 dBm 2427 [ 4] 3.0 dBm
2432 [ 5] 3.0 dBm 2437 [ 6] 3.0 dBm 2442 [ 7] 3.0 dBm 2447 [ 8] 3.0 dBm
2452 [ 9] 3.0 dBm 2457 [ 10] 3.0 dBm 2462 [ 11] 3.0 dBm 2467 [ 12] 3.0 dBm
2472 [ 13] 3.0 dBm 2484 [ 14] 3.0 dBm 5180 [ 36] 18.0 dBm 5200 [ 40] 18.0 dBm
5220 [ 44] 18.0 dBm 5240 [ 48] 18.0 dBm 5260 [ 52] 18.0 dBm 5280 [ 56] 17.0 dBm
5300 [ 60] 17.0 dBm 5320 [ 64] 17.0 dBm 5500 [100] 14.0 dBm 5520 [104] 14.0 dBm
5540 [108] 14.0 dBm 5560 [112] 14.0 dBm 5580 [116] 13.0 dBm 5600 [120] 13.0 dBm
5620 [124] 13.0 dBm 5640 [128] 13.0 dBm 5660 [132] 13.0 dBm 5680 [136] 14.0 dBm
5700 [140] 14.0 dBm 5720 [144] 14.0 dBm 5745 [149] 14.0 dBm 5765 [153] 14.0 dBm
5785 [157] 14.0 dBm 5805 [161] 14.0 dBm 5825 [165] 15.0 dBm 5845 [169] disabled
5865 [173] disabled
bye-bye
└─$ sudo hcxdumptool -v
hcxdumptool 6.3.1 (C) 2023 ZeroBeat
Let me preface this by saying that i know that i shouldnt be attempting this stuff if im a noob, but im trying to collect as many documentation maybe it helps someone in the future or you to probably find whats wrong.
Basically the journey started with wifite, it would always crash after i try to capture a pmkid or do a pmkid attack it crashes my stuff, sudo would not work anymore with commands and the vm will not reboot or turn off unless i force shutdown.
after some more investigation, i couldnt find anything other than that the wifi adapter drivers mt7610u are having an issue with something and crashing
i tried manually finding the drivers for the mt7610u and replacing the one i had and that did nothing at all, and surprisingly even when i hadent added the driver after deleting the old set the adapter it still ran normally
i downloaded a fresh image of kali weekly and tried wifite without installing hcxdumptool or hcxtools and it seemed to not crash my vm at all
after got the dependencies and libs needed for hcxdumptool and hcxtools wifite started doing the same.
so i thought id try airgeddon instead maybe its just a wifite issue right?
everything worked until the point of trying to capture a pmkid and it did the same thing wifite would do.
i am running another wifi adapter (not at the same time) TP-Link Archer T2U PLUS [RTL8821AU] and that seems to work normally.
i will provide a journalctl -e and a dmesg in case those provide any help, whatever i can do to fix my post or info to provide i would really love to help fix this issue or at least troubleshoot it
please do let me know if i should just copy/paste the text of the dmesg and journalctl instead in the comments or here, i just didnt want to clutter it more than it is
dmesg airgeddon hcxdumptool.txt
journalctl -e.txt
please let me know if theres something else i can help with, sorry im still a noob and i do need some hand holding but id really love to help.
Beta Was this translation helpful? Give feedback.
All reactions