diff -uNr cowpatty-4.3/cowpatty.c cowpatty-4.3-fixup2/cowpatty.c --- cowpatty-4.3/cowpatty.c 2008-03-20 09:49:38.000000000 -0700 +++ cowpatty-4.3-fixup2/cowpatty.c 2009-05-21 23:38:17.970291072 -0700 @@ -71,7 +71,7 @@ void cleanup(); void parseopts(struct user_opt *opt, int argc, char **argv); void closepcap(struct capture_data *capdata); -void handle_dot1x(struct crack_data *cdata, struct capture_data *capdata); +void handle_dot1x(struct crack_data *cdata, struct capture_data *capdata, struct user_opt *opt); void dump_all_fields(struct crack_data cdata); void printstats(struct timeval start, struct timeval end, unsigned long int wordcount); @@ -389,7 +389,7 @@ return (ret); } -void handle_dot1x(struct crack_data *cdata, struct capture_data *capdata) +void handle_dot1x(struct crack_data *cdata, struct capture_data *capdata, struct user_opt *opt) { struct ieee8021x *dot1xhdr; struct wpa_eapol_key *eapolkeyhdr; @@ -415,8 +415,8 @@ cdata->ver = key_info & WPA_KEY_INFO_TYPE_MASK; index = key_info & WPA_KEY_INFO_KEY_INDEX_MASK; - /* Check for EAPOL version 1, type EAPOL-Key */ - if (dot1xhdr->version != 1 || dot1xhdr->type != 3) { + /* Check for type EAPOL-Key */ + if (dot1xhdr->type != 3) { return; } @@ -427,59 +427,78 @@ if (cdata->ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4) { /* Check for WPA key, and pairwise key type */ - if (eapolkeyhdr->type != 254 || + if ((eapolkeyhdr->type != 2 && eapolkeyhdr->type != 254) || (key_info & WPA_KEY_INFO_KEY_TYPE) == 0) { return; } } else if (cdata->ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) { - if (eapolkeyhdr->type != 2 || + if ((eapolkeyhdr->type != 2 && eapolkeyhdr->type != 254) || (key_info & WPA_KEY_INFO_KEY_TYPE) == 0) { return; } } + if (opt->verbose > 2) { + printf ("WPA_KEY_INFO_TYPE_HMAC_MD5_RC4: %d\n", WPA_KEY_INFO_TYPE_HMAC_MD5_RC4); + printf ("WPA_KEY_INFO_TYPE_HMAC_SHA1_AES: %d\n", WPA_KEY_INFO_TYPE_HMAC_SHA1_AES); + printf ("key version: %d\n", cdata->ver); + printf ("eapol key header type: %d\n", eapolkeyhdr->type); + } + + /* Check for frame 1 of the 4-way handshake */ + if ((key_info & WPA_KEY_INFO_MIC) == 0 + && (key_info & WPA_KEY_INFO_ACK) + && (key_info & WPA_KEY_INFO_INSTALL) == 0 ) { + /* All we need from this frame is the authenticator nonce */ + memcpy(cdata->anonce, eapolkeyhdr->key_nonce, + sizeof(cdata->anonce)); + cdata->anonceset = 1; + /* Check for frame 2 of the 4-way handshake */ - if ((key_info & WPA_KEY_INFO_MIC) && (key_info & WPA_KEY_INFO_ACK) == 0 - && (key_info & WPA_KEY_INFO_INSTALL) == 0 - && eapolkeyhdr->key_data_length > 0) { - /* All we need from this frame is the authenticator nonce */ - memcpy(cdata->snonce, eapolkeyhdr->key_nonce, - sizeof(cdata->snonce)); - cdata->snonceset = 1; + } else if ((key_info & WPA_KEY_INFO_MIC) + && (key_info & WPA_KEY_INFO_INSTALL) == 0 + && (key_info & WPA_KEY_INFO_ACK) == 0 + && eapolkeyhdr->key_data_length > 0) { - } else if ( /* Check for frame 3 of the 4-way handshake */ - (key_info & WPA_KEY_INFO_MIC) - && (key_info & WPA_KEY_INFO_INSTALL) - && (key_info & WPA_KEY_INFO_ACK)) { + cdata->eapolframe_size = ( packet[capdata->dot1x_offset + 2] << 8 ) + + packet[capdata->dot1x_offset + 3] + 4; memcpy(cdata->spa, &packet[capdata->dstmac_offset], - sizeof(cdata->spa)); - memcpy(cdata->aa, &packet[capdata->srcmac_offset], - sizeof(cdata->aa)); - memcpy(cdata->anonce, eapolkeyhdr->key_nonce, - sizeof(cdata->anonce)); - cdata->aaset = 1; - cdata->spaset = 1; - cdata->anonceset = 1; - /* We save the replay counter value in the 3rd frame to match - against the 4th frame of the four-way handshake */ - memcpy(cdata->replay_counter, eapolkeyhdr->replay_counter, 8); - - } else if ( /* Check for frame 4 of the four-way handshake */ - (key_info & WPA_KEY_INFO_MIC) - && (key_info & WPA_KEY_INFO_ACK) == 0 - && (key_info & WPA_KEY_INFO_INSTALL) == 0 - && - (memcmp - (cdata->replay_counter, eapolkeyhdr->replay_counter, - 8) == 0)) { + sizeof(cdata->spa)); + memcpy(cdata->aa, &packet[capdata->srcmac_offset], + sizeof(cdata->aa)); + memcpy(cdata->snonce, eapolkeyhdr->key_nonce, + sizeof(cdata->snonce)); + cdata->aaset = 1; + cdata->spaset = 1; + cdata->snonceset = 1; memcpy(cdata->keymic, eapolkeyhdr->key_mic, - sizeof(cdata->keymic)); + sizeof(cdata->keymic)); memcpy(cdata->eapolframe, &packet[capdata->dot1x_offset], - sizeof(cdata->eapolframe)); + cdata->eapolframe_size); + cdata->keymicset = 1; cdata->eapolframeset = 1; + + /* Check for frame 3 of the 4-way handshake */ + } else if ((key_info & WPA_KEY_INFO_MIC) + && (key_info & WPA_KEY_INFO_ACK) + && (key_info & WPA_KEY_INFO_INSTALL)) { + /* All we need from this frame is the authenticator nonce */ + memcpy(cdata->anonce, eapolkeyhdr->key_nonce, + sizeof(cdata->anonce)); + cdata->anonceset = 1; + + } + + if (opt->verbose > 2) { + printf("aaset: %d\n",cdata->aaset); + printf("spaset: %d\n",cdata->spaset); + printf("snonceset: %d\n",cdata->snonceset); + printf("keymicset: %d\n",cdata->keymicset); + printf("eapolframeset: %d\n",cdata->eapolframeset); + printf("anonceset: %d\n", cdata->anonceset); } } @@ -507,8 +526,7 @@ printf("\n"); printf("eapolframe is:"); - lamont_hdump(cdata.eapolframe, 99); /* Bug in lamont_hdump makes this look - wrong, only shows 98 bytes */ + lamont_hdump(cdata.eapolframe, cdata.eapolframe_size); printf("\n"); } @@ -706,7 +724,7 @@ } hmac_hash(cdata->ver, ptkset->mic_key, 16, cdata->eapolframe, - sizeof(cdata->eapolframe), keymic); + cdata->eapolframe_size, keymic); if (opt->verbose > 2) { printf("Calculated MIC with \"%s\" is", passphrase); @@ -815,7 +833,7 @@ } hmac_hash(cdata->ver, ptkset->mic_key, 16, cdata->eapolframe, - sizeof(cdata->eapolframe), keymic); + cdata->eapolframe_size, keymic); if (opt->verbose > 2) { printf("Calculated MIC with \"%s\" is", passphrase); @@ -874,7 +892,7 @@ 0 && (h->len > capdata.l2type_offset + sizeof(struct wpa_eapol_key))) { /* It's a dot1x frame, process it */ - handle_dot1x(&cdata, &capdata); + handle_dot1x(&cdata, &capdata, &opt); if (cdata.aaset && cdata.spaset && cdata.snonceset && cdata.anonceset && cdata.keymicset && cdata.eapolframeset) { @@ -909,7 +927,6 @@ eapkeypacket = (struct wpa_eapol_key *)&cdata.eapolframe[EAPDOT1XOFFSET]; memset(&eapkeypacket->key_mic, 0, sizeof(eapkeypacket->key_mic)); - eapkeypacket->key_data_length = 0; printf("Starting dictionary attack. Please be patient.\n"); fflush(stdout); diff -uNr cowpatty-4.3/cowpatty.h cowpatty-4.3-fixup2/cowpatty.h --- cowpatty-4.3/cowpatty.h 2008-03-20 09:49:38.000000000 -0700 +++ cowpatty-4.3-fixup2/cowpatty.h 2009-05-21 23:37:52.533281370 -0700 @@ -94,7 +94,7 @@ u16 length; } __attribute__ ((packed)); -#define MAXPASSLEN 63 +#define MAXPASSLEN 64 #define MEMORY_DICT 0 #define STDIN_DICT 1 #define EAPDOT1XOFFSET 4 @@ -166,7 +166,8 @@ u8 spa[6]; u8 snonce[32]; u8 anonce[32]; - u8 eapolframe[99]; /* Length the same for all packets? */ + u8 eapolframe[99]; + u8 eapolframe2[125]; u8 keymic[16]; u8 aaset; u8 spaset; @@ -177,6 +178,7 @@ u8 replay_counter[8]; int ver; /* Hashing algo, MD5 or AES-CBC-MAC */ + int eapolframe_size; }; struct hashdb_head {