wifiland

Catégorie: Network Difficulté: medium Flag: CTF{b67842d03eadce036c5506f2b7b7bd25aaab4d1f0ec4b4f490f0cb19ccd45c70}

Challenge

Description

---

Are you larping in the wifiland? Get me the client and target IP address!

from hashlib import sha256

ip_client = ""
ip_target = ""


def calculate_sha256(ip_client, ip_target):
    input_string = ip_client + ip_target
    hash_result = sha256(input_string.encode()).hexdigest()    
    return hash_result


sha256_sum = calculate_sha256(ip_client, ip_target)
print('CTF{'+sha256_sum+'}')

Analyse du pcap

En regardant dans Wireless > Traffic WLAN on trouve que wifiland a le bssid 02:00:00:00:05:00

On peut casser la clé avec aircrack-ng et trouver 12345678

$ aircrack-ng -w /usr/share/wordlists/rockyou.txt -b 02:00:00:00:05:00 wifiland.cap                                                                    1 ⨯
Reading packets, please wait...
Opening wifiland.cap
Read 4594 packets.

1 potential targets

                               Aircrack-ng 1.7 

      [00:00:00] 15/10303727 keys tested (2243.83 k/s) 

      Time left: 1 hour, 16 minutes, 32 seconds                  0.00%

                           KEY FOUND! [ 12345678 ]

      Master Key     : 7F 76 94 BD AC D9 1E 94 22 2F 00 BD 49 CD 4D DA 
                       8B 0C 31 16 D5 28 A4 BC C8 3F 8A 40 AE 78 D7 A5 

      Transient Key  : 42 3D AE DB 8E 6E BD 14 44 E5 EB 90 E2 5D 59 F8 
                       3C D0 D0 01 10 12 97 D2 5C DA D8 D2 C3 61 99 BD 
                       DF AD E4 16 26 F0 2F 75 56 F7 00 00 00 00 00 00 
                       00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

      EAPOL HMAC     : A6 01 F2 FA 2C BE BB F7 BC CF 3A 2D 83 A2 44 29

Ensuite on ajoute cette clé dans Edit > Préférences > Protocol > IEEE 802.11

Cela permet de déchiffrer les données qui transitent par ce réseau et de découvrir des requêtes ARP

---

Script de résolution

from hashlib import sha256

ip_client = "10.0.3.19"
ip_target = "93.184.216.34"

def calculate_sha256(ip_client, ip_target):
	input_string = ip_client + ip_target

	hash_result = sha256(input_string.encode()).hexdigest()

	return hash_result

sha256_sum = calculate_sha256(ip_client, ip_target)

print('CTF{' + sha256_sum + '}')
# CTF{b67842d03eadce036c5506f2b7b7bd25aaab4d1f0ec4b4f490f0cb19ccd45c70}