How does "sniffing a PBC session" Work ?

[minanagehsalalma]

I am trying to know if it's possible

to know if the WPS button

was pushed on some AP

without trying to connect to it

but with just monitoring it

So i think sniffing a PBC session is what i am looking for , so i would like to know how it works

Thanks

[rofl0r]

there's currently no code in wash or similar tools to know whether the button was pushed.
you just got to be lucky and have a packet capture running while someone submits M1-M7 with the AP, so you can extract all parameters needed for https://camo.githubusercontent.com/18d30ce7809015bae46a7b5e10957e762e269e01a26ab7b8f7accb146520c1f8/68747470733a2f2f692e696d6775722e636f6d2f71565138526e672e706e67 from wireshark.

[minanagehsalalma]

there's currently no code in wash or similar tools to know whether the button was pushed. you just got to be lucky and have a packet capture running while someone submits M1-M7 with the AP, so you can extract all parameters needed for https://camo.githubusercontent.com/18d30ce7809015bae46a7b5e10957e762e269e01a26ab7b8f7accb146520c1f8/68747470733a2f2f692e696d6775722e636f6d2f71565138526e672e706e67 from wireshark.

@rofl0r Oh! Thanks a lot

So i need to sniff using airodump

and wait for some one to press the button and connect ?
and use the values exchanged between them and the router

To get the password ?

But how do i actually extract these values from a wireshark capture ?

Also this isn't what i meant

I need to detect whether the button was pushed or not
without me or some one try to connect to it

so i can act on it if i notice the button was pushed then i can choose to connect to it or not

I read Here at wifiphisher wpspbc extension That you can detect if a button was pushed or not without needing for someone to connect to it , by just sniffing A WPSPBC IE .... But i wasn't able to understand how

or if it's possible to do it manually

Thanks again for your response
It really helps as i found no mention about the matter online

[rofl0r]

So i need to sniff using airodump and wait for some one to press the button and connect ? and use the values exchanged between them and the router

yes, or using wireshark, or tcpdump or any other tool that can capture packets from monitor if

But how do i actually extract these values from a wireshark capture ?

expand the headers of M1-M7 and look for the relevant fields

I need to detect whether the button was pushed or not

you're the first person needing it so far, so nobody has implemented it. PR adding it to wash is welcome.

[minanagehsalalma]

expand the headers of M1-M7 and look for the relevant fields

@rofl0r what filter do i use to find the m1-m7 headers ?

what about this

I need to detect whether the button was pushed or not
without me or some one try to connect to it

so i can act on it if i notice the button was pushed then i can choose to connect to it or not

I read Here at wifiphisher wpspbc extension That you can detect if a button was pushed or not without needing for someone to connect to it , by just sniffing A WPSPBC IE .... But i wasn't able to understand how

is it possible or not ?

you're the first person needing it so far

Not really as i mentioned above , wifiphisher needed it and this too "hostbase"

They use an evil twin attack and ask the user to push the button instead of a password .... but they have to stop the deauth of the target clients , So they be able to check if the button was pushed or not
as they wasn't able to figure out a way to check by just monitoring

Googling the problem i found a lot of people asking about it but not able to figure it out

And here too they had to use an alternative method because they weren't able to figure out how

https://www.wifi-libre.com/topic-596-vulnerabilidad-wps-pbc-push-button.html

I just want to figure out how to do it using airodump-ng
without any one trying to connect

thanks

[rofl0r]

@rofl0r what filter do i use to find the m1-m7 headers ?

can't recall from the top of my head. just record a WPS session (even if wrong pin) to your router and look at the packets. wireshark somewhere mentions those are iirc EAP packets and also has the info whether M1, etc somewhere listed.

is it possible or not ?

i don't know. you best experiment with your own router and compare packets before you push the button and after. in other words, i can't help you further, you gotta dig into this yourself.

[minanagehsalalma]

i don't know. you best experiment with your own router and compare packets before you push the button and after. in other words, i can't help you further, you gotta dig into this yourself.

@rofl0r oh thanks a lot you helped me a lot so far

I was able to find it i captured Two captures
one without the WPS PBC button pressed
and one with the button pressed I let it sniff for the whole 2 minutes duration of the PBC connection allowance

Then i tried all the WPS PBC filters from the wireshark wiki
And only two filters showed no results on the non pbc capture
while showing a lot of results on the one with pbc pressed

The three filters are
wps.selected_registrar_config_methods.phy_pushbutton
wps.selected_registrar_config_methods.pushbutton
wps.selected_registrar_config_methods

and this one i found by looking at the packets

wps.device_password_id

Now that we know which filters are needed

I still don't know how to do it from the terminal using tcpdump

I am trying to do something like this , but i can't figure out the syntax for using tcpdump and if the matches are zero or not just from bash

HEREAGAIN
If tcpdump wps.selected_registrar_config_methods  != 0 
then echo "The button has been pushed"
break;

else
sleep 10
goto HEREAGAIN

I linked the Two capture files if that would help

Thanks a lot

[minanagehsalalma]

there's currently no code in wash or similar tools to know whether the button was pushed.

@rofl0r i think that i have found a tool

but it works on older systems with python 2.7 only
wps2key.py

Looks like scapy was the key all along haha

[rofl0r]

a thing that comes to mind is the json mode of wash (wash -j). it also lists stuff like that.

[minanagehsalalma]

a thing that comes to mind is the json mode of wash (wash -j). it also lists stuff like that.

@rofl0r oh thanks a lot you are right

But it misses wps.device_password_id and Selected Registrar config methods Even tho wps2key.py is able to see them, And it's a bit slower but no problem

I am trying to do a check using this syntax
wash -i wlan0 -j -b XX:73:8F:XD:XX -c 8 | grep -zqv "wps_selected_registrar" && echo no || echo yes

But it only prints Yes after i kill it using ctrl + c 😥

anyway thanks a lot you helped me a lot so far

PR adding it to wash is welcome.

Yeah just add another column with WPS PBC
with text Not pushed / pushed in front of each AP in case of a "wps_selected_registrar" match , but that should turned on only if an argument is used like --PBC or something as it slows the scan , and as a bonus you can add an option To make it auto connect when A match is found

I am currently wondering

Does the wps lock matter when using the PBC ?
my network has the lock status as true
but i found no problem connecting using pbc tho
Is that the case with all APs ?

But for some reason Reaver -K -L fails Even using the -N option doesn't help
This error occaurs on the router

WPS: A new PIN configured (timeout=0)
WPS: UUID - hexdump(len=16): [NULL]
WPS: PIN - hexdump_ascii(len=8):
     31 32 33 34 35 36 37 30                           12345670        
WPS: Selected registrar information changed
WPS: Internal Registrar selected (pbc=0)
WPS: sel_reg_union
WPS: set_ie
WPS: cb_set_sel_reg
WPS: Enter wps_cg_set_sel_reg
WPS: Leave wps_cg_set_sel_reg early
WPS: return from wps_selected_registrar_changed
[+] Trying pin "12345670"
send_packet called from deauthenticate() 80211.c:380
send_packet called from authenticate() 80211.c:411
[+] Sending authentication request
send_packet called from associate() 80211.c:464
[+] Sending association request
[+] Associated with EX:3X:B3:X0:7B:21 (ESSID: ~XXXXXXX~).
[+] Sending EAPOL START request
send_packet called from send_eapol_start() send.c:48
[+] Received identity request
[+] Sending identity response
send_packet called from send_identity_response() send.c:81
send_packet called from resend_last_packet() send.c:161
WPS: Processing received message (len=396 op_code=4)
WPS: Received WSC_MSG
WPS: Unsupported attribute type 0x1049 len=6
WPS: Parsed WSC_MSG
WPS: Received M1
WPS: UUID-E - hexdump(len=16): bc 32 9e 00 1d d8 11 b2 86 01 ec 3e b3 40 7b 22
WPS: Enrollee MAC Address ec:3e:b3:40:7b:21
WPS: Enrollee Nonce - hexdump(len=16): ae fa d8 dd cd 3b 40 58 f9 98 34 4b a5 ec 3f c9
WPS: Enrollee Authentication Type flags 0x21
WPS: No match in supported authentication types (own 0x0 Enrollee 0x21)
WPS: Workaround - assume Enrollee does not advertise supported authentication types correctly
WPS: Enrollee Encryption Type flags 0x9
WPS: No match in supported encryption types (own 0x0 Enrollee 0x9)
WPS: Workaround - assume Enrollee does not advertise supported encryption types correctly
WPS: Enrollee Connection Type flags 0x1
WPS: Enrollee Config Methods 0x238c [Label] [Display] [PBC] [Keypad]
WPS: Enrollee Wi-Fi Protected Setup State 2
WPS: Manufacturer - hexdump_ascii(len=5):
     5a 79 78 65 6c                                    XXXXX
WPS: Model Name - hexdump_ascii(len=12):
     56 4d 47 33 36 32 35 2d 54 35 30 42               XXXX-XXXX    
WPS: Model Number - hexdump_ascii(len=6):
     52 54 32 38 36 30                                 XXXXX
WPS: Serial Number - hexdump_ascii(len=4):
     31 32 33 34                                       1234            
WPS: Primary Device Type: 6-0050F204-1
WPS: Device Name - hexdump_ascii(len=12):
     56 4d 47 33 36 32 35 2d 54 35 30 42               XXXXX-XXXX
WPS: Enrollee RF Bands 0x1
WPS: Enrollee Association State 0
WPS: Device Password ID 4
WPS: Enrollee Configuration Error 0
WPS: OS Version 80000000
WPS: M1 Processed
WPS: Unsupported Device Password ID 4
WPS: WPS_CONTINUE, Freeing Last Message
WPS: WPS_CONTINUE, Saving Last Message
WPS: returning
[+] Received M1 message
WPS: Found a wildcard PIN. Assigned it for this UUID-E
WPS: Registrar Nonce - hexdump(len=16): 96 72 d5 07 90 3b bf 16 7d b1 1e d5 5a 2f 95 78
WPS: UUID-R - hexdump(len=16): 1a f0 6e 79 80 f3 c4 95 bc 93 14 ee 2b 27 89 9b
WPS: Building Message M2
WPS:  * Version
WPS:  * Message Type (5)
WPS:  * Enrollee Nonce
WPS:  * Registrar Nonce
WPS:  * UUID-R
WPS:  * Public Key
WPS: Generate new DH keys
DH: private value - hexdump(len=192): 57 75 d4 3a df 41 7c 4c 15 37 db e1 18 a2 c8 46 bb a6 28 76 97 0c a7 28 b6 92 e5 08 ab 94 5d a5 01 5f 43 88 7b 52 0a 96 9a 62 dc ce 5b a2 4b 8f 47 97 ef ae d4 1a ad e7 2f 6e 07 09 c6 9d 1e 21 f3 5d fb 5e 59 5a 55 a6 b6 c2 fe bf f1 85 9d 17 36 69 70 85 6f ec 78 37 66 9f 59 f3 23 0a 4f 48 7c a1 bb 4c 50 04 5f 7c 22 e0 09 22 b7 82 e8 c4 aa ff ca f2 3c 33 24 09 16 28 1a f9 be d2 ff b5 ad 6c 5c 0c 8f 4f cd 4b 98 e4 a8 17 6f e2 87 ef 7d 2a 81 10 db be 32 46 30 7a 5e 38 19 49 39 e9 3e e1 90 7e 0a 3f bb c2 6c 17 ee 1b 43 df fb 01 0b 7b 26 b0 17 eb ad 93 eb 94 4b 1f 1f 25 b2 a5
DH: public value - hexdump(len=192): 59 8f 9e 90 ad a4 ae e1 96 1f 2e dd e7 61 a6 ef e1 81 bd 07 0f 4e 8e 51 bd 71 5e 9c 08 01 ca b7 6e 6c 43 23 c1 35 3c a2 bf 08 9a 12 22 b7 03 bf 6c 39 46 b0 bd a2 16 ae 5f 4e 85 2b d4 38 b0 a7 01 4d 3c 2c 0a dc cb 47 77 7c e3 71 4e 9a 00 bb b9 8b 3d a0 72 08 56 62 df 4c 54 80 a3 c1 35 46 b8 fe 95 54 5a f8 de 6f 98 3f 3e 38 6f 96 60 7c ad e8 6f 40 c0 d8 35 a4 f9 6c eb 78 7d 39 89 88 ca 13 e6 2a cb 6e f7 d6 b2 c5 4a 94 c5 67 37 1f e5 27 98 33 53 26 ef a9 96 e7 75 e8 4a eb ba 20 bb d5 44 70 80 80 c6 0a db 32 04 91 f3 dd c6 e7 9d 62 84 a8 b4 35 06 74 b3 6e da cd 2e fb fc e4
WPS: DH Private Key - hexdump(len=192): 57 75 d4 3a df 41 7c 4c 15 37 db e1 18 a2 c8 46 bb a6 28 76 97 0c a7 28 b6 92 e5 08 ab 94 5d a5 01 5f 43 88 7b 52 0a 96 9a 62 dc ce 5b a2 4b 8f 47 97 ef ae d4 1a ad e7 2f 6e 07 09 c6 9d 1e 21 f3 5d fb 5e 59 5a 55 a6 b6 c2 fe bf f1 85 9d 17 36 69 70 85 6f ec 78 37 66 9f 59 f3 23 0a 4f 48 7c a1 bb 4c 50 04 5f 7c 22 e0 09 22 b7 82 e8 c4 aa ff ca f2 3c 33 24 09 16 28 1a f9 be d2 ff b5 ad 6c 5c 0c 8f 4f cd 4b 98 e4 a8 17 6f e2 87 ef 7d 2a 81 10 db be 32 46 30 7a 5e 38 19 49 39 e9 3e e1 90 7e 0a 3f bb c2 6c 17 ee 1b 43 df fb 01 0b 7b 26 b0 17 eb ad 93 eb 94 4b 1f 1f 25 b2 a5
WPS: DH own Public Key - hexdump(len=192): 59 8f 9e 90 ad a4 ae e1 96 1f 2e dd e7 61 a6 ef e1 81 bd 07 0f 4e 8e 51 bd 71 5e 9c 08 01 ca b7 6e 6c 43 23 c1 35 3c a2 bf 08 9a 12 22 b7 03 bf 6c 39 46 b0 bd a2 16 ae 5f 4e 85 2b d4 38 b0 a7 01 4d 3c 2c 0a dc cb 47 77 7c e3 71 4e 9a 00 bb b9 8b 3d a0 72 08 56 62 df 4c 54 80 a3 c1 35 46 b8 fe 95 54 5a f8 de 6f 98 3f 3e 38 6f 96 60 7c ad e8 6f 40 c0 d8 35 a4 f9 6c eb 78 7d 39 89 88 ca 13 e6 2a cb 6e f7 d6 b2 c5 4a 94 c5 67 37 1f e5 27 98 33 53 26 ef a9 96 e7 75 e8 4a eb ba 20 bb d5 44 70 80 80 c6 0a db 32 04 91 f3 dd c6 e7 9d 62 84 a8 b4 35 06 74 b3 6e da cd 2e fb fc e4
WPS: DH Private Key - hexdump(len=192): 57 75 d4 3a df 41 7c 4c 15 37 db e1 18 a2 c8 46 bb a6 28 76 97 0c a7 28 b6 92 e5 08 ab 94 5d a5 01 5f 43 88 7b 52 0a 96 9a 62 dc ce 5b a2 4b 8f 47 97 ef ae d4 1a ad e7 2f 6e 07 09 c6 9d 1e 21 f3 5d fb 5e 59 5a 55 a6 b6 c2 fe bf f1 85 9d 17 36 69 70 85 6f ec 78 37 66 9f 59 f3 23 0a 4f 48 7c a1 bb 4c 50 04 5f 7c 22 e0 09 22 b7 82 e8 c4 aa ff ca f2 3c 33 24 09 16 28 1a f9 be d2 ff b5 ad 6c 5c 0c 8f 4f cd 4b 98 e4 a8 17 6f e2 87 ef 7d 2a 81 10 db be 32 46 30 7a 5e 38 19 49 39 e9 3e e1 90 7e 0a 3f bb c2 6c 17 ee 1b 43 df fb 01 0b 7b 26 b0 17 eb ad 93 eb 94 4b 1f 1f 25 b2 a5
WPS: DH peer Public Key - hexdump(len=192): a0 51 19 12 7b c8 18 8a d4 2f 86 93 d9 9b 13 16 50 6b a8 01 0c f9 89 86 99 c1 db 14 9d 74 2c 12 17 a4 a6 9f ca 5f 10 17 9d 47 ae 78 ec af 5e 1c e2 2d d9 5c 16 3d d4 f4 4a 40 10 86 58 ab 38 59 94 8b 5c 88 9f c1 e1 22 b4 99 77 e6 63 e4 da 38 f1 29 a3 2b 3f 86 93 7b 7c c1 52 ef 6f c8 57 87 82 32 d2 84 09 e6 2c 9c 81 80 2f dc ca 21 41 5c bc 06 94 7d 69 3e ba 5c e2 a7 27 b1 2f 01 a3 56 69 f7 27 96 70 c1 f7 60 10 fb 02 2e 24 1a 99 0e 4f 7f 9e 43 ea a3 c2 c2 a8 38 b5 bb 12 1a 64 74 ec bb 54 40 45 68 5e ba f5 1a db 57 43 b1 87 df 7a 6f 68 cc da ac 6b cd 8c 2e 85 2a 57 04 18 ca
DH: shared key - hexdump(len=192): cc 7a 77 54 14 9d 4e 6f cd e9 6d 53 9f 8e ae 16 f1 e5 cd 7c 3b 1c a9 65 a6 f9 a0 7d 9f b2 3a 6a 7b 29 4b 50 7f 86 85 79 6d fb b6 cb d1 cc 1d ce 7e 73 d5 4e 84 c7 d5 18 3a fc bd 4f 39 5a 9d 39 94 ef 57 0c 92 f0 65 bc 74 69 ab fa 04 3e 5d 64 ca 6a 05 16 aa 8a f3 88 96 f6 14 da d8 ba d2 fc f0 97 1e d1 01 62 61 41 db 02 cc 65 13 29 84 62 e6 86 f7 cf bb 86 0d 76 94 41 42 f7 19 6e ce dc 5e 27 e0 81 03 17 32 be 87 f0 b8 60 78 03 f2 1e 30 3d 52 99 9a 2b 74 fe 1e 0a a8 e4 09 d1 88 35 cd ff b9 62 0d 6f b9 fe 6d fc c3 5e 96 80 79 7b f3 68 03 38 a3 1f 01 b8 0d 2c 17 5d c8 46 e7 ae
WPS: DH shared key - hexdump(len=192): cc 7a 77 54 14 9d 4e 6f cd e9 6d 53 9f 8e ae 16 f1 e5 cd 7c 3b 1c a9 65 a6 f9 a0 7d 9f b2 3a 6a 7b 29 4b 50 7f 86 85 79 6d fb b6 cb d1 cc 1d ce 7e 73 d5 4e 84 c7 d5 18 3a fc bd 4f 39 5a 9d 39 94 ef 57 0c 92 f0 65 bc 74 69 ab fa 04 3e 5d 64 ca 6a 05 16 aa 8a f3 88 96 f6 14 da d8 ba d2 fc f0 97 1e d1 01 62 61 41 db 02 cc 65 13 29 84 62 e6 86 f7 cf bb 86 0d 76 94 41 42 f7 19 6e ce dc 5e 27 e0 81 03 17 32 be 87 f0 b8 60 78 03 f2 1e 30 3d 52 99 9a 2b 74 fe 1e 0a a8 e4 09 d1 88 35 cd ff b9 62 0d 6f b9 fe 6d fc c3 5e 96 80 79 7b f3 68 03 38 a3 1f 01 b8 0d 2c 17 5d c8 46 e7 ae
WPS: DHKey - hexdump(len=32): ff 23 d1 1f 1f 0c be 3c 41 4f dc 00 f5 e5 70 32 a2 c0 3e c3 d0 2b 77 22 6b 3d ca 3c d3 0e db 99
WPS: KDK - hexdump(len=32): be 3e 80 5c db 6f 80 68 bf 26 bb d9 89 f5 5e e4 3b ac f0 41 58 7a 09 3f 82 21 84 1f a5 75 28 fa
WPS: AuthKey - hexdump(len=32): 37 ae c3 76 92 46 df 3f 84 fe 71 32 c2 cd e5 a5 ea 21 63 ed c6 a4 06 b8 40 54 cc 47 ca 94 6a be
WPS: KeyWrapKey - hexdump(len=16): 71 56 a6 35 29 8f ac fa a5 10 d4 31 a2 e6 7a 2e
WPS: EMSK - hexdump(len=32): fc 1f da 04 ae 73 88 90 29 5f c4 1a 59 13 ed a5 b4 48 aa 27 11 a2 de 7e 0d 2d 47 d9 ef fd 2c 7b
WPS:  * Authentication Type Flags
WPS:  * Encryption Type Flags
WPS:  * Connection Type Flags
WPS:  * Config Methods (8c)
WPS:  * Manufacturer
WPS:  * Model Name
WPS:  * Model Number
WPS:  * Serial Number
WPS:  * Primary Device Type
WPS:  * Device Name
WPS:  * RF Bands (0)
WPS:  * Association State
WPS:  * Configuration Error (0)
WPS:  * Device Password ID (4)
WPS:  * OS Version
WPS:  * Authenticator
[+] Sending M2 message
send_packet called from send_msg() send.c:116
send_packet called from resend_last_packet() send.c:161
WPS: Processing received message (len=66 op_code=3)
WPS: Received WSC_NACK
WPS: Unsupported attribute type 0x1049 len=6
WPS: Enrollee terminated negotiation with Configuration Error 15
[+] Received WSC NACK
WPS: Building Message WSC_NACK
WPS:  * Version
WPS:  * Message Type (14)
WPS:  * Enrollee Nonce
WPS:  * Registrar Nonce
WPS:  * Configuration Error (0)
[+] Sending WSC NACK
send_packet called from send_msg() send.c:116
[!] WPS transaction failed (code: 0x04), re-trying last pin

Even that using Pixie dust on Routerscan success with no problem in the same situation !
What the problem ??

[*] Associating with AP...
[+] Associated with EX:3X:B3:X0:7B:21 (ESSID: ~XXXXXXX~).
[*] Warning: AP is locked.
[*] Waiting for pin "00000000"...
[*] Sending EAPOL Start...
[*] Received Identity Request.
[*] Sending Identity Response...
[*] Received WPS Start.
[*] Sending WPS Message M1...
[*] PKE: 8AD2042450A59BA8BC7FA54E8B744D4407F4D1CCC7608B8BBCB6D43FF1302540FEAABA1EE3BFB9448D790047817003066623861D5XXXXXXXXXXXXXXXXX179ED4BCBEC8497F1352F8195C54FF52008560EB924CFBBA00644651AEC7D987939B736ECF0AAAB9D46165A874FF995956B925B9F14507831B969C88C8D8455423851239774465ABE338407FDBC75E900FABA50AF544C02224A34C3A1BFA5BE36733656535F08D5310EE4ECC56F570B49EB26681E88ECC48251225DB
[*] Received WPS Message M2.
[*] R-Nonce: 65F27C09AEBXXXXXXXXXX1F98FD9
[*] PKR: FFD666E8F35F7FCD889998CC22FBF2C1C76ACCF0773CA7D8974AC11A5237629512B62780633391C7333C034AA5CC60B79B26E7C8E63DF6CXXXXXXXXXXXXXXXXXXXXXXXXXXE68551F309B2A6527A9FF160AD241F08640D9522B5DC4C91AAB61B26E0087F24B7B7C46BEE2C220F0DF985774F08C17F4A1741E24E0FF7DC8AE2FD9033BF733702D3FCC4F081B6BA48093D7A3070D08EA115115EB879782445A80E4B8822657318DA00357262C33FC3D1D4D8CC022450CDA187BC4819F412A67
[*] Manufacturer: XXXX
[*] Model Name: XXXXX
[*] Model Number: XXXX
[*] Serial Number: XXX
[*] Device Name: XXXXXX
[*] AuthKey: DF8FD6BF19BA5C060D7EBCDXXXXXXF1888F8564D1BF0F2226D6EC1A7F0
[*] Sending WPS Message M3...
[*] Received WPS Message M4.
[*] R-Hash1: DDF3FC51F7398E513CEE0XXXXXXXXA52E6234995F3FDFA
[*] R-Hash2: 6E3CA58ECC37CB199C2A799XXXXXA5EF10EC231CAC76D75D1DDD2A5145C4F2
[*] R-S1: 04A9C4BABD12E060XXXX56089F57CC
[*] Sending WPS Message M5...
[*] Received WPS Message M6.
[*] R-S2: 820C0D464FC46D551C9FXXXx51115
[*] Sending WPS Message M7...
[*] Received WPS Message M8.
[*] Sending WSC DONE...
[*] EAP session closed.
[+] WPS transaction succeeded!
[+] SSID: XXXXXXXXX
[+] Key: XXXXXXXXXXXX
[+] Key Index: 1

This is Router scan configuration

Even when disabling PixieDust it still works !

[*] Audit started at 2022.01.23 23:00:45 (UTC+02:00).
[*] Associating with AP...
[+] Associated with EX:3X:B3:X0:7B:21 (ESSID: ~XXXXXXX~).
[*] Warning: AP is locked.
[*] Waiting for pin "000000"...
[*] Sending EAPOL Start...
[*] Received Identity Request.
[*] Sending Identity Response...
[*] Received WPS Start.
[*] Sending WPS Message M1...
[*] Received WPS Message M2.
[*] Manufacturer: XXXX
[*] Model Name: XXXXX
[*] Model Number: XXXX
[*] Serial Number: XXX
[*] Device Name: XXXXXX
[*] Sending WPS Message M3...
[*] Received WPS Message M4.
[*] Sending WPS Message M5...
[*] Received WPS Message M6.
[*] Warning: R-Hash2 security check failed.
[*] The AP sent wrong 2nd pin part.
[*] Sending WPS Message M7...
[*] Received WPS Message M8.
[*] Sending WSC DONE...
[*] EAP session closed.
[+] WPS transaction succeeded!
[+] SSID: XXXXXXXXX
[+] Key: XXXXXXXXXXXX
[+] Key Index: 1
[*] Audit stopped at 2022.01.23 23:00:58 (UTC+02:00).

Second : Why Wash doesn't refresh results ? i Mean it only outputs each network status for once for each run
And needs to Exit and then start again for status refresh and using -s scan mode doesn't make any diff ! so ...

[rofl0r]

What the problem ??

i don't know, maybe @binarymaster can shed some light on this difference.

Second : Why Wash doesn't refresh results ?

because wash isn't a tool for real-time monitoring, but for one-shot information gathering. in order to work as you want, you'd need to start it in a way it's automatically terminated after e.g. one sec (like sending a SIGALRM to it, iirc there's some shell tool to achieve that), and only using the channel of the target ap.

[minanagehsalalma]

and only using the channel of the target ap.

@rofl0r hmm what do you mean ?

there's some shell tool to achieve that

What's its name?

i don't know, maybe @binarymaster can shed some light on this difference.

Yeah cause i even tried bully and it still fails

bully  wlan0mon -c 3 -b XX:3E:XX:40:XX:21 -v 4  -p 1234567 --lockignore
[!] Bully v1.1 - WPS vulnerability assessment utility
[P] Modified for pixiewps by AAnarchYY(aanarchyy@gmail.com)
[+] Switching interface 'wlan0mon' to channel '3'
[!] Starting pin specified, defaulting to sequential mode
[!] Using 'XX:XX:XX:21:XX:bb' for the source MAC address
[+] Datalink type set to '127', radiotap headers present
[+] Scanning for beacon from 'XX:3E:XX:40:XX:21' on channel '3'
[+] Got beacon for 'XXXXXXXXXXXXXX' (XX:3E:XX:40:XX:21)
[!] Beacon information element indicates WPS is locked
[+] Index of starting pin number is '1234567'
[+] Last State = 'NoAssoc'   Next pin '12345670'
[+] Rx(  ID  ) = 'Timeout'   Next pin '12345670'
[+] Rx(  ID  ) = 'Timeout'   Next pin '12345670'

[binarymaster]

Does the wps lock matter when using the PBC ?

I think not, since you are explicitly pressing a physical (or virtual) button. Some routers may clean lock flag on button press, some may not.

i don't know, maybe @binarymaster can shed some light on this difference.

I'm actually tracking this thread from the beginning 😄 Would be nice to have a passive way of WPS button press detection when scanning networks (preferably using Probe Response data) so I can integrate this into Router Scan.

[rofl0r]

i don't know, maybe @binarymaster can shed some light on this difference.

I'm actually tracking this thread from the beginning 😄

i suspect the problem lies here in reaver code/output:

WPS: Enrollee MAC Address ec:3e:b3:40:7b:21
WPS: Enrollee Nonce - hexdump(len=16): ae fa d8 dd cd 3b 40 58 f9 98 34 4b a5 ec 3f c9
WPS: Enrollee Authentication Type flags 0x21
WPS: No match in supported authentication types (own 0x0 Enrollee 0x21)
WPS: Workaround - assume Enrollee does not advertise supported authentication types correctly
WPS: Enrollee Encryption Type flags 0x9
WPS: No match in supported encryption types (own 0x0 Enrollee 0x9)
WPS: Workaround - assume Enrollee does not advertise supported encryption types correctly
...
WPS: Device Password ID 4
WPS: Enrollee Configuration Error 0
WPS: OS Version 80000000
WPS: M1 Processed
WPS: Unsupported Device Password ID 4

what does routerscan do differently here than reaver?

there's some shell tool to achieve that

What's its name?

if i would recall i'd already told you. google "shell terminate command after 1 sec"

and only using the channel of the target ap.

@rofl0r hmm what do you mean ?

the idea is that you run wash in a loop targeting only the channel the device uses so no time is wasted scanning different channels, and as soon as you have the magic string in the json output you know that now's the time to start sniffing packets for the WPS interchange.

[binarymaster]

what does routerscan do differently here than reaver?

I think Router Scan just ignores what the AP sends in the "Device Password ID" field.

However when it's configured to Enrollee mode, it sends M1 message first, and the "Device Password ID" is equal either to 0 (PIN mode) or 4 (PBC mode) - depending on what setting is chosen in the GUI.

[rofl0r]

i currently don't have a router with wps button available to test this. maybe @feitoi is interested to look into what's going wrong here ?