PMKID Attack

See https://hashcat.net/forum/thread-7717.html

Steps

1. Start hcxdumptool (daemon)
   • sudo hcxdumptool -i wlan1mon -o pmkid.pcapng -t 10 --enable_status=1
   • Should also use -c <channel>, --filterlist and --filtermode to target a specific client
   • Could be a new attack type: wifite.attack.pmkid
2. Detect when PMKID is found.
   • hcxpcaptool -z pmkid.16800 pmkid.pcapng
   • Single-line in pmkid.16800 will have PMKID, MACAP, MACStation, ESSID (in hex).
3. Save .16800 file (to ./hs/? or ./pmkids/?)
   • New result type: pmkid_result
   • Add entry to cracked.txt
4. Run crack attack using hashcat:
   • ./hashcat64.bin --force -m 16800 -a0 -w2 path/to/pmkid.16800 path/to/wordlist.txt

Problems

• Requires latest hashcat to be installed. This might be in a different directory.
  • Use can specify path to hashcat? Yeck...
  • % hashcat -h | grep 16800
  • 16800 | WPA-PMKID-PBKDF2
• If target can't be attacked... we need to detect this failure mode.
  • Might need to scrape hcxdumptool's output
  • Look at pmkids() func in .bashrc
  • hcxpcaptool -z OUTPUT.16800 INPUT.pcapng > /dev/null
  • Check OUTPUT.16800 for the ESSID.
• Wireless adapter support is minimal, apparently.
• hcxdumptool also deauths networks and captures handshakes... maybe unnecessarily