Every network that we attacked in the three Wi-Fi rooms listed under Prerequisites below used either a single shared secret or no secret at all. The open networks in the Wi-Fi Fundamentals and Reconnaissance room had no key. The networks we broke in the Attacking Open and WPA2-PSK Networks and Attacking WPA3 and Rogue Access Points rooms each came down to one passphrase. Every device on those networks was configured with that passphrase, and we were working to recover that passphrase. That model suits a household or a small venue, but it scales badly. If the passphrase leaks, it has to be changed on every laptop, phone and printer at once. If an employee leaves, the employee still has a working key. For this reason, organisations of any size usually run enterprise Wi-Fi instead of a shared passphrase. In enterprise Wi-Fi, each user authenticates with their own individual credentials against a central authentication server. This means that access is granted and revoked for each person. With a shared passphrase, access is granted and revoked for the whole network.

We can still attack a network that uses enterprise Wi-Fi, but the thing that we are trying to capture is different. The rogue access point technique from the Attacking WPA3 and Rogue Access Points room still works here without any changes. We can still deauthenticate a client from the network it trusts and draw the client onto an access point that we control. However, the client offers something different once it arrives. Once the client connects to our access point, it sends the login of one named user. On a network with a shared passphrase, the client would send a handshake that proves it knows the one passphrase shared across the whole site. Enterprise credentials are usually the same directory credentials that the user holds elsewhere in the organisation. This means that the credentials we capture can also be used outside the wireless network.

802.1X and EAP are used to carry these credentials to the authentication server. In an enterprise deployment, the trust is placed in 802.1X and EAP. The attacks in the later tasks of this room all target this trust. In the next task, we will look at how this trust is meant to work.

Learning Objectives

• Explain how 802.1X and EAP authenticate individual users through a RADIUS server.
• Capture a user's EAP credentials with a rogue RADIUS server behind an evil twin.
• Crack a captured MSCHAPv2 (NetNTLM) hash to recover the plaintext password.
• Connect to an enterprise network with the recovered credentials and read a flag.
• Relay a live authentication to get onto a network without cracking anything.
• Spray a single password across many usernames to find credential reuse.
• Explain why validating the RADIUS server's certificate is the defence that stops the rogue-RADIUS and relay attacks, and why credential spraying needs a different one.

Prerequisites

• Basic Linux commands (Linux Fundamentals room)
• Monitor mode and airodump-ng captures (Wi-Fi Fundamentals and Reconnaissance room)
• Deauthenticating a client and cracking its handshake (Attacking Open and WPA2-PSK Networks room)
• Running a rogue access point (Attacking WPA3 and Rogue Access Points room)

Machine Access

Start the lab by clicking the Start Machine button below. The machine takes a couple of minutes to boot and then appears in Split View in your browser. The expand button in the bottom-left corner opens the VM in full screen. No login is required, since the session opens directly onto the desktop as the user account. If you would rather work from your own machine, the same account is reachable over SSH with the credentials below. Every command in this room runs on that machine. The lab networks are emulated radios inside the machine itself, so no AttackBox is needed.

The tasks build on one another, so they are meant to be worked in order. The machine does not retain that state across a restart. Resuming the room on another day means starting the lab again and re-running the earlier tasks.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Lab Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Lab machine

Status:Off

Start Lab Machine

Credentials for the lab machine are below:

Confirming the Wireless Interfaces

Open a Terminal on the machine and confirm that the wireless interfaces are present:

user@debian-thm:~$ sudo iw dev

Several wlan interfaces are listed, numbered from wlan0 upward. These are the radios used to observe the networks in the lab and to attack them. Most of the tooling requires root privileges, so we prefix our commands with sudo. If we are asked for a password, the password is user.

The attacks in this room run from a card in monitor mode, so we need to create the monitor interface before we begin. First, we can stop NetworkManager with airmon-ng check kill, and then we can set wlan0 into monitor mode with airmon-ng start wlan0:

user@debian-thm:~$ sudo airmon-ng check kill
user@debian-thm:~$ sudo airmon-ng start wlan0

We need to run airmon-ng check kill in this room. It is needed for the monitor interface, and it is also needed for the managed radios that we use to connect to networks. NetworkManager manages every wireless radio on the machine. If we leave it running, it will reclaim our managed radio moments after wpa_supplicant associates with a network. The association will appear to succeed, and wpa_supplicant will report no error. Then, if we check the link with iw dev wlan1 link, the output will read Not connected, and every DHCPDISCOVER will go unanswered. Stopping NetworkManager first avoids this problem. The airmon-ng check kill command also stops any wpa_supplicant that is already running, so we have to run it first.

The airmon-ng start wlan0 command gives us the wlan0mon interface. Every capture and injection command in this room expects wlan0mon. There are also two spare managed radios, wlan1 and wlan2. We will use these radios whenever we need to broadcast a rogue access point or actually connect to a network. Most tasks occupy only one of them, but the relay attack in the Relaying Authentication task runs a rogue access point and a supplicant in the same instant, so it needs a radio for each.