Original subtitles

1

So in the previous lecture we've seen if we run a river against this particular network the network

2

will get locked and we won't be able to brute force the WPA spin because the network will just refuse

3

any requests.

4

So we said one of the ways to try and reset or get the network to get unlocked is to just run the authentication

5

attack like we did before and hope that one of the users will just go in and physically turn off the

6

router and then turn it back on.

7

And we said this is not a great way because we actually were relying on a person to go and turn off

8

the router but it has a high chance of success because what would you do when you lose internet connection.

9

Most people will just go and turn off their now a router and turn it back on.

10

So in this lecture were going to use a tool called MBK 3 and we're going to use it to run a didoes attack

11

a denial of service attack basically on the target network and in some routers this attack will just

12

flood the router.

13

And then it will cause the router to reset automatically and then when it resets it will get unlocked

14

as well.

15

So we'll be able to run river and start guessing the WPA Espen again.

16

And since reverse supports pause and rescue this cat can work really well so even if you're at 60 percent

17

and then the router locks you can just control Siri either run the attack get the router to be unlocked

18

and then run the attack again and it all starts from 60 percent.

19

It's not going to start from zero.

20

So I'm just going to split the screen here.

21

And I'm just going to run the tool that we're going to be using.

22

Is called M.D K3 and I'm going to type in help just to see the options that this tool gives us.

23

And we consider this to actually let us run a number of attacks and test modes are listed in here.

24

So the way the tool works is you specify the name of the tool.

25

You follow it up with your interface and monitor mode and then you follow it with the test mode which

26

are listed in here.

27

And then you give it the options for each of these test mode for this lecture we're going to be using

28

the option which is the authentication DOS mode.

29

So to see all the options and get more information about this attack we're going to do the K3 minus

30

minus help and then put the test mode which is a.

31

So I'm just going to do K3 minus minus help and I'm going to put a and this will give us more information

32

about the attack that we want to do so it's going to be an authentication those mood that's going to

33

send authentication frames to the AP.

34

So basically what it's going to do is we're going to specify a MYF address for our target and the K-3

35

will create fake mac addresses and get all of these MAC addresses to pretend as if their computers are

36

clients and these clients are trying to connect to that network when there is a very large number of

37

clients trying to connect to one network to one router.

38

Some routers will not be able to handle all this demand and they'll actually just restart and reset

39

everything.

40

And when they do that they'll unlock WPX and we'll be able to run river again.

41

So if you're on it if you're on indicator you with the option to do that on all the networks around

42

you.

43

So it's going to create a very large number of clients and it's going to get all of these clients to

44

connect to all the networks do you.

45

And we don't want that.

46

We only want to target one network.

47

So we're going to specify the target network with the minus option to specify the target mark.

48

And we're also going to use minus m to tell it that we want you to use valid Maxo marks of actual devices

49

instead of using a Mac that looks like it's fake like 000 000.

50

So let's run the command.

51

Let me show you the command that we're going to use and things are going to get more clear.

52

So the programs that we're going to use is called M.D K3.

53

Then we're going to give it the interface in monitor mode and it's 1 0.

54

In my case then we're going to give it the test mode or the attack mode and that's the authentication

55

DOS mode.

56

So that's going to be a and then we want to run that against only one specific router.

57

Not all routers.

58

So we're going to specify the minus a and give it the MAC address of my target's router which is the

59

same MAC address in here.

60

It's the same MAC address that's locked in here right here and then we're going to give it minus and

61

to tell it to use valid MAC addresses instead of just ones that look wrong.

62

So we're going to do minus.

63

And that's it we're ready to go.

64

So we're just going to go over the command one more time.

65

We're using a tool called M.D K3.

66

We're given at the interface in monitor mode.

67

In my case it's mon's euro Wartelle and we want to use the attack that's referred to with the option

68

which is the authentication DOS mode we're given it my target access point after the minus.

69

And then I'm giving it minus to use valid MAC addresses.

70

I'm going to hit enter and I actually misspelled M.D K-3 I said M-K D-3.

71

I do that a lot.

72

So it's MBK three hit enter

73

and you might see a result like this saying that the target computer see the target router does not

74

seem to be vulnerable but just let it work.

75

Sometimes you might have to let it work up to 50000 clients.

76

You can see that it's creating fake clients and it's trying to get them to connect to the router so

77

you can try to associate with the router really not connect and you can see that we reached 5000 clients

78

right here.

79

This could be different from one router to another.

80

So sometimes I had to let this go up to 50000.

81

In this case with my home router right here it usually resets between 5000 and 10000.

82

So I'm just going to let it go up to 10000 in this case.

83

And once it's 10000 like this I'm going to Control-C at the same time to get out of this and we're going

84

to run wash again to see if the network is still locked so you can see the last time around wash the

85

network was locked.

86

So I'm just going to give it some time to reset and then I'm just going to be run and wash the same

87

command that we always use this just wash minus.

88

I want zero and keep in mind this doesn't work against all routers but it works against a lot of routers

89

really but not all.

90

So it might not just work for you.

91

So I'm going to hit Enter now to look for networks around me.

92

Looks like something went wrong with my wireless card.

93

So I'm just going to disconnected reconnected enable monitor mode and run wash again.

94

OK so I'm just going to run wash again here.

95

And as you can see now our target network got reset and you can see that WPX is not locked anymore.

96

So I can actually start Rivara again and it will be able to pick up from where it left the last time.

97

So last time the pin count was left at 0 and right now if I run it again I'll be able to go to pin count

98

1 so I'll actually be able to test one more pin.

99

So if we just do revert again using the same command that we did before you can see that it's asking

100

me if I want to continue from where I left the last time I'm going to say yes please.

101

Now again the router got locked again.

102

Now what you can see that we managed to go ahead with one more pin to test one pin right now.

103

And if we do the same now get the router to unlock and do the same.

104

You'll be able to go to the next pin.

105

Now this network is actually a quite stubborn one usually networks lock after four or sometimes even

106

10 attempts.

107

Very rarely they lock after one attempt only.

108

But again this just serves with our examples.

109

The main thing is you can unlock most networks using this method use an empty K-3.