2X PMKID

S83ik12

Active member
Feedback: 0 / 0 / 0
Joined
Dec 30, 2019
Messages
124
Reaction score
0
Credits
0
ESSID: HUAWEI-NDHT1E
BSSID: 44:6e:e5:17:f3:98
PMKID: 00000098fcffbb6cff9b60e111a0b5f7*446ee517f398*087808809d76*4855415745492d4e4448543145
pmkid2: 80f2ffffffffff7ffaffffffffffffff*446ee517f398*087808809d76*4855415745492d4e4448543145
could be 8-10 digits or some Croatian wordlist
 

pasnger57

Active member
Contributor
Feedback: 4 / 0 / 0
Joined
Dec 30, 2019
Messages
3,531
Reaction score
1,126
Credits
7,291
hummmm..... pmkid2: 80f2ffffffffff7ffaffffffffffffff*446ee517f398*087808809d76*4855415745492d4e4448543145
this hash has a Sting that is very obvious rearing
as if the pw is repeating the same tow or just a single charters over and over
 

freeroute

Community Manager
Staff member
Community Manager
Super Moderator
Trusted
Feedback: 8 / 0 / 0
Joined
Dec 30, 2019
Messages
22,845
Reaction score
4,901
Credits
22,166
"Bad" PMKIDs. Could you send me which device has used to capture the PMKIDs, pls? It would be helpful, if we know what kind of device has used.
If we are able to identify chipset and driver, we can make an issue report.
Thank you very much.
 

freeroute

Community Manager
Staff member
Community Manager
Super Moderator
Trusted
Feedback: 8 / 0 / 0
Joined
Dec 30, 2019
Messages
22,845
Reaction score
4,901
Credits
22,166
Explanation of this behavior:
In monitor mode the adapter does not check to see if the cyclic redundancy check (CRC) values are correct for packets captured, so some captured packets may be malformed.
The device is able to detect the Physical Layer Convergence Procedure preamble and is able to synchronize to it, but there is a bit error in the payload.
This can lead to unexpected results.
By latest commit, hcxpcapngtool will detect some kinds malformed packets (unfortunately not all) and inform the user in Wireshark manner:

...
malformed packets (total)..............: 266
BROADCAST MAC error (malformed packets): 163
IE TAG length error (malformed packets): 54
ESSID error (malformed packets.........: 35
EAPOL messages (malformed packets).....: 23

Malformed packets detected!
"In monitor mode the adapter does not check to see if the cyclic redundancy check (CRC)
values are correct for packets captured. The device is able to detect the Physical Layer
Convergence Procedure (PLCP) preamble and is able to synchronize to it, but there is a
bit error in the payload. This can lead to unexpected results."
Please analyze the dump file with Wireshark.
 

S83ik12

Active member
Feedback: 0 / 0 / 0
Joined
Dec 30, 2019
Messages
124
Reaction score
0
Credits
0
"Bad" PMKIDs. Could you send me which device has used to capture the PMKIDs, pls? It would be helpful, if we know what kind of device has used.
If we are able to identify chipset and driver, we can make an issue report.
Thank you very much.
I used acer aspire 5 on win 10 , using commview. I got a new PMKID and hccapx using the same laptop but on kali with wifi-autopwner hopefully they are good?
PMKID: aaead8ec11a79f42ae00be933b5f2e67*446ee517f398*f47def07cebb*4855415745492d4e4448543145
WPA*01*aaead8ec11a79f42ae00be933b5f2e67*446ee517f398*f47def07cebb*4855415745492d4e4448543145***
 

S83ik12

Active member
Feedback: 0 / 0 / 0
Joined
Dec 30, 2019
Messages
124
Reaction score
0
Credits
0
hccapx 0 authenticated ,not good.

Edit: attached new authenticated hccapx
 

Attachments

  • 65586637fa.hccapx.zip
    368 bytes · Views: 5
Last edited:

freeroute

Community Manager
Staff member
Community Manager
Super Moderator
Trusted
Feedback: 8 / 0 / 0
Joined
Dec 30, 2019
Messages
22,845
Reaction score
4,901
Credits
22,166
I used acer aspire 5 on win 10 , using commview. I got a new PMKID and hccapx using the same laptop but on kali with wifi-autopwner hopefully they are good?
PMKID: aaead8ec11a79f42ae00be933b5f2e67*446ee517f398*f47def07cebb*4855415745492d4e4448543145
WPA*01*aaead8ec11a79f42ae00be933b5f2e67*446ee517f398*f47def07cebb*4855415745492d4e4448543145***
Thanks for your reply. We have to examine it. I'll send you the result soon.
 
Top