2

As you may know, WiFi Protected Setup (WPS) has recently been broken.

I downloaded and tested Reaver-WPS, the tool that implements the WPS attack. The tool's README file states:

Reaver performs a brute force attack against an access point's WiFi Protected
Setup pin number. 
Once the WPS pin is found, the WPA PSK can be recovered and alternately the
AP's wireless settings can be reconfigured.

While Reaver does not support reconfiguring the AP, this can be accomplished
with wpa_supplicant once the WPS pin is known.

I managed to find the AP's WPS pin without any problem (it took about 4 hours).

I would now like to try to reconfigure the AP's wireless settings using wpa_supplicant. I tried to find how to do this in wpa_supplicant's man page, but there's no mention of WPS. I tried to Google this, but I could not find anything.

Does anyone know how to reconfigure an AP's wireless settings with wpa_supplicant (or any other tool) knowing the AP's WPS pin?

BTW, what does the WPS protocol itself allow you to reconfigure? Just the WPA passphrase? Or even the SSID or other parameters?

Please don't think that I'm trying to hack my neighbour's network. This is purely a professional research (measuring the risk for my company and our customers).

Thank you very much.

3
  • Ever since WPS came out i disabled it because it was obvios to this brute force problem, and its not used in public places any way because its crap. Just use a WPA2 password.. or if you dont trust that use MAC filtering
    – Piotr Kula
    Jan 9, 2012 at 12:29
  • Yes, I agree, I have already sent out this warning to all our customers, but I wanted to get a better understanding of what's possible.
    – MiniQuark
    Jan 10, 2012 at 10:18
  • for your answer, once you are secured in the network you can access the router. So its good practice to put a strong password on the router admin login! allot of routers are just "enter" and your in.. then there is nothing stopping you from reeking havock. But if you cannot loginto the router, then you will need to hack it..and that means you will need to find out the make,model of it..not that simple unless you have years or experience. But once in the network, damage can be done to unprotected computers, using aggressive ip/port scanners and netbios hacks and other nasty things.
    – Piotr Kula
    Jan 10, 2012 at 21:33

1 Answer 1

2

I asked Craig Heffner, the author of the Reaver-WPS tool, and he kindly answered this (slightly edited for readability):

Start wpa_supplicant then connect to it using wpa_cli. It would look something like this:

wpa_supplicant -Dwext -iwlan1 -g /var/run/wpa_supplicant
wpa_cli -g /var/run/wpa_supplicant

Then at the wpa_cli prompt you can use the wps_reg command to reconfigure the AP. There's a README-WPS file that mentions all the wps_reg options:

wpa_cli wps_reg <AP BSSID> <AP PIN> <new SSID> <auth> <encr> <new key>
examples:
  wpa_cli wps_reg 02:34:56:78:9a:bc 12345670 testing WPA2PSK CCMP 12345678
  wpa_cli wps_reg 02:34:56:78:9a:bc 12345670 clear OPEN NONE ""

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .