Welcome to part two of this module I'm rather excited because we finally made it to the first tool that
I ever used the legendary River back in the ancient days of the early to late 2000s River was a master
key that would allow you to hack into any Wi-Fi network pretty much without fail.
It came prepackaged with backtrack the precursor operating system to Cali Linux and many kids who had
no knowledge of penetration testing or ethical hacking fired up this application and got themselves
some free Wi-Fi.
It was a golden age for black hats as it required virtually no skill or finesse to use but the commands
used were arcane enough that it made you kind of feel like the real deal fortunately River is no longer
the instant win that it once was.
In fact your odds of hacking into a router with it are actually pretty low even though it can't possibly
fail against Most routers.
Did I just contradict myself as we'll see router security has come a long way since the old days and
now things are just a bit more complicated River is a good starting point for this module because it
was the starting point for many of us in the penetration business but in all honesty you may find its
usefulness somewhat limited.
I'm going to explain about how this works but first I want to get it started because this is one of
those tools that you just sort of start and allowed to run
in the last video we went over how to setup our Wi-Fi card in the monitor mode.
Change the MAC address and use aero dump energy to scan the area for access points.
For this reason I'm not going to reiterate all of those instructions here.
Please see the prior video for more details if you need to.
However briefly put I'm going to do airman G and this will show that I have two wireless cards for my
interface devices.
You don't really need to for this particular exercise but I'm going to be using the real tech w land
one which is the alpha card.
It has a better signal and it will perform a little bit better.
So I'm going to start out by doing I have config and I'm going to bring both interfaces down
and next I'm going to do Mac changer and this is absolutely something you should always do.
It's just a good habit to be in Mac changer TAC a for a random mac address.
You could assign any mac address you please but I'm just going to do a random one.
There we go.
The Alpha has a random MAC address
and now I'm gonna go ahead and I'm going to put the card into monitor mode.
But first men do Arum on energy check.
We can see that we have got some potentially problematic processes running so now.
Do airman Angie.
Check.
Kill to eliminate all of those
this might take a moment.
OK you didn't list that it was killing all the processes but they're not showing up.
Sometimes you need to check twice but it seems to have been done.
OK we're almost ready.
There are a couple of things I need to point out before we begin.
First and foremost many of these techniques demonstrated in this module will not work properly in virtual
box.
Realistically you need to have Calleigh installed on a partition or you need to be running it off a
U.S. B device with persistence.
You can also use a live C.D..
But if you don't have persistence you won't be able to resume your attack with river.
Should it be interrupted after you reboot or shut down your system.
Virtual Box unfortunately gets really quirky about network adapters and it just doesn't play well with
a lot of these Wi-Fi tools.
So if you do airman Angie in virtual box and you don't see your adapters listed.
Well I'm sorry.
That's a virtual box.
It's very problematic.
There may be ways around it.
It would really derail the class.
So I'm just going to proceed.
But keep this in mind you can't do this with virtual box for all practical purposes.
Second thing.
Many videos in this module will require you to have an injection capable card and I'll be speaking more
about this in the next video.
River does not require this.
However that being said having a strong card with a good range boosted by a powerful antenna will significantly
improve your capability with a river.
This is a radio based attack.
So the more powerful your radio the the better your performance is going to be.
Last thing it is illegal to use river to hack into your neighbor's Wi-Fi.
Never use this tool or any other tool to hack into anything that you do not personally own or have written
permission from the owner to penetration test in this module.
I'll be using an old net gear router that I inherited when we upgraded the office for demonstration
purposes.
So with all of that out of the way let's get started
whoops.
I've just brought up w land one into monitor mode two cards like I said are not required for this.
I'm just using the alpha for the stronger signal in older versions of Cowley and in backtrack a card
in monitor mode used to show up as either 1 0 or more on one or more on two et cetera in newer versions
of Cowley Mohn is simply appended to the name of the card.
In other words instead of more on one it is now w land one more on your exact interface name may vary.
For example it may be w land zero Mohn or w land to mourn or even something else entirely.
Now we're running arrow dump n g just as we did in the previous video we'll be pulling up our targets
mac address I.D. and channel
and there it is.
The demonstrations target in this video is named Sanjay Al please notice the power rating next to each
target.
The closer this number is to zero the better.
Generally speaking if your number is at minus 70 or below your attack will be significantly less effective.
In fact anything below minus 70 is pretty much guaranteed to be ineffective although it's not completely
impossible to succeed with a bad power level.
What it really means is you'll be dropping signal a lot and Reeva is going to have to reassess --
constantly with the access point and it will take a lot of extra time it'll it'll really drag the process
down.
If your signal strength is poor and you cannot get closer to your target use a more powerful wireless
card and or a better antenna such as for example a Yagi which can improve your signal strength considerably.
So we're going to copy the target MAC address now open another terminal just in case we need that information
again.
I'm going to call up river.
Here are all the switches that can be used with River and a use case example of how to initiate it.
I'll be starting a river and allowing it to run while I speak.
The first thing we want to do is try the simplest form of attack first which is the pixie dust attack.
This can be accomplished with either tack capital K or tack capital Z.
This attack almost never works against modern routers and it won't even work against this old net gear.
But I have seen it work more than I would like to see and if it does work you will get the router password
and the PIN number in a matter of seconds.
So always try the simplest approach first.
So to that end we're going to do River and we're going to use tack lowercase i to specify specify the
interface which is w land one mine in this case we're going to do tech B for the B SSI D that's lowercase
b and paste in the target's mac address and I will use Tak uppercase K and actually we could do it this
way.
But to save time I want to see with channel it's on channel 1.
Yeah.
Channel 1 so we will do Tak lowercase c and specify Channel 1 Tak F to prevent channel hopping and Tak
V V which is double verbose briefly stated you can use 1 v for just basic output that's called verbose
to these will give you extra information although it might be a little spammy and 3D will give you the
most output but it's usually a lot of unnecessary information and it tends to clutter up the screen
I'll just use to these for the moment
I'm not going to restore the previous session
as I said this attack will fail against this router right.
What river is doing here with pixie dust is attempting to exploit a WP s vulnerability that is present
in certain router models when it works.
It is an instant win for the hacker as both the router password and the pin number will be displayed.
Generally speaking pixie dust tends to be somewhat effective against rail link and real tech chipsets
although it rarely ever works against Broadcom.
As I said you can set it up so that this attack repeats several times or even loops and times you'll
succeed after multiple failures more often if it doesn't work on the first or second try.
It isn't going to although signal strength does play a role.
So repeating this attack multiple times will cause most modern routers to lock down which is something
I'll speak about more in a minute.
That's why I don't really recommend it.
I suggest you try pixie dust and if it doesn't work after one or two attempts it's just probably not
going to.
So now that our pixie dust attacks failed it's time to begin the brute forcing procedure.
So we're going to begin with Reaper attack lowercase i for interface w lan one morn we'll give it our
OBSS I d
and in this case I'm just going to do verbose in order to keep the amount of spam on the screen to a
minimum.
We don't really need to see every single NAC request and so forth.
So we hit enter not going to restore the prior session.
I did not specify a channel just to demonstrate that if you don't River will channel hop until it finds
your target it's only really worth remembering if you stop the attack and resume it later only to find
that your access point is no longer broadcasting on the same channel.
I've seen it happen of course in this case we were already it was already broadcasting on channel 1.
All right so let's break this down a bit.
So what is actually happening here.
Well as you can see this is yet another brute forcing method of breaking through security.
However it is really not possible to try to brute force every possible combination of the WPA to pass
key.
Well I should rephrase it's technically possible but doing so would be extremely time consuming.
We'll be looking at doing exactly that when we get to air crack energy.
But remember in penetration testing you always want to try the fastest and most direct method first.
So why is River faster.
Well some genius decided to include pin authentication into the security of most wireless routers.
If you have the PIN number for the router you basically own the network and can even obtain the passkey
in plain text.
So why was this Neolithic Li stupid.
Well the PIN code is just numbers.
This dramatically reduces the amount of time you have to spend guessing a password that could in theory
be over 20 characters long and completely random.
It reduces the number of combinations possible from the millions down to approximately 11000.
Considering that river splits the length of the pin code into two once it finds the first half finding
the second becomes even easier.
In all likelihood you won't even have to do eleven thousand combinations at all.
That being said this attack will not be quick.
The attack itself is not taking place locally on our system.
We aren't trying to crack a file.
Rather we are conducting this attack remotely river associates with the target wireless access point
and then proceeds to attack it in real time by trying to pass the pin codes one by one if any of them
walk out Reeva will tell us the successful pen and the password for the WPA key for that access point.
It's slow because it happens one code at a time but allowing it to run uninterrupted.
The process should only take between about ten to twelve hours.
Unfortunately I said at the start of this video that river is no longer the automatic win that it once
was for hackers and that is because router manufacturers have become a bit more savvy.
While pin codes remain enabled by default some routers particularly high end corporate models do allow
administrators to change or even outright disable pin codes.
Manufacturers have also instituted defense mechanisms against this sort of brute force approach in the
form of lockdowns.
Basically updated modern commercial routers tend to lock down after so many failed pin attempts per
so many minutes of real time these lockdowns prevent further pin guesses.
These lockdowns are automatic and generally lasts for a certain length of time which varies from router
to router.
Sometimes a lockdown will only last about 10 or 15 minutes.
Other times it can be over an hour.
I once came across a router that locked down for two full days although we have heard of a certain model
that locked down permanently.
I've yet to actually see this happen as it would be a major problem in terms of legitimate users authenticating
with the network and would make detoxing a network as easy as failing to associate with it a few times.
So the long and short of it is if your target locks down you're going to see the following message warning
detected AP rate limiting waiting 60 seconds before rechecking.
Now this old router isn't going to lock down in that way but this is what the message would look like
if it happened.
And this is basically the kiss of death.
It means that a direct guest by guests brute force attack against the target is going to be mind bogglingly
slow because if you only managed to get in let's say 5 to 10 guesses and then you'd have to wait out
the routers locked down which let's say lasts for an hour while you get the idea.
The process will take so long.
It's not going to be worth it.
And you may notice that Riva tries the same pin multiple times even if a lockdown has not happened and
this has to do with various factors including signal strength and the router just being finicky see
10 failed connections in a row it's trying the same number over and over again.
Now it will get past this eventually.
So I'm going to use control C and I'm going to stop River for the moment.
If you suspect that a router may have locked down on you because you see the same pin being tried over
and over.
You can use the wash command to check out its status
whoops sorry that's wash tech lowercase i w land one on interesting it hasn't locked down and controls
C will exit the wash scan here you can see the router status no.
Under lock.
Means that the router is still unlocked.
If this said yes that means you're out of luck for the moment and you're gonna have to wait out the
lock.
The question now becomes what can you do with River if you're up against an up to date router with proper
defenses that has the annoying habit of locking down on you fortunately River has a lot of options that
you can try to sidestep this and the best approach is going to vary from router router.
It's a good idea to look up the model of router you're up against to see which tactics work the best.
I can't cover every possible approach but we can look at this in broad terms as you see there are loads
of options that come with river.
These switches allow you to customize your attack and you will have to do this against most routers.
Even if you're able to find exact details online for a particular router model and find exactly what
worked for someone else against a particular chipset you may find that you still have to play around
a bit and fine tune things and how painful this ends up being will depend a great deal on the amount
of time your target stays locked down.
For one thing you may want to hide your attacks and I need to clarify and say that I don't mean you
need to hide who you personally are.
It is virtually impossible to track the source of a river attack as long as Mach changer has been used
to change your mac address.
As long as you're not associated with the network but just using your card for radio based attacks it's
functionally impossible to figure out who you are.
However masking the attack may help in the case of access points that have paranoia level security configurations.
One example might be to use the TAC lowercase w switch so as to mimic a Windows 7 registrar or use the
TAC capital N to specify that you don't want river to send a knack for any out of order packets which
in a very few instances has been known to tip off certain models that hey maybe where we are under attack.
This process that we're seeing looks automated better locked down so the real trick is going to be setting
up a delay between our pin guesses if we know that an access point will lock down after five failed
guesses per 60 seconds and stay locked down for an hour.
Then it makes sense to set a limit of two or three guesses per minute.
This will greatly increase the amount of time it takes to find the correct PIN.
As I said the delay for each model of router is going to be different and if you can't find a specific
number on line you're going to have to guess.
That being said black hat hackers have been known to use extremely cheap little devices such as a five
dollar Raspberry Pi loaded with Kali and attach a simple USP Wi-Fi dongle and leave it hidden somewhere
at a pen testing site to care or an attack site to carry out just such a process over a longer time
scale.
And of course the next door neighbor who's trying to steal your Wi-Fi is probably perfectly happy to
leave his computer on for a week until he gets the right pin number.
So to do this we're gonna do River interface that's tack lowercase i w land one more on tech B for the
B SSI D just the same we'll paste that in there
we're going to do tech R and we're gonna do two colon 60 so what this is doing is we're specifying two
guesses every 60 seconds notice that river gives us the the option to resume our prior session even
though we've changed the exact nature and structure of the command we're gonna do so again the delay
required is going to vary from router router but one of the points I want you to be aware of is that
there is always going to be a specific set delay.
Eventually this has to work because every router out there has a hard coded limitation on these things.
You have to basically say you have X number of tries in X amount of time before a lockout it's an if
then statement hardcoded into the firmware.
If X number of failed tries then locked down for X amount of time and they have to have a limit they
can't use infinite values as long as you are above those stated values.
This will work for you.
Some people have reverse engineered certain models of router and posted this information online.
If you can't find it then I'm sorry you're stuck with some trial and error.
See when it works when it does not work and tweak your settings up or down accordingly until you find
the fastest possible timing that works for your target.
Like I said eventually you will succeed.
However the amount of time this method requires and the requirement that your attacking system and card
be within a certain proximity to the target may render this entire approach in viable in certain cases
and I forgot to save verbose song.
Stop this I'm going to add verbose and I'm going to resume because that made for a boring screen and
I apologize.
We can see that it is in fact working of all the possible eleven thousand combinations zero point three
six percent have been tried so far.
If I stop it and put it into double verbose
it'll make for more interesting spam.
So in the old days black hat hackers would actually park outside of financial institutions that had
weak routers and run river from the comfort of their car since the attack could be resumed they could
do this on their lunch hour then resume the attack the next day and the next and the next and so on
until eventually they got the correct PIN.
As I said uninterrupted eleven thousand combinations will take about 10 to 12 hours in total although
it can get lucky and hit the correct PIN on the very first try.
You never know but when the required delay becomes gargantuan it may not be realistic to conduct such
an attack over a timescale of weeks or even months.
Remember also that many routers allow a system administrator to change their PIN number as easily as
pushing a button and and a protracted attack over a long timescale is a lot more likely to be detected
in the router logs even if they can't zero in on the attacker through any conventional method.
A security professional who knows how river works and sees the same person within range of the access
point every day with a laptop can often put two and two together this is why a river while still a powerful
and dangerous tool is no longer ideal for all penetration testing scenarios.
All security professionals should acquaint themselves with how it works because if the attack is detected
they need to know what to do next.
Disabling pin authentication is a sure fire defense against river though many routers do not allow that
changing the pin every single day or even every hour.
And yes I have seen some administrators do that.
Can also make river attacks pretty pointless.
Then of course if you are an administrator and you see all of these failed Penn attempts you might start
looking through security cameras to see who is nearby with a laptop and maybe a wireless card.
You might also look around for small devices like Raspberry Pis or cheap little Android devices hidden
behind desks or near concealed power outlets and remember that having the PIN code means that you have
the password until the pin for that router is changed or removed completely.
All you need to do if the password is changed is run river using the already guessed pin.
Now I could let river finish its at zero point fifty five percent but I don't think we want to sit here
for 10 hours so I'm going to stop this session and I'm I'm going to use river tech.
I specify the interface and give it the target once again and this time we're gonna say TAC lowercase
P for the pin and this one is for 3 4 1 3 7 7 5.
I've cracked this before loops double verbose and I'll take just a minute.
I think I mistyped the pin number because it jumped to ninety point nine one percent.
Let's stop this.
Which by the way is what happens.
It can go from 5 percent to ninety nine percent if it gets close to the correct PIN c 4 3 4 and there
we go the password gave us the plain text passkey and it's just as simple as that.
And no matter what the password is changed to as long as the pin number remains the same.
And as long as you have that pin you can always get the password in plaintext or even log in directly
to the router itself so River does still work.
It's no longer the master key that it used to be it's more like a set of really good luck picks.
It requires a bit of finesse to get it to work right but given enough time and patience eventually it
will work for you.
So I hope this tutorial was helpful.
As I said river was my first tool.
It's an excellent one but as we approach 2020 and beyond it probably won't be your first choice for
Wi-Fi hacking as we continue with this module we'll be looking at other methods of Wi-Fi hacking some
of which can be done off line without having to remain in protracted contact with the access point.
So have fun penetration testing your own personal router that you own and I'll see you in the next video.
Thank you.