AngryOxide cannot capture 4wHS from old TP-Link router

[PSLLSP]

AngryOxide 0.8.28.

I see a mystery. I tried hard but it seems like AngryOxide cannot capture 4wHS from my old TP-Link router, TP-Link TL-WR-741ND v1. It is 150 Mbps 802.11n with a single antenna. I have one Linux PC connected to the router WiFi. I tried several times manually connect and disconnect WiFi but it seems like AngryOxide cannot see it. When AngryOxide runs attack, I see that PC is disconnected but 4wHS is not captured. I tried targeted attack and I get just nothing...

On the other side, capture of 4wHS from routers running OpenWRT is a simple task, it just works. Even commercial routers based on OpenWRT, like GL.iNet Mango, are vulnerable and AngryOxide captures 4wHS in a minute.

So I wonder why 4wHS from old TP-Link device with firmware from 2019 cannot be recorded. Is there a bug in the AngryOxide? Or does TP-Link firmware uses some trick to resist this kind of attack?

I was going to upgrade this old TP-Link device to OpenWRT or Gargoyle but this result is confusing and it seems like it is safer to stay away from OpenWRT and keep original firmware... My observation is that most commercial routers are immune against AngryOxide but OpenWRT routers are vulnerable. I believed that it was opposite and I try to find what is wrong with OpenWRT routers...

[Ragnt]

Could you provide me a pcap recording of this? I would need to dig into it and identify where the issue resides, but it sounds like it is certainly an AO bug.

…

On Thu, Feb 13, 2025 at 8:33 AM, PSLLSP ***@***.***(mailto:On Thu, Feb 13, 2025 at 8:33 AM, PSLLSP <<a href=)> wrote: AngryOxide 0.8.28. I see a mystery. I tried hard but it seems like AngryOxide cannot capture 4wHS from my old TP-Link router, TP-Link TL-WR-741ND v1. It is 150 Mbps 802.11n with a single antenna. I have one Linux PC connected to the router WiFi. I tried several times manually connect and disconnect WiFi but it seems like AngryOxide cannot see it. When AngryOxide run attack, I see that PC is disconnected but 4wHS is not captured. I tried targeted attack and I get just nothing... On the other side, capture of 4wHS from routers running OpenWRT is a simple task, it just works. Even commercial routers based on OpenWRT, like GL.iNet Mango, are vulnerable and AngryOxide captures 4wHS in a minute. So I wonder why 4wHS from old TP-Link device with firmware from 2019 cannot be recorded. Is there a bug in the AngryOxide? Or does TP-Link firmware uses some trick to resist this kind of attack? I was going to upgrade this old TP-Link device to OpenWRT but this result is confusing and it seems like it is safer to stay away from OpenWRT and keep original firmware... My observation is that most commercial routers are immune against AngryOxide but OpenWRT routers are vulnerable. I believed that it was opposite and I try to find what is wrong with OpenWRT routers... — Reply to this email directly, [view it on GitHub](#53), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/AF4YMEVBKH5KSG7CLS3CUXD2PSNMLAVCNFSM6AAAAABXCGJXEGVHI2DSMVQWIX3LMV43ASLTON2WKOZSHA2TCMBVHE3DINI). You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[Ragnt]

FWIW, in all of the usage and testing commercial routers are certainly not immune to AO, and if your device is disconnecting then the attack is working, but the issue is that AO is not correctly capturing/parsing the EAPOL. Most likely the frames are not being parsed correctly due to error, potentially causing a silent short circuit in the logic.

If you send a PCAP of this interaction (to include the manual disconnect/reconnect) both provided by AO and through another tool (wireshark, even) then I can hopefully identify the issue.

I'm always looking to improve the attacks and reliability of the tool against different devices, and have improved it with bug reports like this over many iterations.

[PSLLSP]

This time AO was successful but it needed many tries and I give it my full support. First it captured 4wHS from LTE USB dongle, it was an easy, it captured 4wHS on the first try. Old TP-Link has SSID Charlie741 and I started AO with sudo ./angryoxide -i mywifidongle -t Charlie741. After several minutes I activated "target lock" and AO switched to channel 9 but it still needed many tries to capture full 4wHS sequence, so I guess it was just a lucky hit. I tried similar attack yesterday for several hours and it was not successful.

I would like to remove this file ASAP you get your copy...

[Ragnt]

Got it, and removed your file. Thanks, I'll dig in and see if there is anything here that I can use to optimize

[Ragnt]

Based on those files, I see some strange occurances, namely:

You captured a valid authorized pair (M2/M3) from the AP and a client ending with a9:dd:c3 one time. There was multiple attempts, but you only captured the client-side on all of them. With a RSSI of -69 on the good attempt, it clearly isn't an issue with seeing it, and I would assume that the issue is related to the parsing of the EAPOL that the Tp-Link is producing (or channel hopping). It's hard to troubleshoot with this capture however, as if it failed to parse it won't be present in this recording. I would need a raw recording done with a third-party tool simultaneously to compare and figure out why it is failing.

You did captured a massive amount of what looks to be Rogue-M2 between AO (running on xx:xx:xx:06:e9:57 and a client ending in a7:b9:df).

These will appear as a separate AP in the list, as the Mac is NOT the same as the, but they are valid challenge pairs for your target network, and cracking them will result in a PSK that is very likely to be accurate.

You can read more about that attack here:

Wiki Page

[PSLLSP]

I noticed that TP-link device runs in 40MHz width channel mode, WiFi analyzer running at Android phone shows channel as 4+5. TP-link is configured in "Auto" mode, for channel and channel width.

I captured some WiFi traffic, channel was configured to 4. AO was configured to capture on channel 4. Wireshark was running on different PC than AO...

[Ragnt]

Thank you! I'll take a look.

I removed your file for you.