feature request: add NONCE ERROR CORRECTIONS to hcxpmktool

[RaduNico]

I've encountered the following hash for which hashcat and hcxpmktool seem to disagree on what the correct PSK is.

WPA*02*c344678f5dffe6b2adb6e2bfbcf9a3d5*5a59ef3d5a0d*00082286fbfb*6950686f6e65202d204b4f5a*96c4775604afb7eaa46c9d91404e756f44ac5ca383a6345aacf2474d81a9a095*0103007502010a000000000000000000014647b5667f88fce5260ec391153c1dc0055c83b5226a3ff0dd6a09bcdc2f191c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001630140100000fac040100000fac040100000fac020000*a0

Running hashcat on this hash result in hashcat returining 12345678 as the PSK for it, while hcxpmktool -l <hash> -p 12345678 is returning MIC not confirmed with a status return code of 2.

Is this a hashcat bug?

[ZerBea]

Interesting case, because I have no idea what's going on, yet.
We take the hash from Yesterday:

$ hcxpmktool -l WPA*02*039e9239445d7895309a3b92118d9a2f*482cd00afa2c*dc5360ad926f*4c6576692042792047656f726765*aedd076acec4b077786a3eea7d0ec51a6d0f8377d285ca10e3f8a38bd8170b16*0103008702010a000000000000000000015ac167d0bbbdcf3d23eff8d9ef3c532d8fe5e7f2f217a62f1da3e270d268888c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002830260100000fac040100000fac040100000fac023c00010000000000000000000000000000000000*02 -p 12345678

HASH FORMAT.: EAPOL (WPA*02)
ESSID.......: Levi By George
MAC_AP......: 482cd00afa2c
MAC_CLIENT..: dc5360ad926f
PSK.........: 12345678
PMK.........: 2a4e469fdfb79f8d98b706ef659069f42e2dfe09557e4a534c8c43c9e2cc2e29 (calculated)
KEY VERSION.: WPA2
NONCE AP....: aedd076acec4b077786a3eea7d0ec51a6d0f8377d285ca10e3f8a38bd8170b16
NONCE CLIENT: 5ac167d0bbbdcf3d23eff8d9ef3c532d8fe5e7f2f217a62f1da3e270d268888c
PTK.........: 3223638bdc6bc27fc7fda2be3a4cbadf609829b96f6e00482cd00afa2cdc5360 (calculated)
KCK.........: 3223638bdc6bc27fc7fda2be3a4cbadf (calculated)
KEK.........: 609829b96f6e00482cd00afa2cdc5360 (calculated)
MIC.........: 039e9239445d7895309a3b92118d9a2f (confirmed)
PMKID.......: d236e7e399ffcca22f0e6f5bffa0f481 (calculated)

hcxpmktool confirmed the PSK

$ echo "WPA*02*039e9239445d7895309a3b92118d9a2f*482cd00afa2c*dc5360ad926f*4c6576692042792047656f726765*aedd076acec4b077786a3eea7d0ec51a6d0f8377d285ca10e3f8a38bd8170b16*0103008702010a000000000000000000015ac167d0bbbdcf3d23eff8d9ef3c532d8fe5e7f2f217a62f1da3e270d268888c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002830260100000fac040100000fac040100000fac023c00010000000000000000000000000000000000*02" > test.hc22000

$ hashcat -m 22000 test.hc22000 -a3 12345678
hashcat (v6.2.6-597-g2d6035982) starting
...
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 22000 (WPA-PBKDF2-PMKID+EAPOL)
Hash.Target......: test.hc22000
Time.Started.....: Wed Jun 21 07:55:26 2023 (0 secs)
Time.Estimated...: Wed Jun 21 07:55:26 2023 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Mask.......: 12345678 [8]
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:       93 H/s (0.41ms) @ Accel:64 Loops:256 Thr:32 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 1/1 (100.00%)
Rejected.........: 0/1 (0.00%)
Restore.Point....: 0/1 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: 12345678 -> 12345678
Hardware.Mon.#1..: Temp: 42c Fan:  0% Util: 60% Core:2850MHz Mem:10802MHz Bus:16

Started: Wed Jun 21 07:55:25 2023
Stopped: Wed Jun 21 07:55:27 2023

hashcat confirmed the PSK

$ hcxhashtool -i test.hc22000 --john=test.john

OUI information file..........: /home/zerobeat/.hcxtools/oui.txt
OUI entries...................: 33772
total lines read..............: 1
valid hash lines..............: 1
EAPOL hash lines..............: 1
EAPOL written to john.........: 1


$ john --no-log --mask=1234567?d --format=wpapsk-opencl --pot=john.wpa.pot test.john
Device 1@tux1: NVIDIA GeForce RTX 4080
Using default input encoding: UTF-8
Loaded 1 password hash (wpapsk-opencl, WPA/WPA2/PMF/PMKID PSK [PBKDF2-SHA1 OpenCL])
Note: Minimum length forced to 8 by format
LWS=256 GWS=4980736 (19456 blocks) 
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
Warning: Only 10 candidates buffered, minimum 4980736 needed for performance.
12345678         (Levi By George)     
1g 0:00:00:00  16.67g/s 166.7p/s 166.7c/s 166.7C/s Dev#1:38°C 12345671..12345677
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 

john confirmed the PSK

Same procedure with the new hash:

$ hcxpmktool -l WPA*02*c344678f5dffe6b2adb6e2bfbcf9a3d5*5a59ef3d5a0d*00082286fbfb*6950686f6e65202d204b4f5a*96c4775604afb7eaa46c9d91404e756f44ac5ca383a6345aacf2474d81a9a095*0103007502010a000000000000000000014647b5667f88fce5260ec391153c1dc0055c83b5226a3ff0dd6a09bcdc2f191c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001630140100000fac040100000fac040100000fac020000*a0 -p 12345678

HASH FORMAT.: EAPOL (WPA*02)
ESSID.......: iPhone - KOZ
MAC_AP......: 5a59ef3d5a0d
MAC_CLIENT..: 00082286fbfb
PSK.........: 12345678
PMK.........: a90370759a18f98616fd23b76f98c06011b7efbfa3c2ac0c56281e407d5a1d3b (calculated)
KEY VERSION.: WPA2
NONCE AP....: 96c4775604afb7eaa46c9d91404e756f44ac5ca383a6345aacf2474d81a9a095
NONCE CLIENT: 4647b5667f88fce5260ec391153c1dc0055c83b5226a3ff0dd6a09bcdc2f191c
PTK.........: ab5b0ebba465ddda172de0e9600c7539a2227f196f6e0000082286fbfb5a59ef (calculated)
KCK.........: ab5b0ebba465ddda172de0e9600c7539 (calculated)
KEK.........: a2227f196f6e0000082286fbfb5a59ef (calculated)
MIC.........: c344678f5dffe6b2adb6e2bfbcf9a3d5 (not confirmed)

hcxpmktool doesn't confirm the PSK

$ echo "WPA*02*c344678f5dffe6b2adb6e2bfbcf9a3d5*5a59ef3d5a0d*00082286fbfb*6950686f6e65202d204b4f5a*96c4775604afb7eaa46c9d91404e756f44ac5ca383a6345aacf2474d81a9a095*0103007502010a000000000000000000014647b5667f88fce5260ec391153c1dc0055c83b5226a3ff0dd6a09bcdc2f191c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001630140100000fac040100000fac040100000fac020000*a0" > test.hc22000

$ hashcat -m 22000 test.hc22000 -a3 12345678
hashcat (v6.2.6-597-g2d6035982) starting
...
c344678f5dffe6b2adb6e2bfbcf9a3d5:5a59ef3d5a0d:00082286fbfb:iPhone - KOZ:12345678
                                                          
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 22000 (WPA-PBKDF2-PMKID+EAPOL)
Hash.Target......: test.hc22000
Time.Started.....: Wed Jun 21 08:02:13 2023 (0 secs)
Time.Estimated...: Wed Jun 21 08:02:13 2023 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Mask.......: 12345678 [8]
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:       69 H/s (0.49ms) @ Accel:8 Loops:256 Thr:256 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 1/1 (100.00%)
Rejected.........: 0/1 (0.00%)
Restore.Point....: 0/1 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: 12345678 -> 12345678
Hardware.Mon.#1..: Temp: 39c Fan:  0% Util: 20% Core:2505MHz Mem:10802MHz Bus:16

Started: Wed Jun 21 08:02:12 2023
Stopped: Wed Jun 21 08:02:13 2023

hashcat confirm the PSK

$ hcxhashtool -i test.hc22000 --john=test.john

OUI information file..........: /home/zerobeat/.hcxtools/oui.txt
OUI entries...................: 33772
total lines read..............: 1
valid hash lines..............: 1
EAPOL hash lines..............: 1
EAPOL written to john.........: 1


$ john --no-log --mask=1234567?d --format=wpapsk-opencl --pot=john.wpa.pot test.john
Device 1@tux1: NVIDIA GeForce RTX 4080
Using default input encoding: UTF-8
Loaded 1 password hash (wpapsk-opencl, WPA/WPA2/PMF/PMKID PSK [PBKDF2-SHA1 OpenCL])
Note: Minimum length forced to 8 by format
LWS=256 GWS=311296 (1216 blocks) 
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
Warning: Only 10 candidates buffered, minimum 311296 needed for performance.
0g 0:00:00:00  0g/s 1000p/s 1000c/s 1000C/s Dev#1:39°C 12345671..12345677
Session completed. 

john doesn't confirm the PSK, too.

To make sure that the hash line is correct (hcxpcapngtool bug?), could you add the dump file, please?
You can remove all frames except BEACON, EAPOL M1 and EAPOL M2 to make sure the has line is converted correctly.

[ZerBea]

I'll contact Atom (hashcat) to figure out, what went wrong. My suspect is the hash line calculated by hcxpcapngtool - but I'm not sure without analyzing the dump file.

[ZerBea]

I got it!

The difference between hashcat and hcxpmktool and hashcat is that
hashcat is doing NONCE ERROR CORRECTIONS (NC)
https://hashcat.net/forum/thread-6361.html

hcxpcapngtool converted the MESSAGEPAIR to hashcat, but due to a packet loss, NONCEERROR CORRECTION is mandatory to recover th PSK.

Neither hcxpmktool nor john doing NC, so both will not get the PSK.
If you do NC by hand, hcxpmktool and jtr get the correct PSK

received ANONCE: 96c4775604afb7eaa46c9d91404e756f44ac5ca383a6345aacf2474d81a9a095
corrected ANONCE: 96c4775604afb7eaa46c9d91404e756f44ac5ca383a6345aacf2474d81a9a094

$ hcxpmktool -l WPA*02*c344678f5dffe6b2adb6e2bfbcf9a3d5*5a59ef3d5a0d*00082286fbfb*6950686f6e65202d204b4f5a*96c4775604afb7eaa46c9d91404e756f44ac5ca383a6345aacf2474d81a9a094*0103007502010a000000000000000000014647b5667f88fce5260ec391153c1dc0055c83b5226a3ff0dd6a09bcdc2f191c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001630140100000fac040100000fac040100000fac020000*a0 -p 12345678

HASH FORMAT.: EAPOL (WPA*02)
ESSID.......: iPhone - KOZ
MAC_AP......: 5a59ef3d5a0d
MAC_CLIENT..: 00082286fbfb
PSK.........: 12345678
PMK.........: a90370759a18f98616fd23b76f98c06011b7efbfa3c2ac0c56281e407d5a1d3b (calculated)
KEY VERSION.: WPA2
NONCE AP....: 96c4775604afb7eaa46c9d91404e756f44ac5ca383a6345aacf2474d81a9a094
NONCE CLIENT: 4647b5667f88fce5260ec391153c1dc0055c83b5226a3ff0dd6a09bcdc2f191c
PTK.........: 67f573d3b32cb364c29b9c5823364b6f3e04616d6f6e0000082286fbfb5a59ef (calculated)
KCK.........: 67f573d3b32cb364c29b9c5823364b6f (calculated)
KEK.........: 3e04616d6f6e0000082286fbfb5a59ef (calculated)
MIC.........: c344678f5dffe6b2adb6e2bfbcf9a3d5 (confirmed)
PMKID.......: 9c53c1e57e70c6cc9cf4e45cd459c082 (calculated)

hcxpmktool confirmed the PSK (using the corrected ANONCE)

$ john --no-log --mask=1234567?d --format=wpapsk-opencl --pot=john.wpa.pot test.john
Device 1@tux1: NVIDIA GeForce RTX 4080
Using default input encoding: UTF-8
Loaded 2 password hashes with no different salts (wpapsk-opencl, WPA/WPA2/PMF/PMKID PSK [PBKDF2-SHA1 OpenCL])
Note: Minimum length forced to 8 by format
LWS=256 GWS=155648 (608 blocks) 
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
Warning: Only 10 candidates buffered, minimum 155648 needed for performance.
12345678         (iPhone - KOZ)     
1g 0:00:00:00  14.29g/s 142.9p/s 142.9c/s 285.7C/s Dev#1:52°C 12345671..12345677
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 

john confirmed the PSK (using the corrected ANONCE)

All tools (hashcat with NC), john (without NC), hcxpmktool (without NC) doing exactly what expected.

I'll add a notice to help, that hcxpmktool not doing NC.

I'll leave this open to remind me to check if it is possible to add NC on CPU to hcxpmktool, because it will slow down us.

[ZerBea]

I changed the head line, because it is more a feature request than a bug.

Now I test if we can add at least NC = 8.

The impact is huge, because it will slow us down by factor 32 (8 + 8 + 8 + 8), because we have to calculate the PTK 32 times and the MIC times instead of one time:
BIG ENDIAN ROUTER NC + 8
BIG ENDIAN ROUTER NC - 8
LITTLE ENDIAN ROUTER NC + 8
LITTLE ENDIAN ROUTER NC - 8

[ZerBea]

Adding NC will take awhile. The entire tools must be refactored.

[RaduNico]

Do you still require the initial capture which generated this hash?

[ZerBea]

No, that is not necessary, because I know what's going on:

packet loss during capturing
hcxpcapngtool converted the hash and detected MESSAGEPAIR CONDITION a0 (bin: 10100000 = nonce-error-corrections mandatory)

In detail:

000 = M1M2 challenge
0 = reserved
0 = no ap-less attack
1 = LITTLE ENDIAN ROUTER detected
0 = BIG ENDIAN ROUTER not detected
1 = not replaycount checked (set to 1) - replaycount not checked, nonce-error-corrections mandatory

PSK can be only confirmed/recovered by a tool that does NONCE ERROR CORRECTIONS (like hashcat).

explanation of the MESSAGEPAIR field:

bitmask of EAPOL hash line (WPA*02) message pair field:
2,1,0:
 000 = M1+M2, EAPOL from M2 (challenge)
 001 = M1+M4, EAPOL from M4 (authorized) - usable if NONCE_CLIENT is not zeroed 
 010 = M2+M3, EAPOL from M2 (authorized)
 011 = M2+M3, EAPOL from M3 (authorized) - unused
 100 = M3+M4, EAPOL from M3 (authorized) - unused
 101 = M3+M4, EAPOL from M4 (authorized) - usable if NONCE_CLIENT is not zeroed
3: reserved
4: ap-less attack (set to 1) - nonce-error-corrections not required
5: LE router detected (set to 1) - nonce-error-corrections required only on LE
6: BE router detected (set to 1) - nonce-error-corrections required only on BE
7: not replaycount checked (set to 1) - replaycount not checked, nonce-error-corrections mandatory

Which tool was used to capture the traffic?
Which command line options are used to convert the hash?

[RaduNico]

hcxdumptool was used to capture the traffic
the hash was converted using hcxpcapngtool -o capture_0005.pcapng

[ZerBea]

Thanks for the information.
Now we know that hcxdumptool and hcxpcapngtool are working as expected. We gt a hash and hashcat was able to recover the PSK (with NC).
hcxpmktool and JtR couldn't recover the PSK, because both do not NC.

Conclusion:
hcxpmktool should get NC.

[kimocoder]

Confirmed. Works in wifite2 v2.7.0 also. password recovered with both "hashcat" and "cowPatty".

[ZerBea]

Doing NC is a little bit tricky (on CPU), because we need several load balancers:
PBKDF2 load balancer
MD5 load balancer (WPA1)
SHA1 load balancer (WPA2)
SHA256 load balancer (WPA2 key version 3)
HMAC SHA1 load balancer (WPA1 WPA2)
AES128-CBC load balancer (WPA2 key version 3)

Additional we need a good (fast) data base.

All together == complete new design of hcxpmktool.

[ZerBea]

As of today all hcxtools only detect if NC is possible and hcxdumptool give a suggestion about the value.
This is done by comparing different EAPOL M1 and/or EAPOL M3 messages.
This will only be possible if the dump file contain more than one different EAPOL M1 and/or EAPOL M3 messages.
If an AP increase its ANONCE, hcxpcapngtool is able to detect a packet loss and hashcat is able to compensate it.
If a packet loss is detected, hcxpcapngtool set bit 5, 6, 7 (of the MESSAGE PAIR FIELD) dependent on the type of the router (BE/LE):

4: NC (set to 1) - nonce-error-corrections deactivated on M1M2ROGUE, M2M3E3 and M3M4E3
5: LE router detected (set to 1) - nonce-error-corrections required only on LE
6: BE router detected (set to 1) - nonce-error-corrections required only on BE
7: NC (set to 1) - nonce-error-corrections activated

This bitmask is explained in help:

$ hcxpcapngtool --help
bitmask of EAPOL hash line (WPA*02) message pair field:
2,1,0:
 000 = M1+M2, EAPOL from M2 (challenge)
 001 = M1+M4, EAPOL from M4 (authorized) - usable if NONCE_CLIENT is not zeroed 
 010 = M2+M3, EAPOL from M2 (authorized)
 011 = M2+M3, EAPOL from M3 (authorized) - usable by option --all
 100 = M3+M4, EAPOL from M3 (authorized) - usable by option --all
 101 = M3+M4, EAPOL from M4 (authorized) - usable if NONCE_CLIENT is not zeroed
3: reserved
4: NC (set to 1) - nonce-error-corrections deactivated on M1M2ROGUE, M2M3E3 and M3M4E3
5: LE router detected (set to 1) - nonce-error-corrections required only on LE
6: BE router detected (set to 1) - nonce-error-corrections required only on BE
7: NC (set to 1) - nonce-error-corrections activated

Hashcat evaluate this bits to handle NC exactly.

$ hashcat --help
 --nonce-error-corrections  | Num  | The BF size range to replace AP's nonce last bytes   | --nonce-error-corrections=16

Additional hcxpcapngtool give an advice:
REPLAYCOUNT gap (suggested NC)...........: 1

The value can be used with hashcat "--nonce-error-corrections=".
Please notice that this suggestion is an approximate value only, because it highly depend on the quality of the dump file.

[ZerBea]

BTW:
I'm still undecided to add NC to hcxpmktool, because this tool is not a cracking tool.
Hashcat and JtR can do this a hundred thousand better and faster.
The only purpose of hcxpmktool is to detect if a MESSAGE PAIR exactly matched to a given PSK/PMK.