OpenWrt Forum Archive

Topic: Reaver WPS

The content of this topic has been archived between 2 Apr 2018 and 14 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

I'm sorry could you please explain how to use this. I've successfully installed on backtrack however it fails on openwrt. Anyone provide some direction on compiling and installing this. Thanks.

I managed to compile it on Fedora, only thing needed was to install two development libraries:
# yum install libpcap-devel libsqlite3x-devel

Are these libraries available in openwrt? Maybe that is the problem?

Someone in IRC already tried it - apparently there are endian issues with it even if built successfully.

jow wrote:

Someone in IRC already tried it - apparently there are endian issues with it even if built successfully.

A question if I may: is bug #46 still relevant, then? It seems to be the only one mentioning endianness. Could you or the original tester please provide feedback to the author? I am going to try and run 1.4 on my Fonera and see how it flies.

well I was able to compile 1.4 on trunk 30366 for DIR-615-E4 (ar71xx)  It runs, but does not appear to do anything.  It will scan channels, I can force a channel and monitor mode with iwconfig but I don't see any sign of it seeing whatever beacon it is looking for.  sad  I setup a test linksys with WPS and nada.  Possibly this hardware isn't really monitor-mode or injection capable?

any news on this?

reaver 1.3 works for me on brcm47xx. when using it make sure to set up the monitor first with airmon-ng like described here
http://code.google.com/p/reaver-wps/wiki/HintsAndTips

i tried 1.4 but compilation dies with pcap.h not found . 1.3 worked fine though.

here is the packages/net/reaver/Makefile. reaver needs sqlite now.

#
#
# Copyright (C) 2011 OpenWrt.org
#
# This is free software, licensed under the GNU General Public License v2.
# See /LICENSE for more information.
#

include $(TOPDIR)/rules.mk

PKG_NAME:=reaver
PKG_VERSION:=1.3
PKG_RELEASE:=1

PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=http://reaver-wps.googlecode.com/files
PKG_MD5SUM:=6ec7dbb11b67e1b4a20f2ceba5f69547 

include $(INCLUDE_DIR)/package.mk

define Package/reaver
  SECTION:=net
  CATEGORY:=Network
  SUBMENU:=wireless
  TITLE:=Brute force attack against Wifi Protected Setup
  URL:=https://code.google.com/p/reaver-wps/
  DEPENDS:=+libpcap +libsqlite3
endef

define Package/reaver/description
  Reaver targets the external registrar functionality mandated by the WiFi
  Protected Setup specification.
  Access points will provide authenticated registrars with their current
  wireless configuration (including the WPA PSK), and also accept a new
  configuration from the registrar.
endef

CONFIGURE_PATH:=src

MAKE_PATH:=src

TARGET_CFLAGS+=$(TARGET_CPPFLAGS)

define Package/reaver/install
    $(INSTALL_DIR) $(1)/usr/bin
    $(INSTALL_BIN) $(PKG_BUILD_DIR)/src/reaver $(1)/usr/bin/
endef

$(eval $(call BuildPackage,reaver))

how did you get airmon on openwrt.
i didnt found airmon in opkg repository

I tried to compile it but i get this error message

user@lubuntu:~/openwrt/trunk$ make package/reaver/compile V=99
Collecting package info: done
make[1]: Entering directory `/home/user/openwrt/trunk'
make[2]: Entering directory `/home/user/openwrt/trunk/feeds/packages/libs/gettext'
make[2]: Leaving directory `/home/user/openwrt/trunk/feeds/packages/libs/gettext'
make[2]: Entering directory `/home/user/openwrt/trunk/feeds/packages/libs/libiconv'
make[2]: Leaving directory `/home/user/openwrt/trunk/feeds/packages/libs/libiconv'
make[2]: Entering directory `/home/user/openwrt/trunk/package/libreadline'
make[2]: Leaving directory `/home/user/openwrt/trunk/package/libreadline'
make[2]: Entering directory `/home/user/openwrt/trunk/package/libtool'
make[2]: Leaving directory `/home/user/openwrt/trunk/package/libtool'
make[2]: Entering directory `/home/user/openwrt/trunk/package/ncurses'
make[2]: Leaving directory `/home/user/openwrt/trunk/package/ncurses'
make[2]: Entering directory `/home/user/openwrt/trunk/package/ncurses'
make[2]: Leaving directory `/home/user/openwrt/trunk/package/ncurses'
make[2]: Entering directory `/home/user/openwrt/trunk/feeds/packages/libs/sqlite3'
make[2]: Leaving directory `/home/user/openwrt/trunk/feeds/packages/libs/sqlite3'
make[2]: Entering directory `/home/user/openwrt/trunk/package/libpcap'
make[2]: Leaving directory `/home/user/openwrt/trunk/package/libpcap'
make[2]: Entering directory `/home/user/openwrt/trunk/package/reaver'
Makefile:49: *** missing separator.  Stop.
make[2]: Leaving directory `/home/user/openwrt/trunk/package/reaver'
make[1]: *** [package/reaver/compile] Error 2
make[1]: Leaving directory `/home/user/openwrt/trunk'
make: *** [package/reaver/compile] Fehler 2
user@lubuntu:~/openwrt/trunk$

Line 49 is

$(eval $(call BuildPackage,reaver))

and I checked the tabs.
whats wrong?

The tabs are wrong.

i pasted the code from bud 1:1 in a Makefile
there are no tabs. only spaces

i found the error.
it was lines before "49"
now reaver works ;-)

what platform are you on?  you built a trunk build?  Mind posting your .config file?

Yes, copy/pasting the Makefile 1:1 from this thread into a file will lead to wrong tabs. The both $(INSTALL_...) lines must be indented with exactly one tabulator but they're intended by four spaces in this forum.

cconn, you are right,
i tested on atheros and broadcom and all devices are "waiting for a beacon" thats it.
i also compiled 1.4, which works but same cautios
:-(

(Last edited by netbus on 10 Apr 2012, 16:10)

I get the same waiting for beacon, tried reaver 1.2 1.3 and 1.4 not even the scanning tool wash will show my wps ap, tested on 2 diffrend ar71xx (ath9k) devices, will test a x86 device now with ath5k and broadcom...

Hy all

I tried to compire the reaver to openwrt, but i couldn't.
It is my first openwrt compire
I used backtrack 5 r2.
My steps

$ svn co svn://svn.openwrt.org/openwrt/trunk/
$ cd trunk
$ mkdir package/reaver
$ nano package/reaver/Makefile // I copyed the makefile form here
$ make menuconfig // I set at71xx
$ make package/reaver/compire V=99
Collecting package info: done
make[1]: Entering directory `/home/somla/openwrt/trunk'
make[2]: Entering directory `/home/somla/openwrt/trunk/package/libpcap'
(cd /home/somla/openwrt/trunk/build_dir/target-mips_r2_uClibc-0.9.33/libpcap-1.1.1/./; if [ -x ./configure ]; then /usr/bin/find /home/somla/openwrt/trunk/build_dir/target-mips_r2_uClibc-0.9.33/libpcap-1.1.1/ -name config.guess | xargs -r chmod u+w; /usr/bin/find /home/somla/openwrt/trunk/build_dir/target-mips_r2_uClibc-0.9.33/libpcap-1.1.1/ -name config.guess | xargs -r -n1 cp /home/somla/openwrt/trunk/scripts/config.guess; /usr/bin/find /home/somla/openwrt/trunk/build_dir/target-mips_r2_uClibc-0.9.33/libpcap-1.1.1/ -name config.sub | xargs -r chmod u+w; /usr/bin/find /home/somla/openwrt/trunk/build_dir/target-mips_r2_uClibc-0.9.33/libpcap-1.1.1/ -name config.sub | xargs -r -n1 cp /home/somla/openwrt/trunk/scripts/config.sub; AR=mips-openwrt-linux-uclibc-ar AS="mips-openwrt-linux-uclibc-gcc -c -Os -pipe -mips32r2 -mtune=mips32r2 -fno-caller-saves -fhonour-copts -Wno-error=unused-but-set-variable -msoft-float -ffunction-sections -fdata-sections" LD=mips-openwrt-linux-uclibc-ld NM=mips-openwrt-linux-uclibc-nm CC="mips-openwrt-linux-uclibc-gcc" GCC="mips-openwrt-linux-uclibc-gcc" CXX="mips-openwrt-linux-uclibc-g++" RANLIB=mips-openwrt-linux-uclibc-ranlib STRIP=mips-openwrt-linux-uclibc-strip OBJCOPY=mips-openwrt-linux-uclibc-objcopy OBJDUMP=mips-openwrt-linux-uclibc-objdump SIZE=mips-openwrt-linux-uclibc-size CFLAGS="-Os -pipe -mips32r2 -mtune=mips32r2 -fno-caller-saves -fhonour-copts -Wno-error=unused-but-set-variable -msoft-float -ffunction-sections -fdata-sections " CXXFLAGS="-Os -pipe -mips32r2 -mtune=mips32r2 -fno-caller-saves -fhonour-copts -Wno-error=unused-but-set-variable -msoft-float -ffunction-sections -fdata-sections " CPPFLAGS="-I/home/somla/openwrt/trunk/staging_dir/target-mips_r2_uClibc-0.9.33/usr/include -I/home/somla/openwrt/trunk/staging_dir/target-mips_r2_uClibc-0.9.33/include -I/home/somla/openwrt/trunk/staging_dir/toolchain-mips_r2_gcc-4.6-linaro_uClibc-0.9.33/usr/include -I/home/somla/openwrt/trunk/staging_dir/toolchain-mips_r2_gcc-4.6-linaro_uClibc-0.9.33/include " LDFLAGS="-L/home/somla/openwrt/trunk/staging_dir/target-mips_r2_uClibc-0.9.33/usr/lib -L/home/somla/openwrt/trunk/staging_dir/target-mips_r2_uClibc-0.9.33/lib -L/home/somla/openwrt/trunk/staging_dir/toolchain-mips_r2_gcc-4.6-linaro_uClibc-0.9.33/usr/lib -L/home/somla/openwrt/trunk/staging_dir/toolchain-mips_r2_gcc-4.6-linaro_uClibc-0.9.33/lib "  ac_cv_linux_vers=3.3.4  ./configure --target=mips-openwrt-linux --host=mips-openwrt-linux --build=i486-linux-gnu --program-prefix="" --program-suffix="" --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --libexecdir=/usr/lib --sysconfdir=/etc --datadir=/usr/share --localstatedir=/var --mandir=/usr/man --infodir=/usr/info --disable-nls   --enable-shared --enable-static --disable-yydebug --enable-ipv6 --with-build-cc="gcc" --with-pcap=linux --without-septel --without-dag --without-libnl ; fi; )
configure: loading site script /home/somla/openwrt/trunk/include/site/mips-openwrt-linux-uclibc
checking build system type... i486-pc-linux-gnu
checking host system type... mips-openwrt-linux-gnu
checking target system type... mips-openwrt-linux-gnu
checking for mips-openwrt-linux-gcc... mips-openwrt-linux-uclibc-gcc
checking for C compiler default output file name... 
configure: error: C compiler cannot create executables
See `config.log' for more details.
make[2]: *** [/home/somla/openwrt/trunk/build_dir/target-mips_r2_uClibc-0.9.33/libpcap-1.1.1/.configured_] Error 77
make[2]: Leaving directory `/home/somla/openwrt/trunk/package/libpcap'
make[1]: *** [package/libpcap/compile] Error 2
make[1]: Leaving directory `/home/somla/openwrt/trunk'
make: *** [package/reaver/compile] Error 2

Please help me.

Sorry my English

(Last edited by somla on 3 May 2012, 18:42)

You need to build a toolchain first. Run a full "make world" before attempting to build single packages.

Hy
Thank you for help me.

The compile was succesful.

Please help me again.
I have a new problem:


root@OpenWrt:~# reaver -b 54:E6:FC:EA:66:AE -i mon0 -vvv

Reaver v1.3 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <cheffner@tacnetsol.com>

[+] Waiting for beacon from 54:E6:FC:EA:66:AE
[+] Switching mon0 to channel 2
[+] Switching mon0 to channel 3
[+] Switching mon0 to channel 4
[+] Switching mon0 to channel 5
[+] Switching mon0 to channel 6
[+] Switching mon0 to channel 7
[+] Switching mon0 to channel 8
[+] Switching mon0 to channel 9
[+] Switching mon0 to channel 10
[+] Switching mon0 to channel 11
[+] Switching mon0 to channel 12
[+] Switching mon0 to channel 13
[+] Switching mon0 to channel 14
[+] Switching mon0 to channel 1
[+] Switching mon0 to channel 2
[+] Switching mon0 to channel 3
[+] Switching mon0 to channel 4
[+] Switching mon0 to channel 5
[+] Switching mon0 to channel 6
[+] Switching mon0 to channel 7
[+] Switching mon0 to channel 8
[+] Switching mon0 to channel 9
[+] Switching mon0 to channel 10
[+] Switching mon0 to channel 11
[+] Switching mon0 to channel 12
[+] Switching mon0 to channel 13
[+] Switching mon0 to channel 14
[+] Switching mon0 to channel 1
[+] Switching mon0 to channel 2
[+] Switching mon0 to channel 3
[+] Switching mon0 to channel 4
[+] Switching mon0 to channel 5
[+] Switching mon0 to channel 6
[+] Switching mon0 to channel 7
^C
[+] Nothing done, nothing to save.
[+] Session saved.

before that i use airmon-ng to set up monitor mode, and it was succesful, i can use airodump-ng and aireplay-ng.

I use Tp-link wr 841nd

(Last edited by somla on 4 May 2012, 14:19)

I think reaver-wps does not work big-endian.

In my case Buffalo WHR-G54S
CPU  Broadcom BMIPS3300 is little-endian.

root@OpenWrt:/# iwconfig wlan0 essid RalinkInitAP_ABEA34 channel 8
root@OpenWrt:/# ifconfig wlan0 up
root@OpenWrt:/# airmon-ng start wlan0
ps: invalid option -- A
BusyBox v1.19.4 (2012-05-04 03:00:00 JST) multi-call binary.

Usage: ps

Show list of processes

        w       Wide output



Interface       Chipset         Driver

wlan0           Broadcom        b43 - [phy0]
                                (monitor mode enabled on mon0)

root@OpenWrt:/# reaver -i mon0 -b 0:18:84:AB:xx:xx -c 8 -vv

Reaver v1.4 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <cheffner@tacnetsol.com>

[+] Switching mon0 to channel 8
[+] Waiting for beacon from 00:18:84:AB:xx:xx
[+] Associated with 00:18:84:AB:xx:xx (ESSID: RalinkInitAP_ABEA34)
[+] Trying pin 12345670
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received WSC NACK
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x04), re-trying last pin
[+] Trying pin 12345670
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[+] Received WSC NACK
[+] Sending WSC NACK
[+] Trying pin 00005678
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[+] Received WSC NACK
[+] Sending WSC NACK
[+] Trying pin 01235678
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
^C
[!] WARNING: Receive timeout occurred
[+] Session saved.

aborted. perhaps this cpu is poor (200MHz)

I also tried qemu.
(malta coreLV board)
 
qemu-system-mipsel -kernel openwrt-malta-le-vmlinux.elf  -nographic -m 256 -usbdevice host:0411:00d8
--- host:0411:00d8 = buffalo WLI-U2-SG54HP (rt73usb)

reaver works perfect. mipsel is little-endian.

but big endian one does not work.(waitting for beacon stop)
qemu-system-mips -kernel openwrt-malta-be-vmlinux.elf  -nographic -m 256 -usbdevice host:0411:00d8

So If my CPU is big-endian I willn't use reaver?