warecrer/hcxpcaptool

hcxtools

Small set of tools convert packets from captures (h = hash, c = capture, convert and calculate candidates, x = different hashtypes) for the use with latest hashcat or John the Ripper. The tools are 100% compatible to hashcat and John the Ripper and recommended by hashcat. This branch is pretty closely synced to hashcat git branch (that means: latest hcxtools matching on latest hashcat beta) and John the Ripper git branch ("bleeding-jumbo").

Support for hashcat hash-modes: 2500, 2501, 4800, 5500, 12000, 16100, 16800, 16801

Support for John the Ripper hash-modes: WPAPSK-PMK, PBKDF2-HMAC-SHA1, chap, netntlm, tacacs-plus

After capturing, upload the "uncleaned" cap here (https://wpa-sec.stanev.org/?submit) to see if your ap or the client is vulnerable by using common wordlists. Convert the cap to hccapx and/or to WPA-PMKID-PBKDF2 hashline (16800) and check if wlan-key or plainmasterkey was transmitted unencrypted.

Brief description

Multiple stand-alone binaries - designed to run on Arch Linux.

All of these utils are designed to execute only one specific function.

hcxdumptool moved to: https://github.com/ZerBea/hcxdumptool

Read this post: hcxtools - solution for capturing wlan traffic and conversion to hashcat formats (https://hashcat.net/forum/thread-6661.html)

Detailed description

Tool	Description
hcxpcaptool	Shows info of pcap/pcapng file and convert it to other hashformats accepted by hashcat and John the Ripper
hcxhashcattool	Calculate PMKs from hashcat -m 2500 potfile
wlanhcx2cap	Converts hccapx to cap
wlanhc2hcx	Converts hccap to hccapx
wlanwkp2hcx	Converts wpk (ELMCOMSOFT EWSA projectfile) to hccapx
wlanhcx2essid	Merges hccapx containing the same ESSID
wlanhcx2ssid	Strips BSSID, ESSID, OUI
wlanhcxinfo	Shows detailed info from contents of hccapxfile
wlanhcxmnc	Help to calculate hashcat's nonce-error-corrections value on byte number xx of an anonce
wlanhashhcx	Generate hashlist from hccapx hashfile (md5_64 hash:mac_ap:mac_sta:essid)
wlanhcxcat	Simple password recovery tool for WPA/WPA2/WPA2 SHA256 AES-128-CMAC (hash-modes 2500, 2501)
wlanpmk2hcx	Converts plainmasterkey and ESSID for use with hashcat hash-mode 12000 or john PBKDF2-HMAC-SHA1
wlanjohn2hcx	Converts john wpapsk hashfiles for use with hashcat hash-modes 2500, 2501
wlancow2hcxpmk	Converts pre-computed cowpatty hashfiles for use with hashcat hash-mode 2501
wlanhcx2john	Converts hccapx to format expected by John the Ripper
wlanhcx2psk	Calculates candidates for hashcat based on the hccapx file
wlancap2wpasec	Upload multiple caps to https://wpa-sec.stanev.org
whoismac	Show vendor information and/or download oui reference list

Compile

Simply run:

make
make install (as super user)

Requirements

• Linux (recommended Arch Linux, but other distros should work, too (no support for other distributions).

• libopenssl and openssl-dev installed

• librt and librt-dev installed (should be installed by default)

• zlib and zlib-dev installed (for gzip compressed cap/pcap/pcapng files)

• libcurl and curl-dev installed (used by whoismac and wlancap2wpasec)

• libpthread and pthread-dev installed (used by hcxhashcattool)

To install requirements on Kali use the following 'apt-get install libcurl4-openssl-dev libssl-dev zlib1g-dev libpcap-dev'

Useful scripts

Script	Description
piwritecard	Example script to restore SD-Card
piwreadcard	Example script to backup SD-Card

Notice

Most output files will be appended to existing files (with the exception of .cap files).

Bitmask message pair field (hcxpcaptool)

0: MP info (https://hashcat.net/wiki/doku.php?id=hccapx#message_pair_table)

1: MP info (https://hashcat.net/wiki/doku.php?id=hccapx#message_pair_table)

2: MP info (https://hashcat.net/wiki/doku.php?id=hccapx#message_pair_table)

3: x unused

4: ap-less attack (set to 1) - no nonce-error-corrections neccessary

5: LE router detected (set to 1) - nonce-error-corrections only for LE neccessary

6: BE router detected (set to 1) - nonce-error-corrections only for BE neccessary

7: not replaycount checked (set to 1) - replaycount not checked, nonce-error-corrections definitely neccessary

hcxpcaptool's Issues

hcxtools not installing showing the error pasted below

cc -O3 -Wall -Wextra -MMD -MF .deps/hcxpcapngtool.d -o hcxpcapngtool hcxpcapngtool.c -lssl -lcrypto -lz -DVERSION_TAG="6.2.7-108-gc97e632" -DVERSION_YEAR="2023" -DWANTZLIB
hcxpcapngtool.c:87:8: error: unknown type name ‘EVP_MAC’
87 | static EVP_MAC *hmac;
| ^~~~~~~
hcxpcapngtool.c:88:8: error: unknown type name ‘EVP_MAC’
88 | static EVP_MAC *cmac;
| ^~~~~~~
hcxpcapngtool.c:89:8: error: unknown type name ‘EVP_MAC_CTX’
89 | static EVP_MAC_CTX *ctxhmac;
| ^~~~~~~~~~~
hcxpcapngtool.c:90:8: error: unknown type name ‘EVP_MAC_CTX’
90 | static EVP_MAC_CTX *ctxcmac;
| ^~~~~~~~~~~
hcxpcapngtool.c:91:8: error: unknown type name ‘OSSL_PARAM’
91 | static OSSL_PARAM paramsmd5[3];
| ^~~~~~~~~~
hcxpcapngtool.c:92:8: error: unknown type name ‘OSSL_PARAM’
92 | static OSSL_PARAM paramssha1[3];
| ^~~~~~~~~~
hcxpcapngtool.c:93:8: error: unknown type name ‘OSSL_PARAM’
93 | static OSSL_PARAM paramssha256[3];
| ^~~~~~~~~~
hcxpcapngtool.c:94:8: error: unknown type name ‘OSSL_PARAM’
94 | static OSSL_PARAM paramsaes128[3];
| ^~~~~~~~~~
hcxpcapngtool.c: In function ‘testpmkid’:
hcxpcapngtool.c:1938:5: warning: implicit declaration of function ‘EVP_MAC_init’; did you mean ‘EVP_MD_CTX_init’? [-Wimplicit-function-declaration]
1938 | if(!EVP_MAC_init(ctxhmac, testpmk, 32, paramssha1)) return false;
| ^~~~~~~~~~~~
| EVP_MD_CTX_init
hcxpcapngtool.c:1939:5: warning: implicit declaration of function ‘EVP_MAC_update’; did you mean ‘HMAC_Update’? [-Wimplicit-function-declaration]
1939 | if(!EVP_MAC_update(ctxhmac, pmkidcalc, 20)) return false;
| ^~~~~~~~~~~~~~
| HMAC_Update
hcxpcapngtool.c:1940:5: warning: implicit declaration of function ‘EVP_MAC_final’; did you mean ‘HMAC_Final’? [-Wimplicit-function-declaration]
1940 | if(!EVP_MAC_final(ctxhmac, pmkidcalc, NULL, 20)) return false;
| ^~~~~~~~~~~~~
| HMAC_Final
hcxpcapngtool.c: In function ‘evpdeinitwpa’:
hcxpcapngtool.c:5637:2: warning: implicit declaration of function ‘EVP_MAC_CTX_free’; did you mean ‘EVP_MD_CTX_free’? [-Wimplicit-function-declaration]
5637 | EVP_MAC_CTX_free(ctxhmac);
| ^~~~~~~~~~~~~~~~
| EVP_MD_CTX_free
hcxpcapngtool.c:5638:2: warning: implicit declaration of function ‘EVP_MAC_free’; did you mean ‘EVP_PKEY_free’? [-Wimplicit-function-declaration]
5638 | EVP_MAC_free(hmac);
| ^~~~~~~~~~~~
| EVP_PKEY_free
hcxpcapngtool.c: In function ‘evpinitwpa’:
hcxpcapngtool.c:5669:8: warning: implicit declaration of function ‘EVP_MAC_fetch’ [-Wimplicit-function-declaration]
5669 | hmac = EVP_MAC_fetch(NULL, "hmac", NULL);
| ^~~~~~~~~~~~~
hcxpcapngtool.c:5669:6: warning: assignment to ‘int *’ from ‘int’ makes pointer from integer without a cast [-Wint-conversion]
5669 | hmac = EVP_MAC_fetch(NULL, "hmac", NULL);
| ^
hcxpcapngtool.c:5671:6: warning: assignment to ‘int *’ from ‘int’ makes pointer from integer without a cast [-Wint-conversion]
5671 | cmac = EVP_MAC_fetch(NULL, "cmac", NULL);
| ^
hcxpcapngtool.c:5674:16: warning: implicit declaration of function ‘OSSL_PARAM_construct_utf8_string’ [-Wimplicit-function-declaration]
5674 | paramsmd5[0] = OSSL_PARAM_construct_utf8_string("digest", "md5", 0);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
hcxpcapngtool.c:5675:16: warning: implicit declaration of function ‘OSSL_PARAM_construct_end’ [-Wimplicit-function-declaration]
5675 | paramsmd5[1] = OSSL_PARAM_construct_end();
| ^~~~~~~~~~~~~~~~~~~~~~~~
hcxpcapngtool.c:5686:11: warning: implicit declaration of function ‘EVP_MAC_CTX_new’; did you mean ‘EVP_MD_CTX_new’? [-Wimplicit-function-declaration]
5686 | ctxhmac = EVP_MAC_CTX_new(hmac);
| ^~~~~~~~~~~~~~~
| EVP_MD_CTX_new
hcxpcapngtool.c:5686:9: warning: assignment to ‘int *’ from ‘int’ makes pointer from integer without a cast [-Wint-conversion]
5686 | ctxhmac = EVP_MAC_CTX_new(hmac);
| ^
hcxpcapngtool.c:5688:9: warning: assignment to ‘int *’ from ‘int’ makes pointer from integer without a cast [-Wint-conversion]
5688 | ctxcmac = EVP_MAC_CTX_new(cmac);
| ^
make: *** No rule to make target 'hcxpcapngtool', needed by 'build'. Stop.

Compile failed - fatal error: curl/curl.h: No such file or directory

Has anyone seen this error, and can guide me on how to resolve it? I did install the dev files with success for another tool (which compiled without error).

└─$ sudo make
cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/wlanhcx2cap.d -o wlanhcx2cap wlanhcx2cap.c -lpcap
wlanhcx2cap.c:19:10: fatal error: curl/curl.h: No such file or directory
19 | #include <curl/curl.h>
| ^~~~~~~~~~~~~
compilation terminated.
make: *** [Makefile:79: wlanhcx2cap] Error 1

Compile Failed

❯ make
mkdir -p .deps
cc -O3 -Wall -Wextra -std=gnu99  -MMD -MF .deps/hcxpcaptool.d -o hcxpcaptool hcxpcaptool.c -lz -lcrypto 
hcxpcaptool.c: In function ‘outputpppchaplist’:
hcxpcaptool.c:1460:57: warning: ‘SHA1_Init’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
 1460 |                                                         SHA1_Init(&ctxsha1);
      |                                                         ^~~~~~~~~
In file included from hcxpcaptool.c:16:
/usr/include/openssl/sha.h:49:27: note: declared here
   49 | OSSL_DEPRECATEDIN_3_0 int SHA1_Init(SHA_CTX *c);
      |                           ^~~~~~~~~
hcxpcaptool.c:1461:57: warning: ‘SHA1_Update’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
 1461 |                                                         SHA1_Update(&ctxsha1, zeigerrs->data, 16);
      |                                                         ^~~~~~~~~~~
In file included from hcxpcaptool.c:16:
/usr/include/openssl/sha.h:50:27: note: declared here
   50 | OSSL_DEPRECATEDIN_3_0 int SHA1_Update(SHA_CTX *c, const void *data, size_t len);
      |                           ^~~~~~~~~~~
hcxpcaptool.c:1462:57: warning: ‘SHA1_Update’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
 1462 |                                                         SHA1_Update(&ctxsha1, zeigerrq->data, 16);
      |                                                         ^~~~~~~~~~~
In file included from hcxpcaptool.c:16:
/usr/include/openssl/sha.h:50:27: note: declared here
   50 | OSSL_DEPRECATEDIN_3_0 int SHA1_Update(SHA_CTX *c, const void *data, size_t len);
      |                           ^~~~~~~~~~~
hcxpcaptool.c:1466:65: warning: ‘SHA1_Update’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
 1466 |                                                                 SHA1_Update(&ctxsha1, zeigerrs->username, zeigerrs->username_len);
      |                                                                 ^~~~~~~~~~~
In file included from hcxpcaptool.c:16:
/usr/include/openssl/sha.h:50:27: note: declared here
   50 | OSSL_DEPRECATEDIN_3_0 int SHA1_Update(SHA_CTX *c, const void *data, size_t len);
      |                           ^~~~~~~~~~~
hcxpcaptool.c:1471:65: warning: ‘SHA1_Update’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
 1471 |                                                                 SHA1_Update(&ctxsha1, un_ptr, strlen(un_ptr));
      |                                                                 ^~~~~~~~~~~
In file included from hcxpcaptool.c:16:
/usr/include/openssl/sha.h:50:27: note: declared here
   50 | OSSL_DEPRECATEDIN_3_0 int SHA1_Update(SHA_CTX *c, const void *data, size_t len);
      |                           ^~~~~~~~~~~
hcxpcaptool.c:1473:57: warning: ‘SHA1_Final’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
 1473 |                                                         SHA1_Final(digestsha1, &ctxsha1);
      |                                                         ^~~~~~~~~~
In file included from hcxpcaptool.c:16:
/usr/include/openssl/sha.h:51:27: note: declared here
   51 | OSSL_DEPRECATEDIN_3_0 int SHA1_Final(unsigned char *md, SHA_CTX *c);
      |                           ^~~~~~~~~~
cc -O3 -Wall -Wextra -std=gnu99  -MMD -MF .deps/hcxhashcattool.d -o hcxhashcattool hcxhashcattool.c -lcrypto -lpthread 
cc -O3 -Wall -Wextra -std=gnu99  -MMD -MF .deps/wlanhc2hcx.d -o wlanhc2hcx wlanhc2hcx.c  
cc -O3 -Wall -Wextra -std=gnu99  -MMD -MF .deps/wlanwkp2hcx.d -o wlanwkp2hcx wlanwkp2hcx.c  
cc -O3 -Wall -Wextra -std=gnu99  -MMD -MF .deps/wlanhcxinfo.d -o wlanhcxinfo wlanhcxinfo.c  
cc -O3 -Wall -Wextra -std=gnu99  -MMD -MF .deps/wlanhcx2cap.d -o wlanhcx2cap wlanhcx2cap.c -lpcap 
wlanhcx2cap.c:12:10: fatal error: pcap.h: No such file or directory
   12 | #include <pcap.h>
      |          ^~~~~~~~
compilation terminated.
make: *** [Makefile:79: wlanhcx2cap] Error 1

Compile Failded

look this error:

(in dir) ~/Hcxpcaptool$ make
mkdir -p .deps
cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/hcxpcaptool.d -o hcxpcaptool hcxpcaptool.c -lz -lcrypto
cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/hcxhashcattool.d -o hcxhashcattool hcxhashcattool.c -lcrypto -lpthread
cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/wlanhc2hcx.d -o wlanhc2hcx wlanhc2hcx.c
cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/wlanwkp2hcx.d -o wlanwkp2hcx wlanwkp2hcx.c
cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/wlanhcxinfo.d -o wlanhcxinfo wlanhcxinfo.c
cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/wlanhcx2cap.d -o wlanhcx2cap wlanhcx2cap.c -lpcap
wlanhcx2cap.c:19:10: fatal error: curl/curl.h: No such file or directory
19 | #include <curl/curl.h>
| ^~~~~~~~~~~~~
compilation terminated.
make: *** [Makefile:79: wlanhcx2cap] Error 1

its raised when i use the make command, can you help me?