247CTF - 00ps, my WiFi disconnected

Posted on In Views: Disqus: Word count in article: 581 Reading time ≈ 2 mins. 
1
Our WiFi keeps disconnecting. We captured wireless traffic to try and figure out what’s happening, but it’s all temporal zeros to us! I think someone is trying to exploit a WiFi vulnerability.. Can you decrypt the traffic and gain access to the flag?

The hint "temporal zeros" and the context of a WiFi vulnerability strongly suggest the KRACK (Key Reinstallation Attack), specifically CVE-2017-13077.

Vulnerability Analysis: Why "Zeros"?

In a standard WPA2 4-way handshake, the client and AP negotiate a PTK (Pairwise Transient Key). KRACK works by intercepting and replaying Message 3 of the handshake, forcing the client to reinstall an already in-use key. This resets nonces (packet numbers) and replay counters.

For certain versions of wpa_supplicant (notably 2.4 and 2.5), a critical implementation bug exists: when the key is reinstalled, the Temporal Key (TK) is not just reused, but cleared to all zeros.

The captured 802.11 CCMP packets are encrypted using a 16-byte key of \x00 values.

The WPA2 4-way Handshake & PTK

  1. Message 1: AP sends a random number (ANonce) to the Client.
  2. Message 2: Client generates its own random number (SNonce), derives the PTK using both Nonces, and sends SNonce to the AP.
  3. Message 3: AP derives the same PTK, sends the Group Temporal Key (GTK), and instructs the Client to install the PTK.
  4. Message 4: Client confirms installation with an ACK.

The KRACK attack manipulates Message 3 to trigger the "all-zero" TK bug.

Decryption Methods

Method 1: Wireshark GUI

If you prefer a visual approach, you can configure Wireshark to decrypt the traffic using the zeroed key:

  1. Open Preferences (Ctrl + Shift + P).
  2. Go to Protocols -> IEEE 802.11.
  3. Check "Enable decryption".
  4. Click "Edit..." next to Decryption keys.
  5. Add a new key:
    • Key type: tk
    • Key: 00000000000000000000000000000000 (32 zeros)

Method 2: Scapy Script (CLI)

The following script manually reconstructs the CCM Nonce and decrypts the packets using the zeroed Temporal Key.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
import binascii
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from scapy.all import rdpcap
from scapy.layers.dot11 import Dot11, Dot11CCMP, Dot11QoS

PCAP_FILE = "/home/kita/Downloads/00ps.pcap"

def crack_temporal_zeros(pcap_file):
    print(f"[*] Parsing {pcap_file}...")
    try:
        packets = rdpcap(pcap_file)
    except Exception as e:
        print(f"[!] File error: {e}")
        return

    # CVE-2017-13077 (KRACK): The bug forces the TK (Temporal Key) to all zeros.
    tk_all_zeros = b"\x00" * 16

    for idx, pkt in enumerate(packets):
        if not pkt.haslayer(Dot11CCMP):
            continue

        ccmp = pkt[Dot11CCMP]

        # 1. Extract Packet Number (PN), 6 bytes
        pn = bytes([ccmp.PN5, ccmp.PN4, ccmp.PN3, ccmp.PN2, ccmp.PN1, ccmp.PN0])

        # 2. Extract Transmitter Address (A2), 6 bytes
        try:
            mac_a2 = binascii.unhexlify(pkt[Dot11].addr2.replace(":", ""))
        except AttributeError:
            continue 

        # 3. Extract QoS Priority (TID)
        priority = b"\x00"
        if pkt.haslayer(Dot11QoS):
            tid = pkt[Dot11QoS].TID & 0x0F
            priority = bytes([tid])

        # 4. Construct 13-byte CCM Nonce
        # Nonce = Priority (1 byte) + MAC A2 (6 bytes) + PN (6 bytes)
        nonce = priority + mac_a2 + pn

        # 5. Assemble CTR Initial Vector (16 bytes)
        # Flags (0x01) + Nonce (13 bytes) + Counter (0x0001)
        iv = b"\x01" + nonce + b"\x00\x01"

        # 6. Decrypt using AES-CTR (Bypassing MIC check for speed/simplicity)
        cipher = Cipher(
            algorithms.AES(tk_all_zeros), modes.CTR(iv), backend=default_backend()
        )
        decryptor = cipher.decryptor()

        raw_data = ccmp.data
        if len(raw_data) <= 8:
            continue

        ciphertext = raw_data[:-8] # Last 8 bytes are the MIC
        plaintext = decryptor.update(ciphertext) + decryptor.finalize()

        try:
            decoded_text = plaintext.decode("utf-8", errors="ignore")
            if "247ctf" in decoded_text.lower():
                print(f"\n[+] Flag found in packet #{idx + 1}:")
                print(f"    Plaintext: {decoded_text}\n")
                break
        except Exception:
            pass

if __name__ == "__main__":
    crack_temporal_zeros(PCAP_FILE)

Flag

247CTF{5e19fbdfa7072d568a28dd47b0edd379}