{"action":"created","issue":{"url":"https://api.github.com/repos/chrsmith/reaver-wps/issues/167","labels_url":"https://api.github.com/repos/chrsmith/reaver-wps/issues/167/labels{/name}","comments_url":"https://api.github.com/repos/chrsmith/reaver-wps/issues/167/comments","events_url":"https://api.github.com/repos/chrsmith/reaver-wps/issues/167/events","html_url":"https://github.com/chrsmith/reaver-wps/issues/167","id":59383851,"number":167,"title":"WPS transaction failed (code: 0x2), and (code: 0x03)","user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/chrsmith/reaver-wps/labels/auto-migrated","name":"auto-migrated","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/reaver-wps/labels/Priority-Triage","name":"Priority-Triage","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/reaver-wps/labels/Type-Defect","name":"Type-Defect","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":33,"created_at":"2015-03-01T06:28:22Z","updated_at":"2015-03-01T06:28:29Z","closed_at":null,"body":"```\nWhen attempting to attack WPS Pin mode on wireless router, attacking device \nsuccessfully associates, tries a pin, sends EAPOL Start request, etc all the \nway up until a 'Wps transaction fail code 0x02' is shown. It will cycle between \nthis error and another error verbatim, except the error code is 0x03 No keys \nare actually successfully tested: It will stay on the first key indefinitely. \n\nScenario - Setup a Netgear WNR2000 wireless router with WPS Pin mode enabled, \nrunning wpa2 psk.\n\nThe laptop running reaver-wps rev 110 from svn, is running backtrack 5 R1 with \nnewer compat-wireless drivers after the first few attempts failed \n(compat-wireless-2012-01-22 is what i am now using). I have also tried multiple \nwireless cards (usb ralink RT2860, internal chipset that is also a ralink \nRT2860 using rt2800pci and another usb ralink 2573 using rt73usb - All of which \ni noticed have been reported to be working) , all of which can inject \nsuccessfully to the wireless access point (Yes. It is in monitor mode.) Signal \nstrength is -120dB (The laptop and wireless router are actually on the same \ndesk, i have also tried moving further away from the AP in case of \ninterference, turned off other access points in the same house - only one other \nAP is in use here, it's for personal internet, NOT using WPS:) )\n\n\nWhat do i think the issue is? I'm not sure if it's either a issue in my set up \n- my wireless cards (perhaps they are having issues with this attack, even \nthough they support injection mode and have worked fine for breaking WEP, \nWPA1/2 and have been thoroughly used for the last year), or possibly the \nwireless router I have used either blocks this sort of attack, or is not \nhandling WPS as per spec. I have also tested with a borrowed wireless AP (Older \nthomson TG782T), both have reported to be running WPS 1.0 according to WASH, \nalthough i am not sure about the thomson being configured to be used for WPS \nPin.  \n\nThe commandline string used is as follows:\n<Against Netgear WNR2000>\nreaver -i mon1 -b 00:1F:33:F7:EA:59 -vv -a\n<Against old thomson TG782T>\n^same as above, except seperate address\n\nHave also tried giving it my adapters mac address with -m (just for testing)\nhave tried with and without -a, sometimes experimenting with --win7 too.\n\nThe output from reaver is as follows:\n[+] Waiting for beacon from 00:1F:33:F7:EA:59\n[+] Switching mon2 to channel 1\n[+] Associated with 00:1F:33:F7:EA:59 (ESSID: PEN_LAB_01)\n[+] Trying pin 12345670\n[+] Sending EAPOL START request\n[+] Received identity request\n[+] Sending identity response\n[+] Received M1 message\n[+] Sending M2 message\n[+] Received M1 message\n[+] Sending WSC NACK\n[+] Sending WSC NACK\n[!] WPS transaction failed (code: 0x03), re-trying last pin\n[+] Trying pin 12345670\n[+] Sending EAPOL START request\n[+] Received identity request\n[+] Sending identity response\n[!] WARNING: Receive timeout occurred\n[+] Sending WSC NACK\n[!] WPS transaction failed (code: 0x02), re-trying last pin\n[+] Trying pin 12345670\n[+] Sending EAPOL START request\n[!] WARNING: Receive timeout occurred\n[+] Sending EAPOL START request\n[!] WARNING: Receive timeout occurred\n[+] Sending EAPOL START request\n[+] Received identity request\n[+] Sending identity response\n[+] Received identity request\n[+] Sending identity response\n[+] Received identity request\n[+] Sending identity response\n[+] Received identity request\n[+] Sending identity response\n[+] Received M1 message\n[+] Sending M2 message\n[+] Received M1 message\n[+] Sending WSC NACK\n[+] Sending WSC NACK\n[!] WPS transaction failed (code: 0x03), re-trying last pin\n[+] Trying pin 12345670\n[+] Sending EAPOL START request\n[+] Received identity request\n[+] Sending identity response\n[+] Received identity request\n[+] Sending identity response\n[!] WARNING: Receive timeout occurred\n[+] Sending WSC NACK\n[!] WPS transaction failed (code: 0x02), re-trying last pin\n[+] Trying pin 12345670\n[+] Sending EAPOL START request\n[!] WARNING: Receive timeout occurred\n[+] Sending EAPOL START request\n[!] WARNING: Receive timeout occurred\n[+] Sending EAPOL START request\n[+] Received identity request\n[+] Sending identity response\n[+] Received identity request\n[+] Sending identity response\n[+] Received identity request\n[+] Sending identity response\n[+] Received identity request\n[+] Sending identity response\n[+] Received M1 message\n[+] Sending M2 message\n[+] Received M1 message\n[+] Sending WSC NACK\n[+] Sending WSC NACK\n[!] WPS transaction failed (code: 0x03), re-trying last pin\n[+] Trying pin 12345670\n[+] Sending EAPOL START request\n[+] Received identity request\n[+] Sending identity response\n[+] Received identity request\n[+] Sending identity response\n[!] WARNING: Receive timeout occurred\n[+] Sending WSC NACK\n[!] WPS transaction failed (code: 0x02), re-trying last pin\n[+] Nothing done, nothing to save.\n[+] 0.00% complete @ 2012-01-23 15:54:52 (0 seconds/pin)\n[+] Trying pin 12345670\n[+] Sending EAPOL START request\n[!] WARNING: Receive timeout occurred\n[+] Sending EAPOL START request\n[!] WARNING: Receive timeout occurred\n[+] Sending EAPOL START request\n[+] Received identity request\n[+] Sending identity response\n[+] Received identity request\n[+] Sending identity response\n[+] Received identity request\n[+] Sending identity response\n[+] Received identity request\n[+] Sending identity response\n[+] Received M1 message\n[+] Sending M2 message\n[+] Received M1 message\n[+] Sending WSC NACK\n[+] Sending WSC NACK\n[!] WPS transaction failed (code: 0x03), re-trying last pin\n<It goes on for another 300 lines, i can attach those too if you'd like>\n\nAlso, the output of WASH is as follows:\nBSSID                  Channel       RSSI       WPS Version       WPS Locked    \n    ESSID\n--------------------------------------------------------------------------------\n-------------------------------\n08:76:FF:0F:E6:5A       1            -54        1.0               No            \n    BigPond0FE65A\n00:1F:33:F7:EA:59       1            -39        1.0               No            \n    PEN_LAB_01\n <sorry about the formatting!>\n\n-Unfortunatly i'm getting a message about issue attachment storage quota \nexceeded, so I cannot post a pcap dump here. Would it be acceptable if I posted \non my own webserver and provided a link?\n\n<PS, sorry for the essay. I've tried a bit to get this to work!>\n```\n\nOriginal issue reported on code.google.com by `m...@c0refailure.com` on 23 Jan 2012 at 5:03"},"comment":{"url":"https://api.github.com/repos/chrsmith/reaver-wps/issues/comments/76581560","html_url":"https://github.com/chrsmith/reaver-wps/issues/167#issuecomment-76581560","issue_url":"https://api.github.com/repos/chrsmith/reaver-wps/issues/167","id":76581560,"user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"created_at":"2015-03-01T06:28:28Z","updated_at":"2015-03-01T06:28:28Z","body":"```\nTo Cashcla...\n\nNotice that jeff is not referring to the main issue on the thread (repeatedly \nreceiving errors with code 0x02 and 0x03). It seems he is receiving an M \nresponse lower than the M message he sent i.e. he sends an M2 message and gets \nback an M1 response. Notice g00gl3c... has this error at the tail of his log in \ncomment 21. Make sure you understand this is a fix for this error (according to \nJeff, I actually haven't tested it, but you should trust him, no harm in \ntrying.) If this is in fact the error you are recieving, then go ahead and try \nout Jeff's code.\n\nIf I understand your question, your are asking how to make a change on to file \nof a program managed by Make and reinstall the program. Here is how to apply \nJeff's change for the linux noob (no offense, keep at it, you learn quick.) \nOpen up a terminal and do as follows (for most if not all linux, just type \ncommands as you see them if not noted otherwise, anything after a # is a \ncomment):\n\ncd /to/your/reaver/directory # replace with where you originally put reaver\ncd src/\ngedit jeffsendc.txt # or whatever text editor you have, I suggest one with a gui\n                                  # if you don't have very much experience\n\n# Now in the blank text file copy in the code for send.c in Jeff's comment\n# then save it and close. Back to the terminal:\n\nsudo make distclean\ncp send.c send.c.old\nrm send.c\ncat jeffsendc.txt > send.c\n./confgure\nmake\nsudo make install\n\n# now you are done applying jeff's changes!\n# maybe it turns out you actually don't want this change, maybe it causes\n# full of bugs and acts really unexpectedly, this is how you revert back to the\n# original. If this is the case, open up the terminal again, and just like \nbefore,\n# input the commands as follows:\n\ncd /to/your/reaver/directory # replace with where you originally put reaver\ncd src/\nsudo make distclean\nrm send.c\nmv send.c.old send.c\n./confgure\nmake\nsudo make install\n\n# everything should be back to normal\n```\n\nOriginal comment by `mikedan...@gmail.com` on 18 Oct 2012 at 8:52"}}