{"id":37,"date":"2009-04-15T19:56:08","date_gmt":"2009-04-15T23:56:08","guid":{"rendered":"http:\/\/www.willhackforsushi.com\/blog\/?page_id=37"},"modified":"2010-05-18T12:41:01","modified_gmt":"2010-05-18T17:41:01","slug":"freeradius-wpe","status":"publish","type":"page","link":"https:\/\/www.willhackforsushi.com\/?page_id=37","title":{"rendered":"FreeRADIUS-WPE"},"content":{"rendered":"<p>A patch for the popular open-source FreeRADIUS implementation to demonstrate RADIUS impersonation vulnerabilities by Joshua Wright and Brad Antoniewicz. This patch adds the following functionality:<\/p>\n<ul>\n<li>Simplifies the setup of FreeRADIUS by adding all RFC1918 addresses as acceptable NAS devices;<\/li>\n<li>Simplifies the setup of EAP authentication by including support for all FreeRADIUS supported EAP types;<\/li>\n<li>Adds WPE logging in $prefix\/var\/log\/radius\/freeradius-server-wpe.log, can be controlled in radius.conf by changing the \u201cwpelogfile\u201d directive;<\/li>\n<li>Simplified the setup of user authentication with a default &#8220;users&#8221; file that accepts authentication for any username;<\/li>\n<li>Adds credential logging for multiple EAP types including PEAP, TTLS, LEAP, EAP-MD5, EAP-MSCHAPv2, PAP, CHAP and others<\/li>\n<\/ul>\n<p>For setup information, see the SETUP section below, or <a href=\"http:\/\/www.willhackforsushi.com\/presentations\/PEAP_Shmoocon2008_Wright_Antoniewicz.pdf\">our slides from Shmoocon 4<\/a>.<\/p>\n<hr \/>\n<h2>News<\/h2>\n<p>May 18 2010<\/p>\n<p>Brad brought the FreeRADIUS-WPE patch up to date for FreeRADIUS 2.1.7.  It&#8217;s amazing to me that lots of people seemed to have missed this issue in PEAP and other EAP methods, as it&#8217;s still extremely useful in most of the pen-tests I engage in.<\/p>\n<p>July 18 2008<\/p>\n<p>I&#8217;ve been working on extending the FreeRADIUS-WPE attack to also compromise EAP\/TLS networks as well.  It&#8217;s still a work-in-progress, but I think it will be cool when it&#8217;s finished.  Stay tuned.<\/p>\n<p>February 18 2008<\/p>\n<p>Thanks to everyone who made it out to our presentation at Shmoocon 2008 where we debuted FreeRADIUS Wireless Pwnage Edition.  Check out <a href=\"http:\/\/www.willhackforsushi.com\/presentations\/PEAP_Shmoocon2008_Wright_Antoniewicz.pdf\">our slides<\/a>, and you can get the patch for freeradius-wpe below.  Drop me a note with any questions. -Josh<\/p>\n<hr \/>\n<h2>Screenshots<\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-39\" title=\"freeradius-wpe\" src=\"http:\/\/www.willhackforsushi.com\/wp-content\/uploads\/2009\/04\/freeradius-wpe.png\" alt=\"freeradius-wpe\" width=\"440\" height=\"158\" srcset=\"https:\/\/www.willhackforsushi.com\/wp-content\/uploads\/2009\/04\/freeradius-wpe.png 440w, https:\/\/www.willhackforsushi.com\/wp-content\/uploads\/2009\/04\/freeradius-wpe-300x107.png 300w\" sizes=\"auto, (max-width: 440px) 100vw, 440px\" \/><\/p>\n<hr \/>\n<h2>Download<\/h2>\n<ul>\n<li><a href=\"http:\/\/www.willhackforsushi.com\/code\/freeradius-wpe\/freeradius-wpe-2.1.7.patch\">FreeRADIUS 2.1.7 patch<\/a> (MD5: 20f48de7689bbff00acb5c8b46c71c20)<\/li>\n<li><a href=\"http:\/\/www.willhackforsushi.com\/code\/freeradius-wpe\/freeradius-wpe-2.0.2.patch\">FreeRADIUS 2.0.2 patch<\/a> (MD5: 6671917d602373d8010fe38de66377e4)<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>A patch for the popular open-source FreeRADIUS implementation to demonstrate RADIUS impersonation vulnerabilities by Joshua Wright and Brad Antoniewicz. This patch adds the following functionality: Simplifies the setup of FreeRADIUS by adding all RFC1918 addresses as acceptable NAS devices; Simplifies &hellip; <a href=\"https:\/\/www.willhackforsushi.com\/?page_id=37\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":17,"menu_order":0,"comment_status":"closed","ping_status":"open","template":"","meta":{"footnotes":""},"class_list":["post-37","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.willhackforsushi.com\/index.php?rest_route=\/wp\/v2\/pages\/37","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.willhackforsushi.com\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.willhackforsushi.com\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.willhackforsushi.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.willhackforsushi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=37"}],"version-history":[{"count":5,"href":"https:\/\/www.willhackforsushi.com\/index.php?rest_route=\/wp\/v2\/pages\/37\/revisions"}],"predecessor-version":[{"id":479,"href":"https:\/\/www.willhackforsushi.com\/index.php?rest_route=\/wp\/v2\/pages\/37\/revisions\/479"}],"up":[{"embeddable":true,"href":"https:\/\/www.willhackforsushi.com\/index.php?rest_route=\/wp\/v2\/pages\/17"}],"wp:attachment":[{"href":"https:\/\/www.willhackforsushi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=37"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}