WPS

#wpsapp
Select Device Password ID Option
[0]. PIN
[1]. PBC
[2]. PBC Auto
Enter Selection : 1
Device Password ID select : [1]
Start Active Scan ...
Scan Result : 2 entry in Scan List
-----------------------------------------------------------------------
# | Mode | Chan# | WPA | WPS | BSSID | SSID
-----------------------------------------------------------------------
00 | Infra | 006 | N | Y |00:b0:0c:05:63:3a |Tenda
01 | Infra | 011 | N | N | 00:0f:cb:a4:1e:0a | PD
Select Target SSID Option
[0]. Quit
[1]. Searching Again
[2]. Connect
Enter Selection : 2
Select Index of SSID : 0
Index Selected : 0
PBCConnecting .....
Connected to following BSS (or IBSS) :
SSID = [Tenda], BSSID = [00:b0:0c:05:63:3a]
Press [q/Q] to abort this program.
State A->B
State B->C
State C->D
Authentication_Type_Flags(M2) = 0x003f
15
Encryption_Type_Flags(M2) = 0x000f
Config_Methods(M2) = 0x0000
SC_Configuration_Error(M2): 0
State D->E
80 c5 93 b9 0b 5a 22 02 22 4a 2a e6 e1 14 c9 18
5c 99 ab c5 33 a2 74 bd 37 6e 0a b1 77 9c 29 8a
c7 04 9a 07 98 86 3a f1 3d 9d 9d 66 b0 8e 54 b3
a6 6b 0e 12 cb e1 44 82 7e f5 5e e8 7c 14 f5 c6
33 18 7c 35 64 3c ec 82 b9 23 75 89 56 6b 37 c6
41 63 a2 9e b9 a8 fd 18 58 58 e1 50 30 23 31 a6
88 9a 17 01 f8 cb 50 e0 24 bb d5 8a eb 43 f7 8d
1f 36 cd 73 36 2d bc 92 22 4b ed d8 1a 50 50 a5
1e 18 55 8b 1c 03 9d 89 d6 b5 17 2d c8 9d 2c 60
86 f1 50 61 d8 d9 c4 6a 56 22 22 2e f9 c9 96 ab
ee 01 ab 14 b5 57 3b af 6a b6 f9 5b 89 93 af e9
90 04 77 72 09 25 e2 1a e4 28 5b 91 86 f0 14 91
Agree Key Len = 192
DH Key - hexdump(len=32):
5e 37 f7 7d aa 20 d9 78 d6 e5 0c 05 82 e5 9e 0f
f1 69 82 bc d1 0f 92 fe c3 ad 8f 76 bc 32 05 a6
Auth Key - hexdump(len=32):
9b 11 44 7b 4a ea c1 a3 93 02 b9 36 91 0e 81 e0
ec 3a 9d f3 41 f1 2a dd 89 bb 9e ff 03 c2 3b 70
Key Wrap Key - hexdump(len=16):
f6 9d 22 7c 99 a9 9b 04 87 05 5c 27 1c 69 ba e7
PSK1 - hexdump(len=16):
30 11 04 65 37 56 c0 cc d2 a2 1a b2 d0 0d 08 fd
PSK2 - hexdump(len=16):
30 11 04 65 37 56 c0 cc d2 a2 1a b2 d0 0d 08 fd
ES1 - hexdump(len=16):
67 ba 75 4e 60 be 23 19 1a fe 5c 20 85 ae f3 5a
E-HASH1 - hexdump(len=32):
56 da 78 cf b1 b7 10 e9 5d a9 e3 49 b9 fc 87 78
f5 64 28 e4 84 51 e6 ea 2c 25 d6 67 ed 11 06 cf
E-HASH1 - hexdump(len=32):
56 da 78 cf b1 b7 10 e9 5d a9 e3 49 b9 fc 87 78
f5 64 28 e4 84 51 e6 ea 2c 25 d6 67 ed 11 06 cf
16
State E->F
State F->E
State E->F
State F->E
State E->F
SC_Message_Type = 0xc
SC_Enrollee_Nonce
SC_Encrypted_Settings
encrypted_data - hexdump(len=128):
26 f0 9c 44 8e 56 3f 0a 73 cf 1d e7 0d be 18 60
b1 e7 cb a3 cc b0 56 21 53 56 4a 53 f6 7d 26 54
85 ae 45 75 aa a9 36 d6 d5 91 76 5e 63 34 fc 0d
ee 6a 69 9e df db 81 8d b1 ce ba 8b b9 b9 e9 a3
c5 5e f6 03 ae 36 3a 24 e1 76 e0 4b c3 dc 23 64
52 9e 3d 4d 0b 5a 9e 1c 71 b1 a1 a3 1f e8 5a bd
ab c6 b2 a2 f4 88 c8 78 ca 22 5b 37 ab bc d0 c3
85 df 79 5a 83 38 70 ce a2 ee 89 60 17 d6 08 40
M8_process Key Wrap Key - hexdump(len=16):
f6 9d 22 7c 99 a9 9b 04 87 05 5c 27 1c 69 ba e7
M8_process Wrap Raw Data - hexdump(len=128):
10 0e 00 6d 10 26 00 01 31 10 45 00 05 54 65 6e
64 61 10 03 00 02 00 20 10 0f 00 02 00 08 10 28
00 01 01 10 27 00 40 65 33 38 39 32 33 61 38 30
36 35 66 65 61 34 37 33 31 39 32 61 35 62 30 63
61 66 34 34 66 37 39 38 31 62 37 32 34 37 64 35
38 32 32 36 66 64 63 37 65 39 63 30 30 35 62 31
33 63 34 37 33 37 32 10 20 00 06 00 b0 0c 05 63
3a 10 1e 00 08 33 46 fe 54 3e 9a fb fa 03 03 03
SC_Credential
Num of SC_Credential received = 1
Num of SC_Credential saved = 1
SC_Network_Index
SC_SSID
SSID : Tenda
SC_Authentication_Type
Authentication_Type(M8) = 0x0020
17
SC_Encryption_Type
Encryption_Type(M8) = 0x0008
SC_Network_Key_Index
SC_Network_Key
SC_Network_Key - hexdump(len=64):
65 33 38 39 32 33 61 38 30 36 35 66 65 61 34 37
33 31 39 32 61 35 62 30 63 61 66 34 34 66 37 39
38 31 62 37 32 34 37 64 35 38 32 32 36 66 64 63
37 65 39 63 30 30 35 62 31 33 63 34 37 33 37 32
SC_MAC_Address
Auth Type: 32
State F->E
State E->H
State H->A
WPS Registration Protocol Completed Successfully !
#Cat Wps.conf:
network={
ssid="Tenda"
proto=RSN
key_mgmt=WPA-PSK
psk=e38923a8065fea473192a5b0caf44f7981b7247d58226fdc7e9c005b13c47372
}
Then wpa_supplicant –w –i eth0 –c./wps.conf
A.2 Test log of WPS-PIN
Select Device Password ID Option
[0]. PIN
[1]. PBC
[2]. PBC Auto
Enter Selection : 0
Device Password ID select : [0]
Start Active Scan ...
Scan Result : 2 entry in Scan List
-----------------------------------------------------------------------
18
# | Mode | Chan# | WPA | WPS | BSSID | SSID
-----------------------------------------------------------------------
00 | Infra | 006 | N | N | 00:b0:0c:05:63:3a | Tenda
01 | Infra | 011 | N | N | 00:0f:cb:a4:1e:0a | PD
Select Target SSID Option
[0]. Quit
[1]. Searching Again
[2]. Connect
Enter Selection : 2
PIN Number is : 90220029
Select Index of SSID : 0
Index Selected : 0
PBCConnecting .....
Connected to following BSS (or IBSS) :
SSID = [Tenda], BSSID = [00:b0:0c:05:63:3a]
Press [q/Q] to abort this program.
EAPOL_START
State Transition After =A
EAP_RESPONSE_IDENTITY
State A->B
State Transition After =B
Event Trigger : WPS_START
State B->C
State Transition After = C
Event Trigger : WPS_M1
State C->D
State Transition After = D
Authentication_Type_Flags(M2) = 0x003f
Encryption_Type_Flags(M2) = 0x000f
Config_Methods(M2) = 0x0000
SC_Configuration_Error(M2): 0
State Transition Before = D
Event Trigger : WPS_M2
State D->E
Transition After = E
TX WPS Message Type: W3
Agree Key - hexdump(len=192):
19
d6 9e e4 8e 20 ec ac d5 a5 ce 19 37 be 85 b9 91
6a 00 c0 56 d2 86 73 46 85 c4 39 c6 aa 6c 4b 9e
32 3d be ea d4 ac cf b0 8a 0f e9 22 18 30 04 82
2b 08 39 d9 d3 36 91 42 3f fa bf ab d0 20 82 04
c7 56 a5 c9 73 9e 3e 42 4f 60 26 af 19 a9 37 1e
6f 91 e2 e8 b5 16 57 27 d5 c8 68 71 f3 0f a1 e2
19 73 65 14 38 b8 42 0d 6e c2 1e 1a 47 cc 94 4d
a6 23 e8 02 28 66 7d fa 38 5a 68 6b 2b a3 1c a3
8a 12 b0 5d a6 10 ac c8 b1 81 d4 db 21 ea 26 68
dd 88 30 55 65 b0 fe 83 7d 68 27 96 e7 0e 02 e5
2a 31 b1 75 92 d4 3d e8 12 82 4f 1d 28 eb 2d 2b
27 dc 81 78 27 c3 b8 23 10 ad 65 e5 8c 3a ab c7
Agree Key Len = 192
DH Key - hexdump(len=32):
3f d8 85 ea 39 11 b3 2c 17 c7 ad 61 7f f4 0a 0f
2b 76 00 59 ea cd 1e 59 54 85 70 5a 65 3e 52 0e
Auth Key - hexdump(len=32):
ba 07 9a 35 3f d3 58 fe be d5 46 0e 34 4d 1c de
6e 2e c6 ec cf 04 99 be 67 ab 11 ec 29 69 15 d1
Key Wrap Key - hexdump(len=16):
a1 e6 c4 c8 48 1a 1b ed 32 69 13 93 f7 f5 8d fb
PSK1 - hexdump(len=16):
81 47 4f eb 8c c7 ab 9c 57 60 e3 0a 5f d3 91 c4
PSK2 - hexdump(len=16):
50 12 c9 6a 3b 72 5d 0a ca ea 5b f1 b2 a4 c7 f0
ES1 - hexdump(len=16):
06 18 0a 6b 39 99 1c 13 fb 75 15 17 31 ca d1 21
E-HASH1 - hexdump(len=32):
a4 1d b1 fe 4e f6 de 8b b4 9b 52 7b 6c 58 86 4a
80 c8 0a d6 5d 5a 36 6b 1d 7e b8 09 1a 86 97 31
20
E-HASH1 - hexdump(len=32):
59 33 c0 82 c1 df 4d 91 bd 65 6b 6b 85 44 ea 3d
75 fb 95 1b b8 85 6d e4 e9 55 b3 71 1d 2d 08 b8
Event Trigger : WPS_M3
State E->F State Transition After = F
Event Trigger : WPS_M4
State F->E State Transition After = E
Event Trigger : WPS_M5
State E->F State Transition After = F
Event Trigger : WPS_M6
State F->E State Transition After = E
Event Trigger : WPS_M7
State E->F State Transition After = F
SC_Version
SC_Message_Type = 0xc
SC_Enrollee_Nonce
SC_Encrypted_Settings
encrypted_data - hexdump(len=128):
09 64 e1 c0 9a e7 0f 20 18 62 be 42 99 a3 5b 6e
80 92 87 c1 01 fb b5 a7 d3 2b 54 a8 41 84 6f d7
1a 02 03 32 37 52 70 3f d0 ab 6d 0f aa c4 b8 64
27 36 72 a6 84 6c 55 4e bf 0d 8a e4 42 87 1a 6c
a8 30 11 f9 c4 fb 43 7f 6f 03 4e 77 0a 51 38 c3
36 f2 1f 6a 19 ab d9 10 41 29 01 71 fd 8c 32 a7
03 64 78 25 c8 e2 40 78 b0 c2 28 18 20 61 eb 26
33 95 fc a5 3d 18 d8 e5 06 3b e7 76 38 ac 49 fa
M8_process Key Wrap Key - hexdump(len=16):
a1 e6 c4 c8 48 1a 1b ed 32 69 13 93 f7 f5 8d fb
M8_process Wrap Raw Data - hexdump(len=128):
10 0e 00 6d 10 26 00 01 31 10 45 00 05 54 65 6e
64 61 10 03 00 02 00 20 10 0f 00 02 00 08 10 28
00 01 01 10 27 00 40 62 61 61 39 32 38 30 35 36
36 64 31 38 35 64 63 31 35 66 38 38 36 63 32 63
63 39 38 35 32 65 65 64 39 63 32 37 61 39 62 39
31 61 33 34 35 33 39 30 35 35 63 34 65 31 38 38
37 62 37 32 36 37 32 10 20 00 06 00 b0 0c 05 63
3a 10 1e 00 08 4f cf f1 77 3a a3 c9 af 03 03 03
21
SC_Credential
Num of SC_Credential received = 1
Num of SC_Credential saved = 1
SC_Network_Index
SC_SSID
SSID : Tenda
SC_Authentication_Type
Authentication_Type(M8) = 0x0020
SC_Encryption_Type
Encryption_Type(M8) = 0x0008
SC_Network_Key_Index
SC_Network_Key
SC_Network_Key - hexdump(len=64):
62 61 61 39 32 38 30 35 36 36 64 31 38 35 64 63
31 35 66 38 38 36 63 32 63 63 39 38 35 32 65 65
64 39 63 32 37 61 39 62 39 31 61 33 34 35 33 39
30 35 35 63 34 65 31 38 38 37 62 37 32 36 37 32
SC_MAC_Address
Create config file for wpa_supplicant
Auth Type: 32
Event Trigger : WPS_M8
State F->E State Transition After = E
Event Trigger : WPS_DONE
State E->H State Transition After = H
State Transition Before = H
Event Trigger : EAP_FAIL State H->A
WPS Registration Protocol Completed Successfully !
#cat wps.conf
network={
ssid="Tenda"
proto=RSN
key_mgmt=WPA-PSK
psk=baa9280566d185dc15f886c2cc9852eed9c27a9b91a34539055c4e1887b72672
}