[Conch Shell]

Got Routers Wifi default Password with Router MAC Address

Belkins Mac Address and WPA/WPA2 key correlation:

steps:
1.) Find the wlan mac address of the target router 08:86:3B:05:3A:41
2.) Add 1 to the end of the mac address: 08:86:3B:05:3A:42
3.) Remove the first 2 pairs from the mac address (08:86), so you're left with 3B:05:3A:42
4.) Take the 8 characters in the mac address and rearrange them so they are in this order: 62:38:51:74. So 3B:05:3A:42 would change to AB023345.
5.) Use this conversion chart and replace the corresponding values we just calculated,
AB023345.
Code:
0123456789ABCDEF
944626378ace9bdf
So,
Code:
A = c
B = e
0 = 9
2 = 4
3 = 6
3 = 6
4 = 2
5 = 6
The password is ce946626

If you're struggling with step 4. -- PM me.

Warm regards,
Conch.

[bb1ox1bb]

do u got some success ? on with routers?

[magicslurp]

I don't know why I thought this would work lol

[LT374L]

Can't understand well step 4. Can u tell more for that ?

[Mad76e]

I don't know why I thought this would work lol

It does! Do proper research first

Theres a bunch of vulnerable Belkin routers out there that has this problem
It evolves around CVE-2012-4366

Vulnerable Belkin routers
F7D1301, F7D3302, F7D3402, F7D4301, F7D7301, F5D7234-4, F7D2301, F7D4402, F7D5301, F7D8301, F9J1102, F9J1105 , F9K1001, F9K1002, F9K1003, F9K1004 and F9K1105

https://forums.kali.org/showthread.php?1...orrelation

https://bitbucket.org/dudux/belkin4xx/src

Wanna try your Belkin router? Test it here...
http://198.61.167.113/belkinwpa/

---

do u got some success ? on with routers?

Around 3 of 5 tested works for me! and that's pretty good so 60% However i don't have many Belkins around me

[Mr. Escrow]

I can see about 35 AP's from my living room, already exploited the WPS, I wonder how many this would work on

[Sharkky]

wow seriously it works ? :D
I'll try as soon as I can, I say you then :)

Anyway, thanks :)

[luigi94]

wow seriously it works ? :D
I'll try as soon as I can, I say you then :)

Anyway, thanks :)

this is an algorithm to create password from mac so basically every router that uses this algorithm is vulnerable

[shep100uk]

anyone no a method for sky routers
thanks

[Root one]

Is this a joke? No way such thing is possible. I'm not going to get in depth. But let's say we have 3 UBNT devices same model, different MAC addresses. so each one would have a different backdoor while Hardware ID has nothing to do with the firmware they flash it with!

[Mad76e]

Is this a joke? No way such thing is possible. I'm not going to get in depth. But let's say we have 3 UBNT devices same model, different MAC addresses. so each one would have a different backdoor while Hardware ID has nothing to do with the firmware they flash it with!

Its more common than you think.. Belkin is not the first one..

Below is about Thomson based routers ( as Speedtouch, Thomson, BTHomeHub etc.. but its perhaps to old to be used nowadays..

http://www.mentalpitstop.com/touchspeedc..._ssid.html

[JustEnter]

Can't understand well step 4. Can u tell more for that ? or pm me please.

[Rogers Communications]

I don't understand step 4? doesn't make sense..

here is a mac addy 77:41:9E:84
its a Pegatron Router

[QuickWick]

Can you explain step #4? It doesnt make sense to me.

edit: got it. you reogranized everything.

[Conch Shell]

I've just found out that I can't send PMs because I don't have enough posts.
I'll explain step 4 here for the people having difficulty.

The algorithm works like this:
I'll take the snippet from my main post:
3.) Remove the first 2 pairs from the mac address (08:86), so you're left with 3B:05:3A:42
4.) Take the 8 characters in the mac address and rearrange them so they are in this order: 62:38:51:74. So 3B:05:3A:42 would change to AB023345.

Now let's take a completely random MAC Address.
0C:47:90:1A:22:F4

Rearrange the MAC counting the last 8 digits.
So if we start with 62.
9 0 1 A 2 2 F 4
1 2 3 4 5 6

2 is the first part.
9 0 1 A 2 2 F 4
1 2

it's 0

so 62 becomes 20
Next part is 38

as before:
9 0 1 A 2 2 F 4
1 2 3

so 3 = 1
9 0 1 A 2 2 F 4
1 2 3 4 5 6 7 8

and of course: 8 becomes 4

so 901A becomes: 2014

Continue with :51:74 -- Then use the chart to discover the PSK.


This is for Enstall.
59:47:fa:2a
A9:4A:F5:27

Using the chart:
ca2cf647 is the PSK.