# UIUCTF: CEO


## Description
You just wirelessly captured the handshake of the CEO of a multi-million dollar company! Use your password cracking skills to get the password! Wrap the password in the flag format.

E.g.: uiuctf{password}

## Tags
MISC, Cracking, Beginner

## Attached files
- [megacorp-01.cap](https://raw.githubusercontent.com/Diplodongus/CTFs/main/UIUCTF2021/attachments/megacorp-01.cap?raw=true)
- [rockyou.txt](https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt)

## Summary
This challenge gave a packet capture that contained a wireless connection to an AP with SSID joesheer. I was able to decrypt the password using hashcat version 6.2.3.

## Flag
```
uiuctf{nanotechnology}
```

## Required Software
Hashcat ```sudo apt install hashcat```

## Detailed solution
The first thing I did was open the pcap file in wireshark to see if there was any low-hanging fruit; maybe the password is unencrypted. (Based off the tags, this is obviously not true, but always worth trying.)

Wireshark tells us that there is a connection to the SSID “joesheer”.


From here, I used an online-based cap-to-hccapx converter to put the file in the format that hashcat can utilize properly. (I used https://www.onlinehashcrack.com/tools-cap-to-hccapx-converter.php)

```
**IMPORTANT NOTE:**
IF YOU ARE FOLLOWING THIS WITH SENSITIVE INFORMATION
I.E. A CLIENT DO NOT SEND INFORMATION TO 3RD PARTIES SUCH AS THE WEBSITE ABOVE.
YOU HAVE NO CONTROL OVER WHAT THEY SAVE AND ANYTHING YOU SEND CAN POTENTIALLY BE LEAKED

To do this with more sensitive information / offline,
I would recommend using the official hashcat-utils cap2hccapx.c file.

(https://github.com/hashcat/hashcat-utils/blob/master/src/cap2hccapx.c)
```


Now that I had the file in the correct format, I could use hashcat to crack the file. You must also have a password dictionary for hashcat to try with. I used the official rockyou.txt file which is attached.

```
hashcat -m 2500 wifi.hccapx rockyou.txt --show
```

(Screenshot is in PowerShell, but essentially the same output.)

Within 6 seconds, my GPU was able to crack the WiFi password, and the flag is uiuctf{nanotechnology}.

Original writeup (https://github.com/Diplodongus/CTFs/blob/main/UIUCTF2021/CEO.md).