Ardumine Ardumine

Extracting WPA(2)-Enterprise credentials

Step by step guide for n00bs.

Requirements

Make sure you have the following software installed:

EnterpriseWifiPasswordRecover (download release build or compile it yourself)
psexec (download & extract the zip. Optionally you can add the location to your PATH variable)

Guide

Open cmd as administrator, navigate to the directory where you downloaded the extractor tool and run it for the first time:

This gist uses the idf-release/v4.2 release of arduino-esp32, can be found here: https://github.com/espressif/arduino-esp32/tree/idf-release/v4.2

How to downgrade from iOS 15 to iOS 14

The latest SEP/BB as of right now is iOS 15.1, and is partially or fully compatible with iOS 14 depending on your device. See the appropriate section for exact compatibility info.

Prequisites

SHSH blobs for the version you want to downgrade to (e.g. from https://tsssaver.1conan.com/, https://shsh.host/)
macOS or Linux (Ubuntu 20.04 or newer recommended). Windows or a VM will NOT work.

Notes

If the exploit fails even after multiple attempts or your device reboots out of DFU mode, you'll have to start over from the beginning and be quicker next time. (You don't have to redownload anything though.) You may have to force restart your device if it's stuck in DFU.

On the VPS:

Create a 10 year certificate. The "Common Name" (CN) must be the static IP of the instance.
```
openssl req  -nodes -new -x509 -keyout key.pem -out cert.pem -days 3650
```

Run the SoftEther docker with either of the following:

A Single User, SSTP only. Not updated recently (7 years ago at the time of creating the gist)

sudo docker run -d --cap-add NET_ADMIN -e SSTP_ENABLED=1 -e USERNAME=YOUR_VPN_USERNAME -e PASSWORD=YOU_VPN_PASS -e SERVER_PWD=YOUR_SERVER_PASS -e CERT="$(cat cert.pem)" -e KEY="$(cat key.pem)" -p 443:443/tcp fernandezcuesta/softethervpn

	// https://lancaster-university.github.io/microbit-docs/resources/bluetooth/bluetooth_profile.html
	const ACCELEROMETER_SERVICE_UUID = "e95d0753-251d-470a-a062-fa1922dfa9a8";
	const ACCELEROMETER_DATA_UUID = "e95dca4b-251d-470a-a062-fa1922dfa9a8";

	let uBitDevice;
	let sinThetaX = 0;
	let sinThetaY = 0;
	let lastAccelerationX = 0;
	let lastAccelerationY = 0;

	// https://lancaster-university.github.io/microbit-docs/resources/bluetooth/bluetooth_profile.html
	// An implementation of Nordic Semicondutor's UART/Serial Port Emulation over Bluetooth low energy
	const UART_SERVICE_UUID = "6e400001-b5a3-f393-e0a9-e50e24dcca9e";

	// Allows the micro:bit to transmit a byte array
	const UART_TX_CHARACTERISTIC_UUID = "6e400002-b5a3-f393-e0a9-e50e24dcca9e";

	// Allows a connected client to send a byte array
	const UART_RX_CHARACTERISTIC_UUID = "6e400003-b5a3-f393-e0a9-e50e24dcca9e";

	#include <ESP8266WiFi.h>

	extern "C" {
	#include "user_interface.h"
	#include "wpa2_enterprise.h"
	#include "c_types.h"
	}

	// SSID to connect to
	char ssid[] = "TEST_KRA";