Category Archives: Rant

Microsoft account in Windows is a silly default

Not to jump on any bandwagons, but this situation is getting now to ridiculous levels. Microsoft made a Microsoft account to be implicit when installing Windows 11. I ran into the situation of having to setup an account without internet access which required having to take a crash course in Shift+F10 followed by running oobe\bypassnro to enable the possibility to create a local user account during Windows 11 installation.

This is a function of time. Microsoft is now planning to get rid of oobe\bypassnro:

We’re removing the bypassnro.cmd script from the build to enhance security and user experience of Windows 11. This change ensures that all users exit setup with internet connectivity and a Microsoft Account.

Ah yes, enhancing security by making it more difficult to run:

@echo off
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE /v BypassNRO /t REG_DWORD /d 1 /f
shutdown /r /t 0

Here’s a new idea: stop robbing people’s choice of deciding which account type to use.

I’m not being a hater here. I am not being even that mad about the change. But what I find utterly infuriating is that Microsoft is now pushing for a product that’s broken by design. Up until yesterday this very machine I am using to type this article has been using a Microsoft account exclusively.

Which takes us to the unintended consequences of pushing this as default. I need to boot into safe mode to clear my video driver as the simple uninstall procedure doesn’t do a good enough job and I needed to run DDU. Basically, the AMD Radeon Pro used by my iGPU doesn’t support VRR (FreeSync) and the AMD Adrenalin driver does support VRR despite installing a “PRO Edition” version of the software. The only difference is that it comes with the default red AMD logo rather than the blue logo used by the Pro version of this driver and, of course, the much desired VRR. It’s not like I can swap my laptop screen to get a different set of features.

Because entering safe mode is a bit of an annoyance with BitLocker enabled and it requires rebooting twice, I simply ran msconfig to enable booting into safe mode via the bootloader config. Here comes the kicker: booting into minimal safe mode actually breaks Windows Hello, so my flashy Microsoft account can’t be used as no authentication method works anymore, whether this is biometrics or PIN (which for all intents and purposes may be a proper password). Great. I got stuck into a login screen that doesn’t work even when attempting to change the boot mode into safe mode with networking in a desperate attempt to see whether the flashing “Microsoft account” does anything. Narrator note: it doesn’t.

This was followed by about an hour of yelling at a screen because the way this default option is implemented is utterly broken. I tried the suggested recovery options: ran the boot trouble-shooter, done a system restore, tried to add a local user via recovery command prompt. None of these worked. What did eventually work is to edit the bootloader via the recovery command prompt:

bcdedit  /deletevalue {default} safeboot

This has finally undone the change made by msconfig. But the story doesn’t end here as creating a local account via the standard GUI got to even more ridiculous levels of anti-user behaviour. So much so that I had to view a YouTube video just to understand what I have been missing.

See, by default when clicking the “Add account” button it doesn’t try to add an account, but it offers an authentication window for a Microsoft account. So the workaround is to click the completely unintuitive link named “I don’t have this person’s sign-in information” which then spins up another screen where “Add a user without a Microsoft account” option is finally available. Which is still rather annoying as it forces the choice of no less than three security questions.

Or, cut out the nonsense and use the CLI:

net user USERNAME PASSWORD /add

As soon as I added a new local user and I anointed that local user as administrator, msconfig & friends came back to life and I could carry out the originally intended work without drama as I had a machine that can actually boot into safe mode and I can authenticate in safe mode into an administrator account.

Do better, Microsoft.

Reproducing KoreK’s ChopChop attack is a pain in the ass

2 Replies

Well, getting a Netgear WNR1000v2, one of the recommended access points by WiFu, was also a pain in the ass since the product is EOL. Imagine my surprise when I couldn’t reproduce this particular attack as the AP was not dropping properly the packets with invalid ICV.

I started to dig for some information. The product that I got was so old that basically was one of those unsold units. It came with the only firmware still available on Netgear’s support site that features WEP support. Actually, the only one who mentions this product in relation to WiFu is Samiux. WNR1000v2h2 is basically a WNR1000v2, but with internal antenna.

The things that I tried, but utterly failed

I tried the Netgear WNR1000v2 AP with firmware versions 1.0.1.1 (the version that was installed on it), 1.0.1.1NA (basically the same as previous, but region locked to USA, so it would stick to FCC’s emission regulations), and 1.1.2.28 (does not feature WEP support).

I dug up my retired ASUS WL-500g Premium. Tried the attack with the following firmwares: OpenWrt 12.09 (built the attitude_adjustment branch myself few months ago due to unstable b43 driver at the time of the 12.09 release), OpenWrt 10.03 brcm-2.4 (Linux 2.4.40, Broadcom STA / wl driver), and the first available factory firmware on ASUS’ support site, v1.9.6.9. Neither of them worked. OpenWrt 12.09 and the factory firmware created the illusion that it works, only to fail few seconds later.

I also tried to create a basic soft AP using hostapd. In reality, not all the drivers and hardware are the same. While it theoretically supports the nl80211 library in order to talk to devices that use mac80211 drivers, only some of the chips that support master mode can actual create a working AP.

My first try was a proof of concept on a piece of Raspberry Pi, but it didn’t work as I was using my portable stuff instead of the toys that stay at home in my proper Wi-Fi lab. I tried to create an AP using Unex DNUA-93F, powered by AR9271, but I had nothing to test it with. While Kali works on VirtualBox / OS X, the USB support is spotty at best and this card is the only one that can be used with a certain degree of reliability. So I had to switch to an ALFA AWUS051NH, powered by RT2770. I could get reliable packet injection starting from a fragmentation attack, but no dice with ChopChop.

In my home lab I tried to create a proper soft AP on a machine which runs Kali, but as previously mentioned, not all the hardware is the same. I tried to create an AP with the legendary ALFA AWUS036H, powered by RTL8187. For some reason, hostapd won’t start with this card if WEP is in use. Running hostapd with -dd added more confusion, hence I switched to the built in wireless interface, an AirForce One 54g, powered by BCM4318. The AP was created successfully, but every connected client wouldn’t finish the authentication and the log was flooded with “wlan0: STA […] did not acknowledge authentication response”. Which was odd as WL-500gP has the same Mini PCI card in it.

What finally worked

I created a soft AP using a TP-LINK TL-WN722N, powered by AR9271 (same as Unex DNUA-93F). For the internet connectivity I used the built in AirForce One 54g to connect to my actual AP.

For the configuration I used the information posted by nims11’s article about how to create a soft AP, but I used dnsmasq as DHCP server because dhcpd was being a pain in the ass (you can see a pattern here).

The hostapd config in /etc/hostapd/hostapd.conf:

interface=wlan2
driver=nl80211
ssid=wifu
hw_mode=g
channel=3
macaddr_acl=0
ignore_broadcast_ssid=0
auth_algs=1
wep_default_key=0
wep_key0=AABBCCDDEE

The dnsmasq config in /etc/dnsmasq.conf:

# disables dnsmasq reading any other files like /etc/resolv.conf
no-resolv
# Interface to bind to
interface=wlan2
# Specify starting_range,end_range,lease_time
dhcp-range=10.0.0.3,10.0.0.20,12h
# dns addresses to send to the clients
server=8.8.8.8
server=8.8.4.4

The initSoftAP for starting up the stuff:

#!/bin/bash
#Initial wifi interface configuration
ifconfig $1 up 10.0.0.1 netmask 255.255.255.0
sleep 2
 
###########Start dnsmasq, modify if required##########
if [ -z "$(ps -e | grep dnsmasq)" ]
then
 dnsmasq
fi
###########
 
#Enable NAT
iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain
iptables --table nat --append POSTROUTING --out-interface $2 -j MASQUERADE
iptables --append FORWARD --in-interface $1 -j ACCEPT
 
sysctl -w net.ipv4.ip_forward=1
 
#start hostapd
hostapd /etc/hostapd/hostapd.conf
killall dnsmasq

Started it with ./initSoftAp wlan2 wlan0 (under root, obviously). I did the double-NAT over Wi-Fi because I was too lazy to add another patch cable over the already crowded desktop. Otherwise, it would be ./initSoftAp wlan2 eth0.

I booted up my desktop machine, started Kali in a VirtualBox VM, and made the ALFA AWUS036H to be available inside the VM. Did the usual drill (airmon-ng, airodump-ng, etc). I had to keep the antennas about 1.5 meters apart due to their radiation pattern.

I used my phone as testing client. I could browse the ‘net and I got the 10.0.0.3 IP via DHCP, as instructed by dnsmasq. The ChopChop attack was running in unauthenticated mode, but the packets fetched from the phone as client were not usable. In fact, I don’t recall getting usable packets in unauthenticated mode.

I fired up another instance of aireplay-ng running fake auth and retried the ChopChop attack in authenticated mode. The first captured packet was a winner. Bam! I got the plaintext capture and the PRGA / xor file. Few minutes later, after creating an ARP packet with packetforge-ng and injecting it via interactive packet injection, I managed to crack the WEP key, therefore successfully completing the ChopChop challenge.

The end

It took me two long days, but I did learn a lot. I think the WiFu lab can be reduced to my desktop machine, running a couple of VirtualBox VMs (one for Kali, one for a soft AP), two Wi-Fi USB adapters, and a wireless client to play the victim role. This can be either a phone, a tablet, a notebook (this may be the host machine for VirtualBox and the victim), or another VM plus another USB adapter. I think hunting for old hardware for this course is a flawed idea. Sure, ALFA AWUS036H may be used after finishing this course, but the AP is going to be virtually useless.

Fixing the AMD AHCI drivers for SB7xx on Windows 7

24 Replies

I heard a lot of urban legends about the Windows Update service that messes up your machine. Of course, I dismissed all of them with the classic “worksforme” as didn’t happen to me. Until Microsoft delivered a 3rd party driver update via an optional package. You know, like the stuff that comes from the vendor and it isn’t properly tested. I had the lack of inspiration to check that too instead of simply ignoring it, like I usually do with Bing Desktop and Silverlight. The next thing was a BSOD at boot.

Had to disable the AHCI in BIOS and revert to using IDE mode for the SATA ports. Which kinda sucks for some reasons. The most important: the SSD performance is hurt under IDE mode, the TRIM command won’t work under IDE mode without 3rd party software since only the MSAHCI driver implements TRIM from Windows 7, and the fact that my HDD array doesn’t support NCQ under IDE mode.

When it comes to drivers, AMD is still a shitty company. Even more, their engineers didn’t grasp the concept of backward compatibility. Uninstalling the driver that broke my installation and installing a driver that works proved to be a non-trivial task. Fortunately I found this post on pchelpforum.com.

For the sake of avoiding the link rot, I’m going to reproduce the essentials for posterity, with the same disclaimer as the original – you’re on your own if you mess up your machine and I’m not taking any responsibility if you follow these:

Delete any older version of the amd_ahci driver from here: C:\Windows\System32\DriverStore\FileRepository. The folders with older AMD AHCI drivers are named something like: amd_sata.inf_amd64_neutral_c85cc6046149a413 (i386 on 32-bit and most probably another hash). In order to remove the directory, you need to either elevate your explorer / shell to SYSTEM privileges, or take the ownership of the driver directory, add proper permissions, then delete it.
From HKLM/SYSTEM/CurrentControlSet/services delete amd_sata and amd_xsata. There’s no need to remove the entries without the underscore (amdsata and amdxsata).
Reboot the computer. Don’t change from IDE to AHCI. The driver that actually worked for my combination, which is AMD 780G / SB700 is this one. Execute the installer, wait till it finishes to copy the files to C:\ATI\Support, then cancel the setup when the Catalyst installer starts.
Open the Device Manager. Action » Add legacy hardware » Advanced mode » Show All Devices » Have Disk. Browse the extraction path for the above package: C:\ATI\Support\11-12_vista32-64_ahci\Packages\Drivers\SBDrv\SB7xx\AHCI. There’s a couple of directories: LH – for 32-bit and LH64A – for 64-bit. Select “AMD SATA Controller” then continue. Unlike the author of the original material, I didn’t get an error about the device not starting.
Reboot the computer. Don’t change from IDE to AHCI. Go to Device Manager. Under IDE ATA/ATAPI controllers should be at least an entry with a yellow exclamation mark, AMD SATA Controller. Uninstall “AMD SATA Controller” without checking “Delete the driver software for this device”. Reboot the machine.
Go to BIOS, enable AHCI. After boot, the OS installs the proper drivers, then prompts for another reboot. Reboot the machine. Done.

In my case, it simply fixed the driver installation from the failed Windows update as the driver that runs on my machine is from 2013 and the driver used in the above steps is from 2011. The drivers from the latest Catalyst, 13.4 failed to install via the “Add legacy hardware” method or via a standard Catalyst setup.