WPA-Enterprise Home Lab

While training for the Offensive Security OSWP certification I needed to set up
a WPA-Enterprise lab. This documents how I did that.

Setup

To make things easier I have created a reopsitory that will help you setup a
Kali Linux virtual machine with vagrant. This will install FreeRadius provide
the config files needed. I will be using this vm to walk you through the setup.
If you choose not to use the VM the steps are mostly identical depending on the
distro.

FreeRadius

To begin with we will need a RADIUS server. I feel the easiest way to get
started to with FreeRadius. On Debian-based distros simply install with apt.

sudo apt-get install -y freeradius

If you are using my vagrant reopsitory it will install FreeRadius when it
provisions the box.

Once FreeRadius has been installed you can test things out in debug mode with
the following:

freeradius -X

If you get the following error then there is already a freeradius server running.

Failed binding to auth address * port 1812 bound to server default: Address already in use
/etc/freeradius/3.0/sites-enabled/default[59]: Error binding to port for 0.0.0.0 port 1812

You will need to find and kill the process and then stop the service to prevent
it from starting up again. Once you have everything set you may restart the
service.

Initial Tests

Edit /etc/freeradius/3.0/mods-config/files/authorize and add the following to
the top of the file before anything else.

testing Cleartext-Password := "password"

Run freeradius -X again and in another terminal run the following:

radtest testing password 127.0.0.1 0 testing123

If you are using the vagrant box you can look at the authorize file in
/vagrant/config/freeradius/authorize for a referance. You can also simply
copy the file with the following:

sudo cp /vagrant/config/freeradius/authorize /etc/freeradius/3.0/mods-config/files/

Adding A Client

In this case, a client is an AP.

To do so, modify /etc/freeradius/3.0/clients.conf with the content below:

client new {
    ipaddr = 192.168.1.1
    secret= Cougar
}

Configure the The AP

The next step is to set up the AP. Each AP is different so I will only cover
mine to give you an idea of what to do.
First, log into your AP. For me all I need to do is to go to http://tplinklogin.net
and log in with the username and password below:

user: admin
passwd: admin

Next, go to Wireless 2.4GHz > Wireless Security. Select the WPA/WPA2-Enterprise
radial. In the radius server, IP put the IP of the machine running freeradius.
If you are running the vagrant box, this is the host machine not the ip of the
vm. I have already taked care of the port forwarding for you. Since this is a
wired machine you can find the IP in DHCP > DHCP Clients List

Try to connect to the new client with the user you created.

Connecting

To connect we will be using wpa_supplicant since this is what you will need to
do when taking the OSWP. For this we need a config file. The following should
work for you if you followed along.

# wpa_supplicant -i wlan0 -c ./wpa_supplicant.conf

network={
  ssid="TP-LINK_2.4GHz_590609"
  scan_ssid=1
  key_mgmt=WPA-EAP
  identity="testing"
  password="password"
  eap=PEAP
  phase1="peaplabel=0"
  phase2="auth=MSCHAPV2"
}

Copy and past the above to a file called wpa_supplicant.conf. With that saved
run wpa_supplicant with the following.

wpa_supplicant -i wlan0 -c ./wpa_supplicant.conf

In another terminal run the following to finish the connection.

sudo dhclient wlan0