Wireless Network Penetration: How We Compromised a WPA2-Enterprise Network at a Fortune 500

The Assumption: WPA2-Enterprise Is Uncrackable

WPA2-Enterprise with 802.1X authentication is substantially more secure than WPA2-Personal. There is no shared PSK to crack. Authentication is per-user, certificate-based. It is the correct choice for enterprise environments. It is not, however, immune to client-side misconfiguration.

The Attack: Evil Twin with RADIUS Interception

Using a laptop with two wireless adapters, we broadcast an access point with the same SSID as the corporate network. Our "RADIUS server" on the evil twin did not present a valid certificate — it presented a self-signed certificate. The question was whether client devices were configured to validate the server certificate.

They were not. Zero of the 23 Windows laptops that connected to our evil twin challenged the certificate. Each device presented its corporate credentials (NTLM hash) to our RADIUS server in the handshake.

Cracking NTLM Hashes Offline

The captured NTLMv2 hashes were taken offline for hashcat cracking. A workstation with a modern GPU processed approximately 140 billion guesses per second against an NTLM hash. Five of the 23 captured hashes were cracked within 4 hours using a combination of a 14-character wordlist and rule-based mutations. One belonged to a domain administrator.

The Fix: Certificate Validation Enforcement

The remediation is entirely on the client side: configure wireless profiles to validate the RADIUS server certificate against a specific trusted CA and certificate fingerprint, and prevent users from accepting untrusted certificates. This is a Group Policy configuration in Windows environments and can be deployed centrally.

Physical Security Note

This attack was conducted from a café within signal range of the headquarters. No physical access to the building was required. Wi-Fi penetration testing scope should always include coverage from public areas adjacent to the facility.