Home - WPA Packet Cracking - NOWTVXXXXX

Are these the same as the Sky Q boxes, and can anyone help me with this.

Many thanks

I thought NOWTV was a streaming box and has to connect to an existing
AP or broadband connection?

What is the model of your NOWTV box acting itself as an AP?

Maybe the SSID is just some kind of Wi-Fi Direct connection for the remote
control or other feature?

The NOWTV access point shows as Device name 'Sky Hub', manufacturer 'Sky'.

I am sure I read somewhere these are the Sky Q routers, with the same algorithm, but different SSID.

OK found this image of a NOWTV box which is a router:

They do look like the new SKY ones and also have the same key lol

NOWTV82601
Key: TYYFCVYMVX (I think from what I can see from image)

Follows same SkyQ algo.

Please read the forum rules | Please read the paid section rules
I accept private hash lists, with forum donations only.
BTC: 15qF9WUeFUD63ishxyAMiEgGqTcYzk4j9b
GPU Power: 9x GTX 1070 + 4x GTX 1080

https://en.wikipedia.org/wiki/Now_TV_(Sky)#Now_Broadband_Hubs

Maybe then it is a Now Broadband Hub?
The NR801 Now Broadband Hub Two is a re-brand of the ER115 Sky Q box
A capture with Probe Responses would have been more useful than hccapx

I notice actually just doing a search on the forum that $cI$$0r$ has already solved one.

https://forum.hashkiller.co.uk/topic-view.aspx?t=24579&m=177310#177310

Ah! Ignore my post here update mine above as key starts with 8, not B. Follows exact same SkyQ algo.

Please read the forum rules | Please read the paid section rules
I accept private hash lists, with forum donations only.
BTC: 15qF9WUeFUD63ishxyAMiEgGqTcYzk4j9b
GPU Power: 9x GTX 1070 + 4x GTX 1080

Look like an 8 to me, not a B in the SSID, so same algorithm as Sky Q

Yup! Exactly the same as confirmed by $cI$$0r$ so owned. I can run SkyQ keys in ~4 hrs 20 mins.

Please read the forum rules | Please read the paid section rules
I accept private hash lists, with forum donations only.
BTC: 15qF9WUeFUD63ishxyAMiEgGqTcYzk4j9b
GPU Power: 9x GTX 1070 + 4x GTX 1080

https://imgur.com/naR5YkZ

Just uploading a raw cap too if that helps? 49.2mb.

NOWTV-01.cap (49.2mb)

https://we.tl/t-D4tyNVttq8

It would have been better with an authenticated handshake on a keyspace
this large, but it looks like it must be a Sky Q clone now

OK running it so we shall see We know the key ends in "S" following SkyQ rules.

Please read the forum rules | Please read the paid section rules
I accept private hash lists, with forum donations only.
BTC: 15qF9WUeFUD63ishxyAMiEgGqTcYzk4j9b
GPU Power: 9x GTX 1070 + 4x GTX 1080

Thank you.

Guess.Mask.......: ?2?2?2?2?2?2?2?2?2S [10]
Guess.Charset....: -1 Undefined, -2 NBPYVLMRXTCFWDSQ, -3 Undefined, -4 Undefined
Guess.Queue......: 1/1 (100.00%)
Speed.#3.........:   474.2 kH/s (160.19ms) @ Accel:16 Loops:1024 Thr:1024 Vec:1
Speed.#4.........:   473.9 kH/s (160.28ms) @ Accel:16 Loops:1024 Thr:1024 Vec:1
Speed.#5.........:   477.1 kH/s (157.57ms) @ Accel:16 Loops:1024 Thr:1024 Vec:1
Speed.#6.........:   473.9 kH/s (158.85ms) @ Accel:16 Loops:1024 Thr:1024 Vec:1
Speed.#7.........:   347.3 kH/s (341.00ms) @ Accel:32 Loops:1024 Thr:1024 Vec:1
Speed.#8.........:   352.3 kH/s (323.05ms) @ Accel:32 Loops:1024 Thr:1024 Vec:1
Speed.#9.........:   352.7 kH/s (330.90ms) @ Accel:32 Loops:1024 Thr:1024 Vec:1
Speed.#10.........:   353.2 kH/s (328.12ms) @ Accel:32 Loops:1024 Thr:1024 Vec:1
Speed.#11.........:   353.3 kH/s (323.87ms) @ Accel:32 Loops:1024 Thr:1024 Vec:1
Speed.#12.........:   352.5 kH/s (326.67ms) @ Accel:32 Loops:1024 Thr:1024 Vec:1
Speed.#13.........:   352.7 kH/s (326.38ms) @ Accel:32 Loops:1024 Thr:1024 Vec:1
Speed.#14.........:   353.0 kH/s (333.03ms) @ Accel:32 Loops:1024 Thr:1024 Vec:1
Speed.#*.........:  4716.1 kH/s

Please read the forum rules | Please read the paid section rules
I accept private hash lists, with forum donations only.
BTC: 15qF9WUeFUD63ishxyAMiEgGqTcYzk4j9b
GPU Power: 9x GTX 1070 + 4x GTX 1080

Your just a tad quicker than anything I can achieve here. About 20x quicker in fact.

Thank you.

CRACKED!!

3cc496869b6bb20185593b3c7449358e:a0bdcd6c5492:cc44631214af:NOWTV39BA7:BLCXFXMVPS

Please read the forum rules | Please read the paid section rules
I accept private hash lists, with forum donations only.
BTC: 15qF9WUeFUD63ishxyAMiEgGqTcYzk4j9b
GPU Power: 9x GTX 1070 + 4x GTX 1080

Excellent. Confirmed and repped.

Thanks for that, and helping confirm the NOWTV is just a rebadged job.

Guess.Mask.......: ?2?2?2?2?2?2?2?2?2S [10]
Guess.Charset....: -1 Undefined, -2 NBPYVLMRXTCFWDSQ, -3 Undefined, -4 Undefined
Guess.Queue......: 1/1 (100.00%)
Speed.#3.........:   474.2 kH/s (160.19ms) @ Accel:16 Loops:1024 Thr:1024 Vec:1
Speed.#4.........:   473.9 kH/s (160.28ms) @ Accel:16 Loops:1024 Thr:1024 Vec:1
Speed.#5.........:   477.1 kH/s (157.57ms) @ Accel:16 Loops:1024 Thr:1024 Vec:1
Speed.#6.........:   473.9 kH/s (158.85ms) @ Accel:16 Loops:1024 Thr:1024 Vec:1
Speed.#7.........:   347.3 kH/s (341.00ms) @ Accel:32 Loops:1024 Thr:1024 Vec:1
Speed.#8.........:   352.3 kH/s (323.05ms) @ Accel:32 Loops:1024 Thr:1024 Vec:1
Speed.#9.........:   352.7 kH/s (330.90ms) @ Accel:32 Loops:1024 Thr:1024 Vec:1
Speed.#10.........:   353.2 kH/s (328.12ms) @ Accel:32 Loops:1024 Thr:1024 Vec:1
Speed.#11.........:   353.3 kH/s (323.87ms) @ Accel:32 Loops:1024 Thr:1024 Vec:1
Speed.#12.........:   352.5 kH/s (326.67ms) @ Accel:32 Loops:1024 Thr:1024 Vec:1
Speed.#13.........:   352.7 kH/s (326.38ms) @ Accel:32 Loops:1024 Thr:1024 Vec:1
Speed.#14.........:   353.0 kH/s (333.03ms) @ Accel:32 Loops:1024 Thr:1024 Vec:1
Speed.#*.........:  4716.1 kH/s

how 14 cards :o ?

+rep if i helped
BTC : 1PAyKniGHt7yyCb8HdsziTHBEFX6zkGSHz

I was already convinced but that saved me wasting any electricity on it

We should thank $cI$$0r$ too for cracking one first
Very tragic ending for $cI$$0r$, but maybe a lesson for us all?

Not 14 cards mate its 12 but PCIe slots start from #3 to #14.

I have updated the Wireless Default Keyspace page so it includes the NOWTV##### APs.

Please read the forum rules | Please read the paid section rules
I accept private hash lists, with forum donations only.
BTC: 15qF9WUeFUD63ishxyAMiEgGqTcYzk4j9b
GPU Power: 9x GTX 1070 + 4x GTX 1080

Have you experienced WPA hashrate slowdown with plain wordlists?
I assume you have 1x PCIe here and its bandwidth will be a bottleneck for 1080Ti

Head of cheap publicity department
Support, discounts, free offers for HK members
BTC: 1GPUHASHckzcL2fDXyGSc2WNqpFjJZbFaN

right XD

what mobo as 12 slots in it ?

+rep if i helped
BTC : 1PAyKniGHt7yyCb8HdsziTHBEFX6zkGSHz

What do you mean very tragic ending?

My haschat stuff (rules, scripts): https://github.com/theherp/Hashcat-stuff

Asrock H110 Pro BTC+ has 13 x PCIe slots, 12 of which are 1x speed. Yes, with wordlists + rules, there is a bottleneck due to interface speed being 1x but brute-force is not affected.

Please read the forum rules | Please read the paid section rules
I accept private hash lists, with forum donations only.
BTC: 15qF9WUeFUD63ishxyAMiEgGqTcYzk4j9b
GPU Power: 9x GTX 1070 + 4x GTX 1080