AWUS036ACH Setup and Configuration (Kali)

I recently picked up a 5GHz/AC Alfa card for engagements, so I wanted to cover AWUS036ACH setup in Kali.

AWUS036ACH Setup – Introduction

While the AWUS036ACH (pictured below) doesn’t work out of the box, support was recently added in the Kali rolling release.

AWUS036ACH Setup - Card

There are a few threads with conflicting results or solutions though.

Verifying Kernel and Installing the Drivers

First, I made sure that my kernel was up-to-date.

root@kali:~# uname -a
Linux kali 4.13.0-kali1-686-pae #1 SMP Debian 4.13.10-1kali1 (2017-11-03) i686 GNU/Linux

Next, I made sure to remove and purge the existing drivers from my system. NOTE: do not think that you can skip this step, or you will probably run into issues later on.

root@kali:~# apt-get remove realtek-rtl88xxau-dkms
root@kali:~# apt-get purge realtek-rtl88xxau-dkms

Finally, I (re)installed the proper Realtek drivers.

root@kali:~# apt-get install -y realtek-rtl88xxau-dkms

Monitor Mode

With the drivers installed, I reconnected the device and verified that it showed up in iwconfig.

root@kali:~# iwconfig
eth0      no wireless extensions.
wlan0     IEEE 802.11  ESSID:off/any 
          Mode:Managed  Access Point: Not-Associated   Tx-Power=12 dBm   
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Encryption key:off
          Power Management:off

lo        no wireless extensions.

Next, I manually put the card in monitor mode to make sure that it could properly switch.

root@kali:~# ifconfig wlan0 down
root@kali:~# iwconfig wlan0 mode monitor
root@kali:~# ifconfig wlan0 up
root@kali:~# iwconfig
eth0      no wireless extensions.
wlan0     IEEE 802.11  Mode:Monitor  Frequency:2.412 GHz  Tx-Power=12 dBm   
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Power Management:off

lo        no wireless extensions.

Finally, I used airmon-ng to verify that I could also enter monitor mode using it.

root@kali:~# airmon-ng stop wlan0
PHY Interface   Driver      Chipset
phy7    wlan0       8812au      Realtek Semiconductor Corp. RTL8812AU 802.11a/b/g/n/ac WLAN Adapter
You already have a wlan0 device but it is NOT in station mode.
Whatever you did, don't do it again.
Please run "iw wlan0 del" before attempting to continue
root@kali:~# airmon-ng start wlan0 6
Found 2 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to run 'airmon-ng check kill'
  PID Name
 4641 dhclient
 4669 dhclient
PHY Interface   Driver      Chipset
phy7    wlan0       8812au      Realtek Semiconductor Corp. RTL8812AU 802.11a/b/g/n/ac WLAN Adapter
        (mac80211 monitor mode already enabled for [phy7]wlan0 on [phy7]6)

Testing Injection

With monitor mode working, the last test for the card was packet injection. I used aireplay-ng and any APs that I could find. While it worked, injection was a bit on the low side.

root@kali:~# aireplay-ng -9 wlan0
21:47:29  Trying broadcast probe requests...
21:47:31  Injection is working!
21:47:31  Found 7 APs
21:47:31  Trying directed probe requests...
21:47:31  8A:xx:xx:xx:xx:xx - channel: 6 - 'CRG'
21:47:35  Ping (min/avg/max): 3.083ms/36.303ms/135.699ms Power: -52.09
21:47:35  11/30:  36%
21:47:35  50:xx:xx:xx:xx:xx - channel: 6 - 'Car-Test-C'
21:47:40  Ping (min/avg/max): 2.724ms/16.048ms/56.770ms Power: -40.50
21:47:40   8/30:  26%
21:47:40  9C:xx:xx:xx:xx:xx - channel: 6 - 'Car-Test-A'
21:47:43  Ping (min/avg/max): 2.529ms/49.418ms/199.492ms Power: -47.21
21:47:43  19/30:  63%
21:47:43  8A:xx:xx:xx:xx:xx - channel: 6 - 'CRG Guest'
21:47:48  Ping (min/avg/max): 4.356ms/80.951ms/200.017ms Power: -52.50
21:47:48   8/30:  26%
21:47:48  34:xx:xx:xx:xx:xx - channel: 6 - 'Internet-ASDF'
21:47:52  Ping (min/avg/max): 2.610ms/48.672ms/196.792ms Power: -70.31
21:47:52  13/30:  43%
21:47:52  00:xx:xx:xx:xx:xx - channel: 6 - 'linksys'
21:47:58  Ping (min/avg/max): 5.073ms/22.112ms/44.140ms Power: -73.00
21:47:58   3/30:  10%
21:47:58  34:xx:xx:xx:xx:xx - channel: 6 - 'WLAN-ASDF'
21:48:02  Ping (min/avg/max): 2.433ms/80.589ms/197.705ms Power: -66.25
21:48:02  12/30:  40%

AWUS036ACH Setup – Conclusion

It was great to have a 5GHz/AC card working, and it was quite easy to set up.

While the injection numbers did disappoint me, I’m hoping those improve with some newer drivers.

That said, I did recently pick up a couple of AWUS051NH cards, and those should do 5GHz in Kali out of the box as well!

doyler on Githubdoyler on Twitter
doyler

Ray Doyle is an avid pentester/security enthusiast/beer connoisseur who has worked in IT for almost 16 years now. From building machines and the software on them, to breaking into them and tearing it all down; he’s done it all. To show for it, he has obtained an OSCP, eCPPT, eWPT, eWPTX, eMAPT, Security+, ICAgile CP, ITIL v3 Foundation, and even a sabermetrics certification!


He currently serves as a Senior Penetration Testing Consultant for SecureWorks. His previous position was a Senior Penetration Tester for a major financial institution.


When he’s not figuring out what cert to get next (OSCE?!) or side project to work on, he enjoys playing video games, traveling, and watching sports.


Leave a Comment

Filed under Security Not Included

Leave a Reply

Your email address will not be published. Required fields are marked *

ERROR: si-captcha.php plugin: GD image support not detected in PHP!

Contact your web host and ask them to enable GD image support for PHP.

ERROR: si-captcha.php plugin: imagepng function not detected in PHP!

Contact your web host and ask them to enable imagepng for PHP.