Author: Damien BENAZET Version : 1.

0 26/01/2011

How to crack the Wi-Fi (WEP/WPA)

encryption key of a Bbox.

1
Copyright IT Helps! © 2011. All Rights Reserved.
 Author: Damien BENAZET Version : 1.0 26/01/2011

This tutorial shows you how to crack the Wi-Fi encryption key (in WEP or

WPA) of a Bbox, the Bouygues Telecom’s router.

It is possible since the WEP/WPA encryption key is generated according to the

hexadecimal part of your SSID (the name of your Wi-Fi network that anybody can

see) and the algorithm to do this is now public.

Note: As this is a fault from the manufacturer Thompson, you can do this on all
Thomson TG787 routers with factory settings.

Note2: This tutorial is for strict education and preventive purposes only. This is

against the law and you have to remind it. So please follow our recommendations at

the end of this tutorial to prevent your equipment to be cracked that way.

(Many thanks to M1ck3y from www.crack-wpa.fr for the algorithm and the instructions

on how to use it)

2
Copyright IT Helps! © 2011. All Rights Reserved.
 Author: Damien BENAZET Version : 1.0 26/01/2011

Step 1:

Download the right version of the generator BBkeys for your operating system (available on
Windows and Linux).

[Linux]: http://www.crack-wifi.com/forum/img/images/bbkeys/software/bbkeys

[Windows]: http://www.crack-wifi.com/forum/img/images/bbkeys/software/bbkeyswin.exe

Step 2a (Linux):

Once you have downloaded the package, run it with you terminal (by typing bbkeys once you
have placed your terminal in the same location than the package).

You should have the following:

3
Copyright IT Helps! © 2011. All Rights Reserved.
 Author: Damien BENAZET Version : 1.0 26/01/2011

In this example, let’s assume that the Bbox we want to crack has the SSID Bbox-3983BC. As
mentioned earlier, the encryption key is generated with the hexadecimal part of the SSID,

here 3983BC.

Enter then the following command: bbkeys -v -i 3983BC (-v for verbose mode and display
every actions on your terminal and –i to indicate the hexadecimal part)

As expected the algorithm gave us the potential encryption key that you will have to
enter when you want to connect to this Bbox by Wi-Fi.

Note that if multiple keys are possible to make with this SSID the algorithm will list

them for you or you can save all of them in a separate file with the option –o file path

4
Copyright IT Helps! © 2011. All Rights Reserved.
 Author: Damien BENAZET Version : 1.0 26/01/2011

Step 2b (Windows):

For Windows it is pretty much the same process. Once you have downloaded the

executable, just double click on it to execute it. You will have the following welcome screen:

In this example, let’s assume that the Bbox we want to crack has the SSID Bbox-3983BC. As
mentioned earlier, the encryption key is generated with the hexadecimal part of the SSID,
here 3983BC.

Enter then the following command: bbkeyswin -v -i 3983BC (-v for verbose mode and display
every actions on your terminal and –i to indicate the hexadecimal part)

As expected the algorithm gave us the potential encryption key that you will have to enter
when you want to connect to this Bbox by Wi-Fi.

5
Copyright IT Helps! © 2011. All Rights Reserved.
 Author: Damien BENAZET Version : 1.0 26/01/2011

Note that if multiple keys are possible to make with this SSID the algorithm will list them for
you or you can save all of them in a separate file with the option –o file path

Recommendations:

As Bbox is mostly used in France, the following screenshots are in French. However,

if you have a Thompson TG787 in another language, the principle remains the same so

please read carefully.

To avoid this kind of trouble to your router you should follow these advices to maximize the
security on your network:

1. Go to the administration interface of you Bbox by entering 192.168.1.254 in

the address bar of your favorite web browser.

6
Copyright IT Helps! © 2011. All Rights Reserved.
 Author: Damien BENAZET Version : 1.0 26/01/2011

2. Go the Wi-Fi configuration and login with the default credentials (admin/admin
if you didn’t change them)

3. In this first tab, change the SSID of your network by what you want (not your
address or a distinctive name to identify you directly for an unknown person).

7
Copyright IT Helps! © 2011. All Rights Reserved.
 Author: Damien BENAZET Version : 1.0 26/01/2011

4. Then go to the security tab and scroll-down the option and choose WPA2 and

set the password to something that you like, you can remember and follow

these two requirements:

 Equal or more than 8 characters

 A mix of alphanumerical characters and special ones like: !@#$%.,:?

(To improve the security of your network, you can also tick the option to hide your SSID, which means
that you will have to enter it manually when you want to connect to it)

5. Apply your changes.

6. You will have to reconnect to your new Wi-Fi network by choosing the new
SSID and enter the new password. We also recommend that once all of these

is done you go back to your administration interface and change the password

of the admin user like the WPA2 but different by clicking on “Modification du
mot de passe” on the left panel.

8
Copyright IT Helps! © 2011. All Rights Reserved.