|
1 | | -# Ethsploiter |
| 1 | +# Ethsploiter |
| 2 | + |
| 3 | +> An ethernet card emulator for exploiting network vulnerabilities in local environment. |
| 4 | +
|
| 5 | +[](https://github.com/maxiwoj/Ethsploiter/releases/latest) [](https://github.com/maxiwoj/Ethsploiter/blob/master/LICENSE) |
| 6 | + |
| 7 | +Ethsploiter is a device for tricking the computer behind a firewall (or not connected to the Internet at all) and exploiting vulnerabilities that are not accessible from the Internet. The computer does not need to be unlocked for the attack to succeed. |
| 8 | +It uses `libcomposite` module with `ConfigFS` for emulation and is highly extendable, the configuration can be dynamically changed during the attack for extending the attack vector and emulation of e.g. HID. |
| 9 | + |
| 10 | +Implemented attacks are just a proof of concept of the attack and will probably not work on fully updated systems. It is possible to implement more exploits that could be used against updated software. |
| 11 | + |
| 12 | + |
| 13 | + |
| 14 | +## Features |
| 15 | +- exploiting locked computers in private/isolated networks through USB |
| 16 | +- emulation of composite device (USB Mass Storage device + Ethernet over USB card) |
| 17 | +- fully automated attack process that triggers various exploits |
| 18 | + |
| 19 | +### Demo |
| 20 | +Demo is available on YouTube: |
| 21 | + |
| 22 | +[](https://www.youtube.com/watch?v=Uiu7IylVNGs) |
| 23 | + |
| 24 | + |
| 25 | +## Instalation |
| 26 | +### Prerequisites |
| 27 | +In order to use the Ethsploiter the user needs: |
| 28 | +- Raspberry Pi Zero |
| 29 | +- MicroUSB-USB cable to connect Raspberry Pi to the target computer |
| 30 | + |
| 31 | +### Clone |
| 32 | +Clone the repository on your raspberry pi into the home directory of user pi (can also be other, but some adjustments will have to be made) using git: |
| 33 | +```shell |
| 34 | +$ git clone [email protected]:maxiwoj/Ethsploiter.git |
| 35 | +``` |
| 36 | +### Setup |
| 37 | +The consists of 2 main directories: |
| 38 | +- exploits - this directory contains all the exploit scripts, that are used to exploit the computer. |
| 39 | +- rpi - this directory contains files in directories that represent the raspberry pi `/` directory. Some files are need to be placed under `/boot` directory, some in `etc`. In order to setup the Raspberrry Pi the user needs to copy appropriate files to appropriate directories. |
| 40 | + |
| 41 | +Some required adjustments and installations are made by running the script: |
| 42 | + |
| 43 | +```shell |
| 44 | +$ cd Ethsploiter |
| 45 | +$ ./rpi-setup.sh |
| 46 | +``` |
| 47 | + |
| 48 | +## Usage |
| 49 | +After successfull configuration of the raspberry Pi, the only thing that needs to be done is to plug the device the computer. It can be done by connecting the microUSB cable with the standard USB port on the computer. Please note, however, that the cable needs to be plugged to the host socket of the raspberry, not the one used for charging (no extra charing is required for this setup). |
| 50 | + |
| 51 | + |
| 52 | + |
| 53 | +### Troubleshooting |
| 54 | +When configuring the device, some problems may appear. Some Information and commands below might be helpful to debug and find the reason of the problem: |
| 55 | + |
| 56 | +Logs of the `rc.local` service can be retrieved using commend: |
| 57 | +```shell |
| 58 | +$ systemctl status rc.local.service |
| 59 | +``` |
| 60 | + |
| 61 | +Some events with USB are logged system-wide and can be retrieved by using the good old friend: |
| 62 | +```shell |
| 63 | +$ dmesg |
| 64 | +``` |
| 65 | + |
| 66 | +If the ethernet card is not identified correctly, the problem probably is connected with the `libcomposite` configuration. `libcomposite` module configuration by `ConfigFS` is run from the rc.local service and all the output is saved by default to: |
| 67 | +`/home/pi/Ethsploiter/runtime/ethsploiter_startup.log`. |
| 68 | + |
| 69 | +The attack logs are stored by default in: `/home/pi/Ethsploiter/runtime/attack.log`. However, this file contains only general logs - every attack creates a separate file for logs. Paths to all those files are printed in the attack log file. |
| 70 | + |
| 71 | +## Documentation |
| 72 | + |
| 73 | +### Ethernet card emulation |
| 74 | +Since the solution has been designed to work with all most popular operating systems (Windows, Linux, OS X) the configuration had to be adjusted. There are 2 major ethernet over USB protocols (RNDIS and CDC ECM) and not all systems support all of them. Linux based operating systems have support for both protocols, but Windows supports only RNDIS and OS X only CDC ECM. In order for all the systems to work, there has been created 2 separate configurations for both protocols. Configurations are connected to USB0 and USB1 network interfaces that are spanned by virtual interface - BR0 (bridge) in order to simplify further interaction with the created network. |
| 75 | + |
| 76 | + |
| 77 | + |
| 78 | +### libcomposite configurations |
| 79 | +For emulating the ethernet card (in a composite device) a `libcomposite` module has been used. Configuration for the `libcomposite` module can be found in the file [ehtslploiter_startup](https://github.com/maxiwoj/Ethsploiter/blob/master/rpi/ethsploiter_startup.sh). It is a script that creates all the necessary files through `ConfigFS`. The overall configuration of the libcomposite module is shown below: |
| 80 | + |
| 81 | + |
| 82 | + |
| 83 | +The device emulates simultaneously a network card as well as a mass storage device (as a composite device). |
| 84 | + |
| 85 | +### DHCP server |
| 86 | +In order for every computer to recognise a new network (that the emulated card is giving access to) it is required to contain a DHCP server that could respond with an IP address for the computer. In the configuration a mock DHCP server has been created that always responds with the same IP address since there is only one computer connected to the network (victim's computer). This simplifies the configuration (no need to discover the victim's computer address, no DHCP server configuration) and also at the same time tries to exploit the shellshock vulnerability that was present in some older DHCP client services. |
| 87 | + |
| 88 | +## Contributions and Further development |
| 89 | +Contributions are more than welcome, most valuable are the ones that implement functionalities stated in the 'TODOs' section in the bottom of README. |
| 90 | + |
| 91 | +## Authors and acknowledgment |
| 92 | +This project has been created as an experiment during the master thesis research on the AGH University of Science and Technology in Cracow under supervision of [dr Łukasz Faber](https://github.com/Nnidyu). The investigation concerned "Emulation of devices as a penetration testing method". |
| 93 | + |
| 94 | +## License |
| 95 | +[](https://github.com/maxiwoj/Ethsploiter/blob/master/LICENSE) |
| 96 | + |
| 97 | +This project is just a result of an experiment testing the security in a local environment. It has neither been created nor designed for any illegal purposes. |
| 98 | + |
| 99 | +## TODOs |
| 100 | +- implementation of a setup script automating the Raspberry Pi setup |
| 101 | +- implementation of more general attacks that could use the advantage of direct connection to the computer |
| 102 | +- implement a fully working composite device configuration that could be successfully recognised by the most popular operating systems (Winodows, Linux and OS X - currently on Windows only Ethernet card is being recognised fromt the composite device) |
| 103 | +- integration with other USB exploiting tools (such as poison tap or Rubber ducky) |
| 104 | + |
| 105 | + |
0 commit comments