search

samyk / poisontap

Exploits locked/password protected computers over USB, drops persistent WebSocket-based backdoor, exposes internal router, and siphons cookies using Raspberry Pi Zero & Node.js.
https://samy.pl/poisontap/
6.22k stars 994 forks source link

Pi Zero not recognized as ethernet controller #123

Open valentin8709 opened 7 years ago

valentin8709 commented 7 years ago

Hello guys! First, thank you for this tool, this is great and I love the idea! I tried to test poisontap on my Pi Zero, but it didn't work. Here is the step I did:

But... my computers (macbook 2008, fedora 25 on MSI GS60 or Windows 8.1 on the same GS60) doesn't recognize anything. I tried to switch the idProduct and Vendor as described in the github, but nothing changed.

I must have missed something, do you know where? I am asking myself if I need a special USB cable (I use the one I use to transfer data on my smartphone).

Thank you for your help =)

samyk commented 7 years ago

I would open up a tool like the Device Manager on Windows, run lsusb on Linux or run system_profiler SPUSBDataType on macOS and share the outputs so we can see whether it's at least coming up.

valentin8709 commented 7 years ago

Yep I should have done that before. Thanks for helping me. Unfortunately, there is no difference between a lsusb with Raspberry and one without Raspberry...

Perhaps my Raspberry missed something? If I add a Wifi dongle, I can connect on my Pi with SSH, so both micro USB are working too...

samyk commented 7 years ago

Anything happen in /var/log/{syslog,messages,system.log} when plugging it in? I would try another USB cable anyway.

valentin8709 commented 7 years ago

I tried with another cable, same behaviour. Nothing in the logs... Wouldn't be around the "thing" who turn the Raspberry into an ethernet controller? I just don't know how this part works, I guess this is these lines who enable it. 

echo "dtoverlay=dwc2" >> /boot/config.txt
echo -e "dwc2\ng_ether" >> /etc/modules
samyk commented 7 years ago

Are you using the right USB port on the Zero?

valentin8709 commented 7 years ago

Yes I think, the one who's used in the videos / pictures, in the middle of the raspberry. It is also the one I use sometimes to plugg a wifi dongle, with a wlan0 interface configured in the /etc/network/interfaces file. But I never specified anything in the interfaces about the USB port. Could it be the problem?

valentin8709 commented 7 years ago

Alright I tried to comment the wlan0 section in /etc/network/interfaces. Now there is only loopback interface and usb0 interface, but same behaviour... I understand nothing =(

dernyn commented 7 years ago

Properly Enabling Gadget mode on the SDHC card with the proper Text Editor

You seem to be having a problem with the device not getting into USB Gadget mode, verify that you are not using the windows notepad.exe or a text editor that can not handle POSIX (new line or LF), etc. to edit the config.txt and the cmdline.txt files, this is a known issue within the LINUX or RPI community when editing Unix/Linux files. So use Notepad ++ if it's a windows machine editing the files and go to the edit tab, go to EOL Conversion and select (Unix), and then edit the file. These two files may have to be replaced if the EOL conversion does not work to fix your previous editing with a non-LF text editor , and then you will have to redo the changes to config.txt and the cmdline.txt files, your best bet is to backup your current progress with win32imager under windows, re-copy which will replace your previous wrongful editing with the original (.txt) files either from the .img file or from the web GitHub repo.

Raspberry Pi Zero USB Functionality native HOST/GUEST modes

Pay close attention ....the firmware Self detects the USB modes on boot up. be aware! The raspberry Pi Zero can be a USB host and a USB guest, but not both at the same time. host mode allows USB hubs and single devices, etc. to be attached to the PI Zero. guest mode is strictly for the gadget mode feature, in which it's a 1:1 direct connection with a computer, aka OTG mode. So if you have a USB Hub attached and booted already, you can not also go in OTG Mode by plugging in an OTG cable.

Raspberry Pi Zero OTG Mode/USB Gadget mode in windows machines

There is some background knowledge which kinda has to happen, mostly on the windows side of things if you are using Winblows. -for some win. systems, an (Acer USB Ethernet/RNDIS Gadget) driver for the RPI Zero USB Gadget mode has to get downloaded and installed, I saw this on an old Instance of windows 10 32 bit(x86), 64 bit seems to download the driver, or natively has the driver and does this for you and installs it just fine. Check out= (http://www.catalog.update.microsoft.com/Search.aspx?q=USB%20RNDIS%20Gadget) and (http://domotique.caron.ws/wp-content/uploads/telechargement/RPI%20Driver%20OTG.zip)

I encounter this very issue on an old laptop, this may be the case.

Samyk as I said on twitter, this network trick to highjack the network connections traffic is brilliant! It's my favorite part of this implementation.

also, a good Idea is to have dd images for SD cards in the 8gb or 16gb flavors for people to simply dump the latest Raspbian vanilla with PoisonTap already implemented, I know this may be an image maintenance nightmare, but it's just a suggestion.

valentin8709 commented 7 years ago

Thank you very much for the information!! I will test it and give a feedback here =)

s0j0hn commented 6 years ago

Same problem on my windows 10, raspberry pi zero recognised only as Usb serial com device. No way i can make it rndis ethernet gadget, any help ?

dernyn commented 6 years ago

you need the driver I listed above.

s0j0hn commented 6 years ago

even if it isn't acer laptop ? It isn't a old laptop.

dernyn commented 6 years ago

it has nothing to do with acer... it just works with the hardware ID of the usb network card emulation for usb gadget mode... trust what I say... the acer name is just a filler...so far this works really great with the driver

s0j0hn commented 6 years ago

alright, i will try it this afternoon. On the other had, does it mean that poisontap will not work if this driver is not installed on windows 10 ? How can i know which host it will work ?

dernyn commented 6 years ago

this seems to only happen on windows 7 32/64 and windows 10 with 32 bit

s0j0hn commented 6 years ago

well mine is 64 bit windows 10 with all updates

dernyn commented 6 years ago

I see... well basically it works on previous jessie versions, something changed in the current raspbian image which causes the hardware ID to not change as per the poisontap startup script , and windows may have some setting which should download the driver and installs it for you but it doesn't, I believe it's a userland setting which stops the automation, it depends on the configured/setup prerogative of the windows user on whether to download and install the driver for you or not when it's required .

s0j0hn commented 6 years ago

That's what i thought , i used raspbian stretch. I will try with jessie instead and will post the result here

dernyn commented 6 years ago

it happened after the nov 25 jessie, I believe. I have to double check....

s0j0hn commented 6 years ago

I just tested my raspberry pi zero v1.1 (added modules-load=dwc2,g_ether and dtoverlay=dwc2 respectively in correct files like tutoriels says) with

What i am doing wrong ? Is windows 10 not vulnerable to poisontap or something ?

s0j0hn commented 6 years ago

It works with acer rndis drivers ... but at this point on ... i had to install them myself. This is pointless

dernyn commented 6 years ago

it's not pointless, there may be a fix for the image and the poisontap startup script, just use the driver for now, the driver is just the generic usb driver, it doesn't actually installs any file, it just tells win10 to use its internal generic .sys file for native rndis support for that particular hardware ID used by RPI usb gadget mode implementation, samyk used his own ID which was more common and didn't need a driver file pointing to the device ID. poke around learn and relax....tinkering is part of life.

also about the acer name , you can modify the .inf driver file and change/ replace the Acer name with what ever you want if it's that annoying, rename the driver title with whatever, it will still work the same.

valentin8709 commented 6 years ago

Hi again, Thank you all for your time. I tried many things but no result. I recently bought a Raspi Zero W (the first one was just a Raspi Zero) for a totally different project, but tried PoisonTap just for testing. And it worked!

I don't understand why, but it works with my W version, and not with the simple version... So problem solved

dernyn commented 6 years ago

did you place your startup script in /usr/bin ? can you extract the image from the sd card and upload it?

valentin8709 commented 6 years ago

Hello @dernyn, sorry for the response time =/ I am checking the image, I upload it in the afternoon then give you the link here as soon as it's finished.

EDIT: no I didn't place the script in /usr/bin, but just like the manual suggests (/home/pi/poisontap/)

valentin8709 commented 6 years ago

Here it is, hoping it's not too late: https://mega.nz/#!4Z911RJa!ECylHRHVWbqqaREqxYF4CPHK_H1bFJm4qjy1VJ8tPYw

dernyn commented 6 years ago

Hey, @valentin8709 Thank you very much for the upload.....I will see the differences to my configuration. I will keep you posted. it's never too late...I always have time to test things like these.

P.S. compressing the .img file further into an archive format like .rar reduces the file size for web transfer. turning that 7GB into 2.4GB..... I'm not being mean...just in case you didn't know. I'm grateful you shared your implementation. Thanks!

valentin8709 commented 6 years ago

Thank you @dernyn, indeed I totally forgot to compress the file. If I have time I will reupload a compressed .img for others who would like to download it.

valentin8709 commented 6 years ago

Here it is, the same image, but compressed: https://mega.nz/#!NQtUFYjB!L4FgukQ7IOLEKsPHR4dL45LezY5mkLN5ioqr1xDkm80

danilo-vieira commented 6 years ago

Está funcionando com a última versão do raspbian no Raspberry PI Zero?

coramat commented 6 years ago

@valentin8709 I've installed the image you've uploaded here but i'm having problems with the login : the default credentials aren't correct and i'm not able to change the password

symbios24 commented 6 years ago

hi i have the same problem it does not accept the pi/raspberry login what are the login details? and another thing how can i access poison tap does it have a web interface?

valentin8709 commented 6 years ago

Oups! I forgot to reset the password. The actual one is "Poison_Lock3d".

coramat commented 6 years ago

@valentin8709 Thanks :)

dernyn commented 6 years ago

@valentin8709 Sorry for the delay on my reply, the image you uploaded has the same problem, it won’t change the usb hardware to that of what Sammy configured on the script, I got it to do the Same as you did, but it won’t change IDs

morpheuslord commented 10 months ago

For anyone having issues with RDNIS drivers I have listed the driver files and the usage procedures on this link : https://github.com/morpheuslord/ZERO_W_RNDIS_DRIVERS