wismna / HackPi

Hacking tool inside a Raspberry Pi zero
303 stars 57 forks source link

Not detected by any OS #9

Closed CanardMandarin closed 7 years ago

CanardMandarin commented 7 years ago

Hi

I was curious about your project, so I gave it try. But my Raspberry pi zero is not detected as an Ethernet Adapter by any OS. Here are the steps that I followed : 1 . I did a fresh install of Raspbian. 2 . apt-get install git 3 . git clone https://github.com/wismna/HackPi 4 . sudo chmod +x install.sh 5 . ./install.sh

Then I plugged it into a Win 10 laptop. Nothing happened. Then I plugged it into a Mac OS Sierra laptop. Same.

No error in /var/log/syslog. gadget.log and usbreq.log are empty. In the os.txt file I got "Unknow".

So I read a little the source code and I tried to force the Mac Os detection. I modified gadget.sh :

#OS=`cat /home/pi/os.txt`
OS="MacOs"

But it's not working :). I didn't have the time to search more, I will update this issue.

Did I do something wrong ? I should precise that the original poisontap works good on the Mac laptop, but not on the Windows one.

wismna commented 7 years ago

Hi! Thanks for trying HackPi. Regarding your issue, I assume there were no errors during installation? Also, is the Pi detected at all on your laptops? E.g. on Windows, is there anything showing up in Device Manager?

PrettyBoyPBM commented 7 years ago

hi i used this tutorial https://youtu.be/Aatp5gCskvk but whit the hackpi version and it worked :)

CanardMandarin commented 7 years ago

Hi ! Thank you for you answer

well I don't know what happened. I just did a fresh install again with the same step. Except that I've made all the bash script executable.

And it works ! But it's not recognizing MacOs Sierra, so I have to force the Mac Os detection.

I looked at the source code, the USB fingerprinting and the kernel module patch that you did.

I was wondering if you found a "cleaner" way to get the USB traffic ? Like writing the USB traffic in a file for example like /var/log/usbtraffic.log ?

I will try to modify the module to see if it's work.

wismna commented 7 years ago

Good to know about the +x flag on the .sh files. I'll update the installer to reflect that. Maybe an update in Sierra broke the fingerprinting method I implemented. I'll see how it goes with my version and update the project if necessary. Question: what are the contents of your os.txt file after plugging it to MacOs?

Well, clearly, there should be better ways to implement this, but I have to admit that as soon as it started working (in my case, at least) I kind of stopped digging around as it already took me quite a while to get there. It is on my todo list to create a real USB fingerprinting program, but I don't really have the time right now. If you make some interesting modifications, please submit a pull request :)

wismna commented 7 years ago

I did some testing on Windows 10 and MacOs 10.12.4 and 10.12.5, and everything seems to be working on my end. I'll try and dig deeper to see if I can find anything. On MacOs, in System Preferences, then in Networks, do you see it appear when you plug it in (without the forced detection) ? And USB Ethernet Gadget should pop up first, then disappear, then the HackPi gadget should appear.

CanardMandarin commented 7 years ago

Hi ! I tried again 10 minutes ago, fresh install, same steps. And it's not working with Mac Os 10.12.4 (16E195)

the content of os.txt is : Other And in Networks I see the dummy gadget being enable first and then disable. But that's all, after nothing.

This is the content of usbreq.log

[    5.455926] USB DWC2 REQ 80 06 0302 0409 0002
[    5.463188] USB DWC2 REQ 80 06 0302 0409 002c
[    5.470265] USB DWC2 REQ 80 06 0301 0409 0002
[    5.477134] USB DWC2 REQ 80 06 0301 0409 0040
[    5.530463] USB DWC2 REQ 80 06 0308 0409 0002
[    5.537192] USB DWC2 REQ 80 06 0308 0409 0042
[    5.555123] USB DWC2 REQ 80 06 0309 0409 0002
[    5.561180] USB DWC2 REQ 80 06 0300 0000 00ff
[    5.567148] USB DWC2 REQ 80 06 0309 0409 001a
wismna commented 7 years ago

Thanks for posting the contents of usbreq.log. I get why there is an issue: an assumption I made in the fingerprinting code. I'll correct that and upload the correction.

wismna commented 7 years ago

All right, change commited. Could you please test it out? No need to reinstall everything, just pull fingerprint.sh.

CanardMandarin commented 7 years ago

Yes it's almost working ;). In the fingerprint.sh file, tee was writing the content of usbreq.log in the standard output. I've made a pull request : #10

Can you explain what was the problem ? You just skipped the line with '0000 00ff' ? Why ? Thank you for your time.

wismna commented 7 years ago

Ah yes, indeed. I merged your change.

More details about the issue: The lines I parse are USB Setup Requests, and more precisely, the Get String Descriptors requests. Their format are of the sort: s 80 06 03xx xxxx xxxx. The last part is actually the one I'm interested in, wLength. In MacOs, its value is never 00ff, whereas in other OS it is always 00ff. So this allows identifying the OS. But the previous parameter, wIndex, also has its importance. It sets the language id of the requested string descriptor. It's almost always 0409, English (even though other languages are in theory supported). But, some other requests will send 0000. From the USB specification:

If a standard descriptor is being requested then the wIndex field specifies the Language ID for string descriptors, and is reset to zero for other standard descriptors.

So, I can safely ignore requests with a 0000 value for wIndex as they don't relate to String Descriptors.

I don't know if I managed to make myself clear (perhaps it would have been easier in French !), but if you want more info about this, I suggest you read the usb specification (which is a pain...).