samyk / poisontap

Exploits locked/password protected computers over USB, drops persistent WebSocket-based backdoor, exposes internal router, and siphons cookies using Raspberry Pi Zero & Node.js.

Home Page:https://samy.pl/poisontap/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Pi Zero not recognized as ethernet controller

valentin8709 opened this issue · comments

commented

Hello guys!
First, thank you for this tool, this is great and I love the idea! I tried to test poisontap on my Pi Zero, but it didn't work. Here is the step I did:

  • downloaded poisontap... obviously
  • updated dist and firmware on the Raspberry
  • set a backend server listening on 1337 with the backdoor (working, I can connect with nc)
  • set the poisontap following the exact instructions, on the github and checked with this video: https://www.youtube.com/watch?v=dYDa_VDbjPY
  • so my dhcpd is set, everything is running smooth when I manually run the bash script, the IP is set correctly as the route table and everything is launched at startup.

But... my computers (macbook 2008, fedora 25 on MSI GS60 or Windows 8.1 on the same GS60) doesn't recognize anything. I tried to switch the idProduct and Vendor as described in the github, but nothing changed.

I must have missed something, do you know where? I am asking myself if I need a special USB cable (I use the one I use to transfer data on my smartphone).

Thank you for your help =)

I would open up a tool like the Device Manager on Windows, run lsusb on Linux or run system_profiler SPUSBDataType on macOS and share the outputs so we can see whether it's at least coming up.

commented

Yep I should have done that before. Thanks for helping me. Unfortunately, there is no difference between a lsusb with Raspberry and one without Raspberry...

  • I checked the cable: I can transfer data on my smartphone
  • I checked the USB port: ok too

Perhaps my Raspberry missed something? If I add a Wifi dongle, I can connect on my Pi with SSH, so both micro USB are working too...

Anything happen in /var/log/{syslog,messages,system.log} when plugging it in? I would try another USB cable anyway.

commented

I tried with another cable, same behaviour. Nothing in the logs... Wouldn't be around the "thing" who turn the Raspberry into an ethernet controller? I just don't know how this part works, I guess this is these lines who enable it.

echo "dtoverlay=dwc2" >> /boot/config.txt
echo -e "dwc2\ng_ether" >> /etc/modules

Are you using the right USB port on the Zero?

commented

Yes I think, the one who's used in the videos / pictures, in the middle of the raspberry. It is also the one I use sometimes to plugg a wifi dongle, with a wlan0 interface configured in the /etc/network/interfaces file. But I never specified anything in the interfaces about the USB port. Could it be the problem?

commented

Alright I tried to comment the wlan0 section in /etc/network/interfaces. Now there is only loopback interface and usb0 interface, but same behaviour... I understand nothing =(

commented

Properly Enabling Gadget mode on the SDHC card with the proper Text Editor


You seem to be having a problem with the device not getting into USB Gadget mode, verify that you are not using the windows notepad.exe or a text editor that can not handle POSIX (new line or LF), etc. to edit the config.txt and the cmdline.txt files, this is a known issue within the LINUX or RPI community when editing Unix/Linux files. So use Notepad ++ if it's a windows machine editing the files and go to the edit tab, go to EOL Conversion and select (Unix), and then edit the file. These two files may have to be replaced if the EOL conversion does not work to fix your previous editing with a non-LF text editor , and then you will have to redo the changes to config.txt and the cmdline.txt files, your best bet is to backup your current progress with win32imager under windows, re-copy which will replace your previous wrongful editing with the original (.txt) files either from the .img file or from the web GitHub repo.

Raspberry Pi Zero USB Functionality native HOST/GUEST modes


Pay close attention ....the firmware Self detects the USB modes on boot up. be aware!
The raspberry Pi Zero can be a USB host and a USB guest, but not both at the same time.
host mode allows USB hubs and single devices, etc. to be attached to the PI Zero.
guest mode is strictly for the gadget mode feature, in which it's a 1:1 direct connection with a computer, aka OTG mode. So if you have a USB Hub attached and booted already, you can not also go in OTG Mode by plugging in an OTG cable.

Raspberry Pi Zero OTG Mode/USB Gadget mode in windows machines


There is some background knowledge which kinda has to happen, mostly on the windows side of things if you are using Winblows.
-for some win. systems, an (Acer USB Ethernet/RNDIS Gadget) driver for the RPI Zero USB Gadget mode has to get downloaded and installed, I saw this on an old Instance of windows 10 32 bit(x86), 64 bit seems to download the driver, or natively has the driver and does this for you and installs it just fine. Check out=
(http://www.catalog.update.microsoft.com/Search.aspx?q=USB%20RNDIS%20Gadget) and (http://domotique.caron.ws/wp-content/uploads/telechargement/RPI%20Driver%20OTG.zip)

I encounter this very issue on an old laptop, this may be the case.


Samyk as I said on twitter, this network trick to highjack the network connections traffic is brilliant!
It's my favorite part of this implementation.

also, a good Idea is to have dd images for SD cards in the 8gb or 16gb flavors for people to simply dump the latest Raspbian vanilla with PoisonTap already implemented, I know this may be an image maintenance nightmare, but it's just a suggestion.


commented

Thank you very much for the information!! I will test it and give a feedback here =)

Same problem on my windows 10, raspberry pi zero recognised only as Usb serial com device. No way i can make it rndis ethernet gadget, any help ?

commented

you need the driver I listed above.

even if it isn't acer laptop ? It isn't a old laptop.

commented

it has nothing to do with acer... it just works with the hardware ID of the usb network card emulation for usb gadget mode... trust what I say... the acer name is just a filler...so far this works really great with the driver

alright, i will try it this afternoon.
On the other had, does it mean that poisontap will not work if this driver is not installed on windows 10 ?
How can i know which host it will work ?

commented

this seems to only happen on windows 7 32/64 and windows 10 with 32 bit

well mine is 64 bit windows 10 with all updates

commented

I see... well basically it works on previous jessie versions, something changed in the current raspbian image which causes the hardware ID to not change as per the poisontap startup script , and windows may have some setting which should download the driver and installs it for you but it doesn't, I believe it's a userland setting which stops the automation, it depends on the configured/setup prerogative of the windows user on whether to download and install the driver for you or not when it's required .

That's what i thought , i used raspbian stretch. I will try with jessie instead and will post the result here

commented

it happened after the nov 25 jessie, I believe. I have to double check....

I just tested my raspberry pi zero v1.1 (added modules-load=dwc2,g_ether and dtoverlay=dwc2 respectively in correct files like tutoriels says) with

  • 2016-05-10-raspbian-jessie-lite - does not boot up
  • 2016-05-27-raspbian-jessie-lite - does not boot up
  • 2016-09-23-raspbian-jessie-lite - does not boot up
  • 2017-07-05-raspbian-jessie-lite - usb problem not recognised as rndis cannot install it as network adapter

What i am doing wrong ? Is windows 10 not vulnerable to poisontap or something ?

It works with acer rndis drivers ... but at this point on ... i had to install them myself. This is pointless

commented

it's not pointless, there may be a fix for the image and the poisontap startup script, just use the driver for now, the driver is just the generic usb driver, it doesn't actually installs any file, it just tells win10 to use its internal generic .sys file for native rndis support for that particular hardware ID used by RPI usb gadget mode implementation, samyk used his own ID which was more common and didn't need a driver file pointing to the device ID. poke around learn and relax....tinkering is part of life.

also about the acer name , you can modify the .inf driver file and change/ replace the Acer name with what ever you want if it's that annoying, rename the driver title with whatever, it will still work the same.

commented

Hi again,
Thank you all for your time. I tried many things but no result. I recently bought a Raspi Zero W (the first one was just a Raspi Zero) for a totally different project, but tried PoisonTap just for testing. And it worked!

I don't understand why, but it works with my W version, and not with the simple version... So problem solved

commented

did you place your startup script in /usr/bin ?
can you extract the image from the sd card and upload it?

commented

Hello @dernyn, sorry for the response time =/ I am checking the image, I upload it in the afternoon then give you the link here as soon as it's finished.

EDIT: no I didn't place the script in /usr/bin, but just like the manual suggests (/home/pi/poisontap/)

commented

Hey, @valentin8709
Thank you very much for the upload.....I will see the differences to my configuration.
I will keep you posted. it's never too late...I always have time to test things like these.

P.S. compressing the .img file further into an archive format like .rar reduces the file size for web transfer.
turning that 7GB into 2.4GB..... I'm not being mean...just in case you didn't know. I'm grateful you shared your implementation. Thanks!

commented

Thank you @dernyn, indeed I totally forgot to compress the file. If I have time I will reupload a compressed .img for others who would like to download it.

Está funcionando com a última versão do raspbian no Raspberry PI Zero?

commented

@valentin8709 I've installed the image you've uploaded here but i'm having problems with the login : the default credentials aren't correct and i'm not able to change the password

hi i have the same problem it does not accept the pi/raspberry login what are the login details?
and another thing how can i access poison tap does it have a web interface?

commented

Oups! I forgot to reset the password. The actual one is "Poison_Lock3d".

commented

@valentin8709 Thanks :)

commented

@valentin8709 Sorry for the delay on my reply, the image you uploaded has the same problem, it won’t change the usb hardware to that of what Sammy configured on the script, I got it to do the Same as you did, but it won’t change IDs

For anyone having issues with RDNIS drivers I have listed the driver files and the usage procedures on this link : https://github.com/morpheuslord/ZERO_W_RNDIS_DRIVERS