红队植入式攻击物联网设备实战（第三部分）

1

dtoverlay=dwc2

1

sudo nano /opt/implant.sh

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

#!/bin/bash
# Based on a combination of: http://www.isticktoit.net/?p=1383
#   and: https://www.raspberrypi.org/forums/viewtopic.php?t=260107
#   and: https://gist.github.com/schlarpc/a327d4aa735f961555e02cbe45c11667/c80d8894da6c716fb93e5c8fea98899c9aab8d89
#   and: https://github.com/ev3dev/ev3-systemd/blob/02caecff9138d0f4dcfeb5afbee67a0bb689cec0/scripts/ev3-usb.sh

configfs="/sys/kernel/config/usb_gadget"
this="${configfs}/Implant"

# Configure values
serial="$(grep 'Serial' /proc/cpuinfo | head -n 1 | sed -E -e 's/^Serial\s+:\s+0000(.+)/\1/')"
model="$(grep 'Model' /proc/cpuinfo | head -n 1 | sed -E -e 's/^Model\s+:\s+(.+)/\1/')"
manufacturer="Raspberry Pi Foundation"

# The serial number ends in a mac-like address. Let's use this to build a MAC address.
#   The first binary xxxxxx10 octet "locally assigned, unicast" which means we can avoid
#   conflicts with other vendors.
mac_base="$(echo "${serial}" | sed 's/\(\w\w\)/:\1/g' | cut -b 4-)"
ecm_mac_address_dev="02${mac_base}"  # ECM/CDC address for the Pi end
ecm_mac_address_host="12${mac_base}" # ECM/CDC address for the "host" end that the Pi is plugged into
rndis_mac_address_dev="${mac_base}22"  # RNDIS address for the Pi end
rndis_mac_address_host="32${mac_base}" # RNDIS address for the "host" end that the Pi is plugged into

# Make sure that libComposite is loaded
libcomposite_loaded="$(lsmod | grep -e '^libcomposite' 2>/dev/null)"
[ -z "${libcomposite_loaded}" ] && modprobe libcomposite
while [ ! -d "${configfs}" ]
do
  sleep 0.1
done

# Make the path to the libComposite device
mkdir -p "${this}"

echo "0x0200"                      > "${this}/bcdUSB"       # USB Version (2)
echo "0x1d6b"                      > "${this}/idVendor"     # Device Vendor: Linux Foundation
echo "0x0104"                      > "${this}/idProduct"    # Device Type: MultiFunction Composite Device
echo "0x02"                        > "${this}/bDeviceClass" # This means it is a communications device

# Device Version (this seems a bit high, but OK)
# This should be incremented each time there's a "breaking change" so that it's re-detected
# rather than cached (apparently)
echo "0x4000"                      > "${this}/bcdDevice"

# "The OS_Desc config must specify a valid OS Descriptor for correct driver selection"
#   See: https://www.kernel.org/doc/Documentation/ABI/testing/configfs-usb-gadget

1

sudo nano /lib/system/system/Implant.service

1
2
3
4

[Unit] Description=Start libComposite 
[Service] Type=oneshot 
ExecStart=/opt/lib_composite.sh 
[Install] WantedBy=multi-user.target

1

sudo systemctl enable Implant.service

1
2
3
4

allow-hotplug usb0
iface usb0 inet static
  address 192.168.254.2
  netmask 255.255.255.0

1
2
3
4

allow-hotplug usb1
iface usb1 inet static
  address 192.168.255.2
  netmask 255.255.255.0

1

sudo apt install dnsmasq

1

sudo nano /etc/dnsmasq.conf

1
2
3
4
5
6
7
8

interface=usb0
interface=usb1
bind-interfaces

dhcp-range=usb0,192.168.254.3,192.0.2.3,2h
dhcp-range=usb1,192.168.255.3,192.168.255.3,2h

dhcp-option=option:router

1

sudo nano /opt/dnsmasq.sh

1
2
3
4
5

#!/bin/bash
set -x
systemctl disable --now dnsmasq
mv /etc/init.d/dnsmasq /etc/init.d/dnsmasq.initd
sed -i -e "s/Requires=network.target/Requires=network.target sys-subsystem-net-devices-usb0.device sys-subsystem-net-devices-usb1.device/" -e "s~/etc/init.d/dnsmasq ~/etc/init.d/dnsmasq.initd ~g" /lib/systemd/system/dnsmasq.service

1

sudo chmod +x /opt/dnsmasq.sh

1

sudo nano /lib/systemd/system/StartDNSMASQ.service

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

[Unit]
Description=Start DNSMasq
After=network-online.target

[Service]
Type=oneshot
ExecStart=/bin/bash -c "/opt/dnsmasq.sh"

[Install]
WantedBy=multi-user.target

1

sudo systemctl enable StartDNSMASQ.service