https://elvis.hcw.ac.at/wiki/api.php?action=feedcontributions&feedformat=atom&user=MReissElvis Wiki - User contributions [en]2026-09-10T15:30:52ZUser contributionsMediaWiki 1.41.5https://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5985Hak5 Packet Squirrel2021-02-09T22:29:34Z<p>MReiss: /* with Cloud C2 */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
You can also install an simple openVPN Server on a linux machine with<br />
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code><br />
and press Enter 6 times.<br />
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position.<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".<br />
<br />
==== Example ====<br />
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]<br />
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]<br />
[[File:Hak5 c2 sqirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]<br />
<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== with Cloud C2 ==<br />
<br />
The [[Hak5 Cloud C2]] is a command and control server for Hak5 devices. Installation and startup is shown in figure "C2 server start". By browsing to the configured address you can login to the dashboard, shown in figure "C2 dashboard".<br />
<br />
To connect the Packet Squirrel with your C2 Cloud, click on the plus button in the lower right corner and choose the device. On the dashboard, open the added device and click on Setup, as shown in figure "C2 Packet Sqirrel". Then copy the downloaded file to the Packet Squirrel's /etc folder and reboot it. <br />
In the Overview tab you can also Edit, Reboot, Wipe and Remove your device. <br />
<br />
In the Clients tab you can see all clients which were connected to your Packet Squirrel with hostname, MAC and IP address. In the Loot tab, you can open the current loot from your Packet Squirrel directly on your C2 server. And in the Terminal tab you can open a ssh session to your device.<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Key_Stroke_Injection&diff=5984Key Stroke Injection2021-02-09T22:20:02Z<p>MReiss: /* Bash Bunny */</p>
<hr />
<div>== Summary == <br />
<br />
This document describes Keystroke Injection and it's different usecases. It lists a selection of tools and how to protect a system against such attacks. <br />
<br />
Keystroke Injection describes the act of simulating keystrokes by a real person. In fact the keystrokes are generated by a script or other software. Thus wantet and unwanted inputs can be entered very fast. This works over the HID protocol (human interface device), with which every common keyboard works. Because computers trust human input in the form of keystrokes.<br />
<br />
To show the actual danger by Keystroke Injection attacks, mostly done with rogue USB flash drives, the paper [https://ieeexplore.ieee.org/document/7546509 Users Really Do Plug in USB Drives They Find] got published on IEEE in May 2016. It shows that 45-98% of the users plug in a found USB flash drive, mostly with the intention to find the drive's owner.<br />
<br />
== Usage ==<br />
The ability to type over 9000 characters per minute opens a few use cases. Ethical correct ones and also not. Beside the probably best-known use as attack vector, also the automation of tasks benefits from this feature.<br />
<br />
==== Automation ====<br />
Even simple tasks like adding network shares or printers are much faster over commandline than over a GUI. Maybe these could also be typed manually, the benefit kicks in thinking of larger scripts to be automatically executed on single computers.<br />
<br />
==== Penetration Testing ====<br />
Penetration Testing is more or less the same use case as Hacking but with another purpose. Instead of really attacking a system you show and document open vulnerabilities.<br />
<br />
==== Hacking ====<br />
The most famous use case for Keystroke Injection is to attack systems over command line. With the command line all sorts of attacks are possible. From running a simple script, over downloading and running an exe file, up to opening a reverse shell and many more. Attackers can just collect valuable informations or exploit the access. Enough examples can be found online.<br />
<br />
== Tools ==<br />
[[File:Usb-rubber-ducky.jpg|thumb|right|150px|Rubber Ducky]]<br />
There are a few different hardware tools, mostly disguised as simple USB falsh drives, also called BadUSB. They are in some sort programmable or loadable with a specific payload to execute.<br />
<br />
==== Rubber Ducky ====<br />
A well known example is the USB Rubberducky. A detailed description is available in the Elvis Wiki: [[Hak5 Rubber Ducky]].<br />
[[File:KSI_pocketadmin.jpg|thumb|right|150px|Pocket Admin]]<br />
<br />
==== Pocket Admin ====<br />
Pocket Admin is an open source variant of Rubber Ducky to build by yourself. It states that it's cheaper and that it has a extended functionality. The projects description and manual can be found [https://www.electronics-lab.com/project/pocketadmin-keystroke-injection-device/ here].<br />
[[File:Usbninja.png|thumb|right|150px|USB Ninja]]<br />
<br />
==== USB Ninja ====<br />
USB Ninja is a more expensive variant of BadUSB. It features different modules lika a bluetooth expansion and can also be built into normal keyboards. An overview is available [https://usbninja.com/ here].<br />
[[File:Rubberbunny.png|thumb|right|150px|Bash Bunny]]<br />
<br />
==== Bash Bunny ====<br />
Bash Bunny is something like Rubber Duckys big brother. Its more expensive but also offers more tools like nmap, responder, impacket and metasploit, additional to the known Ducky Script. It's a small Linux machine on a USB drive mimicking multiple trusted devices. A full description can be found in the articel [[Hak5 Bash Bunny]].<br />
<br />
==== Standard Hardware ====<br />
An emerging trend is to not use special hardware, but to built in keystroke injection hardware/software in common peripheral devices. Imagine a standard HP office mouse, nobody would expect any threat from it. Examples and manuals can be found online.<br />
<br />
== Possible Protections ==<br />
<br />
=== Linux ===<br />
Google published a tool called "USB Keystroke Injection Protection" which runs as daemon and blocks badUSBs. A full [https://opensource.googleblog.com/2020/03/usb-keystroke-injection-protection.html description] and [https://github.com/google/ukip#installation-prerequisites installation guide] are available online.<br />
<br />
An other tool is [https://usbguard.github.io/ USB Guard]. It's an open source software project in which you can write own USB device authorization policies.<br />
<br />
=== Windows ===<br />
<br />
The probably best protection against Keystroke Injection, is to block all unknwon USB devices and allow specific known devices only. This can be achieved by Group Policies by denying installation of removeable devices and only allow devices with a specific serial ID. But this approach has two disadvantages. Thinking of enterprise solutions, it's a very high effort to allow the good devices and also the serial ID can be faked or surpressed by such attacking devices. <br />
<br />
A possible software solution is surprisingly [https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection Windows Defender ATP], an enterprise endpoint security platform. <br />
<br />
A open source solution would be [http://konukoii.com/blog/2016/10/26/duckhunting-stopping-automated-keystroke-injection-attacks/ Duckhunt]. This script rezognizes the average typing speed and blocks key strokes that are too fast. It even has a "Sneaky" mode to not let the attacker know, his attack has been blocked.<br />
<br />
== References ==<br />
<br />
* M. Tischer et al., "Users Really Do Plug in USB Drives They Find," 2016 IEEE Symposium on Security and Privacy (SP), San Jose, CA, 2016, pp. 306-319, doi: 10.1109/SP.2016.26.<br />
* https://www.electronics-lab.com/project/pocketadmin-keystroke-injection-device/<br />
* https://usbninja.com/<br />
* https://shop.hak5.org/<br />
* https://github.com/google/ukip#installation-prerequisites<br />
* https://opensource.googleblog.com/2020/03/usb-keystroke-injection-protection.html<br />
* https://usbguard.github.io/<br />
* https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection<br />
<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Key_Stroke_Injection&diff=5983Key Stroke Injection2021-02-09T22:19:00Z<p>MReiss: /* Rubber Ducky */</p>
<hr />
<div>== Summary == <br />
<br />
This document describes Keystroke Injection and it's different usecases. It lists a selection of tools and how to protect a system against such attacks. <br />
<br />
Keystroke Injection describes the act of simulating keystrokes by a real person. In fact the keystrokes are generated by a script or other software. Thus wantet and unwanted inputs can be entered very fast. This works over the HID protocol (human interface device), with which every common keyboard works. Because computers trust human input in the form of keystrokes.<br />
<br />
To show the actual danger by Keystroke Injection attacks, mostly done with rogue USB flash drives, the paper [https://ieeexplore.ieee.org/document/7546509 Users Really Do Plug in USB Drives They Find] got published on IEEE in May 2016. It shows that 45-98% of the users plug in a found USB flash drive, mostly with the intention to find the drive's owner.<br />
<br />
== Usage ==<br />
The ability to type over 9000 characters per minute opens a few use cases. Ethical correct ones and also not. Beside the probably best-known use as attack vector, also the automation of tasks benefits from this feature.<br />
<br />
==== Automation ====<br />
Even simple tasks like adding network shares or printers are much faster over commandline than over a GUI. Maybe these could also be typed manually, the benefit kicks in thinking of larger scripts to be automatically executed on single computers.<br />
<br />
==== Penetration Testing ====<br />
Penetration Testing is more or less the same use case as Hacking but with another purpose. Instead of really attacking a system you show and document open vulnerabilities.<br />
<br />
==== Hacking ====<br />
The most famous use case for Keystroke Injection is to attack systems over command line. With the command line all sorts of attacks are possible. From running a simple script, over downloading and running an exe file, up to opening a reverse shell and many more. Attackers can just collect valuable informations or exploit the access. Enough examples can be found online.<br />
<br />
== Tools ==<br />
[[File:Usb-rubber-ducky.jpg|thumb|right|150px|Rubber Ducky]]<br />
There are a few different hardware tools, mostly disguised as simple USB falsh drives, also called BadUSB. They are in some sort programmable or loadable with a specific payload to execute.<br />
<br />
==== Rubber Ducky ====<br />
A well known example is the USB Rubberducky. A detailed description is available in the Elvis Wiki: [[Hak5 Rubber Ducky]].<br />
[[File:KSI_pocketadmin.jpg|thumb|right|150px|Pocket Admin]]<br />
<br />
==== Pocket Admin ====<br />
Pocket Admin is an open source variant of Rubber Ducky to build by yourself. It states that it's cheaper and that it has a extended functionality. The projects description and manual can be found [https://www.electronics-lab.com/project/pocketadmin-keystroke-injection-device/ here].<br />
[[File:Usbninja.png|thumb|right|150px|USB Ninja]]<br />
<br />
==== USB Ninja ====<br />
USB Ninja is a more expensive variant of BadUSB. It features different modules lika a bluetooth expansion and can also be built into normal keyboards. An overview is available [https://usbninja.com/ here].<br />
[[File:Rubberbunny.png|thumb|right|150px|Bash Bunny]]<br />
<br />
==== Bash Bunny ====<br />
Bash Bunny is something like Rubber Duckys big brother. Its more expensive but also offers more tools like nmap, responder, impacket and metasploit, additional to the known Ducky Script. It's a small Linux machine on a USB drive mimicking multiple trusted devices. A full description can be found [https://shop.hak5.org/products/bash-bunny here].<br />
<br />
==== Standard Hardware ====<br />
An emerging trend is to not use special hardware, but to built in keystroke injection hardware/software in common peripheral devices. Imagine a standard HP office mouse, nobody would expect any threat from it. Examples and manuals can be found online.<br />
<br />
== Possible Protections ==<br />
<br />
=== Linux ===<br />
Google published a tool called "USB Keystroke Injection Protection" which runs as daemon and blocks badUSBs. A full [https://opensource.googleblog.com/2020/03/usb-keystroke-injection-protection.html description] and [https://github.com/google/ukip#installation-prerequisites installation guide] are available online.<br />
<br />
An other tool is [https://usbguard.github.io/ USB Guard]. It's an open source software project in which you can write own USB device authorization policies.<br />
<br />
=== Windows ===<br />
<br />
The probably best protection against Keystroke Injection, is to block all unknwon USB devices and allow specific known devices only. This can be achieved by Group Policies by denying installation of removeable devices and only allow devices with a specific serial ID. But this approach has two disadvantages. Thinking of enterprise solutions, it's a very high effort to allow the good devices and also the serial ID can be faked or surpressed by such attacking devices. <br />
<br />
A possible software solution is surprisingly [https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection Windows Defender ATP], an enterprise endpoint security platform. <br />
<br />
A open source solution would be [http://konukoii.com/blog/2016/10/26/duckhunting-stopping-automated-keystroke-injection-attacks/ Duckhunt]. This script rezognizes the average typing speed and blocks key strokes that are too fast. It even has a "Sneaky" mode to not let the attacker know, his attack has been blocked.<br />
<br />
== References ==<br />
<br />
* M. Tischer et al., "Users Really Do Plug in USB Drives They Find," 2016 IEEE Symposium on Security and Privacy (SP), San Jose, CA, 2016, pp. 306-319, doi: 10.1109/SP.2016.26.<br />
* https://www.electronics-lab.com/project/pocketadmin-keystroke-injection-device/<br />
* https://usbninja.com/<br />
* https://shop.hak5.org/<br />
* https://github.com/google/ukip#installation-prerequisites<br />
* https://opensource.googleblog.com/2020/03/usb-keystroke-injection-protection.html<br />
* https://usbguard.github.io/<br />
* https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection<br />
<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5982Hak5 Packet Squirrel2021-02-09T22:17:12Z<p>MReiss: /* Tunneling Mode */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
You can also install an simple openVPN Server on a linux machine with<br />
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code><br />
and press Enter 6 times.<br />
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position.<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".<br />
<br />
==== Example ====<br />
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]<br />
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]<br />
[[File:Hak5 c2 sqirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]<br />
<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== with Cloud C2 ==<br />
<br />
The [[Hak5 Cloud C2]] is a command and control server for Hak5 devices. Installation and startup is shown in figure "C2 server start". By browsing to the configured address you can login to the dashboard, shown in figure "C2 dashboard".<br />
<br />
To connect the Packet Squirrel with your C2 Cloud click on the plus button and choose the device. On the dashboard open the added device and click on Setup, as shown in figure "C2 Packet Sqirrel". Then copy the downloaded file to the Packet Squirrel's /etc folder and reboot it. <br />
In the overview you can also Edit, Reboot, Wipe and Remove your device. <br />
<br />
In the Clients tab you can see all clients which were connected to yout Packet Squirrel with hostname, MAC and IP address. In the Loot tab, you can open the current loot from your Packet Squirrel directly on your C2 server. And in the Terminal tab you can open a ssh session to your device.<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5981Hak5 Packet Squirrel2021-02-09T22:16:33Z<p>MReiss: /* with Cloud C2 */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
You can also install an simple openVPN Server on a linux machine with<br />
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code><br />
and press Enter 6 times.<br />
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".<br />
<br />
==== Example ====<br />
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]<br />
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]<br />
[[File:Hak5 c2 sqirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]<br />
<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== with Cloud C2 ==<br />
<br />
The [[Hak5 Cloud C2]] is a command and control server for Hak5 devices. Installation and startup is shown in figure "C2 server start". By browsing to the configured address you can login to the dashboard, shown in figure "C2 dashboard".<br />
<br />
To connect the Packet Squirrel with your C2 Cloud click on the plus button and choose the device. On the dashboard open the added device and click on Setup, as shown in figure "C2 Packet Sqirrel". Then copy the downloaded file to the Packet Squirrel's /etc folder and reboot it. <br />
In the overview you can also Edit, Reboot, Wipe and Remove your device. <br />
<br />
In the Clients tab you can see all clients which were connected to yout Packet Squirrel with hostname, MAC and IP address. In the Loot tab, you can open the current loot from your Packet Squirrel directly on your C2 server. And in the Terminal tab you can open a ssh session to your device.<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5980Hak5 Packet Squirrel2021-02-09T22:15:55Z<p>MReiss: /* with Cloud C2 */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
You can also install an simple openVPN Server on a linux machine with<br />
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code><br />
and press Enter 6 times.<br />
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".<br />
<br />
==== Example ====<br />
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]<br />
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]<br />
[[File:Hak5 c2 sqirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]<br />
<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== with Cloud C2 ==<br />
<br />
The [[Hak5 Cloud C2]] is a command and control server for Hak5 devices. Installation and startup is shown in figure "C2 server start". By browsing to the configured address you can login to the dashboard, shown in figure "C2 dashboard".<br />
<br />
To connect the Packet Squirrel with your C2 Cloud click on the plus button and choose the device. On the dashboard open the added device and click on Setup, as shown in figure "C2 Packet Sqirrel". Then copy the downloaded file to the Packet Squirrel's /etc folder and reboot it. <br />
In the overview you can also Edit, Reboot, Wipe and Remove your device. <br />
<br />
In the Clients tab you can see all clients which were connected to yout Packetsquirrel with hostname, MAC and IP address. In the Loot tab, you can open the current loot from your Packet Squirrel directly on your C2 server. And in the Terminal tab you can open a ssh session to your device.<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5979Hak5 Packet Squirrel2021-02-09T22:11:38Z<p>MReiss: /* with Cloud C2 */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
You can also install an simple openVPN Server on a linux machine with<br />
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code><br />
and press Enter 6 times.<br />
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".<br />
<br />
==== Example ====<br />
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]<br />
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]<br />
[[File:Hak5 c2 sqirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]<br />
<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== with Cloud C2 ==<br />
<br />
The [[Hak5 Cloud C2]] is a command and control server for Hak5 devices. Installation and startup is shown in figure "C2 server start". By browsing to the configured address you can login to the dashboard, shown in figure "C2 dashboard".<br />
<br />
To connect the Packet Squirrel with your C2 Cloud click on the plus button and choose the device. On the dashboard open the added device and click on Setup, as shown in figure "C2 Packet Sqirrel". Then copy the downloaded file to the Packet Squirrel's /etc folder and reboot it.<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5978Hak5 Packet Squirrel2021-02-09T22:10:17Z<p>MReiss: /* with Cloud C2 */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
You can also install an simple openVPN Server on a linux machine with<br />
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code><br />
and press Enter 6 times.<br />
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".<br />
<br />
==== Example ====<br />
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]<br />
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]<br />
[[File:Hak5 c2 sqirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]<br />
<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== with Cloud C2 ==<br />
<br />
The [[Hak5 Cloud C2]] is a command and control server for Hak5 devices. Installation and startup is shown in figure "C2 server start". By browsing to the configured address you can login to the dashboard, shown in figure "C2 dashboard".<br />
<br />
To connect the Packet Squirrel with your C2 Cloud click on the plus button and choose the device. On the dashboard open the added device and click on<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5977Hak5 Packet Squirrel2021-02-09T22:09:07Z<p>MReiss: /* with Cloud C2 */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
You can also install an simple openVPN Server on a linux machine with<br />
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code><br />
and press Enter 6 times.<br />
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".<br />
<br />
==== Example ====<br />
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]<br />
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]<br />
[[File:Hak5 c2 sqirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]<br />
<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== with Cloud C2 ==<br />
<br />
The [[Hak5 Cloud C2]] is a command and control server for Hak5 devices. Installation and startup is shown in figure "C2 server start". By browsing to the configured address you can login to the dashboard, shown in figure "C2 dashboard".<br />
<br />
To connect the Packet Squirrel with your C2 Cloud click on the plus button and choose the device.<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5976Hak5 Packet Squirrel2021-02-09T22:07:23Z<p>MReiss: /* with Cloud C2 */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
You can also install an simple openVPN Server on a linux machine with<br />
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code><br />
and press Enter 6 times.<br />
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".<br />
<br />
==== Example ====<br />
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]<br />
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]<br />
[[File:Hak5 c2 sqirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]<br />
<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== with Cloud C2 ==<br />
<br />
The [[Hak5 Cloud C2]] is a command and control server for Hak5 devices. Installation and startup is shown in figure "C2 Start"<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5975Hak5 Packet Squirrel2021-02-09T22:06:06Z<p>MReiss: /* Example */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
You can also install an simple openVPN Server on a linux machine with<br />
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code><br />
and press Enter 6 times.<br />
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".<br />
<br />
==== Example ====<br />
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]<br />
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]<br />
[[File:Hak5 c2 sqirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]<br />
<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== with Cloud C2 ==<br />
<br />
The [[Hak5 Cloud C2]] is a command and control server for Hak5 devices.<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5974Hak5 Packet Squirrel2021-02-09T22:05:53Z<p>MReiss: /* with Cloud C2 */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
You can also install an simple openVPN Server on a linux machine with<br />
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code><br />
and press Enter 6 times.<br />
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".<br />
<br />
==== Example ====<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== with Cloud C2 ==<br />
<br />
The [[Hak5 Cloud C2]] is a command and control server for Hak5 devices.<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5973Hak5 Packet Squirrel2021-02-09T22:05:23Z<p>MReiss: /* with Cloud C2 */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
You can also install an simple openVPN Server on a linux machine with<br />
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code><br />
and press Enter 6 times.<br />
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".<br />
<br />
==== Example ====<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== with Cloud C2 ==<br />
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]<br />
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]<br />
[[File:Hak5 c2 sqirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]<br />
<br />
The [[Hak5 Cloud C2]] is a command and control server for Hak5 devices.<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5972Hak5 Packet Squirrel2021-02-09T22:04:54Z<p>MReiss: /* with Cloud C2 */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
You can also install an simple openVPN Server on a linux machine with<br />
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code><br />
and press Enter 6 times.<br />
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".<br />
<br />
==== Example ====<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== with Cloud C2 ==<br />
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]<br />
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]<br />
[[File:Hak5 c2 squirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]<br />
<br />
The [[Hak5 Cloud C2]] is a command and control server for Hak5 devices.<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=File:Hak5_c2_sqirrel.jpg&diff=5971File:Hak5 c2 sqirrel.jpg2021-02-09T22:02:35Z<p>MReiss: </p>
<hr />
<div></div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=File:Hak5_c2_dashboard.jpg&diff=5970File:Hak5 c2 dashboard.jpg2021-02-09T22:02:17Z<p>MReiss: </p>
<hr />
<div></div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=File:Hak5_C2_start.jpg&diff=5969File:Hak5 C2 start.jpg2021-02-09T22:02:00Z<p>MReiss: </p>
<hr />
<div></div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5968Hak5 Packet Squirrel2021-02-09T22:01:38Z<p>MReiss: /* with Cloud C2 */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
You can also install an simple openVPN Server on a linux machine with<br />
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code><br />
and press Enter 6 times.<br />
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".<br />
<br />
==== Example ====<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== with Cloud C2 ==<br />
<br />
The [[Hak5 Cloud C2]] is a command and control server for Hak5 devices.<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5967Hak5 Packet Squirrel2021-02-09T21:55:30Z<p>MReiss: /* Tunneling Mode */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
You can also install an simple openVPN Server on a linux machine with<br />
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code><br />
and press Enter 6 times.<br />
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".<br />
<br />
==== Example ====<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== with Cloud C2 ==<br />
<br />
The Hak5 Cloud C2 is a command and control server for Hak5 devices. In combination with Packet Squirrel if offers the following features<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5966Hak5 Packet Squirrel2021-02-09T21:48:09Z<p>MReiss: /* Tunneling Mode */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
You can also install an simple openVPN Server on a linux machine with<br />
[code]wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh[/code]<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".<br />
<br />
==== Example ====<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== with Cloud C2 ==<br />
<br />
The Hak5 Cloud C2 is a command and control server for Hak5 devices. In combination with Packet Squirrel if offers the following features<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5965Hak5 Packet Squirrel2021-02-06T19:31:07Z<p>MReiss: /* with Cloud C2 Server */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".<br />
<br />
==== Example ====<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== with Cloud C2 ==<br />
<br />
The Hak5 Cloud C2 is a command and control server for Hak5 devices. In combination with Packet Squirrel if offers the following features<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5964Hak5 Packet Squirrel2021-02-06T19:29:37Z<p>MReiss: /* Using Cloud C2 */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".<br />
<br />
==== Example ====<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== with Cloud C2 Server ==<br />
<br />
The Hak5 Cloud C2 Server is a command and control server for Hak5 devices. In combination with Packet Squirrel if offers the following features<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5963Hak5 Packet Squirrel2021-02-06T19:26:39Z<p>MReiss: /* Creating your own Payloads */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".<br />
<br />
==== Example ====<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Using Cloud C2 ==<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5962Hak5 Packet Squirrel2021-02-06T19:24:39Z<p>MReiss: /* Creating your own Payloads */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is switch1, switch2, switch3 or switch4.<br />
<br />
==== Example ====<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Using Cloud C2 ==<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5961Hak5 Packet Squirrel2021-02-06T19:24:06Z<p>MReiss: /* Creating your own Payloads */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is switch1, switch2, switch3 or switch4.<br />
<br />
'''Example'''<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Using Cloud C2 ==<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5960Hak5 Packet Squirrel2021-02-06T19:10:50Z<p>MReiss: /* Example */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is switch1, switch2, switch3 or switch4.<br />
<br />
==== Example ====<br />
Here is an example for the usage of Squirrel Script.<br />
<br />
<syntaxhighlight lang="bash"><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Using Cloud C2 ==<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5959Hak5 Packet Squirrel2021-02-06T19:09:37Z<p>MReiss: /* Example */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is switch1, switch2, switch3 or switch4.<br />
<br />
==== Example ====<br />
<syntaxhighlight lang="bash"><br />
Title: Caternet<br />
Author: Hak5Darren<br />
Version: 1.0<br />
Description: Forwards all traffic to local webserver hosting cat photos.<br />
Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</syntaxhighlight><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Using Cloud C2 ==<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5958Hak5 Packet Squirrel2021-02-06T19:07:22Z<p>MReiss: /* Example */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is switch1, switch2, switch3 or switch4.<br />
<br />
==== Example ====<br />
<code>Title: Caternet<br />
Author: Hak5Darren<br />
Version: 1.0<br />
Description: Forwards all traffic to local webserver hosting cat photos.<br />
Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80</code><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Using Cloud C2 ==<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5957Hak5 Packet Squirrel2021-02-06T19:06:25Z<p>MReiss: /* Creating your own Payloads */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is switch1, switch2, switch3 or switch4.<br />
<br />
==== Example ====<br />
<code><br />
# Title: Caternet<br />
# Author: Hak5Darren<br />
# Version: 1.0<br />
# Description: Forwards all traffic to local webserver hosting cat photos.<br />
# Props: In loving memory of Hak5Kerby<br />
<br />
LED SETUP<br />
NETMODE NAT<br />
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address<br />
/etc/init.d/dnsmasq restart<br />
<br />
LED ATTACK<br />
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53<br />
python -m SimpleHTTPServer 80<br />
</code><br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Using Cloud C2 ==<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5956Hak5 Packet Squirrel2021-02-06T19:04:41Z<p>MReiss: /* Creating your own Payloads */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time passed<br />
<br />
* SWITCH<br />
The SWITCH command returns the current position of the hardware payload selection switch. Output is switch1, switch2, switch3 or switch4.<br />
<br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Using Cloud C2 ==<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5955Hak5 Packet Squirrel2021-02-06T18:58:24Z<p>MReiss: /* Creating your own Payloads */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
specifies which network mode Packet Sqirrel uses and how traffic is routed<br />
<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
with this command the multi-color LED can be controlled <br />
<br />
{| class="wikitable"<br />
|-<br />
! Possible configurations !! Description<br />
|-<br />
| LED Colors || red, green, blue, yellow, cyan, magenta, white<br />
|-<br />
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000<br />
|-<br />
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH<br />
|}<br />
<br />
* BUTTON<br />
<br />
* SWITCH<br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Using Cloud C2 ==<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5954Hak5 Packet Squirrel2021-02-06T18:49:46Z<p>MReiss: /* Creating your own Payloads */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel<br />
|-<br />
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address<br />
|-<br />
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel<br />
|-<br />
| NETMODE VPN || same es NAT with VPN interface for client tunneling<br />
|-<br />
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN<br />
|}<br />
<br />
* LED<br />
<br />
* BUTTON<br />
<br />
* SWITCH<br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Using Cloud C2 ==<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5953Hak5 Packet Squirrel2021-02-06T18:45:12Z<p>MReiss: /* Creating your own Payloads */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following additional commands:<br />
<br />
* NETMODE<br />
{| class="wikitable"<br />
|-<br />
! Command !! Description<br />
|-<br />
| NETMODE BRIDGE || Example<br />
|-<br />
| NETMODE TRANSPARENT || Example<br />
|-<br />
| NETMODE NAT || Example<br />
|-<br />
| NETMODE VPN || Example<br />
|-<br />
| NETMODE CLONE || Example<br />
|}<br />
<br />
* LED<br />
<br />
* BUTTON<br />
<br />
* SWITCH<br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Using Cloud C2 ==<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5952Hak5 Packet Squirrel2021-02-06T18:40:06Z<p>MReiss: /* Creating your own Payloads */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget<br />
<br />
The featured Squirrel Script offers the following commands:<br />
<br />
* NETMODE<br />
<br />
* LED<br />
<br />
* BUTTON<br />
<br />
* SWITCH<br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Using Cloud C2 ==<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5951Hak5 Packet Squirrel2021-02-05T21:02:59Z<p>MReiss: /* Using with Cloud C2 */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
* openvpn<br />
* autossh<br />
* tcpdump<br />
* meterpreter-https<br />
* cron<br />
* nmap<br />
* ncat-ssl<br />
* ncat<br />
* sshfs<br />
* tcpdump<br />
* wget<br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
<br />
== Using Cloud C2 ==<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5950Hak5 Packet Squirrel2021-02-05T21:02:34Z<p>MReiss: </p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
* openvpn<br />
* autossh<br />
* tcpdump<br />
* meterpreter-https<br />
* cron<br />
* nmap<br />
* ncat-ssl<br />
* ncat<br />
* sshfs<br />
* tcpdump<br />
* wget<br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
<br />
== Using with Cloud C2 ==<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5949Hak5 Packet Squirrel2021-02-05T21:01:44Z<p>MReiss: /* Paylaods */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Payloads ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
* openvpn<br />
* autossh<br />
* tcpdump<br />
* meterpreter-https<br />
* cron<br />
* nmap<br />
* ncat-ssl<br />
* ncat<br />
* sshfs<br />
* tcpdump<br />
* wget<br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5948Hak5 Packet Squirrel2021-02-05T21:00:14Z<p>MReiss: /* OpenVPN Mode */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Paylaods ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
* openvpn<br />
* autossh<br />
* tcpdump<br />
* meterpreter-https<br />
* cron<br />
* nmap<br />
* ncat-ssl<br />
* ncat<br />
* sshfs<br />
* tcpdump<br />
* wget<br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5947Hak5 Packet Squirrel2021-02-05T21:00:04Z<p>MReiss: /* Access Mode */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Paylaods ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
* openvpn<br />
* autossh<br />
* tcpdump<br />
* meterpreter-https<br />
* cron<br />
* nmap<br />
* ncat-ssl<br />
* ncat<br />
* sshfs<br />
* tcpdump<br />
* wget<br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5946Hak5 Packet Squirrel2021-02-05T20:58:55Z<p>MReiss: /* Description */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
==== Basic Cable Setup ====<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
==== Firmware Upgrade ====<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Paylaods ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
* openvpn<br />
* autossh<br />
* tcpdump<br />
* meterpreter-https<br />
* cron<br />
* nmap<br />
* ncat-ssl<br />
* ncat<br />
* sshfs<br />
* tcpdump<br />
* wget<br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5945Hak5 Packet Squirrel2021-02-05T20:58:17Z<p>MReiss: /* Description */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
=== Basic Cable Setup ===<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
=== Firmware Upgrade ===<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Paylaods ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
* openvpn<br />
* autossh<br />
* tcpdump<br />
* meterpreter-https<br />
* cron<br />
* nmap<br />
* ncat-ssl<br />
* ncat<br />
* sshfs<br />
* tcpdump<br />
* wget<br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=USB_Rubber_Ducky&diff=5944USB Rubber Ducky2021-02-05T20:56:30Z<p>MReiss: MReiss moved page USB Rubber Ducky to Hak5 Rubber Ducky: naming</p>
<hr />
<div>#REDIRECT [[Hak5 Rubber Ducky]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Rubber_Ducky&diff=5943Hak5 Rubber Ducky2021-02-05T20:56:30Z<p>MReiss: MReiss moved page USB Rubber Ducky to Hak5 Rubber Ducky: naming</p>
<hr />
<div>== Summary == <br />
This documentation is about the USB Rubber Ducky, a [https://wiki.elvis.science/index.php?title=Key_Stroke_Injection keystroke injection] tool. It will explain USB Rubber Ducky basics, show some available tools for writing and encoding/decoding scripts, as well to change Rubber Ducky's firmware.<br />
<br />
== Requirements ==<br />
Rubber Ducky itself is operating system independent but you will need a pc with an USB A port in order to be able to create and deploy your own payloads.<br />
<br />
== Description ==<br />
[[File:rubber_ducky_inside.png|thumb|Rubber Ducky under the hood]]<br />
USB Rubber Ducky, is a keyboard injection tool, mainly used from penetration testers and system administrators.<br />
The Rubber Ducky comes disguised with an innocent USB flash drive chassis, to aid in social engineering.<br />
But under the hood hides a 60 MHz 32-bit AT32UC3B1256 CPU with 256K onboard flash, and a micro SD card storage to host the payload, which is ready to deploy with over 9000 characters per minute, once connected into an USB slot.<br />
<br />
The device where Rubber Ducky is connected, recognizes it as a USB Keyboard. But it is also possible to change the PID/VID (Product ID/Vendor ID), so Rubber Ducky can claim to be any USB Human Interface Device (HID).<br />
The payload, is written in Ducky Script, which is a very simple scripting language. Its syntax consists of just a few keywords, so everyone can directly start developing their own ducky scripts.<br />
<br />
== Package Content ==<br />
<br />
[[File:USBRubberDucky.jpg|thumb|Rubber Ducky package content]]<br />
<br />
If you purchase the USB Rubber Ducky form Hak5 you will find this content:<br />
<br />
* USB Rubber Ducky<br />
* 128 MB micro SD Card<br />
* The casing of the USB Rubber Ducky<br />
* USB micro SD Card reader<br />
* USB A female to micro USB male adapter<br />
* USB Rubber Ducky field guide<br />
<br />
The USB micro SD Card reader to transfer the encoded the program onto the micro SD Card.<br />
The USB A female to micro USB male adapter allows to use the USB Rubber Ducky on mobile devices.<br />
<br />
== Rubber Ducky Basics ==<br />
Before diving into the world of keystroke injection attacks, a reader should be familiar with the following terms:<br />
<br />
=== Payload ===<br />
The payload tells USB Rubber Ducky what keystroke sequence shall be injected, once connected into a USB jack. Payloads are written in a language called Ducky Script.<br />
<br />
=== Ducky Script ===<br />
Ducky Script is the script language, in which payloads are written. Ducky Scripts are pure text, so any ascii based text editor can be used. The syntax is very easy, each command (all capital letters) resides on a new line with options to follow. See [https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Duckyscript here] a list of commands and their functions.<br />
<br />
=== Duck Encoder ===<br />
Since Rubber Ducky is not able to interpret text files natively, the scripts need to be encoded into a binary keystroke injection file. There are many tools out there and they come in different flavors, as a browser app, a cli program or with a VB GUI. They all work the same, and produce an inject.bin file. There are also decoder tools available to reverse the process and produce ducky scripts from binary files.<br />
<br />
=== inject.bin ===<br />
The inject.bin file is the compiled version of the ducky script. This file is then transferred on to a micro SD card and placed in Rubber Ducky's SD card reader, in order to be read and processed by the firmware.<br />
<br />
=== Firmware ===<br />
Rubber Ducky's source code is open, so many different firmware alternatives are published from the community. Depending on the attack strategy, choose the firmware with specialized functionality, like: <br />
* Multi Operating System Support (Duck)<br />
* Mass Storage (FAT Duck)<br />
* Multiple Payload Delivery (Detour Duck)<br />
* Mass Storage & HID Keyboard Emulation (Twin Duck)<br />
For more information read the appendix of [http://amarketplaceofideas.com/wp-content/uploads/2015/04/The-USB-Rubber-Ducky-Draft.doc this] developer guide.<br /><br />
Tools to flash firmware for Unix/OSX and Windows, including a tutorial can be found [https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Flashing-ducky here].<br />
<br />
== Attack Workflow ==<br />
No matter what kind of device the chosen target will be, the workflow will be basically similar for all devices.<br />
<br />
=== Research ===<br />
Since Rubber Ducky acts as a simple preprogrammed input device, an attack is more likely to be successful, the more detailed information is gathered during reconnaissance phase, using social engineering and open source intelligence gathering techniques.<br />
Once you know details about the used hardware and software running on it, try to rebuild the setup in bare metal or in a virtual environment, to test and optimize payload. <br />
<br />
=== Write ===<br />
Writing ducky scripts always starts with trying out the payload by typing it directly into the test machine using the keyboard, and make step by step notes how you completed some tasks. Once all the necessary keystroke and shortcut combinations are found to complete the attack, the actual writing of the ducky script can start. But keep in mind that all machines vary in performance, especially when dealing with GUI elements. So be sure to add enough delay in the script, so the victim hosts has time enough to follow the keystrokes. A payload generator for multiple OS platforms can be found [https://ducktoolkit.com/payload here].<br />
<br />
=== Encode ===<br />
Once the ducky script is completed, it's time to convert the human readable file into the binary formatted inject.bin file. There is an online Encoder IDE which can be found on [https://ducktoolkit.com/encode ducktoolkit.com]. Or download an offline version from [https://downloads.hak5.org/api/devices/usbrubberducky/tools/jsencoder/1.0 here]. After encoding place the inject.bin file to the root folder of your micro SD card.<br />
In case you need to convert back a binary file to ascii, use [https://ducktoolkit.com/decode this] or other decoding tools.<br />
<br />
=== Test and Optimize ===<br />
Once the tests succeeded on a test environment, it's time to optimize the code in sense of speed (number of keystrokes and delays) and discreetness (to make the attack stealthier). But keep in mind, a less optimized version of your script might be slower, but more reliable when run on different devices.<br />
<br />
=== Deploy ===<br />
<br />
* Deploy the encoded script on the USB Rubber Ducky by Pasting the inject.bin file onto the micro SD Card.<br />
* Use the USB Rubber Ducky and watch it type<br />
<br />
== References ==<br />
<br />
* https://github.com/hak5darren/USB-Rubber-Ducky/wiki<br />
* https://ducktoolkit.com<br />
<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5942Hak5 Packet Squirrel2021-02-05T20:54:15Z<p>MReiss: /* DNS Spoofing Mode */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
=== Basic Cable Setup ===<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
=== Firmware Upgrade ===<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Paylaods ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
* openvpn<br />
* autossh<br />
* tcpdump<br />
* meterpreter-https<br />
* cron<br />
* nmap<br />
* ncat-ssl<br />
* ncat<br />
* sshfs<br />
* tcpdump<br />
* wget<br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5941Hak5 Packet Squirrel2021-02-05T20:51:50Z<p>MReiss: /* Summary */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
=== Basic Cable Setup ===<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
=== Firmware Upgrade ===<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Paylaods ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/abc.com/216.58.207.164</code> as show in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing the spoofed domain the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
* openvpn<br />
* autossh<br />
* tcpdump<br />
* meterpreter-https<br />
* cron<br />
* nmap<br />
* ncat-ssl<br />
* ncat<br />
* sshfs<br />
* tcpdump<br />
* wget<br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5940Hak5 Packet Squirrel2021-02-05T20:51:25Z<p>MReiss: /* DNS Spoofing Mode */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
=== Basic Cable Setup ===<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
=== Firmware Upgrade ===<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Paylaods ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/abc.com/216.58.207.164</code> as show in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
By browsing the spoofed domain the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
* openvpn<br />
* autossh<br />
* tcpdump<br />
* meterpreter-https<br />
* cron<br />
* nmap<br />
* ncat-ssl<br />
* ncat<br />
* sshfs<br />
* tcpdump<br />
* wget<br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5939Hak5 Packet Squirrel2021-02-05T20:51:20Z<p>MReiss: /* Logging Network Traffic */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
=== Basic Cable Setup ===<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
=== Firmware Upgrade ===<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Paylaods ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/abc.com/216.58.207.164</code> as show in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
<br />
By browsing the spoofed domain the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
* openvpn<br />
* autossh<br />
* tcpdump<br />
* meterpreter-https<br />
* cron<br />
* nmap<br />
* ncat-ssl<br />
* ncat<br />
* sshfs<br />
* tcpdump<br />
* wget<br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5938Hak5 Packet Squirrel2021-02-05T20:51:10Z<p>MReiss: /* DNS Spoofing Mode */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
=== Basic Cable Setup ===<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
=== Firmware Upgrade ===<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Paylaods ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/abc.com/216.58.207.164</code> as show in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
<br />
By browsing the spoofed domain the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.<br />
<br />
=== OpenVPN Mode ===<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
* openvpn<br />
* autossh<br />
* tcpdump<br />
* meterpreter-https<br />
* cron<br />
* nmap<br />
* ncat-ssl<br />
* ncat<br />
* sshfs<br />
* tcpdump<br />
* wget<br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=File:Hak5_Squirrel_version.jpg&diff=5937File:Hak5 Squirrel version.jpg2021-02-05T20:47:03Z<p>MReiss: MReiss uploaded a new version of File:Hak5 Squirrel version.jpg</p>
<hr />
<div></div>MReisshttps://elvis.hcw.ac.at/wiki/index.php?title=Hak5_Packet_Squirrel&diff=5936Hak5 Packet Squirrel2021-02-05T20:44:34Z<p>MReiss: /* Description */</p>
<hr />
<div>== Summary == <br />
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel]]<br />
<br />
The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. <br />
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.<br />
<br />
== Description ==<br />
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]<br />
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]<br />
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]<br />
<br />
<br />
The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.<br />
<br />
In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.<br />
<br />
It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well. <br />
<br />
=== Basic Cable Setup ===<br />
<br />
# Plug the victims Ethernet cable into the "Ethernet In" Port<br />
# Plug the gateway Ethernet cable into the "Ethernet Out" Port<br />
# Power the device by plugging in the power cable<br />
<br />
=== Firmware Upgrade ===<br />
<br />
Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.<br />
<br />
The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.<br />
<br />
Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel. <br />
<br />
The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED. <br />
<br />
Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".<br />
<br />
== Paylaods ==<br />
<br />
=== Logging Network Traffic ===<br />
<br />
This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.<br />
Just follow these easy steps:<br />
<br />
# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up. <br />
# Flip the first position (which is nearest to the micro USB power in).<br />
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.<br />
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.<br />
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.<br />
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.<br />
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].<br />
<br />
<br />
After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.<br />
<br />
=== DNS Spoofing Mode ===<br />
<br />
# For this mode we have to start in arming mode (switch at fourth position)<br />
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.<br />
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.<br />
# In the file add entrys like <code>address=/abc.com/216.58.207.164</code> as show in figure "spoofhost file". The example IP belongs to orf.at<br />
# Unplug the Packet Squirrel and shift the switch to the second position.<br />
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.<br />
<br />
<br />
By browsing the spoofed domain the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match.<br />
<br />
=== OpenVPN Mode ===<br />
<br />
The VPN payload implements VPN access mode and VPN tunnelling mode. <br />
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org]. <br />
# Start by selecting the desired server and download the the OVPN access certificate.<br />
# Set the Packet Squirrel in Arming Mode and connect to its shell<br />
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code><br />
# Steer to the directory with <code> cd /root/payloads/switch3/</code><br />
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code><br />
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:<br />
## <code>freeopenvpn</code> <br />
## <code><the displayed password></code> <br />
# Before starting the VPN we choose the VPN mode:<br />
## Open the <code>payload.sh</code> <br />
## Set the <code>For_Clients=</code> to<br />
### <code>0</code> for Access Mode<br />
### <code>1</code> for Tunneling Mode<br />
# Now set the Switch the the third Position and plug power out and in again<br />
# You are good to go, if the yellow LED starts to flash after the boot up sequence <br />
==== Access Mode ====<br />
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]<br />
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]<br />
<br />
Access mode allows the squirrel to access the VPN Network via the Secure Shell<br />
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.<br />
tun0 <br />
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<br />
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0<br />
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1<br />
RX packets:12 errors:0 dropped:0 overruns:0 frame:0<br />
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0<br />
collisions:0 txqueuelen:100<br />
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)<br />
<br />
The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.<br />
<br />
==== Tunneling Mode ====<br />
<br />
The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].<br />
<br />
=== Creating your own Payloads ===<br />
<br />
The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.<br />
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.<br />
Bash scripts can access the following pre-installed tools:<br />
* openvpn<br />
* autossh<br />
* tcpdump<br />
* meterpreter-https<br />
* cron<br />
* nmap<br />
* ncat-ssl<br />
* ncat<br />
* sshfs<br />
* tcpdump<br />
* wget<br />
<br />
For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].<br />
<br />
== Used Hardware ==<br />
<br />
[[Packet Squirrel]]<br />
<br />
== References ==<br />
<br />
* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel<br />
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2<br />
* https://downloads.hak5.org/<br />
<br />
[[Category:Pentesting]]</div>MReiss