Elvis Wiki - User contributions [en]

Empirische Untersuchung zur M2M-Authentifizierung

2024-01-29T21:32:11Z

VKogard:

Machine-to-machine (M2M) authentication is a crucial aspect of the Internet of Things (IoT) as it enables devices to communicate securely with each other. In this empirical study, various authentication protocols were investigated, including LDAP, SAML, OAuth2 and Kerberos.

Code parts for this project can be found on [https://git.fh-campuswien.ac.at/c2110475053/wfp2_m2m GitLab].

== LDAP ==

LDAP (Lightweight Directory Access Protocol) is a widely used directory access protocol that is used to store and retrieve information. However, it can be complex, especially when it comes to setup. Nevertheless, it offers a robust and flexible solution for authentication.

To set up the LDAP server, [https://computingforgeeks.com/install-and-configure-openldap-server-ubuntu/ this] instructions were used. However, as the creation of a group or user with .ldif files is very error-prone, it is recommended to install an Apache2 server and manage the accounts via the GUI (see [https://computingforgeeks.com/install-and-configure-ldap-account-manager-on-ubuntu/ Link]). No password can be added to a user account via the GUI, which is why an additional [https://ubuntu.com/server/docs/service-ldap-usage CLI tool] is required. Unfortunately, the standard configuration leads to many bugs, which is why it must be replaced by [https://ubuntuforums.org/archive/index.php/t-1488232.html this].

* Note: If .ldif files are to be read in with the command <code>ldapadd -x -D cn=admin,dc=example,dc=com -W -f example.ldif</code> and the error message "ldapadd: attributeDescription "dn": (possible missing newline after line 5, entry "ou=people,dc=wfp2,dc=example,dc=com"?)" is displayed, the problem is the lines between the entries that are supposedly empty. A space or several spaces lead to this problem. Instead, \n\n is provided between the account configurations.

To use public key authentication, a key pair must first be generated. Once the key pair has been generated, it can be added to the LDAP server using the <code>ldapadd</code> command. The private key remains on the device, while the public key is stored on the LDAP server. During authentication, the public key is then checked against the private key on the device.

There are three different types of authentication in LDAP:

* Anonymous Authentication Mechanism of Simple Bind is used for anonymous authentication of a client. This can be useful if data should be accessible to all users. With the command <code>ldapsearch -x -LLL -H ldap://ldap.wfp2.example.com -b dc=wfp2,dc=example,dc=com dn</code>, for example, all entries of the LDAP server can be retrieved, allowing the structure of the groups and users to be viewed. It should be noted here that a DNS server with the domain <code>wfp2-example.com</code> has been set up.

[[File:Ldap_unauthorized_access_to_usernames.png|500px|thumb|right|ldapsearch]]

* In contrast to the above command, <code>ldapwhoami -x -H ldap://ldap.wfp2.example.com -D "cn=ubuntumachine1001,ou=people,dc=wfp2,dc=example,dc=com" -W</code> can be used to authenticate and then authorize a user in the CLI. With this command, it should also be noted that the -W parameter requires the password to be entered in extra. If -w is used instead, the password can be specified directly in the command (-w <password>). This authentication is called "Name/Password Authentication Mechanism of Simple Bind".

* The third group "Unauthenticated Authentication Mechanism of Simple Bind" allows only one user name to be entered. In this case, the password field remains empty.

[[File:ldap_authorization_cli.png|500px|thumb|right|ldapwhoami]]

With the command <code>ldapsearch -x -H ldap://ldap.wfp2.example.com -D "cn=ubuntumachine1001,ou=people,dc=wfp2,dc=example,dc=com" -W -b "dc=wfp2,dc=example,dc=com"</code> the user ubuntumachine1001 queries all available LDAP accounts. It should be noted here that ubuntumachine1001 is not an admin user.

[[File:Ldapsearch_teilausschnitt.png|500px|thumb|right|ldapsearch]]

An M2M authentication using LDAP with the help of a password is therefore possible, but is not recommended. LDAP also provides the ability to authenticate a user using an asymmetric key. The protocol also supports challenge-response procedures.

Regarding the security of LDAP, it should be noted that with a high probability the Apache2 server has the largest chess site. Since usernames can be read out without authorization, brute force methods can be used here.

== SAML ==

SAML (Security Assertion Markup Language) is an XML-based standard used for authentication and authorization. It has been found that SAML is difficult to set up, especially when it comes to creating your own SAML identity provider. Since this did not work with the help of various [https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2067398689 online instructions], [https://auth0.com/de Auth0] was used as an alternative. Auth0 is a cloud-based identity management service that offers a user-friendly interface and supports all common authentication methods (password, token, challenge-response, public-key-crypto).

An X.509 certificate is used for public key authentication in SAML. The private key remains (as usual) on the client device while the certificate is issued and deposited by the SAML Identity Provider. During authentication, the certificate is then checked against the private key on the device.

Note 1: For token-based authentication, several parameters (client_id, client_secret, audience, grant_type) must be passed. Since these have to be stored on the machine - like a password - there is no added value apart from the higher security against brute force attacks.

[[File:Saml_settings.png|500px|thumb|right|SAML settings]]

Note 2: The configuration of SAML is tedious, as there are many sources of error due to the different keys and endpoints. In addition, a lot of data is provided in each request or response, which should be processed in a production environment for security reasons.

[[File:Saml_response.png|500px|thumb|right|SAML response]]

== OAuth2 ==

OAuth2 is an authorization framework that allows users to securely share their access to their data with third-party applications. In this context, GitHub and Auth0 were used as authorization servers. It was not possible to host the authorization server locally because there were no open source libraries available. Compared to SAML, OAuth2 is very user-friendly. Setting up the server was very quick and easy with GitHub and Auth0.

However, GitHub has the disadvantage that only the credentials for existing GitHub accounts can be used. For machine-to-machine (M2M) authentication, this means that only one password authentication is possible. Auth0, as with SAML, allows all common authentication options to be used.

In OAuth2, public key authentication is achieved by using JWT (JSON Web Tokens). A JWT contains a header that contains information about the algorithm used, and a body that contains the actual data. The header and body are then signed with the device's private key. When verifying the validity of the token, the token is verified with the public key of the device.

== mTLS ==

mTLS (Mutual Transport Layer Security) is a method of mutual authentication that ensures that both parties exchanging information are who they claim to be by verifying that they both have the correct private key.

In detail, mTLS works very similar to the TLS protocol. However, there is an additional step before the key exchange. The client sends its public key and certificate to the server, which identifies it from the server to confirm that the request comes from a known client and has the private key that corresponds to the client's shared public key.

In contrast to TLS, an internal certification authority is required to implement mTLS. This is provided by the X.509 Certificates for all clients and servers, so that each certificate has the same root certificate. Authentication is based on this match. The root certificate is self-signed in this case. The advantage of mTLS is that various attacks, such as on-path attacks, credential stuffing, are unsuccessful.

mTLS provides more security than TLS because it verifies the identity of both the server and the client. However, it is more compute-intensive than TLS, making it less suitable for scenarios where lower latency is a priority over Zero Trust security.

== Kerberos ==

Kerberos is a network authentication protocol based on a ticket-granting ticket system originally designed for Windows Active Directory. Kerberos can be easily set up and used in Ubuntu. However, it is important to note that Kerberos requires the use of domain names (for a "simple" configuration), which is why a DNS server must be set up in addition. For a configuration without DNS server, see [https://stackoverflow.com/questions/53290348/how-to-setup-kerberos-realm-without-domain-name Link] (not tested).

For the configuration of the Kerbers server, the steps in [https://ubuntu.com/server/docs/service-kerberos of this] manual were carried out. The client requires [https://ubuntu.com/server/docs/service-kerberos-workstation-auth this] library to be able to request a ticket. With the command <code>kinit <username></code> a ticket can be requested from the Kerberos Key Distribution Center (KDC) and displayed with <code>klist</code>.

Officially, Kerberos only supports password authentication. With additional "plug-ins" this can be extended by a [https://github.com/fuhry/kcrap Challenge-Response-Process] or a [https://ieeexplore.ieee.org/document/6149941 Public-Key Cryptography].

With regard to Kerberos, it should also be mentioned that there is the tool [https://github.com/ropnop/kerbrute Kerbrute], which can read Kerberos accounts and read passwords using dictionary attacks, for example. However, Kerberos can be configured so that the account is blocked after a certain number of incorrect entries.

Finally, it is important to note that Kerberos is only used for authentication and not for managing user groups, Linux UIDs and GIDs, home directories, etc. Therefore, another network source is normally used for this information, such as an LDAP or Windows server. In addition, Kerberos user principals must be manually added to the Kerberos server so that they can log in. This can be done with the <code>kadmin.local</code> commands.

== Fwknop ==

[https://www.cipherdyne.org/fwknop/ Fwknop (Firewall Knocking Operation)] is a tool that allows you to control access to a server by sending "knocks" to the server to open a temporary port. This is particularly useful in environments where Zero Trust principles are applied. Unlike many other services, fwknop is a program that does not require a port, which is why it is very well protected against external vulnerabilities.

The so-called "knock" consists of exactly one IPv4 packet, which is sent to the server and dropped by it, because there is no corresponding FW rule. fwknop takes this dropped package and checks if the provided keys are valid. If these are valid, an IP-Tables rule is opened for a certain time (e.g. 5sec), in which the client has time to connect to the service. The disadvantage of fwknop is that due to the limited number of bytes in an IPV4 packet, keys such as RSA4096 do not have space among the other parameters.

This tool is basically a great idea for M2M communication. However, it must also be said that fwknop has not been further developed, which is why it only works on Ubuntu16 machines.

== Summary ==

This empirical study has shown that there are many different ways to authenticate in M2M environments, each with its own advantages and disadvantages. It is important to consider the specific requirements and conditions of your environment in order to find the best solution for your needs.

{| class="wikitable" style="border: 2px solid #000000;"
|-
! Protocoll
! Setup-Complexity
! Security gaps
! User-friendliness
! Authentication methods
! Comments
|-
| LDAP
| Average
| nmap <LDAP Server> has only found vulnerabilities in the Apache server (2.4.52)
| CLI is not user-friendly / web interface is user-friendly
| Passwords, challenge/response procedure, public key cryptography
| Works well when it works once
|-
|rowspan="2" | SAML
| Average
| Not applicable
| High user-friendliness
| Passwords, Challenge/Response Methods, Public Key Cryptography
| Setting up the identity provider via Auth0 worked quickly and easily
|-
| High
| N/A
| N/A
| N/A
| the attempt to host the identity provider locally was abandoned after many failed attempts
|-
| OAuth2
| Low
| Not applicable
| User-friendly
| Passwords, Challenge/Response Methods, Public Key Cryptography
| Simple setup when using GitHub or Auth0 as authorization server
|-
| Kerberos
| Low
| Kerbrute (brute force attacks)
| User-friendly
| Passwords
| Simple setup, but designed specifically for Windows Active Directory
|-
| Fwknop
| Average
| N/A
| User-friendly
| Passwords, public key cryptography with keys up to 2048 bit
| Simple setup, but only works in Ubuntu16
|}

Fields marked "Not applicable" indicate that the responsibility lies with the external identity providers and not with the internal service providers.

=== Use-Case 1 - all machines have the same rights and are managed by a group ===

Using mTLS (Mutual TLS) for authentication between machines is a good idea as long as no external services are used. However, if external services are used, the certificates must be compatible to ensure successful communication.

The Zero Trust principle and Port Knocking are also suitable methods for controlling access to the machines. Access to the machines is only possible after a certain security process has been successfully completed.

=== Use-Case 2 - Machines are located in different locations and are managed by different groups ===

In this case, it is recommended to use SAML or OAuth2 to manage the identity and access rights of the machines. Both protocols allow a fine-grained configuration of the rights.

While SAML is often considered more secure due to its XML-based structure and wide use, OAuth can offer advantages due to its simplicity and ease of use, especially when it comes to managing user privileges.

The choice between SAML and OAuth2 depends on the specific requirements and available resources.

[[Category:Documentation]]

Empirische Untersuchung zur M2M-Authentifizierung

2024-01-29T20:58:42Z

VKogard:

Die M2M-Authentifizierung (Machine-to-Machine) ist ein entscheidender Aspekt in der Internet der Dinge (IoT), da sie es Geräten ermöglicht, sichere Kommunikation miteinander zu führen. In dieser empirischen Untersuchung wurden verschiedene Authentifizierungsprotokolle untersucht, darunter LDAP, SAML, OAuth2 und Kerberos.

Code-Teile für dieses Projekt können auf [https://git.fh-campuswien.ac.at/c2110475053/wfp2_m2m GitLab] gefunden werden.

== LDAP ==

LDAP (Lightweight Directory Access Protocol) ist ein weit verbreitetes Verzeichnisdienstprotokoll, das zum Speichern und Abrufen von Informationen verwendet wird. Es kann jedoch komplex sein, insbesondere wenn es um die Einrichtung geht. Trotzdem bietet es eine robuste und flexible Lösung für die Authentifizierung.

Zum Aufsetzen des LDAP Servers wurde [https://computingforgeeks.com/install-and-configure-openldap-server-ubuntu/ diese] Anleitung verwendet. Da allerdings das Anlegen einer Gruppe beziehungsweise eines Nutzers mit .ldif-Dateien sehr fehleranfällig ist, ist es empfehlenswert einen Apache2 Server zu installieren und die Accounts über die GUI zu managen (siehe [https://computingforgeeks.com/install-and-configure-ldap-account-manager-on-ubuntu/ Link]). Einem Nutzeraccount kann über die GUI kein Passwort hinzugefügt werden, weshalb zusätzlich ein weiters [https://ubuntu.com/server/docs/service-ldap-usage CLI-Tool] notwendig ist. Bei diesem führt die Standardkonfiguration leider zu vielen Bugs, weshalb diese durch [https://ubuntuforums.org/archive/index.php/t-1488232.html diese] ersetzt werden muss.

* Hinweis: Wenn .ldif-Dateien mit dem Befehl <code>ldapadd -x -D cn=admin,dc=example,dc=com -W -f example.ldif</code> eingelesen werden sollen und die Fehlermeldung "" ausgegeben wird, sind die vermeidlich leeren Zeilen zwischen den Einträgen das Problem. Ein Leerzeichen oder mehrere Lehrzeichen führen hier zu diesem Problem. Stattdessen sind zwischen den Accountkonfigurationen \n\n vorgesehen.

Um die Public Key Authentication zu nutzen, muss zunächst ein Schlüsselpaar generiert werden. Dies kann mit dem <code>ssh-keygen</code> Befehl erreicht werden. Nachdem das Schlüsselpaar erzeugt wurde, kann es mit dem <code>ldapadd</code> Befehl zum LDAP-Server hinzugefügt werden. Der private Schlüssel bleibt auf dem Gerät, während der öffentliche Schlüssel auf dem LDAP-Server hinterlegt wird. Bei der Authentifizierung wird dann der öffentliche Schlüssel gegen den privaten Schlüssel auf dem Gerät geprüft.

In LDAP gibt es drei verschiedene Arten der Authentifizierung:

* Anonymous Authentication Mechanism of Simple Bind dient zur anonymen Authentifizierung eines Clients. Dies kann nützlich sein, wenn Daten für alle Benutzer:innen zugänglich sein sollen. Mit dem Befehl <code>ldapsearch -x -LLL -H ldap://ldap.wfp2.example.com -b dc=wfp2,dc=example,dc=com dn</code> können beispielsweise alle Einträge des LDAP Servers abgerufen werden, wodurch die Struktur der Gruppen und der Nutzer einsehen werden kann. Hier muss angemerkt werden, dass ein DNS Server mit der Domaine <code>wfp2-example.com</code> aufgesetzt wurde.

[[File:Ldap_unauthorized_access_to_usernames.png|500px|thumb|right|ldapsearch]]

* Im Gegensatz zu dem oben angeführten Befehl kann mit <code>ldapwhoami -x -H ldap://ldap.wfp2.example.com -D "cn=ubuntumachine1001,ou=people,dc=wfp2,dc=example,dc=com" -W</code> ein User in der CLI authentifiziert und anschließend autorisiert werden. Bei diesem Befehl ist zusätzlich anzumerken, dass der Parameter -W eine Eingabe des Passwortes in extra anfordert. Wird stattdessen -w verwendet, so kann das Passwort direkt in dem Befehl angegeben werden (-w <Passwort>). Diese Authentifizierung wird "Name/Password Authentication Mechanism of Simple Bind" genannt.

* Die dritte Gruppe "Unauthenticated Authentication Mechanism of Simple Bind" ermöglicht es nur einen Benutzernamen einzugeben. Das Passwortfeld bleibt in diesem Fall leer.

[[File:ldap_authorization_cli.png|500px|thumb|right|ldapwhoami]]

Mit dem Befehl <code>ldapsearch -x -H ldap://ldap.wfp2.example.com -D "cn=ubuntumachine1001,ou=people,dc=wfp2,dc=example,dc=com" -W -b "dc=wfp2,dc=example,dc=com"</code> fragt der User ubuntumachine1001 alle verfügbaren LDAP Accounts ab. Anzumerken ist hier, dass ubuntumachine1001 kein Admin-User ist.

[[File:Ldapsearch_teilausschnitt.png|500px|thumb|right|ldapsearch]]

Eine M2M Authentifizierung mittels LDAP mithilfe eines Passwortes ist also möglich, ist allerdings nicht zu empfehlen. LDAP bietet auch die Möglichkeit einen User mithilfe eines asymmetrischen Schlüssels zu authentifizieren. Ebenfalls unterstützt das Protokoll Challenge-Response-Verfahren.

Bezüglich der Sicherheit von LDAP ist anzumerken, dass mit hoher Wahrscheinlichkeit der Apache2 Server die größte Schachstelle aufweist. Da Usernamen unautorisiert ausgelesen werden können, kann hier mit Brute-Force-Verfahren gearbeitet werden.

== SAML ==

SAML (Security Assertion Markup Language) ist ein XML-basiertes Standard, der zur Authentifizierung und Autorisierung verwendet wird. Es wurde festgestellt, dass SAML schwer einzurichten ist, besonders wenn es darum geht, einen eigenen SAML Identity Provider zu erstellen. Da dies auch mithilfe von diversen [https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2067398689 Online-Anleitungen] nicht funktioniert hat wurde als Alternative [https://auth0.com/de Auth0] verwendet. Auth0 ist ein Cloud-basierter Identitätsverwaltungsdienst, welcher eine benutzerfreundliche Oberfläche bietet und alle gängigen Authentifizierungsmethoden (Passwort, Token, Challenge-Response, Public-Key-Crypto) unterstützt.

Für die Public Key Authentication in SAML wird ein X.509-Zertifikat verwendet. Der private Schlüssel bleibt (wie üblich) auf dem Client-Gerät, während das Zertifikat vom SAML Identity Provider ausgestellt und anschließend hinterlegt wird. Bei der Authentifizierung wird dann das Zertifikat gegen den privaten Schlüssel auf dem Gerät geprüft

Anmerkung 1: Bei einer Token basierten Authentifizierung müssen verschiedene Parameter (client_id, client_secret, audience, grant_type) übermittelt werden. Da diese - wie ein Passwort - auf der Maschine gespeichert werden müssen, ist neben der höheren Sicherheit gegenüber Brute-Force-Angriffen kein Mehrwert vorhanden.

[[File:Saml_settings.png|500px|thumb|right|SAML settings]]

Anmerkung 2: Die Konfiguration von SAML ist langwierig, da durch die verschiedenen Schlüssel und Endpoints sehr viele Fehlerquellen vorhanden sind. Zusätzlich werden in jedem Request beziehungsweise in jedem Response sehr viele Daten mitgegeben, welche in einer Produktions-Umgebung aus Sicherheitsgründen verarbeitet werden sollten.

[[File:Saml_response.png|500px|thumb|right|SAML response]]

== OAuth2 ==

OAuth2 ist ein Autorisierungsframework, das Benutzern ermöglicht, ihren Zugang zu ihren Daten auf sichere Weise mit Drittanbieter-Anwendungen zu teilen. In diesem Kontext wurden GitHub und Auth0 als Autorisierungsserver verwendet. Es war nicht möglich, den Autorisierungsserver lokal zu hosten, da keine Open-Source-Bibliotheken verfügbar waren. Im Vergleich zu SAML ist OAuth2 sehr benutzerfreundlich. Das Aufsetzen des Servers hat bei GitHub sowie Auth0 sehr schnell und einfach funktioniert.

GitHub hat jedoch den Nachteil, dass nur die Zugangsdaten für bestehende GitHub-Konten verwendet werden können. Dies bedeutet für eine Machine-to-Machine (M2M) Authentifizierung, dass nur eine Passwort-Authentifizierung möglich ist. Bei Auth0 können, wie bei SAML, alle gängigen Authentifizierungsmöglichkeiten verwendet werden.

In OAuth2 wird die Public Key Authentication durch die Verwendung von JWT (JSON Web Tokens) erreicht. Ein JWT enthält einen Header, der Informationen über den verwendeten Algorithmus enthält, und einen Body, der die tatsächlichen Daten enthält. Der Header und der Body werden dann mit dem privaten Schlüssel des Geräts signiert. Beim Überprüfen der Gültigkeit des Tokens wird das Token mit dem öffentlichen Schlüssel des Geräts überprüft.

== mTLS ==

mTLS (Mutual Transport Layer Security) ist eine Methode für gegenseitige Authentifizierung, die sicherstellt, dass beide Parteien, die Informationen austauschen, wer sie behaupten zu sein, tatsächlich sind, indem überprüft wird, ob sie beide den richtigen privaten Schlüssel haben.

Im Detail funktioniert mTLS sehr ähnlich wie das TLS-Protokoll. Es gibt jedoch einen zusätzlichen Schritt vor dem Schlüsselaustausch. Der Client sendet seinen öffentlichen Schlüssel und Zertifikat an den Server, der diese vom Server aus identifiziert, um zu bestätigen, dass die Anfrage von einem bekannten Client kommt und den privaten Schlüssel besitzt, der zum geteilten öffentlichen Schlüssel des Clients entspricht.

Um mTLS zu implementieren, wird im Gegensatz zu TLS eine interne Zertifizierungsstelle benötigt. Diese stellt die X.509 Zertifikate für alle Clients und Server aus, wodurch jedes Zertifikat das gleiche Stamm-Zertifikat besitzt. Anhand dieser Übereinstimmung findet die Authentifizierung statt. Das Stamm-Zertifikat ist in diesem Fall selbstsigniert. Der Vorteil von mTLS ist, dass diverse Angriffe wie zum Beispiel On-Path-Angriffe, Credential Stuffing, erfolglos verlaufen.

mTLS bietet mehr Sicherheit als TLS, da es sowohl die Identität des Servers als auch des Clients überprüft. Es ist jedoch rechenintensiver als TLS, was es weniger geeignet für Szenarien macht, in denen eine geringere Latenz Priorität hat als Zero Trust-Sicherheit.

== Kerberos ==

Kerberos ist ein Netzwerkauthentifizierungsprotokoll, das auf einem Ticket-Granting-Ticket-System basiert und ursprünglich für das Windows Active Directory entwickelt wurde. Kerberos kann einfach in Ubuntu eingerichtet und verwendet werden. Es ist jedoch wichtig zu beachten, dass Kerberos die Verwendung von Domain-Namen (für eine "einfache" Konfiguration) erfordert, weshalb zusätzlich ein DNS-Server eingerichtet werden muss. Für eine Konfiguration ohne DNS-Server siehe [https://stackoverflow.com/questions/53290348/how-to-setup-kerberos-realm-without-domain-name Link] (nicht getestet).

Für die Konfiguration vom Kerbers Server wurden die Schritte in [https://ubuntu.com/server/docs/service-kerberos dieser] Anleitung durchgeführt. Der Client benötigt [https://ubuntu.com/server/docs/service-kerberos-workstation-auth diese] Library, um ein Ticket beantragen zu können. Mit dem Befehl <code>kinit <username></code> kann ein Ticket vom Kerberos Key Distribution Center (KDC) beantragt und mit <code>klist</code> angezeigt werden.

Offiziell unterstützt Kerberos nur eine Passwort-Authentifizierung. Mit zusätzlichen "Plug-In"s lässt sich dies um ein [//https://github.com/fuhry/kcrap Challenge-Response-Verfahren] oder eine [https://ieeexplore.ieee.org/document/6149941 Public-Key Cryptography] erweitern.

Bezüglich Kerberos ist auch zu erwähnen, dass es das Tool [https://github.com/ropnop/kerbrute Kerbrute] gibt, welches Kerberos Account auslesen und mithilfe von beispielsweise Dictionary-Attacks Passwörter auslesen kann. Allerdings kann Kerberos so konfiguriert werden, dass nach einer bestimmten Anzahl an Falscheingaben der Account gesperrt wird.

Schließlich ist es wichtig zu beachten, dass Kerberos nur zur Authentifizierung verwendet wird und nicht zur Verwaltung von Benutzergruppen, Linux-UIDs und GIDs, Home-Verzeichnissen usw. Daher wird normalerweise eine weitere Netzwerkquelle für diese Informationen verwendet, wie z.B. ein LDAP- oder Windows-Server. Darüber hinaus müssen Kerberos-Benutzerprinzipale manuell zum Kerberos-Server hinzugefügt werden, damit sie sich anmelden können. Dies kann mit den <code>kadmin.local</code>-Befehlen erfolgen.

== Fwknop ==

[https://www.cipherdyne.org/fwknop/ Fwknop (Firewall Knocking Operation)] ist ein Tool, das es ermöglicht, den Zugriff auf einen Server zu steuern, indem es "knocks" an den Server sendet, um einen temporären Port öffnen zu lassen. Dies ist besonders nützlich in Umgebungen, in denen Zero Trust-Prinzipien angewendet werden. fwknop ist im Gegensatz zu vielen anderen Servicen ein Programm, welches keinen Port benötigt, weshalb es gegenüber Schwachstellen von außen sehr gut geschützt ist.

Der sogenannte "knock" besteht dabei aus genau einem IPv4 Packet, welches zum Server geschickt und von diesem gedroppt wird, da keine entsprechende FW-Regel vorhanden ist. fwknop nimmt dieses gedroppte Packet und überprüft, ob die zur Verfügung gestellten Schlüssel gültig sind. Sind diese gültig, wird eine IP-Tables Regel für eine bestimmte Zeit (z.B. 5sec) geöffnet, in welcher der Client Zeit hat sich mit dem Service zu verbinden. Der Nachteil von fwknop ist, dass durch die begrenzte Anzahl an Byte in einem IPV4 Packet Schlüssel wie RSA4096 neben den anderen Parametern keinen Platz haben.

Für die M2M Kommunikation ist dieses Tool grundsätzlich eine tolle Idee. Allerdings muss auch gesagt werden, dass fwknop nicht mehr weiter entwickelt wurde, weshalb es nur auf Ubuntu16 Maschinen funktioniert.

== Zusammenfassung ==

Diese empirische Untersuchung hat gezeigt, dass es viele verschiedene Möglichkeiten zur Authentifizierung in M2M-Umgebungen gibt, jede mit ihren eigenen Vor- und Nachteilen. Es ist wichtig, die spezifischen Anforderungen und Bedingungen Ihrer Umgebung zu berücksichtigen, um die beste Lösung für Ihre Bedürfnisse zu finden.

{| class="wikitable" style="border: 2px solid #000000;"
|-
! Protokoll
! Einrichtungskomplexität
! Sicherheitslücken
! Benutzerfreundlichkeit
! Authentifizierungsmethoden
! Kommentare
|-
| LDAP
| Mittel
| nmap <LDAP Server> hat ausschließlich Schwachstellen beim Apache Server (2.4.52) gefunden
| CLI ist nicht benutzerfreundlich / Weboberfläche ist benutzerfreundlich
| Passwörter, Challenge/Response-Verfahren, Public-Key-Kryptografie
| Funktioniert gut, wenn es einmal funktioniert
|-
|rowspan="2" | SAML
| Mittel
| Nicht relevant
| Hohe Benutzerfreundlichkeit
| Passwörter, Challenge/Response-Verfahren, Public-Key-Kryptografie
| Einrichtung des Identity Providers über Auth0 hat schnell und problemlos funktioniert
|-
| Hoch
| N/A
| N/A
| N/A
| der Versuch den Identity Provider lokal zu hosten wurde nach vielen Fehlversuchen aufgegeben
|-
| OAuth2
| Niedrig
| Nicht relevant
| Benutzerfreundlich
| Passwörter, Challenge/Response-Verfahren, Public-Key-Kryptografie
| Einfache Einrichtung, wenn GitHub oder Auth0 als Autorisierungsserver verwendet werden
|-
| Kerberos
| Niedrig
| Kerbrute (Brute-Force-Angriffe)
| Benutzerfreundlich
| Passwörter
| Einfache Einrichtung, aber speziell für Windows Active Directory entwickelt
|-
| Fwknop
| Mittel
| N/A
| Benutzerfreundlich
| Passwörter, Public-Key-Kryptografie mit Schlüsseln bis 2048 Bit
| Einfache Einrichtung, aber nur in Ubuntu16 funktioniert
|}

Felder, welche mit "Nicht relevant" markiert wurden, bedeuten, dass die Verantwortung bei den externen Identity Providern und nicht bei den internen Service Providern liegt.

=== Use-Case 1 - alle Maschinen haben die gleichen Rechte und werden von einer Gruppe verwaltet ===

Die Verwendung von mTLS (Mutual TLS) für die Authentifizierung zwischen den Maschinen ist eine gute Idee, solange keine externen Dienste verwendet werden. Wenn jedoch externe Dienste verwendet werden, müssen die Zertifikate kompatibel sein, um eine erfolgreiche Kommunikation zu gewährleisten.

Das Zero Trust-Prinzip und das Port Knocking sind ebenfalls geeignete Methoden zur Steuerung des Zugriffs auf die Maschinen. Hierbei wird der Zugriff auf die Maschinen erst nach erfolgreichem Durchlaufen eines bestimmten Sicherheitsprozesses ermöglicht.

=== Use-Case 2 - Maschinen sind an unterschiedlichen Standorten und werden von unterschiedlichen Gruppen verwaltet ===

Für diesen Fall ist die Verwendung von SAML oder OAuth2 empfehlenswert, um die Identität und Zugriffsrechte der Maschinen zu verwalten. Beide Protokolle ermöglichen eine feingranulare Konfiguration der Rechte.

Während SAML aufgrund seiner XML-basierten Struktur und seines breiten Einsatzes oft als sicherer gilt, kann OAuth aufgrund seiner Einfachheit und Benutzerfreundlichkeit Vorteile bieten, insbesondere wenn es um die Verwaltung von Benutzerprivilegien geht.

Die Wahl zwischen SAML und OAuth2 hängt also von den spezifischen Anforderungen und der vorhandenen Ressourcen ab.

[[Category:Documentation]]

Empirische Untersuchung zur M2M-Authentifizierung

2024-01-27T14:55:20Z

VKogard:

Die M2M-Authentifizierung (Machine-to-Machine) ist ein entscheidender Aspekt in der Internet der Dinge (IoT), da sie es Geräten ermöglicht, sichere Kommunikation miteinander zu führen. In dieser empirischen Untersuchung wurden verschiedene Authentifizierungsprotokolle untersucht, darunter LDAP, SAML, OAuth2 und Kerberos.

Code-Teile für dieses Projekt können auf [https://git.fh-campuswien.ac.at/c2110475053/wfp2_m2m GitLab] gefunden werden.

== LDAP ==

LDAP (Lightweight Directory Access Protocol) ist ein weit verbreitetes Verzeichnisdienstprotokoll, das zum Speichern und Abrufen von Informationen verwendet wird. Es kann jedoch komplex sein, insbesondere wenn es um die Einrichtung geht. Trotzdem bietet es eine robuste und flexible Lösung für die Authentifizierung.

Zum Aufsetzen des LDAP Servers wurde [https://computingforgeeks.com/install-and-configure-openldap-server-ubuntu/ diese] Anleitung verwendet. Da allerdings das Anlegen einer Gruppe beziehungsweise eines Nutzers mit .ldif-Dateien sehr fehleranfällig ist, ist es empfehlenswert einen Apache2 Server zu installieren und die Accounts über die GUI zu managen (siehe [https://computingforgeeks.com/install-and-configure-ldap-account-manager-on-ubuntu/ Link]). Allerdings lässt sich einem erstellten Nutzeraccount kein Passwort über die GUI hinzufügen, weshalb zusätzlich ein weiters [https://ubuntu.com/server/docs/service-ldap-usage CLI-Tool] notwendig ist. Bei diesem führt die Standardkonfiguration leider zu vielen Bugs, weshalb diese durch [https://ubuntuforums.org/archive/index.php/t-1488232.html diese] ersetzt werden muss.

Um die Public Key Authentication zu nutzen, muss zunächst ein Schlüsselpaar generiert werden. Dies kann mit dem <code>ssh-keygen</code> Befehl erreicht werden. Nachdem das Schlüsselpaar erzeugt wurde, kann es mit dem <code>ldapadd</code> Befehl zum LDAP-Server hinzugefügt werden. Der private Schlüssel bleibt auf dem Gerät, während der öffentliche Schlüssel auf dem LDAP-Server hinterlegt wird. Bei der Authentifizierung wird dann der öffentliche Schlüssel gegen den privaten Schlüssel auf dem Gerät geprüft.

Interessant ist, dass ein nicht authentifizierter Nutzer mit dem Befehl <code>ldapsearch -x -LLL -H ldap://ldap.wfp2.example.com -b dc=wfp2,dc=example,dc=com dn</code> alle Einträge des LDAP Servers abrufen und so die Struktur der Gruppen und deren Nutzer einsehen kann. Hier muss angemerkt werden, dass ein DNS Server mit der Domaine <code>wfp2-example.com</code> aufgesetzt wurde.

[[File:Ldap_unauthorized_access_to_usernames.png|500px|thumb|right|ldapsearch]]

Im Gegensatz zu dem oben angeführten Befehl kann mit <code>ldapwhoami -x -H ldap://ldap.wfp2.example.com -D "cn=ubuntumachine1001,ou=people,dc=wfp2,dc=example,dc=com" -W</code> ein User in der CLI authentifiziert und anschließend autorisiert werden. Bei diesem Befehl ist zusätzlich anzumerken, dass der Parameter -W eine Eingabe des Passwortes in extra anfordert. Wird stattdessen -w verwendet, so kann das Passwort direkt in dem Befehl angegeben werden (-w <Passwort>).

[[File:ldap_authorization_cli.png|500px|thumb|right|ldapwhoami]]

Mit dem Befehl <code>ldapsearch -x -H ldap://ldap.wfp2.example.com -D "cn=ubuntumachine1001,ou=people,dc=wfp2,dc=example,dc=com" -W -b "dc=wfp2,dc=example,dc=com"</code> fragt der User ubuntumachine1001 alle verfügbaren LDAP Accounts ab. Anzumerken ist hier, dass ubuntumachine1001 kein Admin-User ist.

[[File:Ldapsearch_teilausschnitt.png|500px|thumb|right|ldapsearch]]

Eine M2M Authentifizierung mittels LDAP mithilfe eines Passwortes ist also möglich, ist allerdings nicht zu empfehlen. LDAP bietet auch die Möglichkeit einen User mithilfe eines asymmetrischen Schlüssels zu authentifizieren. Ebenfalls unterstützt das Protokoll Challenge-Response-Verfahren.

Bezüglich der Sicherheit von LDAP ist anzumerken, dass mit hoher Wahrscheinlichkeit der Apache2 Server die größte Schachstelle aufweist. Da Usernamen unautorisiert ausgelesen werden können, kann hier mit Brute-Force-Verfahren gearbeitet werden.

== SAML ==

SAML (Security Assertion Markup Language) ist ein XML-basiertes Standard, der zur Authentifizierung und Autorisierung verwendet wird. Es wurde festgestellt, dass SAML schwer einzurichten ist, besonders wenn es darum geht, einen eigenen SAML Identity Provider zu erstellen. Da dies auch mithilfe von diversen [https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2067398689 Online-Anleitungen] nicht funktioniert hat wurde als Alternative [https://auth0.com/de Auth0] verwendet. Auth0 ist ein Cloud-basierter Identitätsverwaltungsdienst, welcher eine benutzerfreundliche Oberfläche bietet und alle gängigen Authentifizierungsmethoden (Passwort, Token, Challenge-Response, Public-Key-Crypto) unterstützt.

Für die Public Key Authentication in SAML wird ein X.509-Zertifikat verwendet. Der private Schlüssel bleibt (wie üblich) auf dem Client-Gerät, während das Zertifikat vom SAML Identity Provider ausgestellt und anschließend hinterlegt wird. Bei der Authentifizierung wird dann das Zertifikat gegen den privaten Schlüssel auf dem Gerät geprüft

Anmerkung 1: Bei einer Token basierten Authentifizierung müssen verschiedene Parameter (client_id, client_secret, audience, grant_type) übermittelt werden. Da diese - wie ein Passwort - auf der Maschine gespeichert werden müssen, ist neben der höheren Sicherheit gegenüber Brute-Force-Angriffen kein Mehrwert vorhanden.

[[File:Saml_settings.png|500px|thumb|right|SAML settings]]

Anmerkung 2: Die Konfiguration von SAML ist langwierig, da durch die verschiedenen Schlüssel und Endpoints sehr viele Fehlerquellen vorhanden sind. Zusätzlich werden in jedem Request beziehungsweise in jedem Response sehr viele Daten mitgegeben, welche in einer Produktions-Umgebung aus Sicherheitsgründen verarbeitet werden sollten.

[[File:Saml_response.png|500px|thumb|right|SAML response]]

== OAuth2 ==

OAuth2 ist ein Autorisierungsframework, das es Benutzern ermöglicht, ihren Zugang zu ihren Daten auf sichere Weise mit Drittanbieter-Anwendungen zu teilen. In diesem Fall wurde im ersten Fall GitHub und im zweiten Fall Auth0 als Autorisierungsserver verwendet. Den Autorisierungsserver lokal zu hosten war nicht möglich, da es keine Open-Source Bibliotheken gibt. Im Vergleich zu SAML ist OAuth2 sehr benutzerfreundlich. Das Aufsetzen des Servers hat bei GitHub als auch Auth0 sehr schnell und einfach funktioniert. GitHub hat allerdings den Nachteil, dass nur die Zugangsdaten für vorhandene GitHub-Konten verwendet werden können. Dies bedeutet für eine M2M Authentifizierung, dass nur eine Passwort Authentifizierung möglich ist. Bei Auth0 können - wie bei SAML - alle gängigen Authentifizierungsmöglichkeiten verwendet werden.

In OAuth2 wird die Public Key Authentication durch die Verwendung von JWT (JSON Web Tokens) erreicht. Ein JWT enthält einen Header, der Informationen über den verwendeten Algorithmus enthält, und einen Body, der die tatsächlichen Daten enthält. Der Header und der Body werden dann mit dem privaten Schlüssel des Geräts signiert. Beim Überprüfen der Gültigkeit des Tokens wird das Token mit dem öffentlichen Schlüssel des Geräts überprüft.

== mTLS ==

mTLS (Mutual Transport Layer Security) ist eine Methode für gegenseitige Authentifizierung, die sicherstellt, dass beide Parteien, die Informationen austauschen, wer sie behaupten zu sein, tatsächlich sind, indem überprüft wird, ob sie beide den richtigen privaten Schlüssel haben.

Im Detail funktioniert mTLS sehr ähnlich wie das TLS-Protokoll. Es gibt jedoch einen zusätzlichen Schritt vor dem Schlüsselaustausch. Der Client sendet seinen öffentlichen Schlüssel und Zertifikat an den Server, der diese vom Server aus identifiziert, um zu bestätigen, dass die Anfrage von einem bekannten Client kommt und den privaten Schlüssel besitzt, der zum geteilten öffentlichen Schlüssel des Clients entspricht.

Um mTLS zu implementieren, wird im Gegensatz zu TLS eine interne Zertifizierungsstelle benötigt. Diese stellt die X.509 Zertifikate für alle Clients und Server aus, wodurch jedes Zertifikat das gleiche Stamm-Zertifikat besitzt. Anhand dieser Übereinstimmung findet die Authentifizierung statt. Das Stamm-Zertifikat ist in diesem Fall selbstsigniert. Der Vorteil von mTLS ist, dass diverse Angriffe wie zum Beispiel On-Path-Angriffe, Credential Stuffing, erfolglos verlaufen.

== Kerberos ==

Kerberos ist ein Netzwerkauthentifizierungsprotokoll, das auf einem Ticket-Granting-Ticket-System basiert. Obwohl es für das Windows Active Directory entwickelt wurde, ist es in Ubuntu einfach zum einrichten und zum verwenden. Kerberos verlangt allerdings die Verwendung von Domain-Namen. es werden keine IP Adressen akzeptiert, weshalb zusätzlich ein DNS-Server aufzusetzen ist.

Für die Konfiguration vom Kerbers Server wurden die Schritte in [https://ubuntu.com/server/docs/service-kerberos dieser] Anleitung durchgeführt. Der Client benötigt [https://ubuntu.com/server/docs/service-kerberos-workstation-auth diese] Library, um ein Ticket beantragen zu können. Mit dem Befehl <code>kinit <username></code> kann ein Ticket vom Kerberos Key Distribution Center (KDC) beantragt und mit <code>klist</code> angezeigt werden.

Offiziell unterstützt Kerberos nur eine Passwort-Authentifizierung. Mit zusätzlichen "Plug-In"s lässt sich dies um ein [//https://github.com/fuhry/kcrap Challenge-Response-Verfahren] oder eine [https://ieeexplore.ieee.org/document/6149941 Public-Key Cryptography] erweitern.

Bezüglich Kerberos ist auch zu erwähnen, dass es das Tool [https://github.com/ropnop/kerbrute Kerbrute] gibt, welches Kerberos Account auslesen und mithilfe von beispielsweise Dictionary-Attacks Passwörter auslesen kann. Allerdings kann Kerberos so konfiguriert werden, dass nach einer bestimmten Anzahl an Falscheingaben der Account gesperrt wird.

== Fwknop ==

[https://www.cipherdyne.org/fwknop/ Fwknop (Firewall Knocking Operation)] ist ein Tool, das es ermöglicht, den Zugriff auf einen Server zu steuern, indem es "knocks" an den Server sendet, um einen temporären Port öffnen zu lassen. Dies ist besonders nützlich in Umgebungen, in denen Zero Trust-Prinzipien angewendet werden. fwknop ist im Gegensatz zu vielen anderen Servicen ein Programm, welches keinen Port benötigt, weshalb es gegenüber Schwachstellen von außen sehr gut geschützt ist.

Der sogenannte "knock" besteht dabei aus genau einem IPv4 Packet, welches zum Server geschickt und von diesem gedroppt wird, da keine entsprechende FW-Regel vorhanden ist. fwknop nimmt dieses gedroppte Packet und überprüft, ob die zur Verfügung gestellten Schlüssel gültig sind. Sind diese gültig, wird eine IP-Tables Regel für eine bestimmte Zeit (z.B. 5sec) geöffnet, in welcher der Client Zeit hat sich mit dem Service zu verbinden. Der Nachteil von fwknop ist, dass durch die begrenzte Anzahl an Byte in einem IPV4 Packet Schlüssel wie RSA4096 neben den anderen Parametern keinen Platz haben.

Für die M2M Kommunikation ist dieses Tool grundsätzlich eine tolle Idee. Allerdings muss auch gesagt werden, dass fwknop nicht mehr weiter entwickelt wurde, weshalb es nur auf Ubuntu16 Maschinen funktioniert.

== Zusammenfassung ==

Diese empirische Untersuchung hat gezeigt, dass es viele verschiedene Möglichkeiten zur Authentifizierung in M2M-Umgebungen gibt, jede mit ihren eigenen Vor- und Nachteilen. Es ist wichtig, die spezifischen Anforderungen und Bedingungen Ihrer Umgebung zu berücksichtigen, um die beste Lösung für Ihre Bedürfnisse zu finden.

{| class="wikitable" style="border: 2px solid #000000;"
|-
! Protokoll
! Einrichtungskomplexität
! Sicherheitslücken
! Benutzerfreundlichkeit
! Authentifizierungsmethoden
! Kommentare
|-
| LDAP
| Mittel
| nmap <LDAP Server> hat ausschließlich Schwachstellen beim Apache Server (2.4.52) gefunden
| CLI ist nicht benutzerfreundlich / Weboberfläche ist benutzerfreundlich
| Passwörter, Challenge/Response-Verfahren, Public-Key-Kryptografie
| Funktioniert gut, wenn es einmal funktioniert
|-
|rowspan="2" | SAML
| Mittel
| Nicht relevant
| Hohe Benutzerfreundlichkeit
| Passwörter, Challenge/Response-Verfahren, Public-Key-Kryptografie
| Einrichtung des Identity Providers über Auth0 hat schnell und problemlos funktioniert
|-
| Hoch
| N/A
| N/A
| N/A
| der Versuch den Identity Provider lokal zu hosten wurde nach vielen Fehlversuchen aufgegeben
|-
| OAuth2
| Niedrig
| Nicht relevant
| Benutzerfreundlich
| Passwörter, Challenge/Response-Verfahren, Public-Key-Kryptografie
| Einfache Einrichtung, wenn GitHub oder Auth0 als Autorisierungsserver verwendet werden
|-
| Kerberos
| Niedrig
| Kerbrute (Brute-Force-Angriffe)
| Benutzerfreundlich
| Passwörter
| Einfache Einrichtung, aber speziell für Windows Active Directory entwickelt
|-
| Fwknop
| Mittel
| N/A
| Benutzerfreundlich
| Passwörter, Public-Key-Kryptografie mit Schlüsseln bis 2048 Bit
| Einfache Einrichtung, aber nur in Ubuntu16 funktioniert
|}

Felder, welche mit "Nicht relevant" markiert wurden, bedeuten, dass die Verantwortung bei den externen Identity Providern und nicht bei den internen Service Providern liegt.

=== Use-Case 1 - alle Maschinen haben die gleichen Rechte und werden von einer Gruppe verwaltet ===

In dem Fall, dass alle Maschinen die gleichen Berechtigungen haben, kann mTLS verwendet werden, um beide Seiten gegenseitig authentifizieren zu können. Dies funktioniert allerdings nur, wenn keine Services von Dritten (z.B. Azure) in Anspruch genommen werden. In diesem Fall würden die Zertifikate nicht zusammenpassen, wodurch die Maschine die Verbindung zu Azure ablehnen würde.

Zusätzlich kann in diesem Use-Case das Zero Trust (ZT) Prinzip umgesetzt werden, sodass eine Maschine nur jene Services anderer Maschinen sieht, die sich auch wirklich benötigt. Dies könnte mit Port Knocking erreicht werden.

=== Use-Case 2 - Maschinen sind an unterschiedlichen Standorten und werden von unterschiedlichen Gruppen verwaltet ===

In diesem Fall ist mTLS nicht möglich, weshalb eine Authentifizierung über SAML oder OAuth2 empfehlenswert ist. Wie mit LDAP lassen sich mit SAML oder OAuth2 die Rechte einzelner Maschinen feingranular konfigurieren. Empfehlenswert ist die Verwendung von OAUth2 , da diese deutlich schneller und mit weniger Fehlerquellen zu implementieren ist.

Im Fall von OAuth2 ist allerdings das Service von Auth0 zu verwenden, da es aktuell keine Open-Source Lösungen gibt, weshalb Kosten anfallen können.

Im Fall von SAML ist die Installation sehr langwierig, da es keine Wheels zum Installieren gibt.

[[Category:Documentation]]

Empirische Untersuchung zur M2M-Authentifizierung

2024-01-27T14:54:26Z

VKogard:

Die M2M-Authentifizierung (Machine-to-Machine) ist ein entscheidender Aspekt in der Internet der Dinge (IoT), da sie es Geräten ermöglicht, sichere Kommunikation miteinander zu führen. In dieser empirischen Untersuchung wurden verschiedene Authentifizierungsprotokolle untersucht, darunter LDAP, SAML, OAuth2 und Kerberos.

Code-Teile für dieses Projekt können auf [//https://git.fh-campuswien.ac.at/c2110475053/wfp2_m2m GitLab] gefunden werden.

== LDAP ==

LDAP (Lightweight Directory Access Protocol) ist ein weit verbreitetes Verzeichnisdienstprotokoll, das zum Speichern und Abrufen von Informationen verwendet wird. Es kann jedoch komplex sein, insbesondere wenn es um die Einrichtung geht. Trotzdem bietet es eine robuste und flexible Lösung für die Authentifizierung.

Zum Aufsetzen des LDAP Servers wurde [https://computingforgeeks.com/install-and-configure-openldap-server-ubuntu/ diese] Anleitung verwendet. Da allerdings das Anlegen einer Gruppe beziehungsweise eines Nutzers mit .ldif-Dateien sehr fehleranfällig ist, ist es empfehlenswert einen Apache2 Server zu installieren und die Accounts über die GUI zu managen (siehe [https://computingforgeeks.com/install-and-configure-ldap-account-manager-on-ubuntu/ Link]). Allerdings lässt sich einem erstellten Nutzeraccount kein Passwort über die GUI hinzufügen, weshalb zusätzlich ein weiters [https://ubuntu.com/server/docs/service-ldap-usage CLI-Tool] notwendig ist. Bei diesem führt die Standardkonfiguration leider zu vielen Bugs, weshalb diese durch [https://ubuntuforums.org/archive/index.php/t-1488232.html diese] ersetzt werden muss.

Um die Public Key Authentication zu nutzen, muss zunächst ein Schlüsselpaar generiert werden. Dies kann mit dem <code>ssh-keygen</code> Befehl erreicht werden. Nachdem das Schlüsselpaar erzeugt wurde, kann es mit dem <code>ldapadd</code> Befehl zum LDAP-Server hinzugefügt werden. Der private Schlüssel bleibt auf dem Gerät, während der öffentliche Schlüssel auf dem LDAP-Server hinterlegt wird. Bei der Authentifizierung wird dann der öffentliche Schlüssel gegen den privaten Schlüssel auf dem Gerät geprüft.

Interessant ist, dass ein nicht authentifizierter Nutzer mit dem Befehl <code>ldapsearch -x -LLL -H ldap://ldap.wfp2.example.com -b dc=wfp2,dc=example,dc=com dn</code> alle Einträge des LDAP Servers abrufen und so die Struktur der Gruppen und deren Nutzer einsehen kann. Hier muss angemerkt werden, dass ein DNS Server mit der Domaine <code>wfp2-example.com</code> aufgesetzt wurde.

[[File:Ldap_unauthorized_access_to_usernames.png|500px|thumb|right|ldapsearch]]

Im Gegensatz zu dem oben angeführten Befehl kann mit <code>ldapwhoami -x -H ldap://ldap.wfp2.example.com -D "cn=ubuntumachine1001,ou=people,dc=wfp2,dc=example,dc=com" -W</code> ein User in der CLI authentifiziert und anschließend autorisiert werden. Bei diesem Befehl ist zusätzlich anzumerken, dass der Parameter -W eine Eingabe des Passwortes in extra anfordert. Wird stattdessen -w verwendet, so kann das Passwort direkt in dem Befehl angegeben werden (-w <Passwort>).

[[File:ldap_authorization_cli.png|500px|thumb|right|ldapwhoami]]

Mit dem Befehl <code>ldapsearch -x -H ldap://ldap.wfp2.example.com -D "cn=ubuntumachine1001,ou=people,dc=wfp2,dc=example,dc=com" -W -b "dc=wfp2,dc=example,dc=com"</code> fragt der User ubuntumachine1001 alle verfügbaren LDAP Accounts ab. Anzumerken ist hier, dass ubuntumachine1001 kein Admin-User ist.

[[File:Ldapsearch_teilausschnitt.png|500px|thumb|right|ldapsearch]]

Eine M2M Authentifizierung mittels LDAP mithilfe eines Passwortes ist also möglich, ist allerdings nicht zu empfehlen. LDAP bietet auch die Möglichkeit einen User mithilfe eines asymmetrischen Schlüssels zu authentifizieren. Ebenfalls unterstützt das Protokoll Challenge-Response-Verfahren.

Bezüglich der Sicherheit von LDAP ist anzumerken, dass mit hoher Wahrscheinlichkeit der Apache2 Server die größte Schachstelle aufweist. Da Usernamen unautorisiert ausgelesen werden können, kann hier mit Brute-Force-Verfahren gearbeitet werden.

== SAML ==

SAML (Security Assertion Markup Language) ist ein XML-basiertes Standard, der zur Authentifizierung und Autorisierung verwendet wird. Es wurde festgestellt, dass SAML schwer einzurichten ist, besonders wenn es darum geht, einen eigenen SAML Identity Provider zu erstellen. Da dies auch mithilfe von diversen [https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2067398689 Online-Anleitungen] nicht funktioniert hat wurde als Alternative [https://auth0.com/de Auth0] verwendet. Auth0 ist ein Cloud-basierter Identitätsverwaltungsdienst, welcher eine benutzerfreundliche Oberfläche bietet und alle gängigen Authentifizierungsmethoden (Passwort, Token, Challenge-Response, Public-Key-Crypto) unterstützt.

Für die Public Key Authentication in SAML wird ein X.509-Zertifikat verwendet. Der private Schlüssel bleibt (wie üblich) auf dem Client-Gerät, während das Zertifikat vom SAML Identity Provider ausgestellt und anschließend hinterlegt wird. Bei der Authentifizierung wird dann das Zertifikat gegen den privaten Schlüssel auf dem Gerät geprüft

Anmerkung 1: Bei einer Token basierten Authentifizierung müssen verschiedene Parameter (client_id, client_secret, audience, grant_type) übermittelt werden. Da diese - wie ein Passwort - auf der Maschine gespeichert werden müssen, ist neben der höheren Sicherheit gegenüber Brute-Force-Angriffen kein Mehrwert vorhanden.

[[File:Saml_settings.png|500px|thumb|right|SAML settings]]

Anmerkung 2: Die Konfiguration von SAML ist langwierig, da durch die verschiedenen Schlüssel und Endpoints sehr viele Fehlerquellen vorhanden sind. Zusätzlich werden in jedem Request beziehungsweise in jedem Response sehr viele Daten mitgegeben, welche in einer Produktions-Umgebung aus Sicherheitsgründen verarbeitet werden sollten.

[[File:Saml_response.png|500px|thumb|right|SAML response]]

== OAuth2 ==

OAuth2 ist ein Autorisierungsframework, das es Benutzern ermöglicht, ihren Zugang zu ihren Daten auf sichere Weise mit Drittanbieter-Anwendungen zu teilen. In diesem Fall wurde im ersten Fall GitHub und im zweiten Fall Auth0 als Autorisierungsserver verwendet. Den Autorisierungsserver lokal zu hosten war nicht möglich, da es keine Open-Source Bibliotheken gibt. Im Vergleich zu SAML ist OAuth2 sehr benutzerfreundlich. Das Aufsetzen des Servers hat bei GitHub als auch Auth0 sehr schnell und einfach funktioniert. GitHub hat allerdings den Nachteil, dass nur die Zugangsdaten für vorhandene GitHub-Konten verwendet werden können. Dies bedeutet für eine M2M Authentifizierung, dass nur eine Passwort Authentifizierung möglich ist. Bei Auth0 können - wie bei SAML - alle gängigen Authentifizierungsmöglichkeiten verwendet werden.

In OAuth2 wird die Public Key Authentication durch die Verwendung von JWT (JSON Web Tokens) erreicht. Ein JWT enthält einen Header, der Informationen über den verwendeten Algorithmus enthält, und einen Body, der die tatsächlichen Daten enthält. Der Header und der Body werden dann mit dem privaten Schlüssel des Geräts signiert. Beim Überprüfen der Gültigkeit des Tokens wird das Token mit dem öffentlichen Schlüssel des Geräts überprüft.

== mTLS ==

mTLS (Mutual Transport Layer Security) ist eine Methode für gegenseitige Authentifizierung, die sicherstellt, dass beide Parteien, die Informationen austauschen, wer sie behaupten zu sein, tatsächlich sind, indem überprüft wird, ob sie beide den richtigen privaten Schlüssel haben.

Im Detail funktioniert mTLS sehr ähnlich wie das TLS-Protokoll. Es gibt jedoch einen zusätzlichen Schritt vor dem Schlüsselaustausch. Der Client sendet seinen öffentlichen Schlüssel und Zertifikat an den Server, der diese vom Server aus identifiziert, um zu bestätigen, dass die Anfrage von einem bekannten Client kommt und den privaten Schlüssel besitzt, der zum geteilten öffentlichen Schlüssel des Clients entspricht.

Um mTLS zu implementieren, wird im Gegensatz zu TLS eine interne Zertifizierungsstelle benötigt. Diese stellt die X.509 Zertifikate für alle Clients und Server aus, wodurch jedes Zertifikat das gleiche Stamm-Zertifikat besitzt. Anhand dieser Übereinstimmung findet die Authentifizierung statt. Das Stamm-Zertifikat ist in diesem Fall selbstsigniert. Der Vorteil von mTLS ist, dass diverse Angriffe wie zum Beispiel On-Path-Angriffe, Credential Stuffing, erfolglos verlaufen.

== Kerberos ==

Kerberos ist ein Netzwerkauthentifizierungsprotokoll, das auf einem Ticket-Granting-Ticket-System basiert. Obwohl es für das Windows Active Directory entwickelt wurde, ist es in Ubuntu einfach zum einrichten und zum verwenden. Kerberos verlangt allerdings die Verwendung von Domain-Namen. es werden keine IP Adressen akzeptiert, weshalb zusätzlich ein DNS-Server aufzusetzen ist.

Für die Konfiguration vom Kerbers Server wurden die Schritte in [https://ubuntu.com/server/docs/service-kerberos dieser] Anleitung durchgeführt. Der Client benötigt [https://ubuntu.com/server/docs/service-kerberos-workstation-auth diese] Library, um ein Ticket beantragen zu können. Mit dem Befehl <code>kinit <username></code> kann ein Ticket vom Kerberos Key Distribution Center (KDC) beantragt und mit <code>klist</code> angezeigt werden.

Offiziell unterstützt Kerberos nur eine Passwort-Authentifizierung. Mit zusätzlichen "Plug-In"s lässt sich dies um ein [//https://github.com/fuhry/kcrap Challenge-Response-Verfahren] oder eine [https://ieeexplore.ieee.org/document/6149941 Public-Key Cryptography] erweitern.

Bezüglich Kerberos ist auch zu erwähnen, dass es das Tool [https://github.com/ropnop/kerbrute Kerbrute] gibt, welches Kerberos Account auslesen und mithilfe von beispielsweise Dictionary-Attacks Passwörter auslesen kann. Allerdings kann Kerberos so konfiguriert werden, dass nach einer bestimmten Anzahl an Falscheingaben der Account gesperrt wird.

== Fwknop ==

[https://www.cipherdyne.org/fwknop/ Fwknop (Firewall Knocking Operation)] ist ein Tool, das es ermöglicht, den Zugriff auf einen Server zu steuern, indem es "knocks" an den Server sendet, um einen temporären Port öffnen zu lassen. Dies ist besonders nützlich in Umgebungen, in denen Zero Trust-Prinzipien angewendet werden. fwknop ist im Gegensatz zu vielen anderen Servicen ein Programm, welches keinen Port benötigt, weshalb es gegenüber Schwachstellen von außen sehr gut geschützt ist.

Der sogenannte "knock" besteht dabei aus genau einem IPv4 Packet, welches zum Server geschickt und von diesem gedroppt wird, da keine entsprechende FW-Regel vorhanden ist. fwknop nimmt dieses gedroppte Packet und überprüft, ob die zur Verfügung gestellten Schlüssel gültig sind. Sind diese gültig, wird eine IP-Tables Regel für eine bestimmte Zeit (z.B. 5sec) geöffnet, in welcher der Client Zeit hat sich mit dem Service zu verbinden. Der Nachteil von fwknop ist, dass durch die begrenzte Anzahl an Byte in einem IPV4 Packet Schlüssel wie RSA4096 neben den anderen Parametern keinen Platz haben.

Für die M2M Kommunikation ist dieses Tool grundsätzlich eine tolle Idee. Allerdings muss auch gesagt werden, dass fwknop nicht mehr weiter entwickelt wurde, weshalb es nur auf Ubuntu16 Maschinen funktioniert.

== Zusammenfassung ==

Diese empirische Untersuchung hat gezeigt, dass es viele verschiedene Möglichkeiten zur Authentifizierung in M2M-Umgebungen gibt, jede mit ihren eigenen Vor- und Nachteilen. Es ist wichtig, die spezifischen Anforderungen und Bedingungen Ihrer Umgebung zu berücksichtigen, um die beste Lösung für Ihre Bedürfnisse zu finden.

{| class="wikitable" style="border: 2px solid #000000;"
|-
! Protokoll
! Einrichtungskomplexität
! Sicherheitslücken
! Benutzerfreundlichkeit
! Authentifizierungsmethoden
! Kommentare
|-
| LDAP
| Mittel
| nmap <LDAP Server> hat ausschließlich Schwachstellen beim Apache Server (2.4.52) gefunden
| CLI ist nicht benutzerfreundlich / Weboberfläche ist benutzerfreundlich
| Passwörter, Challenge/Response-Verfahren, Public-Key-Kryptografie
| Funktioniert gut, wenn es einmal funktioniert
|-
|rowspan="2" | SAML
| Mittel
| Nicht relevant
| Hohe Benutzerfreundlichkeit
| Passwörter, Challenge/Response-Verfahren, Public-Key-Kryptografie
| Einrichtung des Identity Providers über Auth0 hat schnell und problemlos funktioniert
|-
| Hoch
| N/A
| N/A
| N/A
| der Versuch den Identity Provider lokal zu hosten wurde nach vielen Fehlversuchen aufgegeben
|-
| OAuth2
| Niedrig
| Nicht relevant
| Benutzerfreundlich
| Passwörter, Challenge/Response-Verfahren, Public-Key-Kryptografie
| Einfache Einrichtung, wenn GitHub oder Auth0 als Autorisierungsserver verwendet werden
|-
| Kerberos
| Niedrig
| Kerbrute (Brute-Force-Angriffe)
| Benutzerfreundlich
| Passwörter
| Einfache Einrichtung, aber speziell für Windows Active Directory entwickelt
|-
| Fwknop
| Mittel
| N/A
| Benutzerfreundlich
| Passwörter, Public-Key-Kryptografie mit Schlüsseln bis 2048 Bit
| Einfache Einrichtung, aber nur in Ubuntu16 funktioniert
|}

Felder, welche mit "Nicht relevant" markiert wurden, bedeuten, dass die Verantwortung bei den externen Identity Providern und nicht bei den internen Service Providern liegt.

=== Use-Case 1 - alle Maschinen haben die gleichen Rechte und werden von einer Gruppe verwaltet ===

In dem Fall, dass alle Maschinen die gleichen Berechtigungen haben, kann mTLS verwendet werden, um beide Seiten gegenseitig authentifizieren zu können. Dies funktioniert allerdings nur, wenn keine Services von Dritten (z.B. Azure) in Anspruch genommen werden. In diesem Fall würden die Zertifikate nicht zusammenpassen, wodurch die Maschine die Verbindung zu Azure ablehnen würde.

Zusätzlich kann in diesem Use-Case das Zero Trust (ZT) Prinzip umgesetzt werden, sodass eine Maschine nur jene Services anderer Maschinen sieht, die sich auch wirklich benötigt. Dies könnte mit Port Knocking erreicht werden.

=== Use-Case 2 - Maschinen sind an unterschiedlichen Standorten und werden von unterschiedlichen Gruppen verwaltet ===

In diesem Fall ist mTLS nicht möglich, weshalb eine Authentifizierung über SAML oder OAuth2 empfehlenswert ist. Wie mit LDAP lassen sich mit SAML oder OAuth2 die Rechte einzelner Maschinen feingranular konfigurieren. Empfehlenswert ist die Verwendung von OAUth2 , da diese deutlich schneller und mit weniger Fehlerquellen zu implementieren ist.

Im Fall von OAuth2 ist allerdings das Service von Auth0 zu verwenden, da es aktuell keine Open-Source Lösungen gibt, weshalb Kosten anfallen können.

Im Fall von SAML ist die Installation sehr langwierig, da es keine Wheels zum Installieren gibt.

[[Category:Documentation]]

File:Saml response.png

2024-01-26T10:47:29Z

VKogard:

File:Saml settings.png

2024-01-26T10:33:48Z

VKogard:

File:Ldapsearch teilausschnitt.png

2024-01-26T10:13:35Z

VKogard:

File:Ldap authorization cli.png

2024-01-26T10:05:17Z

VKogard:

File:Ldap unauthorized access to usernames.png

2024-01-26T10:00:46Z

VKogard:

Hak5 Packet Squirrel

2023-12-18T13:53:26Z

VKogard: /* Payloads */

== Summary ==
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]

The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing / Modifying DNS requests and Tunnel taffic through an OpenVPN tunnel. These can also be modified and exchanged with other scripts. It's stealthy pocket-size enables it to be placed without notice, this can come in handy for penetration testers. The efficient energy usage makes it possible to power it with a battery pack to run over a week.
The Packet Squirrel can also be combined with the [https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2 Hak5 Cloud C2], a command and control server specially for Hak5 devices.

The device brings following characteristics with it:
# Dimensions: 50 x 40 x 15 mm – small and lightweight with 24 grams
# Consumption: 0,12A using a Micro-USB-Port
## Can be run with a battery pack
# Ports: 2 x RJ45-Ethernet-Port | 1 x USB-Port for a flash drive | Micro-USB-Port for power supply
# OS: Runs a Linux platform with root access and common network utilities
# Hardware
## LED indicating the status of the device
## Payload Selection Switch to choose the respective payload
## Scriptable push-button to stop payloads with ease

==== Possible attacks with the Packet Squirrel ====

The '''Man-in-the-Middle Attack (MITM)''' is a popular cyber security attack which is described by an attacker interfering physically, or nowadays often logically, the communication between two or more network targets. Thus, the attacker gains complete control over the data traffic and can read, store, block, manipulate or delete the data traffic. The crux of the attack is that the attacker pretends to be the respective counterpart to the communication partners.

The MITM-Attack can be realized by another attack called '''Spoofing'''. Spoofing is when a hacker pretends to be someone known to an individual or network host to access confidential information. Spoofing can technically occur in many ways, among others ARP, DHCP or DNS Spoofing.

== Community ==

Hak5 does not only provide the opportunity to use following payloads fluently and easy using the switch on the side but additionally fosters building a [https://hak5.org/pages/payloads community] regarding all there devices.

The Hak5-webiste provides a way of submitting self-made payloads or to ask questions in a [https://forums.hak5.org/forum/94-packet-squirrel/ forum]. To promote the development of new payloads and to reward creativity, effort and collaboration Hak5 provides the possibility to submit a payload to “Hak5 Payload Awards” to receive a monetary reward in a hight of $ 2.000, -. The winner will be decided yearly by the voting community.

Through [https://github.com/hak5/packetsquirrel-payloads Hak5’s Github-Account] payloads are made available to public and can be downloaded/cloned within the respective repository.

== Description ==
[[File:Packet_squirrel_file_tree.jpg|thumb|right|400px||SSH connect]]
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]

The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.

In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.

It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgoing Ethernet interface as well.

==== Basic Cable Setup ====

# Plug the victims Ethernet cable into the "Ethernet In" Port
# Plug the gateway Ethernet cable into the "Ethernet Out" Port
# Power the device by plugging in the power cable

==== Firmware Upgrade ====

Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the [https://downloads.hak5.org/squirrel Hak5 website].

The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.

Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel.

The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blue blinking LED.

Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".

==== Manual upgrade ====

It is also possible to manually upgrade the firmware of the Packet Squirrel by:

# Download the latest firmware from the website linked above and verify the checksum
# Switch into “Arming Mode” and power on the device
# Use SCP to transfer the file to Packet Squirrel’s /tmp directory. The appropriate command could be: scp upgrade-x.x.bin root@172.16.32.1:/tmp/
# Use SSH (command: ssh root@172.16.31.1) to connect to Packet Squirrel’s bash prompt and use the sysupgrade command (sysupgrade -n /tmp/upgrade-x.x.bin) to start the firmware update
# The process may take 5-10 minutes. Do NOT unplug the device during the process, otherwise the device could become inoperable.

==== Formatting the USB-Stick ====

The Hak5 Packet Squirrel can only operate with a USB disk that is formatted with an NTFS or EXT4 file system.

NTFS (New Technology File System) is a proprietary journaling file system that was developed by Microsoft and offers targeted access protection at file level and greater data security through journaling and is not limited to a file size of 4GB as e.g. FAT. Formatting is performed with following steps:

# On a Windows-machine:
## Find and open your file explorer on Windows
## Locate your USB-Stick in the left bar
## Select “Format”
## Set NTFS as file system using the drop down, tick “Quick Format” and click “Start”

EXT4 is the fourth extended filesystem that was developed for the Linux Kernel and like NTFS a journaling file system. Windows cannot directly format a USB-Stick to the EXT4 format and therefore there is a need for an third-party tool. A USB-Stick is formatted to EXT4 using following steps:

# On a Windows-machine:
## Download and install [https://www.diskgenius.com/download.php DiskGuard]
## Select your drive from the left bar
## Select the “Format”-button at the top bar
## Select the wanted file system “EXT4” from the drop down menu
## Click “Format”

== Payloads ==

Payloads can be stored on an external USB disk or on the device’s internal memory. On boot the device gives priority to payloads on the USB disk, other payloads existing on the internal memory will be overridden. If no USB disk is available, payloads stored on the internal memory are executed. Payloads on the internal memory are stored in /root/payloads and need to be called switch1, switch2 and switch3, payloads on an USB disk should be stored in /payloads/ and named accordingly.

=== Logging Network Traffic ===

This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.
Just follow these easy steps:

# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up.
# Flip the first position (which is nearest to the micro USB power in).
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].

After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.

=== DNS Spoofing Mode ===

This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.

# For this mode we have to start in arming mode (switch at fourth position)
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at. If all requests should be redirected to this IP address a # is needed (<code>address=/#/194.232.104.140</code>). Furthermore, It must be mentioned that the IP address of orf.at must be specified. The specification of orf.at itself does not work, as the Packet Squirrel does not resolve it into an IP.
# Unplug the Packet Squirrel and shift the switch to the second position.
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.

By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.

=== OpenVPN Mode ===
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Access Mode]]

An existing VPN server from [https://www.freeopenvpn.org/en/ freeopenvpn.org] can be used for Tunnel Mode. To use the Access Mode, a separate VPN server must be set up. This requires a server with a static IP address to which you have full access for configuration. As part of a project at the FH Campus Wien, it makes sense to use the FH infrastructure. The hardware requirements for the server are very low with 2 CPUs and 2GB RAM. The self-hosted [https://openvpn.net/access-server/ Server] was used as OpenVPN (OVPN). This offers two free connections, which are sufficient in this case.

# Download the the OVPN access certificate.
# Set the Packet Squirrel in Arming Mode and connect to its shell
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code>
# Steer to the directory with <code> cd /root/payloads/switch3/</code>
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code>
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:
## <code>freeopenvpn</code>
## <code><the displayed password></code>
# Before starting the VPN we choose the VPN mode:
## Open the <code>payload.sh</code>
## Set the <code>For_Clients=</code> to
### <code>0</code> for Access Mode
### <code>1</code> for Tunneling Mode
# Now set the Switch the the third Position and plug power out and in again
# You are good to go, if the yellow LED starts to flash after the boot up sequence
==== Access Mode ====

Access mode allows the squirrel to access the VPN Network via the Secure Shell if the connection was established. Therefore you have to install an OpenVPN Client at another device like a Ubuntu VM as well. From this VM you can establish a tunnel to the VPN Server. From there connect via SSH to the Packet Squirrel.

The command <code>ifconfig tun0</code> shows the following output when it is issued at the Packet Squirrels Shell.
tun0
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:12 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)

The Access Mode can be used to access an Private network from outside.

==== Tunneling Mode ====

The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].

You can also install an simple openVPN Server on a linux machine with
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code>
and press Enter 6 times.
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position.

=== Meterpreter-via-SSH ===
[[File:Packet squirrel meterpreter ssh.PNG |thumb|right|400px||Packet Squirrel Payload Meterpreter-via-SSH settings]]
This payload starts the Packet Squirrel in NAT mode and waits for user input. When the button is pressed, the payload connects to a remote SSH server and creates a local port tunnel. It then launches a meterpreter shell over the tunnel.
The intent is to hide the meterpreter network traffic behind a legitimate SSH activity.
You can download this payload from the offical [https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library/remote-access/Meterpreter-via-SSH hak5 github].
==== Getting Started ====
Copy the playload to the Packet Squirrel into the desired switch folder. Now edit the scirpt to configure your server options:
* SSH_USER - username on remote SSH server
* SSH_HOST - ip address of remote SSH Server

'''Note:''' If you changed the default meterpreter port don't forget to change it on the metasploit side as well.
* MSF_PORT

===== Generate SSH Key on Squirrel =====
Now you have to generate an ssh key-pair (just use default location and empty password) on your Packet Squirrel:
root@squirrel:~# ssh-keygen
===== Allow Squirrel on SSH Server =====
Then you have to copy the contents of /root/.ssh/id_rsa.pub from Packet Squirrel to the SSH Server authorized file:

user@server:~# mkdir ~/.ssh
user@server:~# echo 'paste id_rsa.pub contents inside this quote' > ~/.ssh/authorized_keys
===== Run Metasploit with Resource =====
msf@server:~# msfconsole -r server.rc

==== LED Definitions ====
# Configure NETMODE
#* Solid Magenta
# Connect to SSH Server
#* SUCCESS - Blink Amber 5 Times
#* FAIL - Blink Red 2 Times
# Launch meterpreter
#* SUCESS - Blink Cyan 1 Time
#* FAIL - Blink Red 1 Time

==== Hardening Recommendations ====
# Use an accout with limited privileges for SSH acces on the server.
# User a dedicated account for Packet Squirrel device (audit usage with SSH access logs).
# Disable PasswordAuthentication in sshd_config on the server.

=== ISpyintel ===
[[File:Packet squirrel ispyintel.PNG |thumb|right|400px||Packet Squirrel Payload ISpyIntel settings]]
This payload will automate gathering various recon data on whatever passes between it's Ethernet ports. You can download this payload from the [https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library/sniffing/ispyintel official hak5 github].
'''Note:''' This payload requires a usb stick to store loot.
==== Setup ====
# Edit the config variables at the top. The main variables are:
## <code>lootPath="/mnt/loot/intel" # Path to loot</code>
## <code>mode="TRANSPARENT" # Network mode we want to use</code>
## <code>interface="br-lan" # Interface to listen on</code>
# Copy payload.sh into the ~/payloads/switch folder you wish to deploy on.
# Connect into a target machine with access to the LAN.
# Set switch to the spot and power up.
# Leave, get coffee, take a nap while everything is recorded and parsed for future use.
# When done; hit the button. The LED will rapidly flash white to let you know it is finishing up.
# When all is done the LED will just go blank. It is now safe to unplug and go about your day.

==== Tasks that are started ====
* tcpdump - records every packet that was send and received
* urlsnarf - collects all websites that were visited
* dsniff - attempts to acquire passwords and what not
* ngrep - on ports 80 and 21 with the filter for common password fields
* ngrep - on ports 80 and 21 with the filter for common session id fields
* log.txt - logs the progress of the payload for troubleshooting

==== Clean Up ====
Once the button is pressed the payload will automatically parse the TCPDump log file for the following items and store the results in seperate files.
As this process can take some time the LED will change to a rapid white blink letting you know the button command was recieved and the payload is in the process of shutting down.
* ipv4found.txt Will contain a unique list of all the ipv4 which the pcap file contains
* maybeEmails.txt Is a very loose search for possible email addresses that came across the wire in plain text.

=== Creating your own Payloads ===

Ducky Script is the payload language of Hak5 and consists of several simple commands specific to the Packet Squirrel hardware and bash. The basic Ducky Script commands are describe below and include NETMODE, LED, BUTTON and SWITCH.

The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.
Bash scripts can access the following pre-installed tools:
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget

The featured Squirrel Script offers the following additional commands:

* NETMODE
specifies which network mode Packet Sqirrel uses and how traffic is routed

{| class="wikitable"
|-
! Command !! Description
|-
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel
|-
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address
|-
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel
|-
| NETMODE VPN || same as NAT with VPN interface for client tunneling
|-
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN
|}

* LED
with this command the multi-color LED can be controlled.

Further information regarding the LED, its colors, patterns and states can be found [https://docs.hak5.org/hc/en-us/articles/360010554653-LED here].

{| class="wikitable"
|-
! Possible configurations !! Description
|-
| LED Colors || red, green, blue, yellow, cyan, magenta, white
|-
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000
|-
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH
|}

* BUTTON
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed.

Further information regarding the Ducky Script’s “Button” command like its return value, possible ways of configuring the wait time, LED color during the pause as well as the option to suppress the LED can be found [https://docs.hak5.org/hc/en-us/articles/360010554673-BUTTON here].

* SWITCH
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".

==== Example and Best Practices ====
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]
[[File:Hak5 c2 sqirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]

As shown below, payloads should begin with comments specifying the name of the payload, a description, the author(s), the target, special requirements, category, netmodes and the LED status.

Configurable options should be placed on the top of the payload file.

The LED should be used regarding common payload states and not with unique pattern combinations. The LED command should precede the NETMODE command indicating a specific state like SETUP or even FAIL if specific conditions are not met. If a payload reaches a FINISH state, the Packet Squirrel is safe to power off.

Here is an example for the usage of Squirrel Script.

<syntaxhighlight lang="bash">
# Title: Caternet
# Author: Hak5Darren
# Version: 1.0
# Description: Forwards all traffic to local webserver hosting cat photos.
# Props: In loving memory of Hak5Kerby

LED SETUP
NETMODE NAT
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address
/etc/init.d/dnsmasq restart

LED ATTACK
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53
python -m SimpleHTTPServer 80
</syntaxhighlight>

For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].

== with Cloud C2 ==

The [https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2 Hak5 Cloud C2] is a command and control server for Hak5 devices. Installation and startup is shown in figure "C2 server start". By browsing to the configured address you can login to the dashboard, shown in figure "C2 dashboard".

To connect the Packet Squirrel with your C2 Cloud, click on the plus button in the lower right corner and choose the device. On the dashboard, open the added device and click on Setup, as shown in figure "C2 Packet Sqirrel". Then copy the downloaded file to the Packet Squirrel's /etc folder and reboot it.
In the Overview tab you can also Edit, Reboot, Wipe and Remove your device.

In the Clients tab you can see all clients which were connected to your Packet Squirrel with hostname, MAC and IP address. In the Loot tab, you can open the current loot from your Packet Squirrel directly on your C2 server. And in the Terminal tab you can open a ssh session to your device.

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Pentesting]]

Hak5 Packet Squirrel

2023-12-18T13:51:33Z

VKogard: /* OpenVPN Mode */

== Summary ==
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]

The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing / Modifying DNS requests and Tunnel taffic through an OpenVPN tunnel. These can also be modified and exchanged with other scripts. It's stealthy pocket-size enables it to be placed without notice, this can come in handy for penetration testers. The efficient energy usage makes it possible to power it with a battery pack to run over a week.
The Packet Squirrel can also be combined with the [https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2 Hak5 Cloud C2], a command and control server specially for Hak5 devices.

The device brings following characteristics with it:
# Dimensions: 50 x 40 x 15 mm – small and lightweight with 24 grams
# Consumption: 0,12A using a Micro-USB-Port
## Can be run with a battery pack
# Ports: 2 x RJ45-Ethernet-Port | 1 x USB-Port for a flash drive | Micro-USB-Port for power supply
# OS: Runs a Linux platform with root access and common network utilities
# Hardware
## LED indicating the status of the device
## Payload Selection Switch to choose the respective payload
## Scriptable push-button to stop payloads with ease

==== Possible attacks with the Packet Squirrel ====

The '''Man-in-the-Middle Attack (MITM)''' is a popular cyber security attack which is described by an attacker interfering physically, or nowadays often logically, the communication between two or more network targets. Thus, the attacker gains complete control over the data traffic and can read, store, block, manipulate or delete the data traffic. The crux of the attack is that the attacker pretends to be the respective counterpart to the communication partners.

The MITM-Attack can be realized by another attack called '''Spoofing'''. Spoofing is when a hacker pretends to be someone known to an individual or network host to access confidential information. Spoofing can technically occur in many ways, among others ARP, DHCP or DNS Spoofing.

== Community ==

Hak5 does not only provide the opportunity to use following payloads fluently and easy using the switch on the side but additionally fosters building a [https://hak5.org/pages/payloads community] regarding all there devices.

The Hak5-webiste provides a way of submitting self-made payloads or to ask questions in a [https://forums.hak5.org/forum/94-packet-squirrel/ forum]. To promote the development of new payloads and to reward creativity, effort and collaboration Hak5 provides the possibility to submit a payload to “Hak5 Payload Awards” to receive a monetary reward in a hight of $ 2.000, -. The winner will be decided yearly by the voting community.

Through [https://github.com/hak5/packetsquirrel-payloads Hak5’s Github-Account] payloads are made available to public and can be downloaded/cloned within the respective repository.

== Description ==
[[File:Packet_squirrel_file_tree.jpg|thumb|right|400px||SSH connect]]
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]

The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.

In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.

It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgoing Ethernet interface as well.

==== Basic Cable Setup ====

# Plug the victims Ethernet cable into the "Ethernet In" Port
# Plug the gateway Ethernet cable into the "Ethernet Out" Port
# Power the device by plugging in the power cable

==== Firmware Upgrade ====

Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the [https://downloads.hak5.org/squirrel Hak5 website].

The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.

Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel.

The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blue blinking LED.

Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".

==== Manual upgrade ====

It is also possible to manually upgrade the firmware of the Packet Squirrel by:

# Download the latest firmware from the website linked above and verify the checksum
# Switch into “Arming Mode” and power on the device
# Use SCP to transfer the file to Packet Squirrel’s /tmp directory. The appropriate command could be: scp upgrade-x.x.bin root@172.16.32.1:/tmp/
# Use SSH (command: ssh root@172.16.31.1) to connect to Packet Squirrel’s bash prompt and use the sysupgrade command (sysupgrade -n /tmp/upgrade-x.x.bin) to start the firmware update
# The process may take 5-10 minutes. Do NOT unplug the device during the process, otherwise the device could become inoperable.

==== Formatting the USB-Stick ====

The Hak5 Packet Squirrel can only operate with a USB disk that is formatted with an NTFS or EXT4 file system.

NTFS (New Technology File System) is a proprietary journaling file system that was developed by Microsoft and offers targeted access protection at file level and greater data security through journaling and is not limited to a file size of 4GB as e.g. FAT. Formatting is performed with following steps:

# On a Windows-machine:
## Find and open your file explorer on Windows
## Locate your USB-Stick in the left bar
## Select “Format”
## Set NTFS as file system using the drop down, tick “Quick Format” and click “Start”

EXT4 is the fourth extended filesystem that was developed for the Linux Kernel and like NTFS a journaling file system. Windows cannot directly format a USB-Stick to the EXT4 format and therefore there is a need for an third-party tool. A USB-Stick is formatted to EXT4 using following steps:

# On a Windows-machine:
## Download and install [https://www.diskgenius.com/download.php DiskGuard]
## Select your drive from the left bar
## Select the “Format”-button at the top bar
## Select the wanted file system “EXT4” from the drop down menu
## Click “Format”

== Payloads ==

Payloads can be stored on an external USB disk or on the device’s internal memory. On boot the device gives priority to payloads on the USB disk, other payloads existing on the internal memory will be overridden. If no USB disk is available, payloads stored on the internal memory are executed. Payloads on the internal memory are stored in /root/payloads and need to be called switch1, switch2 and switch3, payloads on an USB disk should be stored in /payloads/ and named accordingly.

=== Logging Network Traffic ===

This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.
Just follow these easy steps:

# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up.
# Flip the first position (which is nearest to the micro USB power in).
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].

After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.

=== DNS Spoofing Mode ===

This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.

# For this mode we have to start in arming mode (switch at fourth position)
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at. If all requests should be redirected to this IP address a # is needed (<code>address=/#/194.232.104.140</code>). Furthermore, It must be mentioned that the IP address of orf.at must be specified. The specification of orf.at itself does not work, as the Packet Squirrel does not resolve it into an IP.
# Unplug the Packet Squirrel and shift the switch to the second position.
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.

By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.

=== OpenVPN Mode ===
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]

An existing VPN server from [https://www.freeopenvpn.org/en/ freeopenvpn.org] can be used for Tunnel Mode. To use the Access Mode, a separate VPN server must be set up. This requires a server with a static IP address to which you have full access for configuration. As part of a project at the FH Campus Wien, it makes sense to use the FH infrastructure. The hardware requirements for the server are very low with 2 CPUs and 2GB RAM. The self-hosted [https://openvpn.net/access-server/ Server] was used as OpenVPN (OVPN). This offers two free connections, which are sufficient in this case.

# Download the the OVPN access certificate.
# Set the Packet Squirrel in Arming Mode and connect to its shell
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code>
# Steer to the directory with <code> cd /root/payloads/switch3/</code>
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code>
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:
## <code>freeopenvpn</code>
## <code><the displayed password></code>
# Before starting the VPN we choose the VPN mode:
## Open the <code>payload.sh</code>
## Set the <code>For_Clients=</code> to
### <code>0</code> for Access Mode
### <code>1</code> for Tunneling Mode
# Now set the Switch the the third Position and plug power out and in again
# You are good to go, if the yellow LED starts to flash after the boot up sequence
==== Access Mode ====

Access mode allows the squirrel to access the VPN Network via the Secure Shell if the connection was established. Therefore you have to install an OpenVPN Client at another device like a Ubuntu VM as well. From this VM you can establish a tunnel to the VPN Server. From there connect via SSH to the Packet Squirrel.

The command <code>ifconfig tun0</code> shows the following output when it is issued at the Packet Squirrels Shell.
tun0
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:12 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)

The Access Mode can be used to access an Private network from outside.

==== Tunneling Mode ====

The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].

You can also install an simple openVPN Server on a linux machine with
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code>
and press Enter 6 times.
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position.

=== Meterpreter-via-SSH ===
[[File:Packet squirrel meterpreter ssh.PNG |thumb|right|400px||Packet Squirrel Payload Meterpreter-via-SSH settings]]
This payload starts the Packet Squirrel in NAT mode and waits for user input. When the button is pressed, the payload connects to a remote SSH server and creates a local port tunnel. It then launches a meterpreter shell over the tunnel.
The intent is to hide the meterpreter network traffic behind a legitimate SSH activity.
You can download this payload from the offical [https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library/remote-access/Meterpreter-via-SSH hak5 github].
==== Getting Started ====
Copy the playload to the Packet Squirrel into the desired switch folder. Now edit the scirpt to configure your server options:
* SSH_USER - username on remote SSH server
* SSH_HOST - ip address of remote SSH Server

'''Note:''' If you changed the default meterpreter port don't forget to change it on the metasploit side as well.
* MSF_PORT

===== Generate SSH Key on Squirrel =====
Now you have to generate an ssh key-pair (just use default location and empty password) on your Packet Squirrel:
root@squirrel:~# ssh-keygen
===== Allow Squirrel on SSH Server =====
Then you have to copy the contents of /root/.ssh/id_rsa.pub from Packet Squirrel to the SSH Server authorized file:

user@server:~# mkdir ~/.ssh
user@server:~# echo 'paste id_rsa.pub contents inside this quote' > ~/.ssh/authorized_keys
===== Run Metasploit with Resource =====
msf@server:~# msfconsole -r server.rc

==== LED Definitions ====
# Configure NETMODE
#* Solid Magenta
# Connect to SSH Server
#* SUCCESS - Blink Amber 5 Times
#* FAIL - Blink Red 2 Times
# Launch meterpreter
#* SUCESS - Blink Cyan 1 Time
#* FAIL - Blink Red 1 Time

==== Hardening Recommendations ====
# Use an accout with limited privileges for SSH acces on the server.
# User a dedicated account for Packet Squirrel device (audit usage with SSH access logs).
# Disable PasswordAuthentication in sshd_config on the server.

=== ISpyintel ===
[[File:Packet squirrel ispyintel.PNG |thumb|right|400px||Packet Squirrel Payload ISpyIntel settings]]
This payload will automate gathering various recon data on whatever passes between it's Ethernet ports. You can download this payload from the [https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library/sniffing/ispyintel official hak5 github].
'''Note:''' This payload requires a usb stick to store loot.
==== Setup ====
# Edit the config variables at the top. The main variables are:
## <code>lootPath="/mnt/loot/intel" # Path to loot</code>
## <code>mode="TRANSPARENT" # Network mode we want to use</code>
## <code>interface="br-lan" # Interface to listen on</code>
# Copy payload.sh into the ~/payloads/switch folder you wish to deploy on.
# Connect into a target machine with access to the LAN.
# Set switch to the spot and power up.
# Leave, get coffee, take a nap while everything is recorded and parsed for future use.
# When done; hit the button. The LED will rapidly flash white to let you know it is finishing up.
# When all is done the LED will just go blank. It is now safe to unplug and go about your day.

==== Tasks that are started ====
* tcpdump - records every packet that was send and received
* urlsnarf - collects all websites that were visited
* dsniff - attempts to acquire passwords and what not
* ngrep - on ports 80 and 21 with the filter for common password fields
* ngrep - on ports 80 and 21 with the filter for common session id fields
* log.txt - logs the progress of the payload for troubleshooting

==== Clean Up ====
Once the button is pressed the payload will automatically parse the TCPDump log file for the following items and store the results in seperate files.
As this process can take some time the LED will change to a rapid white blink letting you know the button command was recieved and the payload is in the process of shutting down.
* ipv4found.txt Will contain a unique list of all the ipv4 which the pcap file contains
* maybeEmails.txt Is a very loose search for possible email addresses that came across the wire in plain text.

=== Creating your own Payloads ===

Ducky Script is the payload language of Hak5 and consists of several simple commands specific to the Packet Squirrel hardware and bash. The basic Ducky Script commands are describe below and include NETMODE, LED, BUTTON and SWITCH.

The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.
Bash scripts can access the following pre-installed tools:
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget

The featured Squirrel Script offers the following additional commands:

* NETMODE
specifies which network mode Packet Sqirrel uses and how traffic is routed

{| class="wikitable"
|-
! Command !! Description
|-
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel
|-
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address
|-
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel
|-
| NETMODE VPN || same as NAT with VPN interface for client tunneling
|-
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN
|}

* LED
with this command the multi-color LED can be controlled.

Further information regarding the LED, its colors, patterns and states can be found [https://docs.hak5.org/hc/en-us/articles/360010554653-LED here].

{| class="wikitable"
|-
! Possible configurations !! Description
|-
| LED Colors || red, green, blue, yellow, cyan, magenta, white
|-
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000
|-
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH
|}

* BUTTON
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed.

Further information regarding the Ducky Script’s “Button” command like its return value, possible ways of configuring the wait time, LED color during the pause as well as the option to suppress the LED can be found [https://docs.hak5.org/hc/en-us/articles/360010554673-BUTTON here].

* SWITCH
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".

==== Example and Best Practices ====
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]
[[File:Hak5 c2 sqirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]

As shown below, payloads should begin with comments specifying the name of the payload, a description, the author(s), the target, special requirements, category, netmodes and the LED status.

Configurable options should be placed on the top of the payload file.

The LED should be used regarding common payload states and not with unique pattern combinations. The LED command should precede the NETMODE command indicating a specific state like SETUP or even FAIL if specific conditions are not met. If a payload reaches a FINISH state, the Packet Squirrel is safe to power off.

Here is an example for the usage of Squirrel Script.

<syntaxhighlight lang="bash">
# Title: Caternet
# Author: Hak5Darren
# Version: 1.0
# Description: Forwards all traffic to local webserver hosting cat photos.
# Props: In loving memory of Hak5Kerby

LED SETUP
NETMODE NAT
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address
/etc/init.d/dnsmasq restart

LED ATTACK
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53
python -m SimpleHTTPServer 80
</syntaxhighlight>

For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].

== with Cloud C2 ==

The [https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2 Hak5 Cloud C2] is a command and control server for Hak5 devices. Installation and startup is shown in figure "C2 server start". By browsing to the configured address you can login to the dashboard, shown in figure "C2 dashboard".

To connect the Packet Squirrel with your C2 Cloud, click on the plus button in the lower right corner and choose the device. On the dashboard, open the added device and click on Setup, as shown in figure "C2 Packet Sqirrel". Then copy the downloaded file to the Packet Squirrel's /etc folder and reboot it.
In the Overview tab you can also Edit, Reboot, Wipe and Remove your device.

In the Clients tab you can see all clients which were connected to your Packet Squirrel with hostname, MAC and IP address. In the Loot tab, you can open the current loot from your Packet Squirrel directly on your C2 server. And in the Terminal tab you can open a ssh session to your device.

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Pentesting]]

File:Packet Squirrel VPN2.jpg

2023-12-18T13:29:45Z

VKogard: VKogard uploaded a new version of File:Packet Squirrel VPN2.jpg

File:Packet Squirrel VPN1.jpg

2023-12-18T13:28:32Z

VKogard: VKogard uploaded a new version of File:Packet Squirrel VPN1.jpg

File:Packet Squirrel VPN1.jpg

2023-12-18T13:26:07Z

VKogard: VKogard reverted File:Packet Squirrel VPN1.jpg to an old version

File:Packet Squirrel VPN1.jpg

2023-12-18T13:25:26Z

VKogard: VKogard uploaded a new version of File:Packet Squirrel VPN1.jpg

Hak5 Packet Squirrel

2023-12-18T13:08:37Z

VKogard: /* DNS Spoofing Mode */

== Summary ==
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]

The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing / Modifying DNS requests and Tunnel taffic through an OpenVPN tunnel. These can also be modified and exchanged with other scripts. It's stealthy pocket-size enables it to be placed without notice, this can come in handy for penetration testers. The efficient energy usage makes it possible to power it with a battery pack to run over a week.
The Packet Squirrel can also be combined with the [https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2 Hak5 Cloud C2], a command and control server specially for Hak5 devices.

The device brings following characteristics with it:
# Dimensions: 50 x 40 x 15 mm – small and lightweight with 24 grams
# Consumption: 0,12A using a Micro-USB-Port
## Can be run with a battery pack
# Ports: 2 x RJ45-Ethernet-Port | 1 x USB-Port for a flash drive | Micro-USB-Port for power supply
# OS: Runs a Linux platform with root access and common network utilities
# Hardware
## LED indicating the status of the device
## Payload Selection Switch to choose the respective payload
## Scriptable push-button to stop payloads with ease

==== Possible attacks with the Packet Squirrel ====

The '''Man-in-the-Middle Attack (MITM)''' is a popular cyber security attack which is described by an attacker interfering physically, or nowadays often logically, the communication between two or more network targets. Thus, the attacker gains complete control over the data traffic and can read, store, block, manipulate or delete the data traffic. The crux of the attack is that the attacker pretends to be the respective counterpart to the communication partners.

The MITM-Attack can be realized by another attack called '''Spoofing'''. Spoofing is when a hacker pretends to be someone known to an individual or network host to access confidential information. Spoofing can technically occur in many ways, among others ARP, DHCP or DNS Spoofing.

== Community ==

Hak5 does not only provide the opportunity to use following payloads fluently and easy using the switch on the side but additionally fosters building a [https://hak5.org/pages/payloads community] regarding all there devices.

The Hak5-webiste provides a way of submitting self-made payloads or to ask questions in a [https://forums.hak5.org/forum/94-packet-squirrel/ forum]. To promote the development of new payloads and to reward creativity, effort and collaboration Hak5 provides the possibility to submit a payload to “Hak5 Payload Awards” to receive a monetary reward in a hight of $ 2.000, -. The winner will be decided yearly by the voting community.

Through [https://github.com/hak5/packetsquirrel-payloads Hak5’s Github-Account] payloads are made available to public and can be downloaded/cloned within the respective repository.

== Description ==
[[File:Packet_squirrel_file_tree.jpg|thumb|right|400px||SSH connect]]
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]

The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.

In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.

It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgoing Ethernet interface as well.

==== Basic Cable Setup ====

# Plug the victims Ethernet cable into the "Ethernet In" Port
# Plug the gateway Ethernet cable into the "Ethernet Out" Port
# Power the device by plugging in the power cable

==== Firmware Upgrade ====

Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the [https://downloads.hak5.org/squirrel Hak5 website].

The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.

Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel.

The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blue blinking LED.

Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".

==== Manual upgrade ====

It is also possible to manually upgrade the firmware of the Packet Squirrel by:

# Download the latest firmware from the website linked above and verify the checksum
# Switch into “Arming Mode” and power on the device
# Use SCP to transfer the file to Packet Squirrel’s /tmp directory. The appropriate command could be: scp upgrade-x.x.bin root@172.16.32.1:/tmp/
# Use SSH (command: ssh root@172.16.31.1) to connect to Packet Squirrel’s bash prompt and use the sysupgrade command (sysupgrade -n /tmp/upgrade-x.x.bin) to start the firmware update
# The process may take 5-10 minutes. Do NOT unplug the device during the process, otherwise the device could become inoperable.

==== Formatting the USB-Stick ====

The Hak5 Packet Squirrel can only operate with a USB disk that is formatted with an NTFS or EXT4 file system.

NTFS (New Technology File System) is a proprietary journaling file system that was developed by Microsoft and offers targeted access protection at file level and greater data security through journaling and is not limited to a file size of 4GB as e.g. FAT. Formatting is performed with following steps:

# On a Windows-machine:
## Find and open your file explorer on Windows
## Locate your USB-Stick in the left bar
## Select “Format”
## Set NTFS as file system using the drop down, tick “Quick Format” and click “Start”

EXT4 is the fourth extended filesystem that was developed for the Linux Kernel and like NTFS a journaling file system. Windows cannot directly format a USB-Stick to the EXT4 format and therefore there is a need for an third-party tool. A USB-Stick is formatted to EXT4 using following steps:

# On a Windows-machine:
## Download and install [https://www.diskgenius.com/download.php DiskGuard]
## Select your drive from the left bar
## Select the “Format”-button at the top bar
## Select the wanted file system “EXT4” from the drop down menu
## Click “Format”

== Payloads ==

Payloads can be stored on an external USB disk or on the device’s internal memory. On boot the device gives priority to payloads on the USB disk, other payloads existing on the internal memory will be overridden. If no USB disk is available, payloads stored on the internal memory are executed. Payloads on the internal memory are stored in /root/payloads and need to be called switch1, switch2 and switch3, payloads on an USB disk should be stored in /payloads/ and named accordingly.

=== Logging Network Traffic ===

This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.
Just follow these easy steps:

# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up.
# Flip the first position (which is nearest to the micro USB power in).
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].

After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.

=== DNS Spoofing Mode ===

This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.

# For this mode we have to start in arming mode (switch at fourth position)
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at. If all requests should be redirected to this IP address a # is needed (<code>address=/#/194.232.104.140</code>). Furthermore, It must be mentioned that the IP address of orf.at must be specified. The specification of orf.at itself does not work, as the Packet Squirrel does not resolve it into an IP.
# Unplug the Packet Squirrel and shift the switch to the second position.
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.

By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.

=== OpenVPN Mode ===
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]

The VPN payload implements VPN access mode and VPN tunnelling mode.
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org].
# Start by selecting the desired server and download the the OVPN access certificate.
# Set the Packet Squirrel in Arming Mode and connect to its shell
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code>
# Steer to the directory with <code> cd /root/payloads/switch3/</code>
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code>
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:
## <code>freeopenvpn</code>
## <code><the displayed password></code>
# Before starting the VPN we choose the VPN mode:
## Open the <code>payload.sh</code>
## Set the <code>For_Clients=</code> to
### <code>0</code> for Access Mode
### <code>1</code> for Tunneling Mode
# Now set the Switch the the third Position and plug power out and in again
# You are good to go, if the yellow LED starts to flash after the boot up sequence
==== Access Mode ====

Access mode allows the squirrel to access the VPN Network via the Secure Shell
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.
tun0
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:12 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)

The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.

==== Tunneling Mode ====

The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].

You can also install an simple openVPN Server on a linux machine with
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code>
and press Enter 6 times.
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position.
=== Meterpreter-via-SSH ===
[[File:Packet squirrel meterpreter ssh.PNG |thumb|right|400px||Packet Squirrel Payload Meterpreter-via-SSH settings]]
This payload starts the Packet Squirrel in NAT mode and waits for user input. When the button is pressed, the payload connects to a remote SSH server and creates a local port tunnel. It then launches a meterpreter shell over the tunnel.
The intent is to hide the meterpreter network traffic behind a legitimate SSH activity.
You can download this payload from the offical [https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library/remote-access/Meterpreter-via-SSH hak5 github].
==== Getting Started ====
Copy the playload to the Packet Squirrel into the desired switch folder. Now edit the scirpt to configure your server options:
* SSH_USER - username on remote SSH server
* SSH_HOST - ip address of remote SSH Server

'''Note:''' If you changed the default meterpreter port don't forget to change it on the metasploit side as well.
* MSF_PORT

===== Generate SSH Key on Squirrel =====
Now you have to generate an ssh key-pair (just use default location and empty password) on your Packet Squirrel:
root@squirrel:~# ssh-keygen
===== Allow Squirrel on SSH Server =====
Then you have to copy the contents of /root/.ssh/id_rsa.pub from Packet Squirrel to the SSH Server authorized file:

user@server:~# mkdir ~/.ssh
user@server:~# echo 'paste id_rsa.pub contents inside this quote' > ~/.ssh/authorized_keys
===== Run Metasploit with Resource =====
msf@server:~# msfconsole -r server.rc

==== LED Definitions ====
# Configure NETMODE
#* Solid Magenta
# Connect to SSH Server
#* SUCCESS - Blink Amber 5 Times
#* FAIL - Blink Red 2 Times
# Launch meterpreter
#* SUCESS - Blink Cyan 1 Time
#* FAIL - Blink Red 1 Time

==== Hardening Recommendations ====
# Use an accout with limited privileges for SSH acces on the server.
# User a dedicated account for Packet Squirrel device (audit usage with SSH access logs).
# Disable PasswordAuthentication in sshd_config on the server.

=== ISpyintel ===
[[File:Packet squirrel ispyintel.PNG |thumb|right|400px||Packet Squirrel Payload ISpyIntel settings]]
This payload will automate gathering various recon data on whatever passes between it's Ethernet ports. You can download this payload from the [https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library/sniffing/ispyintel official hak5 github].
'''Note:''' This payload requires a usb stick to store loot.
==== Setup ====
# Edit the config variables at the top. The main variables are:
## <code>lootPath="/mnt/loot/intel" # Path to loot</code>
## <code>mode="TRANSPARENT" # Network mode we want to use</code>
## <code>interface="br-lan" # Interface to listen on</code>
# Copy payload.sh into the ~/payloads/switch folder you wish to deploy on.
# Connect into a target machine with access to the LAN.
# Set switch to the spot and power up.
# Leave, get coffee, take a nap while everything is recorded and parsed for future use.
# When done; hit the button. The LED will rapidly flash white to let you know it is finishing up.
# When all is done the LED will just go blank. It is now safe to unplug and go about your day.

==== Tasks that are started ====
* tcpdump - records every packet that was send and received
* urlsnarf - collects all websites that were visited
* dsniff - attempts to acquire passwords and what not
* ngrep - on ports 80 and 21 with the filter for common password fields
* ngrep - on ports 80 and 21 with the filter for common session id fields
* log.txt - logs the progress of the payload for troubleshooting

==== Clean Up ====
Once the button is pressed the payload will automatically parse the TCPDump log file for the following items and store the results in seperate files.
As this process can take some time the LED will change to a rapid white blink letting you know the button command was recieved and the payload is in the process of shutting down.
* ipv4found.txt Will contain a unique list of all the ipv4 which the pcap file contains
* maybeEmails.txt Is a very loose search for possible email addresses that came across the wire in plain text.

=== Creating your own Payloads ===

Ducky Script is the payload language of Hak5 and consists of several simple commands specific to the Packet Squirrel hardware and bash. The basic Ducky Script commands are describe below and include NETMODE, LED, BUTTON and SWITCH.

The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.
Bash scripts can access the following pre-installed tools:
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget

The featured Squirrel Script offers the following additional commands:

* NETMODE
specifies which network mode Packet Sqirrel uses and how traffic is routed

{| class="wikitable"
|-
! Command !! Description
|-
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel
|-
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address
|-
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel
|-
| NETMODE VPN || same as NAT with VPN interface for client tunneling
|-
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN
|}

* LED
with this command the multi-color LED can be controlled.

Further information regarding the LED, its colors, patterns and states can be found [https://docs.hak5.org/hc/en-us/articles/360010554653-LED here].

{| class="wikitable"
|-
! Possible configurations !! Description
|-
| LED Colors || red, green, blue, yellow, cyan, magenta, white
|-
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000
|-
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH
|}

* BUTTON
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed.

Further information regarding the Ducky Script’s “Button” command like its return value, possible ways of configuring the wait time, LED color during the pause as well as the option to suppress the LED can be found [https://docs.hak5.org/hc/en-us/articles/360010554673-BUTTON here].

* SWITCH
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".

==== Example and Best Practices ====
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]
[[File:Hak5 c2 sqirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]

As shown below, payloads should begin with comments specifying the name of the payload, a description, the author(s), the target, special requirements, category, netmodes and the LED status.

Configurable options should be placed on the top of the payload file.

The LED should be used regarding common payload states and not with unique pattern combinations. The LED command should precede the NETMODE command indicating a specific state like SETUP or even FAIL if specific conditions are not met. If a payload reaches a FINISH state, the Packet Squirrel is safe to power off.

Here is an example for the usage of Squirrel Script.

<syntaxhighlight lang="bash">
# Title: Caternet
# Author: Hak5Darren
# Version: 1.0
# Description: Forwards all traffic to local webserver hosting cat photos.
# Props: In loving memory of Hak5Kerby

LED SETUP
NETMODE NAT
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address
/etc/init.d/dnsmasq restart

LED ATTACK
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53
python -m SimpleHTTPServer 80
</syntaxhighlight>

For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].

== with Cloud C2 ==

The [https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2 Hak5 Cloud C2] is a command and control server for Hak5 devices. Installation and startup is shown in figure "C2 server start". By browsing to the configured address you can login to the dashboard, shown in figure "C2 dashboard".

To connect the Packet Squirrel with your C2 Cloud, click on the plus button in the lower right corner and choose the device. On the dashboard, open the added device and click on Setup, as shown in figure "C2 Packet Sqirrel". Then copy the downloaded file to the Packet Squirrel's /etc folder and reboot it.
In the Overview tab you can also Edit, Reboot, Wipe and Remove your device.

In the Clients tab you can see all clients which were connected to your Packet Squirrel with hostname, MAC and IP address. In the Loot tab, you can open the current loot from your Packet Squirrel directly on your C2 server. And in the Terminal tab you can open a ssh session to your device.

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Pentesting]]

Hak5 Packet Squirrel

2023-12-18T12:59:02Z

VKogard: /* Description */

== Summary ==
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]

The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing / Modifying DNS requests and Tunnel taffic through an OpenVPN tunnel. These can also be modified and exchanged with other scripts. It's stealthy pocket-size enables it to be placed without notice, this can come in handy for penetration testers. The efficient energy usage makes it possible to power it with a battery pack to run over a week.
The Packet Squirrel can also be combined with the [https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2 Hak5 Cloud C2], a command and control server specially for Hak5 devices.

The device brings following characteristics with it:
# Dimensions: 50 x 40 x 15 mm – small and lightweight with 24 grams
# Consumption: 0,12A using a Micro-USB-Port
## Can be run with a battery pack
# Ports: 2 x RJ45-Ethernet-Port | 1 x USB-Port for a flash drive | Micro-USB-Port for power supply
# OS: Runs a Linux platform with root access and common network utilities
# Hardware
## LED indicating the status of the device
## Payload Selection Switch to choose the respective payload
## Scriptable push-button to stop payloads with ease

==== Possible attacks with the Packet Squirrel ====

The '''Man-in-the-Middle Attack (MITM)''' is a popular cyber security attack which is described by an attacker interfering physically, or nowadays often logically, the communication between two or more network targets. Thus, the attacker gains complete control over the data traffic and can read, store, block, manipulate or delete the data traffic. The crux of the attack is that the attacker pretends to be the respective counterpart to the communication partners.

The MITM-Attack can be realized by another attack called '''Spoofing'''. Spoofing is when a hacker pretends to be someone known to an individual or network host to access confidential information. Spoofing can technically occur in many ways, among others ARP, DHCP or DNS Spoofing.

== Community ==

Hak5 does not only provide the opportunity to use following payloads fluently and easy using the switch on the side but additionally fosters building a [https://hak5.org/pages/payloads community] regarding all there devices.

The Hak5-webiste provides a way of submitting self-made payloads or to ask questions in a [https://forums.hak5.org/forum/94-packet-squirrel/ forum]. To promote the development of new payloads and to reward creativity, effort and collaboration Hak5 provides the possibility to submit a payload to “Hak5 Payload Awards” to receive a monetary reward in a hight of $ 2.000, -. The winner will be decided yearly by the voting community.

Through [https://github.com/hak5/packetsquirrel-payloads Hak5’s Github-Account] payloads are made available to public and can be downloaded/cloned within the respective repository.

== Description ==
[[File:Packet_squirrel_file_tree.jpg|thumb|right|400px||SSH connect]]
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]

The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.

In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.

It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgoing Ethernet interface as well.

==== Basic Cable Setup ====

# Plug the victims Ethernet cable into the "Ethernet In" Port
# Plug the gateway Ethernet cable into the "Ethernet Out" Port
# Power the device by plugging in the power cable

==== Firmware Upgrade ====

Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the [https://downloads.hak5.org/squirrel Hak5 website].

The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.

Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel.

The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blue blinking LED.

Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".

==== Manual upgrade ====

It is also possible to manually upgrade the firmware of the Packet Squirrel by:

# Download the latest firmware from the website linked above and verify the checksum
# Switch into “Arming Mode” and power on the device
# Use SCP to transfer the file to Packet Squirrel’s /tmp directory. The appropriate command could be: scp upgrade-x.x.bin root@172.16.32.1:/tmp/
# Use SSH (command: ssh root@172.16.31.1) to connect to Packet Squirrel’s bash prompt and use the sysupgrade command (sysupgrade -n /tmp/upgrade-x.x.bin) to start the firmware update
# The process may take 5-10 minutes. Do NOT unplug the device during the process, otherwise the device could become inoperable.

==== Formatting the USB-Stick ====

The Hak5 Packet Squirrel can only operate with a USB disk that is formatted with an NTFS or EXT4 file system.

NTFS (New Technology File System) is a proprietary journaling file system that was developed by Microsoft and offers targeted access protection at file level and greater data security through journaling and is not limited to a file size of 4GB as e.g. FAT. Formatting is performed with following steps:

# On a Windows-machine:
## Find and open your file explorer on Windows
## Locate your USB-Stick in the left bar
## Select “Format”
## Set NTFS as file system using the drop down, tick “Quick Format” and click “Start”

EXT4 is the fourth extended filesystem that was developed for the Linux Kernel and like NTFS a journaling file system. Windows cannot directly format a USB-Stick to the EXT4 format and therefore there is a need for an third-party tool. A USB-Stick is formatted to EXT4 using following steps:

# On a Windows-machine:
## Download and install [https://www.diskgenius.com/download.php DiskGuard]
## Select your drive from the left bar
## Select the “Format”-button at the top bar
## Select the wanted file system “EXT4” from the drop down menu
## Click “Format”

== Payloads ==

Payloads can be stored on an external USB disk or on the device’s internal memory. On boot the device gives priority to payloads on the USB disk, other payloads existing on the internal memory will be overridden. If no USB disk is available, payloads stored on the internal memory are executed. Payloads on the internal memory are stored in /root/payloads and need to be called switch1, switch2 and switch3, payloads on an USB disk should be stored in /payloads/ and named accordingly.

=== Logging Network Traffic ===

This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.
Just follow these easy steps:

# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up.
# Flip the first position (which is nearest to the micro USB power in).
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].

After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.

=== DNS Spoofing Mode ===

This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.

# For this mode we have to start in arming mode (switch at fourth position)
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at
# Unplug the Packet Squirrel and shift the switch to the second position.
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.

By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.

=== OpenVPN Mode ===
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]

The VPN payload implements VPN access mode and VPN tunnelling mode.
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org].
# Start by selecting the desired server and download the the OVPN access certificate.
# Set the Packet Squirrel in Arming Mode and connect to its shell
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code>
# Steer to the directory with <code> cd /root/payloads/switch3/</code>
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code>
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:
## <code>freeopenvpn</code>
## <code><the displayed password></code>
# Before starting the VPN we choose the VPN mode:
## Open the <code>payload.sh</code>
## Set the <code>For_Clients=</code> to
### <code>0</code> for Access Mode
### <code>1</code> for Tunneling Mode
# Now set the Switch the the third Position and plug power out and in again
# You are good to go, if the yellow LED starts to flash after the boot up sequence
==== Access Mode ====

Access mode allows the squirrel to access the VPN Network via the Secure Shell
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.
tun0
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:12 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)

The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.

==== Tunneling Mode ====

The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].

You can also install an simple openVPN Server on a linux machine with
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code>
and press Enter 6 times.
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position.
=== Meterpreter-via-SSH ===
[[File:Packet squirrel meterpreter ssh.PNG |thumb|right|400px||Packet Squirrel Payload Meterpreter-via-SSH settings]]
This payload starts the Packet Squirrel in NAT mode and waits for user input. When the button is pressed, the payload connects to a remote SSH server and creates a local port tunnel. It then launches a meterpreter shell over the tunnel.
The intent is to hide the meterpreter network traffic behind a legitimate SSH activity.
You can download this payload from the offical [https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library/remote-access/Meterpreter-via-SSH hak5 github].
==== Getting Started ====
Copy the playload to the Packet Squirrel into the desired switch folder. Now edit the scirpt to configure your server options:
* SSH_USER - username on remote SSH server
* SSH_HOST - ip address of remote SSH Server

'''Note:''' If you changed the default meterpreter port don't forget to change it on the metasploit side as well.
* MSF_PORT

===== Generate SSH Key on Squirrel =====
Now you have to generate an ssh key-pair (just use default location and empty password) on your Packet Squirrel:
root@squirrel:~# ssh-keygen
===== Allow Squirrel on SSH Server =====
Then you have to copy the contents of /root/.ssh/id_rsa.pub from Packet Squirrel to the SSH Server authorized file:

user@server:~# mkdir ~/.ssh
user@server:~# echo 'paste id_rsa.pub contents inside this quote' > ~/.ssh/authorized_keys
===== Run Metasploit with Resource =====
msf@server:~# msfconsole -r server.rc

==== LED Definitions ====
# Configure NETMODE
#* Solid Magenta
# Connect to SSH Server
#* SUCCESS - Blink Amber 5 Times
#* FAIL - Blink Red 2 Times
# Launch meterpreter
#* SUCESS - Blink Cyan 1 Time
#* FAIL - Blink Red 1 Time

==== Hardening Recommendations ====
# Use an accout with limited privileges for SSH acces on the server.
# User a dedicated account for Packet Squirrel device (audit usage with SSH access logs).
# Disable PasswordAuthentication in sshd_config on the server.

=== ISpyintel ===
[[File:Packet squirrel ispyintel.PNG |thumb|right|400px||Packet Squirrel Payload ISpyIntel settings]]
This payload will automate gathering various recon data on whatever passes between it's Ethernet ports. You can download this payload from the [https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library/sniffing/ispyintel official hak5 github].
'''Note:''' This payload requires a usb stick to store loot.
==== Setup ====
# Edit the config variables at the top. The main variables are:
## <code>lootPath="/mnt/loot/intel" # Path to loot</code>
## <code>mode="TRANSPARENT" # Network mode we want to use</code>
## <code>interface="br-lan" # Interface to listen on</code>
# Copy payload.sh into the ~/payloads/switch folder you wish to deploy on.
# Connect into a target machine with access to the LAN.
# Set switch to the spot and power up.
# Leave, get coffee, take a nap while everything is recorded and parsed for future use.
# When done; hit the button. The LED will rapidly flash white to let you know it is finishing up.
# When all is done the LED will just go blank. It is now safe to unplug and go about your day.

==== Tasks that are started ====
* tcpdump - records every packet that was send and received
* urlsnarf - collects all websites that were visited
* dsniff - attempts to acquire passwords and what not
* ngrep - on ports 80 and 21 with the filter for common password fields
* ngrep - on ports 80 and 21 with the filter for common session id fields
* log.txt - logs the progress of the payload for troubleshooting

==== Clean Up ====
Once the button is pressed the payload will automatically parse the TCPDump log file for the following items and store the results in seperate files.
As this process can take some time the LED will change to a rapid white blink letting you know the button command was recieved and the payload is in the process of shutting down.
* ipv4found.txt Will contain a unique list of all the ipv4 which the pcap file contains
* maybeEmails.txt Is a very loose search for possible email addresses that came across the wire in plain text.

=== Creating your own Payloads ===

Ducky Script is the payload language of Hak5 and consists of several simple commands specific to the Packet Squirrel hardware and bash. The basic Ducky Script commands are describe below and include NETMODE, LED, BUTTON and SWITCH.

The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.
Bash scripts can access the following pre-installed tools:
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget

The featured Squirrel Script offers the following additional commands:

* NETMODE
specifies which network mode Packet Sqirrel uses and how traffic is routed

{| class="wikitable"
|-
! Command !! Description
|-
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel
|-
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address
|-
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel
|-
| NETMODE VPN || same as NAT with VPN interface for client tunneling
|-
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN
|}

* LED
with this command the multi-color LED can be controlled.

Further information regarding the LED, its colors, patterns and states can be found [https://docs.hak5.org/hc/en-us/articles/360010554653-LED here].

{| class="wikitable"
|-
! Possible configurations !! Description
|-
| LED Colors || red, green, blue, yellow, cyan, magenta, white
|-
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000
|-
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH
|}

* BUTTON
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed.

Further information regarding the Ducky Script’s “Button” command like its return value, possible ways of configuring the wait time, LED color during the pause as well as the option to suppress the LED can be found [https://docs.hak5.org/hc/en-us/articles/360010554673-BUTTON here].

* SWITCH
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".

==== Example and Best Practices ====
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]
[[File:Hak5 c2 sqirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]

As shown below, payloads should begin with comments specifying the name of the payload, a description, the author(s), the target, special requirements, category, netmodes and the LED status.

Configurable options should be placed on the top of the payload file.

The LED should be used regarding common payload states and not with unique pattern combinations. The LED command should precede the NETMODE command indicating a specific state like SETUP or even FAIL if specific conditions are not met. If a payload reaches a FINISH state, the Packet Squirrel is safe to power off.

Here is an example for the usage of Squirrel Script.

<syntaxhighlight lang="bash">
# Title: Caternet
# Author: Hak5Darren
# Version: 1.0
# Description: Forwards all traffic to local webserver hosting cat photos.
# Props: In loving memory of Hak5Kerby

LED SETUP
NETMODE NAT
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address
/etc/init.d/dnsmasq restart

LED ATTACK
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53
python -m SimpleHTTPServer 80
</syntaxhighlight>

For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].

== with Cloud C2 ==

The [https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2 Hak5 Cloud C2] is a command and control server for Hak5 devices. Installation and startup is shown in figure "C2 server start". By browsing to the configured address you can login to the dashboard, shown in figure "C2 dashboard".

To connect the Packet Squirrel with your C2 Cloud, click on the plus button in the lower right corner and choose the device. On the dashboard, open the added device and click on Setup, as shown in figure "C2 Packet Sqirrel". Then copy the downloaded file to the Packet Squirrel's /etc folder and reboot it.
In the Overview tab you can also Edit, Reboot, Wipe and Remove your device.

In the Clients tab you can see all clients which were connected to your Packet Squirrel with hostname, MAC and IP address. In the Loot tab, you can open the current loot from your Packet Squirrel directly on your C2 server. And in the Terminal tab you can open a ssh session to your device.

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Pentesting]]

File:Packet squirrel file tree.jpg

2023-12-18T12:53:04Z

VKogard:

Hak5 Packet Squirrel

2023-12-18T12:42:18Z

VKogard: /* Summary */

== Summary ==
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]

The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing / Modifying DNS requests and Tunnel taffic through an OpenVPN tunnel. These can also be modified and exchanged with other scripts. It's stealthy pocket-size enables it to be placed without notice, this can come in handy for penetration testers. The efficient energy usage makes it possible to power it with a battery pack to run over a week.
The Packet Squirrel can also be combined with the [https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2 Hak5 Cloud C2], a command and control server specially for Hak5 devices.

The device brings following characteristics with it:
# Dimensions: 50 x 40 x 15 mm – small and lightweight with 24 grams
# Consumption: 0,12A using a Micro-USB-Port
## Can be run with a battery pack
# Ports: 2 x RJ45-Ethernet-Port | 1 x USB-Port for a flash drive | Micro-USB-Port for power supply
# OS: Runs a Linux platform with root access and common network utilities
# Hardware
## LED indicating the status of the device
## Payload Selection Switch to choose the respective payload
## Scriptable push-button to stop payloads with ease

==== Possible attacks with the Packet Squirrel ====

The '''Man-in-the-Middle Attack (MITM)''' is a popular cyber security attack which is described by an attacker interfering physically, or nowadays often logically, the communication between two or more network targets. Thus, the attacker gains complete control over the data traffic and can read, store, block, manipulate or delete the data traffic. The crux of the attack is that the attacker pretends to be the respective counterpart to the communication partners.

The MITM-Attack can be realized by another attack called '''Spoofing'''. Spoofing is when a hacker pretends to be someone known to an individual or network host to access confidential information. Spoofing can technically occur in many ways, among others ARP, DHCP or DNS Spoofing.

== Community ==

Hak5 does not only provide the opportunity to use following payloads fluently and easy using the switch on the side but additionally fosters building a [https://hak5.org/pages/payloads community] regarding all there devices.

The Hak5-webiste provides a way of submitting self-made payloads or to ask questions in a [https://forums.hak5.org/forum/94-packet-squirrel/ forum]. To promote the development of new payloads and to reward creativity, effort and collaboration Hak5 provides the possibility to submit a payload to “Hak5 Payload Awards” to receive a monetary reward in a hight of $ 2.000, -. The winner will be decided yearly by the voting community.

Through [https://github.com/hak5/packetsquirrel-payloads Hak5’s Github-Account] payloads are made available to public and can be downloaded/cloned within the respective repository.

== Description ==
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]

The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.

In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.

It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgoing Ethernet interface as well.

==== Basic Cable Setup ====

# Plug the victims Ethernet cable into the "Ethernet In" Port
# Plug the gateway Ethernet cable into the "Ethernet Out" Port
# Power the device by plugging in the power cable

==== Firmware Upgrade ====

Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the [https://downloads.hak5.org/squirrel Hak5 website].

The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.

Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel.

The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blue blinking LED.

Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".

==== Manual upgrade ====

It is also possible to manually upgrade the firmware of the Packet Squirrel by:

# Download the latest firmware from the website linked above and verify the checksum
# Switch into “Arming Mode” and power on the device
# Use SCP to transfer the file to Packet Squirrel’s /tmp directory. The appropriate command could be: scp upgrade-x.x.bin root@172.16.32.1:/tmp/
# Use SSH (command: ssh root@172.16.31.1) to connect to Packet Squirrel’s bash prompt and use the sysupgrade command (sysupgrade -n /tmp/upgrade-x.x.bin) to start the firmware update
# The process may take 5-10 minutes. Do NOT unplug the device during the process, otherwise the device could become inoperable.

==== Formatting the USB-Stick ====

The Hak5 Packet Squirrel can only operate with a USB disk that is formatted with an NTFS or EXT4 file system.

NTFS (New Technology File System) is a proprietary journaling file system that was developed by Microsoft and offers targeted access protection at file level and greater data security through journaling and is not limited to a file size of 4GB as e.g. FAT. Formatting is performed with following steps:

# On a Windows-machine:
## Find and open your file explorer on Windows
## Locate your USB-Stick in the left bar
## Select “Format”
## Set NTFS as file system using the drop down, tick “Quick Format” and click “Start”

EXT4 is the fourth extended filesystem that was developed for the Linux Kernel and like NTFS a journaling file system. Windows cannot directly format a USB-Stick to the EXT4 format and therefore there is a need for an third-party tool. A USB-Stick is formatted to EXT4 using following steps:

# On a Windows-machine:
## Download and install [https://www.diskgenius.com/download.php DiskGuard]
## Select your drive from the left bar
## Select the “Format”-button at the top bar
## Select the wanted file system “EXT4” from the drop down menu
## Click “Format”

== Payloads ==

Payloads can be stored on an external USB disk or on the device’s internal memory. On boot the device gives priority to payloads on the USB disk, other payloads existing on the internal memory will be overridden. If no USB disk is available, payloads stored on the internal memory are executed. Payloads on the internal memory are stored in /root/payloads and need to be called switch1, switch2 and switch3, payloads on an USB disk should be stored in /payloads/ and named accordingly.

=== Logging Network Traffic ===

This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.
Just follow these easy steps:

# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up.
# Flip the first position (which is nearest to the micro USB power in).
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].

After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.

=== DNS Spoofing Mode ===

This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.

# For this mode we have to start in arming mode (switch at fourth position)
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at
# Unplug the Packet Squirrel and shift the switch to the second position.
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.

By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.

=== OpenVPN Mode ===
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]

The VPN payload implements VPN access mode and VPN tunnelling mode.
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org].
# Start by selecting the desired server and download the the OVPN access certificate.
# Set the Packet Squirrel in Arming Mode and connect to its shell
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code>
# Steer to the directory with <code> cd /root/payloads/switch3/</code>
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code>
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:
## <code>freeopenvpn</code>
## <code><the displayed password></code>
# Before starting the VPN we choose the VPN mode:
## Open the <code>payload.sh</code>
## Set the <code>For_Clients=</code> to
### <code>0</code> for Access Mode
### <code>1</code> for Tunneling Mode
# Now set the Switch the the third Position and plug power out and in again
# You are good to go, if the yellow LED starts to flash after the boot up sequence
==== Access Mode ====

Access mode allows the squirrel to access the VPN Network via the Secure Shell
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.
tun0
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:12 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)

The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.

==== Tunneling Mode ====

The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].

You can also install an simple openVPN Server on a linux machine with
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code>
and press Enter 6 times.
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position.
=== Meterpreter-via-SSH ===
[[File:Packet squirrel meterpreter ssh.PNG |thumb|right|400px||Packet Squirrel Payload Meterpreter-via-SSH settings]]
This payload starts the Packet Squirrel in NAT mode and waits for user input. When the button is pressed, the payload connects to a remote SSH server and creates a local port tunnel. It then launches a meterpreter shell over the tunnel.
The intent is to hide the meterpreter network traffic behind a legitimate SSH activity.
You can download this payload from the offical [https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library/remote-access/Meterpreter-via-SSH hak5 github].
==== Getting Started ====
Copy the playload to the Packet Squirrel into the desired switch folder. Now edit the scirpt to configure your server options:
* SSH_USER - username on remote SSH server
* SSH_HOST - ip address of remote SSH Server

'''Note:''' If you changed the default meterpreter port don't forget to change it on the metasploit side as well.
* MSF_PORT

===== Generate SSH Key on Squirrel =====
Now you have to generate an ssh key-pair (just use default location and empty password) on your Packet Squirrel:
root@squirrel:~# ssh-keygen
===== Allow Squirrel on SSH Server =====
Then you have to copy the contents of /root/.ssh/id_rsa.pub from Packet Squirrel to the SSH Server authorized file:

user@server:~# mkdir ~/.ssh
user@server:~# echo 'paste id_rsa.pub contents inside this quote' > ~/.ssh/authorized_keys
===== Run Metasploit with Resource =====
msf@server:~# msfconsole -r server.rc

==== LED Definitions ====
# Configure NETMODE
#* Solid Magenta
# Connect to SSH Server
#* SUCCESS - Blink Amber 5 Times
#* FAIL - Blink Red 2 Times
# Launch meterpreter
#* SUCESS - Blink Cyan 1 Time
#* FAIL - Blink Red 1 Time

==== Hardening Recommendations ====
# Use an accout with limited privileges for SSH acces on the server.
# User a dedicated account for Packet Squirrel device (audit usage with SSH access logs).
# Disable PasswordAuthentication in sshd_config on the server.

=== ISpyintel ===
[[File:Packet squirrel ispyintel.PNG |thumb|right|400px||Packet Squirrel Payload ISpyIntel settings]]
This payload will automate gathering various recon data on whatever passes between it's Ethernet ports. You can download this payload from the [https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library/sniffing/ispyintel official hak5 github].
'''Note:''' This payload requires a usb stick to store loot.
==== Setup ====
# Edit the config variables at the top. The main variables are:
## <code>lootPath="/mnt/loot/intel" # Path to loot</code>
## <code>mode="TRANSPARENT" # Network mode we want to use</code>
## <code>interface="br-lan" # Interface to listen on</code>
# Copy payload.sh into the ~/payloads/switch folder you wish to deploy on.
# Connect into a target machine with access to the LAN.
# Set switch to the spot and power up.
# Leave, get coffee, take a nap while everything is recorded and parsed for future use.
# When done; hit the button. The LED will rapidly flash white to let you know it is finishing up.
# When all is done the LED will just go blank. It is now safe to unplug and go about your day.

==== Tasks that are started ====
* tcpdump - records every packet that was send and received
* urlsnarf - collects all websites that were visited
* dsniff - attempts to acquire passwords and what not
* ngrep - on ports 80 and 21 with the filter for common password fields
* ngrep - on ports 80 and 21 with the filter for common session id fields
* log.txt - logs the progress of the payload for troubleshooting

==== Clean Up ====
Once the button is pressed the payload will automatically parse the TCPDump log file for the following items and store the results in seperate files.
As this process can take some time the LED will change to a rapid white blink letting you know the button command was recieved and the payload is in the process of shutting down.
* ipv4found.txt Will contain a unique list of all the ipv4 which the pcap file contains
* maybeEmails.txt Is a very loose search for possible email addresses that came across the wire in plain text.

=== Creating your own Payloads ===

Ducky Script is the payload language of Hak5 and consists of several simple commands specific to the Packet Squirrel hardware and bash. The basic Ducky Script commands are describe below and include NETMODE, LED, BUTTON and SWITCH.

The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.
Bash scripts can access the following pre-installed tools:
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget

The featured Squirrel Script offers the following additional commands:

* NETMODE
specifies which network mode Packet Sqirrel uses and how traffic is routed

{| class="wikitable"
|-
! Command !! Description
|-
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel
|-
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address
|-
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel
|-
| NETMODE VPN || same as NAT with VPN interface for client tunneling
|-
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN
|}

* LED
with this command the multi-color LED can be controlled.

Further information regarding the LED, its colors, patterns and states can be found [https://docs.hak5.org/hc/en-us/articles/360010554653-LED here].

{| class="wikitable"
|-
! Possible configurations !! Description
|-
| LED Colors || red, green, blue, yellow, cyan, magenta, white
|-
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000
|-
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH
|}

* BUTTON
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed.

Further information regarding the Ducky Script’s “Button” command like its return value, possible ways of configuring the wait time, LED color during the pause as well as the option to suppress the LED can be found [https://docs.hak5.org/hc/en-us/articles/360010554673-BUTTON here].

* SWITCH
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".

==== Example and Best Practices ====
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]
[[File:Hak5 c2 sqirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]

As shown below, payloads should begin with comments specifying the name of the payload, a description, the author(s), the target, special requirements, category, netmodes and the LED status.

Configurable options should be placed on the top of the payload file.

The LED should be used regarding common payload states and not with unique pattern combinations. The LED command should precede the NETMODE command indicating a specific state like SETUP or even FAIL if specific conditions are not met. If a payload reaches a FINISH state, the Packet Squirrel is safe to power off.

Here is an example for the usage of Squirrel Script.

<syntaxhighlight lang="bash">
# Title: Caternet
# Author: Hak5Darren
# Version: 1.0
# Description: Forwards all traffic to local webserver hosting cat photos.
# Props: In loving memory of Hak5Kerby

LED SETUP
NETMODE NAT
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address
/etc/init.d/dnsmasq restart

LED ATTACK
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53
python -m SimpleHTTPServer 80
</syntaxhighlight>

For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].

== with Cloud C2 ==

The [https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2 Hak5 Cloud C2] is a command and control server for Hak5 devices. Installation and startup is shown in figure "C2 server start". By browsing to the configured address you can login to the dashboard, shown in figure "C2 dashboard".

To connect the Packet Squirrel with your C2 Cloud, click on the plus button in the lower right corner and choose the device. On the dashboard, open the added device and click on Setup, as shown in figure "C2 Packet Sqirrel". Then copy the downloaded file to the Packet Squirrel's /etc folder and reboot it.
In the Overview tab you can also Edit, Reboot, Wipe and Remove your device.

In the Clients tab you can see all clients which were connected to your Packet Squirrel with hostname, MAC and IP address. In the Loot tab, you can open the current loot from your Packet Squirrel directly on your C2 server. And in the Terminal tab you can open a ssh session to your device.

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Pentesting]]

JavaScript Pentest Powerhouse

2023-07-04T10:21:40Z

VKogard:

= JavaScript Pentest Powerhouse =

'''The source code for this project can be found on [https://git.fh-campuswien.ac.at/c2110475053/wfp1_datasniffer Gitlab]!'''


== Introduction ==

The goal of this project is to create an automated penetration testing platform capable of executing various attack methods, with a specific focus on man-in-the-middle attacks targeting the HTTP protocol. The main objective is to inject malicious JavaScript code into legitimate HTTP responses. Traditionally, performing such attacks has been a cumbersome process. However, our software streamlines these tasks by automating them, requiring users to input critical environmental variables (stored in a .env file).

To achieve this, we have developed a Python-based framework that utilizes additional libraries such as nmap and scapy. Notably, scapy plays an essential role in crafting customized packets to optimize the effectiveness of the attacks. Our project places a strong emphasis on performance and user convenience, relieving users from labor-intensive tasks by seamlessly handling complex aspects. We intend to continue working on this project beyond the current semester.

Specifically, the attack is designed to function in the following manner: - Establish MITM via ARP spoofing or rogue DHCP server - Intercept HTTP responses meant for legitimate clients and forward them to the proxy server using mitmproxy. The response can be modified by inserting (malicious) JavaScript into the HTTP head, causing the target browser to execute our chosen JavaScript - Alternatively, you can load the Beef framework (https://beefproject.com/) to take control of target browsers.

[[File:illustration_wfp1.png|thumb|none|alt=illustration image|illustration image]]

Dependencies/libraries used by Powerhouse:
* python-dotenv -> for loading the .env variables
* netifaces -> for enumerating network interfaces
* netaddr -> network address manipulation library
* python-nmap -> network scanning, host detection and monitoring
* scapy -> packet crafting
* dhcpkit -> dhcp
* mitmproxy -> intercepts HTTP responses and modifies them according to user parameters
* sslsplitter -> intercept HTTPS traffic
* beef -> a framework that offers an intuitive web GUI, enabling users to trigger events on a target browser through the injection of a hook.js file.
* pm2 -> a very useful process management tool within npm, we use it to start/stop processes


== Setup guide (based on Kali Linux running on a Raspberry Pi) ==

# Install Kali Linux for Raspberry Pi.
# Run: <code>sudo apt update</code>
# Run: <code>sudo apt upgrade</code> (optional)
# Run: <code>sudo apt install npm</code>
# Run: <code>npm install pm2 -g</code> -> needs to be installed globally (-g)
# Run: <code>sudo apt install mitmproxy</code> (if not already pre-installed with Kali Linux)
# Run: <code>sudo apt install beef-xss</code>
# Run: <code>sudo apt install sslsplit</code>
# Run: <code>cd</code>
# Run: <code>wget http://standards-oui.ieee.org/oui.txt</code> (for DHCP leasing record)
# Run: <code>sudo mv oui.txt /usr/local/etc</code> (folder can only be modified with sudo rights / file has “644” rights)
# Switch to the “Code” directory
# Run: <code>sudo apt install python3.11-venv</code> (may not be necessary)
# Run: <code>python -m venv venv</code>
# Run: <code>source venv/bin/activate</code>
# Run: <code>venv/bin/pip install -r requirements.txt</code>
# To run the program: <code>sudo venv/bin/python main.py</code>
# Press <code>Ctrl + C</code> to exit the program
# Run: <code>deactivate</code>

The program assumes the username is “kali”. If your username is different, you might need to change that in the code. Refer to the error message logged to the console during the execution of the program!

Every system is different, therefore refer to any possible error messages/logging if something doesn’t work!


=== The <code>.env</code> file ===

Here is where things get interesting. In the <code>.env</code> file, you can change various settings related to the execution of the program.

'''General Settings:'''

* <code>METHOD</code>: Here, you can specify which modules of the program shall be used.
** Examples:
*** <code>dhcp;webserver;proxy</code> (use rogue DHCP server, web server to host all relevant files, (mitm)proxy to edit incoming HTTP responses)
*** <code>arp;webserver;proxy</code> (use ARP spoofing instead of rogue DHCP)
*** <code>arp;webserver;beef</code> (launch the BeEF framework -> this injects the hook.js needed to connect a target browser to the framework)
* <code>IGNORE_GATEWAY</code>: When set to “YES”, the program will ignore the gateway (not spoof it).
* <code>IGNORE_IPS</code>: In this variable, you can list any IPs you don’t want to spoof.
** Example: <code>IGNORE_IPS="192.168.1.1;192.168.1.2"</code>
* <code>IFACE</code>: In case you need to tell the program which specific network interface to use, you can specify it here. Under Kali Linux running on a Raspberry Pi, the default interface is <code>eth0</code>.
* <code>RESET_IPTABLES_RULES</code>: Can be useful if any errors/problems arise regarding <code>iptables</code>.

'''Proxy Settings:'''

* <code>INJECT_FILE</code>: Here you can choose which JavaScript code you want to insert into HTTP responses intercepted by the program. These JavaScript files can be found in <code>WFP1/Code/res_changer_www</code>. If you have any custom JavaScript you want to sneak into other hosts’ HTTP responses, feel free to add JavaScript files to this directory and reference them in this parameter of the <code>.env</code> file.

'''SSL Settings:'''

Here you can find some settings related to the SSL certificate creation process.

* <code>NEW_CERTIFICATE</code>: if set to <code>YES</code> a new ssl certificate is created, used and stored in the <code>certs</code> folder. if set to <code>NO</code> a existing cert is read. Use the <code>CERTIFICATE</code> variable to define the certificate. Use <code>latest</code> or <code>%Y_%m_%d__%H_%M_%S</code>

'''Web Server Settings:'''

These parameters can be used in case you need to modify anything related to the webserver.

(In our Git repository, you can also find example <code>.env</code> files with some extra explanations.)


== Contact ==

If you have any questions regarding this project, feel free to email us at: [mailto:timothy.nicholson@stud.fh-campuswien.ac.at timothy.nicholson@stud.fh-campuswien.ac.at] or [mailto:valentin.kogard@stud.fh-campuswien.ac.at valentin.kogard@stud.fh-campuswien.ac.at].

[[Category:Documentation]]