Hak5 Shark Jack - Revision history

NKirnbauer: segmentation of hardware

2024-10-11T12:27:26Z

segmentation of hardware

← Older revision		Revision as of 12:27, 11 October 2024
Line 1:		Line 1:
	{{Device\|device_name=Shark Jack network attack tool\|manufacturer=Hak5\|link=https://lab401.com/products/shark-jack\|image_link=https://stuff.elvis.science/uploads/models/assetmodel-image-8EubvbfP6k.png\|description=Portable network attack tool, fast nmap scans. The Shark-Jack is a pen-testing utility developed by the ”Hak5” company and is designed for Ethernet plug and play vulnerability scanning in LANs. In its most basic form, it is essentially a small Linux-machine with a built-in Ethernet plug. The modest, portable physical nature of the device allows for quick and secretive reconnaissance activity. The Shark-Jack consists of following physical components: USB-C charging port, Battery, Status LED, RJ45 Ethernet Jack, MT7628DAN Mikrocontroller, 64 MB RAM, Casing with mode-switch.		{{Device\|device_name=Shark Jack network attack tool\|manufacturer=Hak5\|link=https://lab401.com/products/shark-jack\|image_link=https://stuff.elvis.science/uploads/models/assetmodel-image-8EubvbfP6k.png\|description=Portable network attack tool, fast nmap scans. The Shark-Jack is a pen-testing utility developed by the ”Hak5” company and is designed for Ethernet plug and play vulnerability scanning in LANs. In its most basic form, it is essentially a small Linux-machine with a built-in Ethernet plug. The modest, portable physical nature of the device allows for quick and secretive reconnaissance activity. The Shark-Jack consists of following physical components: USB-C charging port, Battery, Status LED, RJ45 Ethernet Jack, MT7628DAN Mikrocontroller, 64 MB RAM, Casing with mode-switch.

	~~== Operation ==~~
	It provides 3 modes of operation: Off, Arming, and Attack. In attack mode, the Shark Jack will execute the payload.sh or payload.txt bash script from the /root/payload directory. In arming mode, the Shark Jack will be configured with a static IP address of 172.16.24.1 and will simply start an SSH server, without automatically executing any script. In this mode, a perpetrator may load and configure scripts, or retrieve output files placed in the loot directory from previous reconnaissance or attack operations. This can be done using the Linux command line utility “scp”. The status LED lights are configurable using appropriate syntax inside the payload script, provided by the Shark-Jack firmware.

	~~== Example Usage ==~~
	The user prepares a payload script which performs basic network auditing. Here, the user obtains an IP address via DHCP. The DHCP flow is initiated using the "NETMODE DHCP\_CLIENT" directive provided by the Shark Jack framework. Once an address is assigned, grep and sed is used to perform text manipulation on the output of the "ip addr" command, in order to filter the subnet. This subnet is then passed as a argument to nmap. A simple nmap with the option "-sn" is performed. This means that port scans and other elaborate scans are skipped. It is a fast way to determine available hosts. Additionally, a traceroute to Google servers is used to gain further insight into the network topology. The outputs of nmap and traceroute are appended to a loot file:


	~~#!/bin/bash~~
	~~#Using \ as pipe symbol because i dont know how to escape it in this wiki editor thingy~~
	~~LED SETUP~~
	~~NMAP_OPTIONS="-sn" LOOT_DIR=/root/loot/net~~
	~~mkdir -p $LOOT_DIR~~
	~~echo "Obtain IP address..." >> SLOOT_DIR/log.txt~~
	~~NETMODE DHCP_CLIENT~~
	~~while [ -z "$SUBNET" 1; do~~
	~~sleep 1 && SUBNET=$(ip addr \ grep -i eth0 \ grep -i inet \ grep -E -o" ( [0-91{1,3}[\. 1) {3710-91{1,33\/1{1}[0-91{1,23" \ sed 's/\.[0~~
	~~9]*\//\.01 //')~~
	~~done~~
	~~echo "Obtained IP address in subnet: $SUBNET" >> $LOOT_DIR/log.txt~~
	~~LED ATTACK~~
	~~echo "Starting nmap with options §NMAP_OPTIONS" >> $LOOT_DIR/log.txt~~
	~~nmap SNMAP_OPTIONS $SUBNET -ON SLOOT_DIR/net-scan.txt echo "Starting traceroute >> SLOOT_DIR/log.txt~~
	~~traceroute 8.8.8.8 > SLOOT_DIR/net-scan.txt~~
	~~echo "Done" >> $LOOT_DIR/log.txt~~
	~~echo "Inspect loot under SLOOT_DIR/net-scan.txt" >>~~
	~~$LOOT_DIR/log.txt~~
	~~LED FINISH~~
	~~sleep 2 && halt"~~

	The user then puts the Shark Jack into arming mode and plugs the device into the Ethernet port of their machine. The user loads the prepared script onto the Shark Jack using scp. The Shark Jack is unplugged and switched into attack mode. It is ready to be deployed onto a target network. Once execution is done, the loot can be retrieved via arming mode.

	~~== Defense ==~~

	~~- Make sure physical access to infrastructure is only possible for authorized personnel (lock doors to server rooms and server cabinets)~~

	~~- Disable unused ports~~

	~~- Physically inspect routers and switches on a regular basis~~

	~~- Network segmentation, subnets, to reduce attack surface~~

	~~- Monitor network for suspicious traffic~~

	~~== References ==~~

	~~https://docs.hak5.org/shark-jack/getting-started/shark-jack-basics~~

	~~https://github.com/hak5/sharkjack-payloads~~



	\|technicalSpecification=https://docs.hak5.org/shark-jack/\|supportedTechnologies=Ethernet, USB\|includedEquipment=1x shark jack, 1x instruction card\|elviscategory=Security/Crypto}}		\|technicalSpecification=https://docs.hak5.org/shark-jack/\|supportedTechnologies=Ethernet, USB\|includedEquipment=1x shark jack, 1x instruction card\|elviscategory=Security/Crypto}}

	~~[[Category:Documentation]]~~

GKlaus at 18:16, 4 March 2024

2024-03-04T18:16:49Z

Show changes

ARessl: Added Used Hardware Link

2023-08-17T07:43:48Z

Added Used Hardware Link

← Older revision		Revision as of 07:43, 17 August 2023
Line 80:		Line 80:
	=== netdiscover ===		=== netdiscover ===
	The netdiscover payload tries to gather information about a network even if the Shark Jack won't get an IP address from a DCHP-Server. There are two modes netdiscover can use: active and passive. In active mode netdiscover sends ARP packages into the network and tries to gather information about devices, which are currently online. The passive mode doesn't send packages on his own, instead it analyses the traffic of the network (see [[Sniffing_Devices]]).		The netdiscover payload tries to gather information about a network even if the Shark Jack won't get an IP address from a DCHP-Server. There are two modes netdiscover can use: active and passive. In active mode netdiscover sends ARP packages into the network and tries to gather information about devices, which are currently online. The passive mode doesn't send packages on his own, instead it analyses the traffic of the network (see [[Sniffing_Devices]]).


			== Used Hardware ==

			[[Shark Jack network attack tool]]


	== References ==		== References ==

MRiedl: /* Description */

2022-12-29T13:39:24Z

Description

← Older revision		Revision as of 13:39, 29 December 2022
Line 49:		Line 49:
	=== C2 ===		=== C2 ===

	#C2 is a dashboard created by hak5 for tools from hak5, which can be easily set up on a local server for free. With C2, data can be inspected directly in the dashboard and the current state of the device can be viewed. It is also possible to let Shark Jack execute commands like nmap without a previously uploaded payload.		C2 is a dashboard created by hak5 for tools from hak5, which can be easily set up on a local server for free. With C2, data can be inspected directly in the dashboard and the current state of the device can be viewed. It is also possible to let Shark Jack execute commands like nmap without a previously uploaded payload.

	=== Hardware ===		=== Hardware ===

MRiedl: /* Description */

2022-12-29T13:38:26Z

Description

← Older revision		Revision as of 13:38, 29 December 2022
Line 46:		Line 46:
	# Wait 5-10 minutes while the firmware is flashed.		# Wait 5-10 minutes while the firmware is flashed.
	# DO NOT unplug the Shark Jack during the update process!		# DO NOT unplug the Shark Jack during the update process!

			=== C2 ===

			#C2 is a dashboard created by hak5 for tools from hak5, which can be easily set up on a local server for free. With C2, data can be inspected directly in the dashboard and the current state of the device can be viewed. It is also possible to let Shark Jack execute commands like nmap without a previously uploaded payload.

	=== Hardware ===		=== Hardware ===

MRiedl: /* Summary */

2022-12-29T13:28:42Z

Summary

← Older revision		Revision as of 13:28, 29 December 2022
Line 2:		Line 2:
	[[File:Shark_Jack.jpg \|thumb\|right\|600px\|\|Shark Jack]]		[[File:Shark_Jack.jpg \|thumb\|right\|600px\|\|Shark Jack]]

	The Shark Jack is a penetration tool for penetration testers and system administrators looking like a simple USB-Stick. It consists of three main components: a LAN-Port for configuration and executing pentests (which also uses a RGB-LED for visual responses), a USB-C port for charging and a slider to change modes. It provides possibilities to perform network audits and information gathering attacks. These functions are provided by the packages which are installed on the Shark Jack. The packages are provided by the OpenWRT platform, which means that users can add other packages than the preinstalled ones.		The Shark Jack is a penetration tool for penetration testers and system administrators looking like a simple USB-Stick. It consists of three main components: a LAN-Port for configuration and executing pentests (which also uses a RGB-LED for visual responses), a USB-C port for charging and a slider to change modes. It provides possibilities to perform network audits and information gathering attacks. These functions are provided by the packages which are installed on the Shark Jack. The packages are provided by the OpenWRT platform, which means that users can add other packages than the preinstalled ones. Regarding the phases of penetration testing, Shark Jack is in phase 2, information gathering.

	== Description ==		== Description ==

MRiedl: /* Description */

2022-12-29T13:17:58Z

Description

← Older revision		Revision as of 13:17, 29 December 2022
Line 25:		Line 25:
	* payloads		* payloads
	* loot		* loot
	The payloads directory is the place where the code is located which you want to be executed when the Shark Jack is in Attacking Mode. The filename of the code needs to be <code>payload.sh</code>.		The payloads directory is the place where the code is located which you want to be executed when the Shark Jack is in Attacking Mode. The filename of the code needs to be <code>payload.sh</code>. Only one payload script may exist at a time. The loot directory is the place where you can save the results of the network attack.
	The loot directory is the place where you can save the results of the network attack.

	=== Installing/updating packages (optional) ===		=== Installing/updating packages (optional) ===

MRiedl: /* Description */

2022-12-29T13:16:27Z

Description

← Older revision		Revision as of 13:16, 29 December 2022
Line 47:		Line 47:
	# Wait 5-10 minutes while the firmware is flashed.		# Wait 5-10 minutes while the firmware is flashed.
	# DO NOT unplug the Shark Jack during the update process!		# DO NOT unplug the Shark Jack during the update process!

			=== Hardware ===

			# Size: 62 x 21 x 12 mm
			# Charging plug: USB-C
			# Microcontroller: MT7628DAN

	=== How to attack ===		=== How to attack ===

MRiedl: /* How to Attack */

2022-12-29T13:03:56Z

How to Attack

← Older revision		Revision as of 13:03, 29 December 2022
Line 48:		Line 48:
	# DO NOT unplug the Shark Jack during the update process!		# DO NOT unplug the Shark Jack during the update process!

	=== How to ~~Attack~~ ===		=== How to attack ===

	# Shark Jack must be connected to a router or a switch to perform an attack		# Shark Jack must be connected to a router or a switch to perform an attack

MRiedl: /* Description */

2022-12-29T13:02:59Z

Description

@@ Line 47: / Line 47: @@
 # Wait 5-10 minutes while the firmware is flashed.
 # DO NOT unplug the Shark Jack during the update process!
 == Examples ==