Shark Jack network attack tool - Revision history

NKirnbauer: segmentation from hardware

2024-10-14T15:39:25Z

segmentation from hardware

← Older revision		Revision as of 15:39, 14 October 2024
Line 1:		Line 1:
	{{Device\|device_name=Shark Jack network attack tool\|manufacturer=Hak5\|link=https://lab401.com/products/shark-jack\|image_link=https://stuff.elvis.science/uploads/models/assetmodel-image-8EubvbfP6k.png\|description=Portable network attack tool, fast nmap scans. The Shark-Jack is a pen-testing utility developed by the ”Hak5” company and is designed for Ethernet plug and play vulnerability scanning in LANs. In its most basic form, it is essentially a small Linux-machine with a built-in Ethernet plug. The modest, portable physical nature of the device allows for quick and secretive reconnaissance activity. The Shark-Jack consists of following physical components: USB-C charging port, Battery, Status LED, RJ45 Ethernet Jack, MT7628DAN Mikrocontroller, 64 MB RAM, Casing with mode-switch.		{{Device\|device_name=Shark Jack network attack tool\|manufacturer=Hak5\|link=https://lab401.com/products/shark-jack\|image_link=https://stuff.elvis.science/uploads/models/assetmodel-image-8EubvbfP6k.png\|description=Portable network attack tool, fast nmap scans. The Shark-Jack is a pen-testing utility developed by the ”Hak5” company and is designed for Ethernet plug and play vulnerability scanning in LANs. In its most basic form, it is essentially a small Linux-machine with a built-in Ethernet plug. The modest, portable physical nature of the device allows for quick and secretive reconnaissance activity. The Shark-Jack consists of following physical components: USB-C charging port, Battery, Status LED, RJ45 Ethernet Jack, MT7628DAN Mikrocontroller, 64 MB RAM, Casing with mode-switch.

	~~== Operation ==~~
	It provides 3 modes of operation: Off, Arming, and Attack. In attack mode, the Shark Jack will execute the payload.sh or payload.txt bash script from the /root/payload directory. In arming mode, the Shark Jack will be configured with a static IP address of 172.16.24.1 and will simply start an SSH server, without automatically executing any script. In this mode, a perpetrator may load and configure scripts, or retrieve output files placed in the loot directory from previous reconnaissance or attack operations. This can be done using the Linux command line utility “scp”. The status LED lights are configurable using appropriate syntax inside the payload script, provided by the Shark-Jack firmware.

	~~== Example Usage ==~~
	The user prepares a payload script which performs basic network auditing. Here, the user obtains an IP address via DHCP. The DHCP flow is initiated using the "NETMODE DHCP\_CLIENT" directive provided by the Shark Jack framework. Once an address is assigned, grep and sed is used to perform text manipulation on the output of the "ip addr" command, in order to filter the subnet. This subnet is then passed as a argument to nmap. A simple nmap with the option "-sn" is performed. This means that port scans and other elaborate scans are skipped. It is a fast way to determine available hosts. Additionally, a traceroute to Google servers is used to gain further insight into the network topology. The outputs of nmap and traceroute are appended to a loot file:


	~~#!/bin/bash~~
	~~#Using \ as pipe symbol because i dont know how to escape it in this wiki editor thingy~~
	~~LED SETUP~~
	~~NMAP_OPTIONS="-sn" LOOT_DIR=/root/loot/net~~
	~~mkdir -p $LOOT_DIR~~
	~~echo "Obtain IP address..." >> SLOOT_DIR/log.txt~~
	~~NETMODE DHCP_CLIENT~~
	~~while [ -z "$SUBNET" 1; do~~
	~~sleep 1 && SUBNET=$(ip addr \ grep -i eth0 \ grep -i inet \ grep -E -o" ( [0-91{1,3}[\. 1) {3710-91{1,33\/1{1}[0-91{1,23" \ sed 's/\.[0~~
	~~9]*\//\.01 //')~~
	~~done~~
	~~echo "Obtained IP address in subnet: $SUBNET" >> $LOOT_DIR/log.txt~~
	~~LED ATTACK~~
	~~echo "Starting nmap with options §NMAP_OPTIONS" >> $LOOT_DIR/log.txt~~
	~~nmap SNMAP_OPTIONS $SUBNET -ON SLOOT_DIR/net-scan.txt echo "Starting traceroute >> SLOOT_DIR/log.txt~~
	~~traceroute 8.8.8.8 > SLOOT_DIR/net-scan.txt~~
	~~echo "Done" >> $LOOT_DIR/log.txt~~
	~~echo "Inspect loot under SLOOT_DIR/net-scan.txt" >>~~
	~~$LOOT_DIR/log.txt~~
	~~LED FINISH~~
	~~sleep 2 && halt"~~

	The user then puts the Shark Jack into arming mode and plugs the device into the Ethernet port of their machine. The user loads the prepared script onto the Shark Jack using scp. The Shark Jack is unplugged and switched into attack mode. It is ready to be deployed onto a target network. Once execution is done, the loot can be retrieved via arming mode.

	~~== Defense ==~~

	~~- Make sure physical access to infrastructure is only possible for authorized personnel (lock doors to server rooms and server cabinets)~~

	~~- Disable unused ports~~

	~~- Physically inspect routers and switches on a regular basis~~

	~~- Network segmentation, subnets, to reduce attack surface~~

	~~- Monitor network for suspicious traffic~~

	~~== References ==~~

	~~https://docs.hak5.org/shark-jack/getting-started/shark-jack-basics~~

	~~https://github.com/hak5/sharkjack-payloads~~



	\|technicalSpecification=https://docs.hak5.org/shark-jack/\|supportedTechnologies=Ethernet, USB\|includedEquipment=1x shark jack, 1x instruction card\|elviscategory=Security/Crypto}}		\|technicalSpecification=https://docs.hak5.org/shark-jack/\|supportedTechnologies=Ethernet, USB\|includedEquipment=1x shark jack, 1x instruction card\|elviscategory=Security/Crypto}}

GKlaus: Add references

2024-03-03T16:42:17Z

Add references

← Older revision		Revision as of 16:42, 3 March 2024
Line 43:		Line 43:

	- Monitor network for suspicious traffic		- Monitor network for suspicious traffic

			== References ==

			https://docs.hak5.org/shark-jack/getting-started/shark-jack-basics

			https://github.com/hak5/sharkjack-payloads



	\|technicalSpecification=https://docs.hak5.org/shark-jack/\|supportedTechnologies=Ethernet, USB\|includedEquipment=1x shark jack, 1x instruction card\|elviscategory=Security/Crypto}}		\|technicalSpecification=https://docs.hak5.org/shark-jack/\|supportedTechnologies=Ethernet, USB\|includedEquipment=1x shark jack, 1x instruction card\|elviscategory=Security/Crypto}}

GKlaus at 16:40, 3 March 2024

2024-03-03T16:40:48Z

← Older revision		Revision as of 16:40, 3 March 2024
Line 35:		Line 35:

	- Make sure physical access to infrastructure is only possible for authorized personnel (lock doors to server rooms and server cabinets)		- Make sure physical access to infrastructure is only possible for authorized personnel (lock doors to server rooms and server cabinets)

	- Disable unused ports		- Disable unused ports

	- Physically inspect routers and switches on a regular basis		- Physically inspect routers and switches on a regular basis

	- Network segmentation, subnets, to reduce attack surface		- Network segmentation, subnets, to reduce attack surface

	- Monitor network for suspicious traffic		- Monitor network for suspicious traffic

GKlaus at 16:40, 3 March 2024

2024-03-03T16:40:28Z

← Older revision		Revision as of 16:40, 3 March 2024
Line 34:		Line 34:
	== Defense ==		== Defense ==

	- ~~Lock~~ server rooms and server cabinets		- Make sure physical access to infrastructure is only possible for authorized personnel (lock doors to server rooms and server cabinets)
			- Disable unused ports
			- Physically inspect routers and switches on a regular basis
			- Network segmentation, subnets, to reduce attack surface
			- Monitor network for suspicious traffic



	\|technicalSpecification=https://docs.hak5.org/shark-jack/\|supportedTechnologies=Ethernet, USB\|includedEquipment=1x shark jack, 1x instruction card\|elviscategory=Security/Crypto}}		\|technicalSpecification=https://docs.hak5.org/shark-jack/\|supportedTechnologies=Ethernet, USB\|includedEquipment=1x shark jack, 1x instruction card\|elviscategory=Security/Crypto}}

GKlaus at 16:35, 3 March 2024

2024-03-03T16:35:05Z

← Older revision		Revision as of 16:35, 3 March 2024
Line 29:		Line 29:
	LED FINISH		LED FINISH
	sleep 2 && halt"		sleep 2 && halt"

			The user then puts the Shark Jack into arming mode and plugs the device into the Ethernet port of their machine. The user loads the prepared script onto the Shark Jack using scp. The Shark Jack is unplugged and switched into attack mode. It is ready to be deployed onto a target network. Once execution is done, the loot can be retrieved via arming mode.

	== Defense ==		== Defense ==

	- Lock server rooms and server cabinets		- Lock server rooms and server cabinets




	\|technicalSpecification=https://docs.hak5.org/shark-jack/\|supportedTechnologies=Ethernet, USB\|includedEquipment=1x shark jack, 1x instruction card\|elviscategory=Security/Crypto}}		\|technicalSpecification=https://docs.hak5.org/shark-jack/\|supportedTechnologies=Ethernet, USB\|includedEquipment=1x shark jack, 1x instruction card\|elviscategory=Security/Crypto}}

GKlaus at 16:34, 3 March 2024

2024-03-03T16:34:20Z

← Older revision		Revision as of 16:34, 3 March 2024
Line 9:		Line 9:

	#!/bin/bash		#!/bin/bash
			#Using \ as pipe symbol because i dont know how to escape it in this wiki editor thingy
	LED SETUP		LED SETUP
	NMAP_OPTIONS="-sn" LOOT_DIR=/root/loot/net		NMAP_OPTIONS="-sn" LOOT_DIR=/root/loot/net
Line 15:		Line 16:
	NETMODE DHCP_CLIENT		NETMODE DHCP_CLIENT
	while [ -z "$SUBNET" 1; do		while [ -z "$SUBNET" 1; do
	sleep 1 && SUBNET=$(ip addr \| grep -i eth0 \| grep -i inet \| grep -E -o" ( [0-91{1,3}[\. 1) {3710-91{1,33\/1{1}[0-91{1,23" \| sed 's/\.[0		sleep 1 && SUBNET=$(ip addr \ grep -i eth0 \ grep -i inet \ grep -E -o" ( [0-91{1,3}[\. 1) {3710-91{1,33\/1{1}[0-91{1,23" \ sed 's/\.[0
	9]*\//\.01 //')		9]*\//\.01 //')
	done		done
Line 27:		Line 28:
	$LOOT_DIR/log.txt		$LOOT_DIR/log.txt
	LED FINISH		LED FINISH
	sleep 2 && halt		sleep 2 && halt"

	== Defense ==		== Defense ==

GKlaus at 16:30, 3 March 2024

2024-03-03T16:30:25Z

← Older revision		Revision as of 16:30, 3 March 2024
Line 28:		Line 28:
	LED FINISH		LED FINISH
	sleep 2 && halt		sleep 2 && halt

			== Defense ==

			- Lock server rooms and server cabinets


	\|technicalSpecification=https://docs.hak5.org/shark-jack/\|supportedTechnologies=Ethernet, USB\|includedEquipment=1x shark jack, 1x instruction card\|elviscategory=Security/Crypto}}		\|technicalSpecification=https://docs.hak5.org/shark-jack/\|supportedTechnologies=Ethernet, USB\|includedEquipment=1x shark jack, 1x instruction card\|elviscategory=Security/Crypto}}

GKlaus at 16:28, 3 March 2024

2024-03-03T16:28:42Z

← Older revision		Revision as of 16:28, 3 March 2024
Line 14:		Line 14:
	echo "Obtain IP address..." >> SLOOT_DIR/log.txt		echo "Obtain IP address..." >> SLOOT_DIR/log.txt
	NETMODE DHCP_CLIENT		NETMODE DHCP_CLIENT

	while [ -z "$SUBNET" 1; do		while [ -z "$SUBNET" 1; do
	sleep 1 && SUBNET=$(ip addr \| grep -i eth0 \| grep -i inet \| grep -E -o" ( [0-91{1,3}[\. 1) {3710-91{1,33\/1{1}[0-91{1,23" \| sed 's/\.[0		sleep 1 && SUBNET=$(ip addr \| grep -i eth0 \| grep -i inet \| grep -E -o" ( [0-91{1,3}[\. 1) {3710-91{1,33\/1{1}[0-91{1,23" \| sed 's/\.[0
Line 20:		Line 19:
	done		done
	echo "Obtained IP address in subnet: $SUBNET" >> $LOOT_DIR/log.txt		echo "Obtained IP address in subnet: $SUBNET" >> $LOOT_DIR/log.txt

	LED ATTACK		LED ATTACK
	echo "Starting nmap with options §NMAP_OPTIONS" >> $LOOT_DIR/log.txt		echo "Starting nmap with options §NMAP_OPTIONS" >> $LOOT_DIR/log.txt
Line 28:		Line 26:
	echo "Inspect loot under SLOOT_DIR/net-scan.txt" >>		echo "Inspect loot under SLOOT_DIR/net-scan.txt" >>
	$LOOT_DIR/log.txt		$LOOT_DIR/log.txt

	LED FINISH		LED FINISH
	sleep 2 && halt		sleep 2 && halt

	\|technicalSpecification=https://docs.hak5.org/shark-jack/\|supportedTechnologies=Ethernet, USB\|includedEquipment=1x shark jack, 1x instruction card\|elviscategory=Security/Crypto}}		\|technicalSpecification=https://docs.hak5.org/shark-jack/\|supportedTechnologies=Ethernet, USB\|includedEquipment=1x shark jack, 1x instruction card\|elviscategory=Security/Crypto}}

GKlaus: Finally found out i need to to indentations to put text into grey box

2024-03-03T16:28:11Z

Finally found out i need to to indentations to put text into grey box

← Older revision		Revision as of 16:28, 3 March 2024
Line 8:		Line 8:


	#!/bin/bash		#!/bin/bash
	LED SETUP		LED SETUP
			NMAP_OPTIONS="-sn" LOOT_DIR=/root/loot/net
			mkdir -p $LOOT_DIR
			echo "Obtain IP address..." >> SLOOT_DIR/log.txt
			NETMODE DHCP_CLIENT

	~~NMAP_OPTIONS="-sn" LOOT_DIR=/root/loot/net~~		while [ -z "$SUBNET" 1; do
	~~mkdir -p $LOOT_DIR~~		sleep 1 && SUBNET=$(ip addr \| grep -i eth0 \| grep -i inet \| grep -E -o" ( [0-91{1,3}[\. 1) {3710-91{1,33\/1{1}[0-91{1,23" \| sed 's/\.[0
			9]*\//\.01 //')
	~~echo "Obtain IP address..." >> SLOOT_DIR/log.txt~~		done
	~~NETMODE DHCP_CLIENT~~		echo "Obtained IP address in subnet: $SUBNET" >> $LOOT_DIR/log.txt

	while [ -z "$SUBNET" 1; do		LED ATTACK
	sleep 1 && SUBNET=$(ip addr \| grep -i eth0 \| grep -i inet \| grep -E -o		echo "Starting nmap with options §NMAP_OPTIONS" >> $LOOT_DIR/log.txt
	" ( [0-91{1,3}[\. 1) {3710-91{1,33\/1{1}[0-91{1,23" \| sed 's/\.[0-9]*\//\.01 //')		nmap SNMAP_OPTIONS $SUBNET -ON SLOOT_DIR/net-scan.txt echo "Starting traceroute >> SLOOT_DIR/log.txt
	done		traceroute 8.8.8.8 > SLOOT_DIR/net-scan.txt
	echo "Obtained IP address in subnet: $SUBNET" >> $LOOT_DIR/log.txt		echo "Done" >> $LOOT_DIR/log.txt
			echo "Inspect loot under SLOOT_DIR/net-scan.txt" >>
	LED ATTACK		$LOOT_DIR/log.txt
	echo "Starting nmap with options §NMAP_OPTIONS" >> $LOOT_DIR/log.txt
	nmap SNMAP_OPTIONS $SUBNET -ON SLOOT_DIR/net-scan.txt echo "Starting traceroute >> SLOOT_DIR/log.txt		LED FINISH
	traceroute 8.8.8.8 > SLOOT_DIR/net-scan.txt		sleep 2 && halt
	echo "Done" >> $LOOT_DIR/log.txt
	echo "Inspect loot under SLOOT_DIR/net-scan.txt" >>
	$LOOT_DIR/log.txt

	LED FINISH
	sleep 2 && halt
	\|technicalSpecification=https://docs.hak5.org/shark-jack/\|supportedTechnologies=Ethernet, USB\|includedEquipment=1x shark jack, 1x instruction card\|elviscategory=Security/Crypto}}		\|technicalSpecification=https://docs.hak5.org/shark-jack/\|supportedTechnologies=Ethernet, USB\|includedEquipment=1x shark jack, 1x instruction card\|elviscategory=Security/Crypto}}

GKlaus: Create subsections

2024-03-03T16:25:57Z

Create subsections

← Older revision		Revision as of 16:25, 3 March 2024
Line 1:		Line 1:
	{{Device\|device_name=Shark Jack network attack tool\|manufacturer=Hak5\|link=https://lab401.com/products/shark-jack\|image_link=https://stuff.elvis.science/uploads/models/assetmodel-image-8EubvbfP6k.png\|description=Portable network attack tool, fast nmap scans. The Shark-Jack is a pen-testing utility developed by the ”Hak5” company and is designed for Ethernet plug and play vulnerability scanning in LANs. In its most basic form, it is essentially a small Linux-machine with a built-in Ethernet plug. The modest, portable physical nature of the device allows for quick and secretive reconnaissance activity. The Shark-Jack consists of following physical components: USB-C charging port, Battery, Status LED, RJ45 Ethernet Jack, MT7628DAN Mikrocontroller, 64 MB RAM, Casing with mode-switch.		{{Device\|device_name=Shark Jack network attack tool\|manufacturer=Hak5\|link=https://lab401.com/products/shark-jack\|image_link=https://stuff.elvis.science/uploads/models/assetmodel-image-8EubvbfP6k.png\|description=Portable network attack tool, fast nmap scans. The Shark-Jack is a pen-testing utility developed by the ”Hak5” company and is designed for Ethernet plug and play vulnerability scanning in LANs. In its most basic form, it is essentially a small Linux-machine with a built-in Ethernet plug. The modest, portable physical nature of the device allows for quick and secretive reconnaissance activity. The Shark-Jack consists of following physical components: USB-C charging port, Battery, Status LED, RJ45 Ethernet Jack, MT7628DAN Mikrocontroller, 64 MB RAM, Casing with mode-switch.

			== Operation ==
	It provides 3 modes of operation: Off, Arming, and Attack. In attack mode, the Shark Jack will execute the payload.sh or payload.txt bash script from the /root/payload directory. In arming mode, the Shark Jack will be configured with a static IP address of 172.16.24.1 and will simply start an SSH server, without automatically executing any script. In this mode, a perpetrator may load and configure scripts, or retrieve output files placed in the loot directory from previous reconnaissance or attack operations. This can be done using the Linux command line utility “scp”. The status LED lights are configurable using appropriate syntax inside the payload script, provided by the Shark-Jack firmware.		It provides 3 modes of operation: Off, Arming, and Attack. In attack mode, the Shark Jack will execute the payload.sh or payload.txt bash script from the /root/payload directory. In arming mode, the Shark Jack will be configured with a static IP address of 172.16.24.1 and will simply start an SSH server, without automatically executing any script. In this mode, a perpetrator may load and configure scripts, or retrieve output files placed in the loot directory from previous reconnaissance or attack operations. This can be done using the Linux command line utility “scp”. The status LED lights are configurable using appropriate syntax inside the payload script, provided by the Shark-Jack firmware.

	Example ~~usage:~~		== Example Usage ==
	The user prepares a payload script which performs basic network auditing. Here, the user obtains an IP address via DHCP. The DHCP flow is initiated using the "NETMODE DHCP\_CLIENT" directive provided by the Shark Jack framework. Once an address is assigned, grep and sed is used to perform text manipulation on the output of the "ip addr" command, in order to filter the subnet. This subnet is then passed as a argument to nmap. A simple nmap with the option "-sn" is performed. This means that port scans and other elaborate scans are skipped. It is a fast way to determine available hosts. Additionally, a traceroute to Google servers is used to gain further insight into the network topology. The outputs of nmap and traceroute are appended to a loot file:		The user prepares a payload script which performs basic network auditing. Here, the user obtains an IP address via DHCP. The DHCP flow is initiated using the "NETMODE DHCP\_CLIENT" directive provided by the Shark Jack framework. Once an address is assigned, grep and sed is used to perform text manipulation on the output of the "ip addr" command, in order to filter the subnet. This subnet is then passed as a argument to nmap. A simple nmap with the option "-sn" is performed. This means that port scans and other elaborate scans are skipped. It is a fast way to determine available hosts. Additionally, a traceroute to Google servers is used to gain further insight into the network topology. The outputs of nmap and traceroute are appended to a loot file: