pwnagotchi 2022

Pwnagotchi is a cool project that I had seen a few years back and just recent decided to finally take a look at it.

What is Pwnagotchi?

Pwnagotchi is a small "AI" device derived from the 90's toy Tamagotchi. Similar to the toy, you please your Pwnagotchi by allowing it to observe and "eat" wifi handshakes. The artificial intelligence of the Pwnagotchi allows it to analyze it's surroundings making decisions on how to best collect wifi handshakes through passive sniffing, deauthentication and association attacks. 

Pwnagotchi is capable of storing the collected handshakes supporting hashcat to later crack the obtained handshakes, thus possibly providing the wifi network password.

If you don't have any pi's around, the whole project costs about 60-70 bucks including the Waveshare ink screen, Raspberry Pi Zero and Pisugar2 power pack.

Configuration Notes:

While the project is seemingly abandoned by its original developer, the documentation is still pretty relavent to complete this project. 

Image used: Build 1.5.5 to a 32gb Micro SD using Etcher.

I booted my Pi Zero before editing my config file. Once booted, Windows detected the device but did not install the correct drivers for the device to be identified as an RNDIS, I had to download drivers found here https://www.factoryforward.com/wp-content/uploads/2018/01/mod-duo-rndis.zip

 

In device manager, find the device under USB devices and install the new drivers. It will then be listed under Network devices as an RNDIS device. 

Go to network adapters and find your new network adapter. Right click properties - Tcpip 4 and manually assign an IP, subnet mask and DNS:

IP: 10.0.0.1

255.0.0.0

DNS: 1.1.1.1 (google)

Once this has applied, use putty to SSH into Pwnagotchi.

pi@10.0.0.2
Pass:raspberry

At this point I was connected SSH and also able to the webgui 10.0.0.2:8080.

Under plugins I enabled Bluetooth. I then began to edit the config file with

sudo nano /etc/pwnagotchi/config.toml

Here I changed my pwnagotchi name, configured the bluetooth, changed the webui password, opted in on grid. Grid is a Pwnagotchi API that collects stats on your device and shares then with others, keeping track of your stats.

bluetoothctl

Once connected via Bluetooth, was now able to SSH into my Pwnagotchi using an Android app called Juice SSH allowing me to perform more work from my phone. 

I installed the Pisugar2 device drivers and pwnagotchi support plugin that basically includes the battery percentage on your pwnagotchi web and screen UI. What was cool was discovering the functions of Pisugar2 - the webui for the device allows you to configure sequential button functions such as single click, double click, or long click and have it run a shell command. This is awesome for providing a proper way to shutdown, launch an service, etc.

In additional you can also schedule wakeup times which is awesome for turning on my Pwnagotchi at specific time automatically.

I was able to enable paw-gps and have my pwnagotchi map pwn'd access points through the GPS on my phone. You can view them in the webui pwnagotchiname:8080/plugins/webgpsmap. 

I ended up grabbing a U-blox 7 GPS module as I was more interested in making it standalone, rather than absolutely needing bt-teethering for geo positions.

U-blox has a piece of software called 'U-central' that I tested my unit it on prior to, but plugging it into my PI Zero I was able immediately see it with 

>lsusb

Knowing the device was detected, I used dmesg to try and be certain of its assignment:

dmesg | grep tty

I could see it was assigned ttyACM0 - so I added this to my config so it knew which device to use when a handshake is captured to mark it's coordinates.

I took my unit outside initially and gave it a few minutes to initialize and be located by GPS satellites. After a few minutes, the green LED began to flash I was receiving coordinates.

Now knowing that works, I would like to redesign the case to I cooperate the GPS module, wiring it into the GPIO rather than externally connected USB.

Proxmark3 - Getting Started

Like with any new tool, it's time to discover and become fluent with some basics:

Out of habit with the back and forth I had when flashing my Proxmark3, I check to see that the device is detect by running the command:

~$lsusb

This is used to list usb buses and get information about devices connected them, and as we can see on bus 001 Device 003 our Proxmark3 is listed.

I also then ensure that the port has be assigned by running 

~$sudo dmesg| grep -i usb

and can see it has been properly assigned to ttyAMC0

I can now change directories to /proxmark3 and attempt to launch it

~$cd proxmark3 
~$sudo ./client/proxmark3 /dev/ttyACM0
 

Above you can see information on the board as it loads and we can now perform a few tests. Although we have made a number of steps to ensure we are connected to the proxmark3, we can run a pin test to validate communication to the board.

proxmark3>hw ping 
Ping successful

Next we should run a hardware tune to test the tuning of the antennas for transmitting and receiving

~$hw tune 

Above you can see the test came back with the High Frequency(HF) and Low Frequency (LF) and while I do not have a GUI added to the build, we can see the values are accurate to the device frequency requirement and specifications.

The only RFID's I have to play with at this time are some HF cards that came with the Proxmark3. So to test this I check 'help' and see that I can do a High Frequency Search.

~$hf search

You can see a failed search attempt in the image above and is present because I didn't have an RFID near the antenna when I ran the command. Running again was successful and the UID can information can be seen.

With this data, we can see that the card has been identified as a MIFARE Classic 1K. Refering to official Proxmark3 Command Dump ( a reference guide I've spent a bit of time on) we can refer to the high frequency MIFARE commands on how to write.

Now we can try another basic command of applying a UID to another card.

~$hf mf csetuid 1e45ae7

Success! I can read and write values to HF MIFARE cards.

Proxmark3 Easy

The Proxmark3 is an RFID (radio frequency identification) tool kit. It is capable of sniffing, reading and writing RFIDs aswell as portraying an RFID itself. Many of its features can also be utilized in a "field mode" where a computer is not required after use case configuration of firmware.

I purchased a Proxmark3 Easy to dive into the world of RFIDs as my growing obsession with radio frequencies in general seems to grow, and I hope to continue to report back as I break this report into segments as I progress.

My Proxmark3 is a popular Chinese brand "Elechouse" and although it came assembled, I disassembled to get a good look at it. While there are some mixed reviews on clones over official Proxmark3's, it is clear that the 256kb memory versions are obsolete as the recent firmware has exceeded its capacity. 

I was able to pick up this 512kb version for $60 dollars on Amazon and with my current comprehension RFIDs and the pm3 in general, I am very satisfied with my purchase believing there is a lot to learn with the Proxmark3 Easy.

From left to right we can see the riser shield - I don't believe there to be function to this piece aside from spacing the card off the HF antenna. Moving left to the middle is Proxmark3 itself with PCB embedded HF (high frequency) antenna - then finally the LF (low frequency) antenna far right coil. 

So what is the use case for this device?

As acknowledged with SDR (software defined radio) and my hackrf, Radio frequencies are everywhere and for a long time lacked severly in security considerations. While this device is capable performing task that would question legalities, my interests strictly lie in the understanding of the technology to identify short comings of security measures implemented in the field. 

Getting Started

Keystroke Injection

Keystroke injection is accomplished by masking a HID (human interface device) such as a mouse, keyboard or jump drive that can execute keystrokes upon insertion. The very idea of this attack is cleaver as the possibility of detection can be low and a very viable solution for bridging air gaps ( a computer or network physically isolated from internet or other networks).

While there are many devices to choose from, I picked up a cheap Arduino pro micro knock off to play with called the Keystudio Pro Micro 32u4. These are cheap and readily available everywhere.

To get started, I read a bit on the keyboard.h library and some of the modifiers while trying devise a quick and dirty attack plan.To me this is one of the most exciting things about Pentesting and security research; visualization of the plan, reconnaissance and establishing viable execution. 

Playing with some simple inputs and delays with keyboard shortcut combinations lead to some interesting use cases allowing PowerShell commands to be executed. 

To increase the functionality of this device buttons could be added to cycle pre-scripted payloads, and adding an SSD to possibly store text dumps would be beneficial.

  

Squire LP10 Picked

When I first started learning lock picking, I quickly discovered that finding practice locks was half the challenge. I started asking friends, and family if they had any old or unwanted padlocks lying around.

One of my neighbors—who still insists some of my hobbies are a little unusual—had a Squire LP10 padlock securing a tow chain. The key had long since disappeared, and he jokingly said that if I could get it open, I could keep it.

Challenge accepted.

The lock had clearly spent years outdoors, so getting it moving freely took longer than actually picking it. After flushing it with engine degreaser and working some machine oil into the keyway, I was able to free up the pins enough to rake it open in under five minutes.

Once the chain was liberated, I returned it to my neighbour and gave the padlock a little restoration of its own. An hour soaking in CLR removed much of the corrosion, followed by a thorough drying and fresh lubrication. While it's hardly a high-security lock, bringing it back to life made it a great addition to the growing collection.

More importantly, it became another opportunity to practice single-pin picking and develop better feedback through the lock. Every lock has its own personality, and even inexpensive padlocks like this are valuable learning tools.

Specifications

• Model: Squire LP10
• Body: 50 mm solid brass
• Shackle: Hardened steel
• Pins: 4-pin mechanism