Physical Security Experiments

Google Slides Here

Overview

This was a project during my last semester at MHC for ITEC285, my security class. The goal was to pick a security topic, research its importance, and extra for a demo.

Including source code, though omitting the 17pg essay as there is little need for it here

Highlights

• Created a Rubber ducky from an Raspberry Pi Pico
• Created a Rubber ducky from an Arduino Leonardo
• Outlined simple security issues and potential solutions
• Brute forced Samsung A70 with Pico
• Persistent Reverse Shell, w/BAD-USB
• .py Script for Windows 10 hash collection

Video Demo, Gandalf, Pico, Leonardo

Setup both Raspberry Pi Pico and Arduino Pro Micro (Leonardo) as HID devices. Basically they are now user input devices. System does not know difference. Pico also a mass storage device (2mb). Simulate user input to enter commands in RUN box.

Google Drive Proj Demo

• Project Resources, Attributes
  • Starting point, SEXY-GANDALF - Kylerees64
    • Project here
    • GitHub Profile here
  • Pico setup, file resources, guide
    • YouTube Video here
    • YouTube Channel here
  • Arduino Version
    • ChatGPT as debugger, transpiler, someone to talk too
    • Had to make minor changes, issue with type(‘’, false) vs should have been keyboard.press(‘’);
  • DuckyScript Resources, Examples
    • Github Hak5 Library here

Video Demo, Persistent Reverse Shell, w/BAD-USB

During class created persistent Kali USB for a lab. Listening with NC on port 87, for any IP. Pico injects PowerShell, creates scheduled task on logon, logs out user.

Caveat: Thought PS turns off firewall and Live-Protection, tamper protection has to be disabled (not by default), though this does not get reset when restarted, so only needs to be done once by user or by Ducky Script.

Google Drive Proj Demo

• Project Resources, Attributes
  • Starting point, Netcat-Reverseshell-On-Log-In - HokkaidoInu
    • Project here
    • GitHub Profile here
  • Pair Programmer, help w/Debugging, Emotional Support
    • ChatGPT
      • PowerShell syntax/commands, debugging assistance
• Issues
  • Stuck in session 0 😭
  • Permissions issue, which users to use
  • Task Scheduler running but not running script 👀
  • Disabling live-protection
  • Tamper protection
  • Potential dependency issue
  • Currently working with this one

Video Demo, Brute-Force, Android-10, 4 digit lock

Pico can connect to android phone like a computer, because it is one. Lockout time is limited to 30 seconds, try every 30 seconds, only 10k possibilities, ~4 days, no lockdown/wipe by default.

Note: I do 4 days because don't have a camera mount. This just was a shortened version, just proof we can enter data and unlock a phone with prompts from DuckyScript.

Google Drive Proj Demo

• Project Resources, Attributes
  • Starting point, Idea, droidbrute - mandatoryprogrammer
    • Project here
    • Github Profile here
  • Idea, Information
    • YouTube Video here
    • YouTube Channel here
  • Suggestions, initially learning ducky syntax
    • ChatGPT
    • YT Proj Demo

Video Demo, Hash-Collection, Win-10, .py Script

Using lab (from Mike L, ITEC285, MHC) as process. Python Script used as delivery method, already runs fine, installed on Kali. Detects largest drive, guesses is Win-10, mounts, collects hashes, outputs to file, uses pastebin's API to send to internet (anon), unmounts drive. Process finishes in <5 seconds if successful.

Google Drive Proj Demo

• Project Resources, Attributes
  • Mike Long’s ITEC285, labs.
    • Practiced python in his labs
    • Given lab on collecting hashes, following same process in code
  • Boilerplate, syntax help, debugging help
    • ChatGPT
    • CoPilot

Technologies Used