Skip to content

Commit

Permalink
Merge pull request #24 from i-am-shodan/picoBasedBoards
Browse files Browse the repository at this point in the history
  • Loading branch information
i-am-shodan authored Nov 11, 2024
2 parents a9fb999 + ce016f3 commit faadcd0
Show file tree
Hide file tree
Showing 36 changed files with 971 additions and 186 deletions.
17 changes: 13 additions & 4 deletions .github/workflows/main.yml
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ jobs:
- name: Install PlatformIO Core
run: pip install --upgrade platformio

- name: Build PlatformIO Project
- name: Build PlatformIO Project LILYGO-T-Dongle-S3
run: pio run --environment LILYGO-T-Dongle-S3

- name: Upload LILYGO-T-Dongle-S3 artifacts
Expand All @@ -35,7 +35,7 @@ jobs:
name: LILYGO-T-Dongle-S3 Firmware binaries
path: .pio/build/LILYGO-T-Dongle-S3/*.bin

- name: Build PlatformIO Project
- name: Build PlatformIO Project Waveshare-ESP32-S3-LCD-1_47
run: pio run --environment Waveshare-ESP32-S3-LCD-1_47

- name: Upload Waveshare-ESP32-S3-LCD-1_47 artifact
Expand All @@ -44,11 +44,20 @@ jobs:
name: Waveshare-ESP32-S3-LCD-1_47 Firmware binaries
path: .pio/build/Waveshare-ESP32-S3-LCD-1_47/*.bin

- name: Build PlatformIO Project
- name: Build PlatformIO Project Generic-ESP32-S2
run: pio run --environment Generic-ESP32-S2

- name: Upload Generic-ESP32-S2 artifact
uses: actions/upload-artifact@v4
with:
name: Generic-ESP32-S2 Firmware binaries
path: .pio/build/Generic-ESP32-S2/*.bin
path: .pio/build/Generic-ESP32-S2/*.bin

- name: Build PlatformIO Project Waveshare-RP2040-GEEK
run: pio run --environment Waveshare-RP2040-GEEK

- name: Upload Waveshare-RP2040-GEEK artifact
uses: actions/upload-artifact@v4
with:
name: Waveshare-RP2040-GEEK Firmware binaries
path: .pio/build/Waveshare-RP2040-GEEK/*.bin
7 changes: 6 additions & 1 deletion .vscode/settings.json
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,11 @@
"streambuf": "cpp",
"thread": "cpp",
"cinttypes": "cpp",
"typeinfo": "cpp"
"typeinfo": "cpp",
"format": "cpp",
"text_encoding": "cpp",
"charconv": "cpp",
"future": "cpp",
"variant": "cpp"
}
}
3 changes: 1 addition & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -78,8 +78,7 @@ This project implements a variety of attacks based around an easily concealable
| **Waveshare ESP32-S3 1.47inch** ![screenshot](./docs/images/waveshare-147.png) | This device is similar in design, size and features to the LilyGo T-Dongle S3 and uses the same chipset. It is clearly a dev board as it doesn't come with a case and has exposed circuitry on the underside. Where this device betters the T-Dongle S3 is that it has a very large high quality screen and 8MB of additional RAM. | <ul><li>[AliExpress](https://s.click.aliexpress.com/e/_DmlJI3x)</li><li>[eBay UK](https://ebay.us/E4gFr5])</li></ul>
| **ESP32 Udisk** ![screenshot](./docs/images/esp32-udisk.png) | The most basic device that can run the USB Army Knife code is a ESP32-S2 chip connected to a USB port. Often you can find these sold in a very similar enclosures to the T-Dongle S3 and tend to advertised on sites like AliExpress as Playstation 4 jailbreaks under the name 'USB Dongle Udisk for P4'. These devices lack RAM, a screen, SD card, Bluetooth, LEDs and a good hardware button. Instead of an SD card, flash memory is used to store tiny files. These devices are incredibly cheap and are often good at running HID+WiFi payloads (like the rick roll). **Warning** They are too underpowered to run the webserver. When buying these **beware** that they can often be confused with a very similar looking device that includes a CH343P chipset and no reset button. **Make sure the device you buy has a button that can be pushed with a paperclip.** Ensure you flash this device with the Generic-ESP32-S2 configuration. | <ul><li>[AliExpress](https://s.click.aliexpress.com/e/_Dn5wXe5)</li><li>[Amazon UK](https://amzn.to/3Y4hrCE)</li><li>[Amazon US](https://amzn.to/4h98Jf4)</li><li>[eBay UK](https://ebay.us/AVZcK0)</li></ul>
| **ESP32 Key** ![screenshot](./docs/images/esp32-key.png) | Very similar to the ESP32 UDisk this is an ESP32-S2 on a circuit board. It is probably the cheapest device that can just about run USB Army Knife and has a price point to match. You'll need to hold down the button when you plug it in to get the device into flashing mode. Ensure you flash this device with the Generic-ESP32-S2 configuration. | <ul><li>[AliExpress](https://s.click.aliexpress.com/e/_EyliW13)</li></ul>


| **Waveshare-RP2040-GEEK** ![screenshot](./docs/images/rp2040-geek.jpg) | RP2040-GEEK is a development board designed by Waveshare. It has USB-A, 1.14-inch LCD screen, an SD card and has external ports (SWD, UART and I2C). **This board does not run the ESP32 chipset. USB ethernet (NCM) mode are whole disk SD usage are both currently unsupported. ESP32 Maurader cannot work on this device!** On Windows you may also need to set this device to use a WinUSB driver using [Zadig](https://zadig.akeo.ie/). Hold down the button when you plug it in to get the device into flashing mode. | <ul><li>[AliExpress](https://s.click.aliexpress.com/e/_EvdfVGH)</li><li>[Amazon UK](https://amzn.to/3YZvD1f)</li><li>[Amazon US](https://amzn.to/3YY4Ouy)</li></ul>

## Getting Started

Expand Down
Binary file added docs/images/rp2040-geek.jpg
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
26 changes: 23 additions & 3 deletions extra_scripts.py
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,26 @@
staticFiles = {}
headerFiles = []

Import("env")

def skip_esp32_libs_from_pi_builds(node):
"""
`node.name` - a name of File System Node
`node.get_path()` - a relative path
`node.get_abspath()` - an absolute path
to ignore file from a build process, just return None
"""

if ("usb-ncm" in node.get_path() or "ESP32Marauder" in node.get_path()) and "raspberrypi" in env.GetProjectOption("platform"):
# Return None for exclude
print ("Ignoring /lib dir as platform is raspberrypi")
return None

return node

# Register callback
env.AddBuildMiddleware(skip_esp32_libs_from_pi_builds, "*")

def compress_to_c_array(srcFile, dstFile, varName, dataConvertFunc=None):
try:
# Read the contents of the source file
Expand All @@ -28,7 +48,7 @@ def compress_to_c_array(srcFile, dstFile, varName, dataConvertFunc=None):
except:
pass
with open(dstFile, 'w') as f:
f.write(f"#pragma once\n\nconst uint8_t PROGMEM {varName}[{len(compressed_data)}] = {{ {c_array_string} }};")
f.write(f"#pragma once\n\n#ifndef NO_WEB\n\nconst uint8_t PROGMEM {varName}[{len(compressed_data)}] = {{ {c_array_string} }};\n\n#endif")

print(f"Compressed data written to {dstFile}")

Expand Down Expand Up @@ -72,7 +92,7 @@ def compress_to_c_array(srcFile, dstFile, varName, dataConvertFunc=None):
# Call the compress_to_c_array function
compress_to_c_array(file_path, f"src/html/vnc/{file_name}.h", f"noVNC{file_name}Gz")

cpp_vector_code = "#include <string>\n#include <unordered_map>\n#include <cstdint>\n#include <pgmspace.h>\n\n";
cpp_vector_code = "#ifndef NO_WEB\n\n#include <string>\n#include <unordered_map>\n#include <cstdint>\n#include <pgmspace.h>\n\n";
for header in headerFiles:
cpp_vector_code += '#include "'+header.replace("src/html/", "")+'"\n'

Expand All @@ -85,7 +105,7 @@ def compress_to_c_array(srcFile, dstFile, varName, dataConvertFunc=None):
cpp_vector_code += ",\n"
else:
cpp_vector_code += "\n"
cpp_vector_code += "};"
cpp_vector_code += "};\n\n#endif"

with open("src/html/htmlFiles.cpp", "w") as file:
file.write(cpp_vector_code)
139 changes: 95 additions & 44 deletions platformio.ini
Original file line number Diff line number Diff line change
Expand Up @@ -39,14 +39,9 @@ build_flags =
; -D LOCALE_win_sk_SK
; -D LOCALE_win_tr_TR

[common]
platform = https://github.com/platformio/platform-espressif32.git
platform_packages =
platformio/framework-arduinoespressif32 @ https://github.com/espressif/arduino-esp32.git#3.0.3
platformio/framework-arduinoespressif32-libs @ https://github.com/espressif/esp32-arduino-libs.git#idf-release/v5.1
[core]
framework = arduino
extra_scripts = pre:extra_scripts.py
monitor_filters = esp32_exception_decoder
build_src_filter =
+<*>
-<.git/>
Expand All @@ -61,16 +56,32 @@ build_unflags =
build_flags =
${keyboardlayouts.build_flags}
-std=gnu++2a
-DLOLIN_WIFI_FIX
-DARDUINO_USB_MODE=0
-DARDUINO_USB_CDC_ON_BOOT=1
-D DISABLE_ALL_LIBRARY_WARNINGS
-D USER_SETUP_LOADED
-Wnarrowing
-Wno-deprecated
-Wwrite-strings
-Wreturn-type
-Wl,-z,muldefs
-D CFG_TUD_ENABLED
;-D DUCKY_CUSTOM_LOG
lib_deps_core =
https://github.com/i-am-shodan/DuckScriptInterpreter#962e24e81aa548f64fa38a580717edb3ae65c989
bblanchon/ArduinoJson@^7.0.3
ivanseidel/[email protected]+sha.dac3874d28
https://github.com/i-am-shodan/Uptime-Library

[core-esp32]
extends = core
platform = https://github.com/platformio/platform-espressif32.git
platform_packages =
platformio/framework-arduinoespressif32 @ https://github.com/espressif/arduino-esp32.git#3.0.3
platformio/framework-arduinoespressif32-libs @ https://github.com/espressif/esp32-arduino-libs.git#idf-release/v5.1
monitor_filters = esp32_exception_decoder
monitor_speed = 115200
build_flags =
${core.build_flags}
-D LOLIN_WIFI_FIX
-D DISABLE_STATUS_LED
-D ENABLE_NONSERIAL_COMMAND_EXECUTION
-D CFG_TUD_NCM
Expand All @@ -80,33 +91,54 @@ build_flags =
-D ELEGANTOTA_USE_ASYNC_WEBSERVER=1
-D WS_MAX_QUEUED_MESSAGES=64
-D CONFIG_ASYNC_TCP_MAX_ACK_TIME=3000
;-D DUCKY_CUSTOM_LOG
lib_deps_core =
lib_deps =
${core.lib_deps_core}
AsyncTCP=https://github.com/mathieucarbou/AsyncTCP
AsyncTCP-esphome=https://github.com/mathieucarbou/AsyncTCP
https://github.com/i-am-shodan/Adafruit_TinyUSB_Arduino
ESPAsyncWebServer=https://github.com/mathieucarbou/ESPAsyncWebServer
https://github.com/i-am-shodan/DuckScriptInterpreter
bblanchon/ArduinoJson@^7.0.3
ivanseidel/[email protected]+sha.dac3874d28
yiannisbourkelis/Uptime Library@^1.0.0
ayushsharma82/[email protected]

[core-esp32-s3]
extends = core-esp32
build_flags =
${core-esp32.build_flags}
-D ARDUINO_ARCH_ESP32S3
-D GENERIC_ESP32 ; ESP32 Maurader
-D CONFIG_ASYNC_TCP_QUEUE_SIZE=128
lib_deps =
${core-esp32.lib_deps}
h2zero/NimBLE-Arduino@^1.4.2 ; ESP32 Maurader
mathertel/OneButton
lovyan03/LovyanGFX@^1.1.16
https://github.com/pololu/apa102-arduino

[core-pico]
extends = core
platform = https://github.com/maxgerhardt/platform-raspberrypi.git
board = pico
board_build.core = earlephilhower
build_flags =
${core.build_flags}
-D CFG_TUD_ENABLED
-D ARDUINO_ARCH_RP2040
-D NO_ESP_MARAUDER
-D USE_TINYUSB ; needed to change stacks
lib_deps =
${core.lib_deps_core}
vshymanskyy/Preferences@^2.1.0

[env:LILYGO-T-Dongle-S3]
extends = common
extends = core-esp32-s3
board = esp32-s3-devkitc-1
board_build.flash_size = 16MB
board_build.partitions = default_8MB.csv
monitor_speed = 115200
build_flags =
${common.build_flags}
-D ARDUINO_ARCH_ESP32S3
${core-esp32-s3.build_flags}
-D LILYGO_T_DONGLE_S3
-D HAS_SD ; ESP32 Maurader
-D USE_SD_MMC_INTERFACE ; ESP32 Maurader
-D GENERIC_ESP32 ; ESP32 Maurader
-D CONFIG_ASYNC_TCP_QUEUE_SIZE=128
;;;;;;;; Pin Config for TFT ;;;;;;;;
-D DISPLAY_TYPE_ST7735S
-D DISPLAY_RST=1
-D DISPLAY_DC=2
-D DISPLAY_MOSI=3
Expand All @@ -133,28 +165,20 @@ build_flags =
-D LED_CI_PIN=39
;;;;;;;; End of Pin Config ;;;;;;;;
lib_deps =
${common.lib_deps_core}
h2zero/NimBLE-Arduino@^1.4.2 ; ESP32 Maurader
mathertel/OneButton
bitbank2/PNGdec@^1.0.1
lovyan03/LovyanGFX@^1.1.16
https://github.com/pololu/apa102-arduino
${core-esp32-s3.lib_deps}

[env:Waveshare-ESP32-S3-LCD-1_47]
extends = common
extends = core-esp32-s3
board = esp32-s3-devkitc-1
board_build.flash_size = 16MB
board_build.partitions = default_8MB.csv
build_flags =
${common.build_flags}
-D ARDUINO_ARCH_ESP32S3
${core-esp32-s3.build_flags}
-D WAVESHARE_ESP32_S3_LCD_147
-D HAS_SD ; ESP32 Maurader
-D USE_SD_MMC_INTERFACE ; ESP32 Maurader
-D GENERIC_ESP32 ; ESP32 Maurader
-D CONFIG_ASYNC_TCP_QUEUE_SIZE=128
-DBOARD_HAS_PSRAM
;;;;;;;; Pin Config for TFT ;;;;;;;;
-D DISPLAY_TYPE_ST7789
-D DISPLAY_RST=39
-D DISPLAY_DC=41
-D DISPLAY_MOSI=45
Expand All @@ -181,21 +205,16 @@ build_flags =
-D LED_CI_PIN=38
;;;;;;;; End of Pin Config ;;;;;;;;
lib_deps =
${common.lib_deps_core}
h2zero/NimBLE-Arduino@^1.4.2 ; ESP32 Maurader
mathertel/OneButton
bitbank2/PNGdec@^1.0.1
lovyan03/LovyanGFX@^1.1.16
https://github.com/pololu/apa102-arduino
${core-esp32-s3.lib_deps}

[env:Generic-ESP32-S2]
extends = common
extends = core-esp32
board = esp32-s2-kaluga-1 ; close enough
board_build.partitions = min_spiffs.csv
monitor_speed = 115200
build_flags =
${common.build_flags}
-D ARDUINO_ARCH_ESP32S3
${core-esp32.build_flags}
-D ARDUINO_ARCH_ESP32S2
-D NO_TFT
-D NO_LED
-D NO_BUTTON
Expand All @@ -204,4 +223,36 @@ build_flags =
-D USE_SPIFFS_INTERFACE ; ESP32 Maurader
-D MEM_LOWER_LIM=20000 ; ESP32 Maurader
lib_deps =
${common.lib_deps_core}
${core-esp32.lib_deps}

[env:Waveshare-RP2040-GEEK]
extends = core-pico
build_flags =
${core-pico.build_flags}
-D WAVESHARE_RP2040_GEEK
-D NO_LED
-D NO_BUTTON
-D NO_WEB
-D NO_WIFI
;;;;;;;;Pin Config for SD;;;;;;;;
-D SD_SCLK=18
-D SD_MOSI=19
-D SD_MISO=20
-D SD_CS=23
;;;;;;;; Pin Config for TFT ;;;;;;;;
-D DISPLAY_RST=12
-D DISPLAY_DC=8
-D DISPLAY_MOSI=11
-D DISPLAY_CS=9
-D DISPLAY_SCLK=10
-D DISPLAY_LEDA=25
-D DISPLAY_MISO=-1
-D DISPLAY_BUSY=-1
-D DISPLAY_WIDTH=240
-D DISPLAY_HEIGHT=135
-D TFT_WIDTH=240
-D TFT_HEIGHT=135
;;;;;;;; End of Pin Config ;;;;;;;;
lib_deps =
${core-pico.lib_deps}
https://github.com/lovyan03/LovyanGFX.git#develop
7 changes: 5 additions & 2 deletions src/Attacks/Agent/Agent.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -22,12 +22,13 @@ static unsigned long previousMillis = 0;

SerialAgent::SerialAgent()
{
registerUserConfigurableSetting(CATEGORY_USB, USB_AGENT_POLLING_ENABLED, USBArmyKnifeCapability::SettingType::Bool, USB_AGENT_POLLING_ENABLED_DEFAULT);
registerUserConfigurableSetting(CATEGORY_USB, USB_AGENT_POLLING_TIME_IN_SEC, USBArmyKnifeCapability::SettingType::Int16, (int16_t)USB_AGENT_POLLING_TIME_IN_SEC_DEFAULT);
}

void SerialAgent::begin(Preferences &prefs)
{
registerUserConfigurableSetting(CATEGORY_USB, USB_AGENT_POLLING_ENABLED, USBArmyKnifeCapability::SettingType::Bool, USB_AGENT_POLLING_ENABLED_DEFAULT);
registerUserConfigurableSetting(CATEGORY_USB, USB_AGENT_POLLING_TIME_IN_SEC, USBArmyKnifeCapability::SettingType::Int16, (int16_t)USB_AGENT_POLLING_TIME_IN_SEC_DEFAULT);

agentPollingEnabled = prefs.getBool(USB_AGENT_POLLING_ENABLED, USB_AGENT_POLLING_ENABLED_DEFAULT);
agentPollingIntervalInSec = prefs.getInt(USB_AGENT_POLLING_TIME_IN_SEC, USB_AGENT_POLLING_TIME_IN_SEC_DEFAULT);

Expand All @@ -46,6 +47,8 @@ void SerialAgent::begin(Preferences &prefs)
// for now use the log but limit the size
const std::string msg = "Agent execution result\n";
Debug::Log.info(LOG_AGENT, msg + std::string((char*)buffer, size + msg.length() > MAX_LOG_ENTRY_IN_CHARS ? MAX_LOG_ENTRY_IN_CHARS - msg.length() : size));

agentCmdResult = true;
});
}

Expand Down
3 changes: 3 additions & 0 deletions src/Attacks/Agent/Agent.h
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,12 @@ class SerialAgent : USBArmyKnifeCapability {
void run(const std::string& cmd);
bool isAgentConnected() { return m_agentIsConnected; }
std::string machineName() { return m_machineName; }
bool hasAgentCmdResult() { return agentCmdResult; }
void resetAgentCmdResultState() { agentCmdResult = false; }

private:
bool m_agentIsConnected = false;
bool agentCmdResult = false;
std::string m_machineName;
};

Expand Down
Loading

0 comments on commit faadcd0

Please sign in to comment.