Recently I was playing with the Teensy www.pjrc.com/teensy and I wanted to test it as a Metasploit exploit/payload attack vector. The Social Engineering Toolkit (SET) in Metasploit exploit/payload sounded like the perfect thing to try. I followed the instructions at www.offensive-security.com/metasploit-unleashed/SET_Teensy_USB_HID_Attack and they worked almost flawlessly. A couple of hints I'd give are:
1) Update SET prior to starting. Simply use the menu, or do a 'svn update' from the SET directory
2) I was surprised when SET didn't ask me for my IP address. I RTFM, and I noticed that the AUTO_DETECT in the set_config file was set to ON, which means that it automatically gave the payload the IP address of my Ethernet address. So remember to change this if you want to get through a NAT or something.
For my Teensy, I selected:
WSCRIPT HTTP GET MSF Payload
WINDOWS REVERSE_TCP_METERPRETER
BACKDOOR EXECUTABLE
PORT
Then SET made a exploit/payload image, and I uploaded it to the Teensy. The instructions at the URL above show a "Teensy 2.0 (USB Keyboard/Mouse)" option under Boards, and I didn't have that. But I had a Keyboard option under USB, and the Teensy 2.0 under Boards, and when I selected both of these, the SET image compiled just fine.
I uploaded it to the Teensy, and put it in a victim box. The Teensy was recognized as a Teensy USB Keyboard, installed the keyboard drivers, and started popping up screens galore... notepad files, command prompts, and about 15 Start->Run Windows that it filled in with various text and executed, and the whole process takes about 15 seconds! Then it errored out on an C:\x.exe file, saying that Windows couldn't find it. What was worse, MS Security Essentials detected a backdoor in System32, and killed the exploit process by stopping it from executing (why the aforementioned c:\x.exe error occurred). I guess the Teensy doesn't slip past AV very well. Good to know. So I uninstalled Security Essentials, rebooted, and tried again. This was awarded with a Meterpreter session on my attack platform!
My take away from this endeavor is that while the Teensy may be useful to pwn a system that you may have physical access to, it pops up so many windows that there is no way that you could social engineer it and hand it to someone and have them sit through all the windows while it infects their system... they'd unplug it and run to their IT shop for help. So I put this in my toolbox as a quick way to install a backdoor myself, keeping in mind the AV hit potential.
1) Update SET prior to starting. Simply use the menu, or do a 'svn update' from the SET directory
2) I was surprised when SET didn't ask me for my IP address. I RTFM, and I noticed that the AUTO_DETECT in the set_config file was set to ON, which means that it automatically gave the payload the IP address of my Ethernet address. So remember to change this if you want to get through a NAT or something.
For my Teensy, I selected:
WSCRIPT HTTP GET MSF Payload
WINDOWS REVERSE_TCP_METERPRETER
BACKDOOR EXECUTABLE
PORT
Then SET made a exploit/payload image, and I uploaded it to the Teensy. The instructions at the URL above show a "Teensy 2.0 (USB Keyboard/Mouse)" option under Boards, and I didn't have that. But I had a Keyboard option under USB, and the Teensy 2.0 under Boards, and when I selected both of these, the SET image compiled just fine.
I uploaded it to the Teensy, and put it in a victim box. The Teensy was recognized as a Teensy USB Keyboard, installed the keyboard drivers, and started popping up screens galore... notepad files, command prompts, and about 15 Start->Run Windows that it filled in with various text and executed, and the whole process takes about 15 seconds! Then it errored out on an C:\x.exe file, saying that Windows couldn't find it. What was worse, MS Security Essentials detected a backdoor in System32, and killed the exploit process by stopping it from executing (why the aforementioned c:\x.exe error occurred). I guess the Teensy doesn't slip past AV very well. Good to know. So I uninstalled Security Essentials, rebooted, and tried again. This was awarded with a Meterpreter session on my attack platform!
My take away from this endeavor is that while the Teensy may be useful to pwn a system that you may have physical access to, it pops up so many windows that there is no way that you could social engineer it and hand it to someone and have them sit through all the windows while it infects their system... they'd unplug it and run to their IT shop for help. So I put this in my toolbox as a quick way to install a backdoor myself, keeping in mind the AV hit potential.
Comments
Post a Comment