給平民的MouseJack–Qcon2016Presenter:kjbybyThinputer2016-4-23Thinputer2016-4-23LanguageSelection IntroductionMostofthetimeMostofthetimeproject.>Iamthecoder>Iamtheadministrator>IamwhatIamAlmostEveryWeekendWithVNSecuritysinceyear>CTFplayer>WeekendgamerOnceOnceayearrdfans>Goodfriends>CTFCTFandCTF>>2008,HackInTheBoxCTFWinner>2010,HackInTheBoxSpeaker,Malaysia>2012,CodegateSpeaker,Korea>2015,VXRLSpeaker,HongKong>2015,HITCONCTF,PrequalTop10>2016,CodegateCTF,PrequalTop5>OSX,LocalPrivilegeEscalation>Codecommitformetasploit3>GDBBughunting>LinuxRandomizationBypass>/xwings/tuya ResearchCreditsPartnerPartnerInCrime:klks84,/klks84AllmymissingLogitechkeyboardandmouse WhatIsMouseJackWhatIsMouseJackTargetingTargetingnon-BluetoothkeyboardandmiceSniffandtransmitspecialcratedradiopackettowardsvictimsKeyboardsnormallysendsencryptedpacketsAffectedProduct?Mostofthenon-BluetoothkeyboardandmouseHowItWorksScanScanallthenearbywirelessmouse,signaljumpingSnifftargetedvictimDump“keystroke”,”MouseStroke”Replay,Hijack,0wn3d Objectives WhyThisResearchMostMostcompleteMouseJackimplementationguide,inchineseBothguidebasedonCrazyradio.“PA”andnon“PA”Objective1:Canitbecheaper?Objective2:Smaller?(Nottooobvious)Objective3:Easiertopurchase?Justtabaoit?WhatNot,ButNothingNothingtodowithkeyboardinjectionNothingtodowithbreakingkeyboardencryptionNothingtodowithmouseinjectionNothingtodowithsuperlongdistancesniffingBut,Wedohavesomething.Yes,thatsomething HowItStartedItDoesRingtheBellGotGotitfewyearsbackAlwayshideinsmalllittlecornerAftertwotimesflyingIthinkIgiveup,completelyTheCrazyradioBasedBasedonnRF24LU1+chip125radiochannelsSendandreceivepacketsupto32bytesDesignbybitcraze.iotoflycrazyfliesComment:NottooeasytoflyInTheBeginning,IScrewItUpTwoDifferentTypes,PAandNonPAInInthebeginning,therearetwotypesofcrazyradioItem1.CrazyradioPAItem2,Crazyradio(Obsolete)CrazyradioPAcomeswithextendedrange.1KMBitcrazenolongersellingcrazyradio,onlyPAmodelisavailableHowItAllStartedAtAtthebeginning,therearetwocrazyradioFlashingthe“PA”firmwareintothetheNON“PA”isabadideaSomehow,bootloaderbeenoverwrittenTheEndSolutionsCrazyradioCrazyradiowikisaysneedacompleteSPIflash1UnitBusPirate1Unit2x5PinsAlmoststablehand ToolsNeededWhatIsBusPirateItemItem1,version3.6Item2,version4Support1-Wire,I2C,SPI,JTAG,AsynchronousSerial,MIDIandetcSPIiswhatweneedSellsbyseeedsstudioandnotintaobaoThePerlScript/xwings/tuyaThedefectorstandardSPIflashingscriptforcrazyradio BeforeWeGoFurthernRF24LU1+BasedDeviceComesComeswithnRF24L01+2.4GHzRFtransceiverUSBConnectorExternalAntennaorPCBAntennanRF24LU1+SpecificationnRFnRF24LU1+2.4GHzRFtransceiverFullspeedUSB2.0compliantdevicecontroller8-bitmicrocontroller16or32kilobytesofflashmemoryUpto12MbpsairdatarateComeswithAESencryptionaccelerationFullSpecdocumentin:/xwings/tuya SavingCrazyradioSolderingCrazyradioCrazyradiocomeswithbreakoutpinSoldera2x5Pinintocrazyradio“Clipped”inBusPirateaccordinglyBewareofcrazyradiobreakoutpinsequenceProblem1:BootLoaderMissingDueDuetothe“PA”flashedintotheNON“PA”,itoverwritesthebootloaderAlmostbrokenPerlscriptnotabletoexecutecompletelyERASEALLmakesitallworseInfo:https://forum.bitcraze.io/viewtopic.php?t=323_TheBootLoaderTheThepossiblewayis,flashthebootloaderOncecompleted,flashthecrazyradiofirmwareBootLoder:/xwings/tuyaTheFinalError##gitclone/RFStorm/mousejack.git#cdmousejack#makeFlashthefirmwareintocrazyradioAlmostworkingPerlscriptnotworking,almostworkingandalmostbrokenThe“Broken”PerlScriptTheThePerlscriptisbrokenbydefaultunderVMReplaceallusleep(20000)tousleep(40000)CompletelyRe-implementedinpython:/xwings/tuyaDidImentionwithintwohoursRe-Flash BootLoaderFirmwareTwoTwohoursforthebootloaderTwohoursforthecrazyradiofirmwareTwohoursforthemousejackfirmwareOk,Maybetwohours.Iwentoutaftertheflashstarted EndisAnotherStartGoogleFoundThisWeWefoundsomeoneactuallytryingtoflycrazyflieswithLogitechunifydongleIfLogitechUnifydonglecompatiblewithcrazyradiofirmware,itmeans….https://hackaday.io/project/6741-crazyradio-for-cheapskatesWhatisLogitechUnifyingReceiverOneOneforall,allforone25RMBattaobaoIdentifyingthePinsMOSIMOSI-Pin11MISO-Pin13SCK-Pin10CS-PIN14AUX–Pin73V3-Pin1GND–AnyGNDWhatIsinLogitechUnifyingDongleOpenOpenupthecasingItcomeswithbreakoutPINS!FindtheGRDULTRASTABLEHANDSolderingBreakoutBreakoutPinsavetheworldSolderingallthePinaccordinglyConnectstoBUSPirateStartFlashingthebootloaderFlashMouseJackfirmwareRe-Flash BootloaderfirmwareTwoTwohoursforthebootloaderTwohoursforthecrazyradiofirmwareTwohoursforthemousejackfirmwareAgain,maybenottwohoursConnectConnecttoPCRunthescanner-worksRunthesniffer-worksReplayworks OneProblemLeftBusPirateBusBusPirateisexpensiveBacktobackorderLongwaitingtimeEXPENSIVE!!!We(Wo)Love(Da)China(TianChao)FirstBuyPAUnitIdentifyIdentifyallthe7PinsfromtheprogrammerandUSBdongleSolderingisneeded“Rainbow”connectorisneeded,bothfemaleSinglerowpinisneeded/PogoPin119RMB+40RMB=159RMBPinMappingFlashFlashwithpogopinComeswithSoftwareAllpinsareclear,exceptCSNneedstomaptoNSSConnectConnecttoPCAlignPogoPinsFlashRunthescanner-worksRunthesniffer-worksSecondBuy–NonPAUnitNoNoSolderingrequiredComeswithSoftware99RMBOnecompleteset,justlikebuyingamacThisshouldbetheNON-PAunitComputerComputerUSB->Programmer->Connector->BreakoutPins5SecondsFlashingEndbeforeyoustartDone!!!RunRunthescanner-worksRunthesniffer-works ConclusionCheapWay,EasyWay=GoodWayMadeMadeinChinaProgrammercanflashcrazyradioandLogitechUnifyingdongleEasytoget.StockalwaysavailableCheapandcheapandcheap OneMoreThingWhatIsMissingIsIstherereallywhyitcallMouseJack?OnlyMouseatthemoment?Possibletohijackakeyboard?HavingFunwithLogitechKeyboardMostMostpopularbrand,LogitechLetsseewhatisinLogitechKeyboardWhatWeKnowAESAES128bitencryptionbetweenkeyboardanddongleAbletodumpsomefunctionsFewprojectsdoingLogitechUnifyingKeyboard,suchassolaar.http://pwr.github.io/SolaarTimeistoolimitedandnothingmuchabletocapturefromthetraceSomeInfoonWirelessKeyboardMostMostofthemultimediakeyseemstobenotbeingencryptedNotenoughtoencryptallthekeys?WhatIf,KeyboardIsNotAvailableNoNoonewillbringawirelesskeyboardoutdoorSendinunencryptedkeystroketomousedongle?Yes,itworksSendi