3 ms·

I've done pen testing in the past and I've made similar 'plugs' like this. It's quite simple to make one of these, all you need is a router that can run openwrt

I've done pen testing in the past and I've made similar 'plugs' like this. It's quite simple to make one of these, all you need is a router that can run openwrt and a case of some sort (pelican cases work nicely), tear it apart, flash it, paint the case and that's about it - total cost was about ~$100 + 2 hours of time and as an added bonus openwrt comes with a webui. Maybe this offers more...

nikcub 15y ago
Same. I built one in the late 90s as a pen test project. It only had network support, no wifi, but you could plug it in anywhere and it would arpflood and then passive listen for everything, before running through some rules on what to keep and then sending it back to a dump box (and saving it to disk). I was part way through setting it up to spoof as an active directory backup (or primary auth server) before we had the plug pulled. Did two real pentests with it. Went back to the client with a list of 90% of their passwords and hundreds of web account authentication details (shopping sites, email, amazon, slashdot, etc.). I'd love to build one again today. Battery powered and a lot smaller than what is seen in that Ars article. They would be so cheap that it wouldn't be worth retrieving - just letting them run for a week and being able to reverse shell into it to control it. Hacking an android phone would be good for this. remove the screen and get 10+ days of battery life of just the OS running (remove bluetooth, etc.). package it as something that looks innocent of place it under carper or in a void space in a wall.
dfc 15y ago
It is certainly easy to flash openwrt on a linksys router and throw it in a case. This thing may not be the best thing since sliced bread but lets be honest what you described is a far cry from what is being displayed here (which also has a webui). I am not affiliated with these guys but I am also not going to pretend that this is nothing more than a linksys and two hours on a Sunday. Does your $100 include 3G hardware? Or is it included in the $80 price tag that you mentioned in a different post downthread? Does your pelican case looks as innocuous as this thing does plugged into the wall at XYZ Corp? Do you think you could mod a vanilla openwrt installation to do the NAC/802.1x/RADIUS bypass in two hours? Do you already have a reliable/repeatable process to get through basic corporate IPS/FW and get a reverse shell? Can you rattle it off the top of your head right now? If not its going to be tough to implement in two hours...

nikcub 15y ago

Same. I built one in the late 90s as a pen test project. It only had network support, no wifi, but you could plug it in anywhere and it would arpflood and then passive listen for everything, before running through some rules on what to keep and then sending it back to a dump box (and saving it to disk). I was part way through setting it up to spoof as an active directory backup (or primary auth server) before we had the plug pulled. Did two real pentests with it. Went back to the client with a list of 90% of their passwords and hundreds of web account authentication details (shopping sites, email, amazon, slashdot, etc.). I'd love to build one again today. Battery powered and a lot smaller than what is seen in that Ars article. They would be so cheap that it wouldn't be worth retrieving - just letting them run for a week and being able to reverse shell into it to control it. Hacking an android phone would be good for this. remove the screen and get 10+ days of battery life of just the OS running (remove bluetooth, etc.). package it as something that looks innocent of place it under carper or in a void space in a wall.

dfc 15y ago

It is certainly easy to flash openwrt on a linksys router and throw it in a case. This thing may not be the best thing since sliced bread but lets be honest what you described is a far cry from what is being displayed here (which also has a webui). I am not affiliated with these guys but I am also not going to pretend that this is nothing more than a linksys and two hours on a Sunday. Does your $100 include 3G hardware? Or is it included in the $80 price tag that you mentioned in a different post downthread? Does your pelican case looks as innocuous as this thing does plugged into the wall at XYZ Corp? Do you think you could mod a vanilla openwrt installation to do the NAC/802.1x/RADIUS bypass in two hours? Do you already have a reliable/repeatable process to get through basic corporate IPS/FW and get a reverse shell? Can you rattle it off the top of your head right now? If not its going to be tough to implement in two hours...