Skip to content
This repository has been archived by the owner on Jul 15, 2024. It is now read-only.

important file changes #4

Merged
merged 25 commits into from
Apr 3, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 8 additions & 6 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,9 @@
A physical pentesting toolkit on a regular Raspberry Pi Pico.

### Intro
The Raspberry Pi Pico is a flexible microcontroller board designed for multiple purposes. With this project I intend to use make a powerful Keystroke Injection tool for such an intricate board with a special purpose. It is designed to be easy to configure, modify, and use for fun. This will be designed to be a little more than a *Bad USB*. Instead of being a basic, high level program on a Pico, we build firmware designed for this purpose.
You've probably seen other similar tools for other MCU's and SBC's, such as the ESP32 Marauder, ESP8266 Deauther, P4wnP1 A.L.O.A, PocketPhishr, Pwnagotchi, etc. Although these are all very good projects, there hasn't been much talk regarding the Raspberry Pi Pico becoming a good tool in the right hands.

The Raspberry Pi Pico is a flexible microcontroller board designed for multiple purposes. With this project, I intend to use make a powerful Keystroke Injection tool for such an intricate board with a special purpose. It is designed to be easy to configure, modify, and use for fun. This will be designed to be a little more than a *Bad USB*. Instead of being a basic, high-level program on a Pico, we build firmware designed for keystroke injection.

### Development progress
This [project](https://github.com/users/dj1ch/projects/3) showcases my progress thus far.
Expand All @@ -20,24 +22,24 @@ Unlike your usual *Bad USB*, the setup is a lot more complex.

3. Your config must be edited to allow the script to be run on startup after editing it, using the shell or your computer.

**Before asking to install, this is merely a blueprint for what I will be working on for the next couple weeks!**
**Before asking to install, this is merely a blueprint for what I will be working on for the next couple of weeks!**

### The shell

The shell allows you to do a fair share of things with the board, allowing you to make it look like a USB drive by blinking the LED, checking board stats, and the testing of payloads. I plan on making this a very small "OS" for the Pico to do basic things.
The shell allows you to do a fair share of things with the board, allowing you to make it look like a USB drive by blinking the LED, checking board stats, and testing of payloads. I plan on making this a very small "OS" for the Pico to do basic things.

### FAQ

**How long will it be until a release?**

Most of the changes haven't been tested and it is yet to work as intended. This might take a while depending on how long it will take to implement the wanted feature(s). Most likely this will all be finalized sometime around March/April 2024
Most of the changes haven't been tested and it is yet to work as intended. This might take a while depending on how long it will take to implement the wanted feature(s). Most likely this will all be finalized sometime around late April 2024

**Can it do things other than Keystroke injection?**

It's pretty bare bones right now, it has a work in progress text editor, to build the scripts on the board without having to worry about editing the files on your own computer, along with being able to test scripts on the device it is plugged into. Unless we can implement some way to control GPIO over the shell, it does only keystroke injection. The OS itself is minimal and can only do so much.
It's pretty bare bones right now, it has a work-in-progress text editor, to build the scripts on the board without having to worry about editing the files on your computer, along with being able to test scripts on the device it is plugged into. Unless we can implement some way to control GPIO over the shell, it does only keystroke injection. The OS itself is minimal and can only do so much.

### Contributing

TBA, will add contributing guidelines soon
TBA will add contributing guidelines soon

**Made with :heart: by [@dj1ch](https://github.com/dj1ch)**
34 changes: 34 additions & 0 deletions pico-key/boot.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
/**
* boot.c
* "bootup" process to run after the firmware is loaded
*/

#include "boot.h"

int boot() {
// boot logo
char coolArt[] = "pico-key...";
char author[] = "by dj1ch";

// print this ^^
printf("\n%s\n", coolArt);

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
sleep(1);
printf("%s\n", author);

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected

// board info
boardInfo();

if (config.run_on_startup) {
read();
return 0;
} else {
// do nothing
}
}

void boardInfo() {
// we can only really print memory here
printf("\nBoard info:\n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
printf(malloc_stats() + " bytes");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
printf(checkConfig());

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
}
16 changes: 16 additions & 0 deletions pico-key/boot.h
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
/**
* boot.h
* headers for boot.c
*/

#ifndef BOOT_H
#define BOOT_H

#include "config.h"
#include "pico/stdio.h"
#include "pico/malloc.h"

int boot();
void boardInfo();

#endif // BOOT_H
14 changes: 14 additions & 0 deletions pico-key/config.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
/**
* config.c
* configuration related things in a source file
*/

#include "config.h"

void checkConfig(const Configuration& config) {
printf("\nCurrent Config: \n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
printf("LED Pin definition: %d\n", config.led_pin);

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
printf("Payload location: %s\n", config.payload_location.c_str());

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
printf("Run on startup: %s\n", config.run_on_startup ? "true" : "false");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
printf("Current version: %s\n", config.version.c_str());

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
}
22 changes: 16 additions & 6 deletions pico-key/config.h
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,22 @@
#ifndef CONFIG_H
#define CONFIG_H

// configuration parameters
#include <string>
#include "pico/stdio.h"

// default config params
#define LED_PIN PICO_DEFAULT_LED_PIN
#define PAYLOAD_LOCATION "/payload.dd"
#define RUN_ON_STARTUP true
#define DEFAULT_PAYLOAD_LOCATION "/payload.dd"
#define DEFAULT_RUN_ON_STARTUP true

// configuration structure
struct Configuration {
int led_pin;
std::string payload_location;
bool run_on_startup;
std::string version;
};

// version
#define VERSION "0.1.0-alpha\n"
void checkConfig();

#endif // CONFIG_H
#endif // CONFIG_H
38 changes: 38 additions & 0 deletions pico-key/duckyscript.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
/**
* duckyscript.c
* this handles the commmands and the hid
*/

#include "duckyscript.h"

// run a duckyscript command based on what is in duckyscript.h
int run(const char* command) {

return 0;
}

// crap i gotta build a new compiler for this :/
void read(const char* filePath) {
FILE *file = fopen(filePath, "r");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected

if (file == NULL) {
perror("Can't open '%s' :/", filePath);
return;
}

char line[256];
while (fgets(line, sizeof(line), file)) {
char *command = strtok(line, " \t\n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected

char *param = strtok(NULL, "\n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
while (param && strtok(NULL, "\n")) {

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
strcat(command, " ");

Check failure

Code scanning / devskim

If the combination of strings is larger than the destination buffer, strcat will cbuffer overflow the destination buffer Error

Banned C function detected (strcat)
strcat(command, param);

Check failure

Code scanning / devskim

If the combination of strings is larger than the destination buffer, strcat will cbuffer overflow the destination buffer Error

Banned C function detected (strcat)
param = strtok(NULL, "\n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
}

run(command);
}

fclose(filePath);
}
123 changes: 123 additions & 0 deletions pico-key/duckyscript.h
Original file line number Diff line number Diff line change
@@ -0,0 +1,123 @@
/**
* duckyscript.h
* define duckyscript in C...?
*/

#ifndef DUCKYSCRIPT_H
#define DUCKYSCRIPT_H

#include <string>
#include "pico/stdio.h"

// control keys
#define WINDOWS 0x08
#define GUI 0x10
#define APP 0x20
#define MENU 0x40
#define SHIFT 0x80
#define ALT 0x40
#define CONTROL 0x20
#define CTRL 0x20

// arrows
#define DOWNARROW 0x51
#define DOWN 0x51
#define LEFTARROW 0x50
#define LEFT 0x50
#define RIGHTARROW 0x4F
#define RIGHT 0x4F
#define UPARROW 0x52
#define UP 0x52

// other keys
#define BREAK 0x48
#define PAUSE 0x48
#define CAPSLOCK 0x39
#define DELETE 0x4C
#define END 0x4D
#define ESC 0x29
#define ESCAPE 0x29
#define HOME 0x4A
#define INSERT 0x49
#define NUMLOCK 0x53
#define PAGEUP 0x4B
#define PAGEDOWN 0x4E
#define PRINTSCREEN 0x46
#define ENTER 0x28
#define SCROLLLOCK 0x47
#define SPACE 0x2C
#define TAB 0x2B
#define BACKSPACE 0x2A

// abc's
#define A 0x04
#define B 0x05
#define C 0x06
#define D 0x07
#define E 0x08
#define F 0x09
#define G 0x0A
#define H 0x0B
#define I 0x0C
#define J 0x0D
#define K 0x0E
#define L 0x0F
#define M 0x10
#define N 0x11
#define O 0x12
#define P 0x13
#define Q 0x14
#define R 0x15
#define S 0x16
#define T 0x17
#define U 0x18
#define V 0x19
#define W 0x1A
#define X 0x1B
#define Y 0x1C
#define Z 0x1D

// f keys
#define F1 0x3A
#define F2 0x3B
#define F3 0x3C
#define F4 0x3D
#define F5 0x3E
#define F6 0x3F
#define F7 0x40
#define F8 0x41
#define F9 0x42
#define F10 0x43
#define F11 0x44
#define F12 0x45

// mouse actions
typedef enum {
MOUSE_MOVE,
CLICK,
RIGHT_CLICK,
MIDDLE_CLICK
} mse;

// keyboard actions
typedef enum {
PRESS_KEY,
RELEASE_KEY
} key;

// mouse commands
typedef struct {
mse action;
int x;
int y;
} mseCommand;

// keyboard commands
typedef struct {
key action;
char key;
} keyCommand;

void run();

#endif // DUCKYSCRIPT_H
36 changes: 36 additions & 0 deletions pico-key/easter-egg.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
/**
* egg.c
* maybe this is an easter egg ;)
*/

#include "easter-egg.h"

void specialMessage() {
printf("\nWhat did you expect to be here???\n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
printf("\nAnyway, wanna play a game? (Y/N) > ");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected

char* specialChoice[10];

fgets(specialChoice, sizeof(specialChoice), stdin);
specialChoice[strcspn(specialChoice, "\n")] = '\0';

for (int i = 0; specialChoicep[i]; i++) {
specialChoice[i] = toupper(specialChoice[i]);
}

if (strcmp(specialChoice, "Y") == 0) {
continue;
} else if (strcmp(specialChoice, "N") == 0) {
break;
} else {
printf("%s: Not a valid response\n", specialChoice);

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
continue;
}

// cool game
game();
}

void game() {

}
16 changes: 16 additions & 0 deletions pico-key/easter-egg.h
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
/**
* egg.h
* special header?
*/

#ifndef EASTER_EGG_H
#define EASTER_EGG_H

#include "pico/stdio.h"

char* specialChoice[10];

void specialMessage();
void game();

#endif // EASTER_EGG_H
Loading
Loading