Descriptions #109

jcstill · 2017-09-13T03:48:11Z

Added some descriptions about the backdoor shell commands

mame82

Hi, I have still no time to test and merge your commits.

Anyway thanks again for the effort, I put some comments on this one. You don't have to necessarily use them.

The only real error is in the description of SendDuckyScript

mame82 · 2017-09-13T15:45:42Z

hidtools/backdoor/P4wnP1.py

@@ -635,6 +635,9 @@ def do_GetClientProcs(self, line):
 		self.client_call_get_proc_list(waitForResult = True)

 	def do_shell(self, line):
+		'''
+		Start a shell inside the target computer


Spawns a "cmd.exe" process on the remote host and starts interaction. STDOUT and STDIN of the remote process are piped through the HID device (covert communication channel).
Appending powershell to the command, starts a powershell process instead. The Default is to use cmd.exe, as binding to STDOUT and STDIN of a PowerShell console host could fail (depending on the target's Windows Version). In case binding Fails, the OUTPUT doesn't get transmitted over the HID device. For this reason cmd.exe should be used in favor.

usage: shell <powershell>

mame82 · 2017-09-13T15:47:58Z

hidtools/backdoor/P4wnP1.py

@@ -827,6 +830,12 @@ def do_GetKeyboardLanguage(self, line):
 		print self.duckencoder.getLanguage()

 	def do_interact(self, line):
+		'''
+		Interact with processes on the target


Interaction is only possible with processes vreated by P4wnP1 (using CreateProc or shell).
For other (interactive) processes STDIN/STDERR/STDOUT couldn't be accessed

Interaction is only possible with processes vreated by P4wnP1

I am assuming this is not true for:
killproc

mame82 · 2017-09-13T15:52:03Z

hidtools/backdoor/P4wnP1.py

+		'''
+		Interact with processes on the target
+		Usage: Interact <process ID>
+


If the process id is omitted, a list of process IDs which allow interaction is shown.

Remark for future change:
I'm planning to change this in future, but I'm still unsure how:

A list of all processes is shown, including the Images (like 'cmd.exe')

A list of processes which allow interaction is shown, including Images + command line (like cmd.exe -c "powershell -c get-date"

Additionally, I plan to implement a menu to choose a process ID interactively.

mame82 · 2017-09-13T15:56:18Z

hidtools/backdoor/P4wnP1.py

@@ -851,11 +860,17 @@ def do_interact(self, line):
 		self.interactWithClientProcess(pid)

 	def do_exit(self, line):
+		'''
+		Exit the Backdoor payload to the pi's command-line
+		'''


This is maybe a good place to Highlight the intended user behavior:

The Server is running in a screen session, which can be detached using CTRL+A followed by D, in order to get access to the command line. In case one wants to interact with the backdoor again sudo Screen -d -r could be used (happens on SSH Login automatically).

The problem is, that this behavior isn't part of the backdoor server itself, but caused by the surrounding payload script, which starts P4wnP1.py in a separate screen session.

mame82 · 2017-09-13T15:58:01Z

hidtools/backdoor/P4wnP1.py

 		print "Exitting..."
 		# self.ll.stop() # should happen in global finally statement
 		sys.exit()

 	def do_state(self, line):
+		'''
+		See details about the target computer


Shows state of the connection through HID device.
At least at the Moment, the code to fill the client Information (PowerShell Version, target OS) has been removed right now.

mame82 · 2017-09-13T15:59:42Z

hidtools/backdoor/P4wnP1.py

@@ -866,6 +881,9 @@ def do_echotest(self, line):
 		self.client_call_echo(line)

 	def do_SendDuckyScript(self, line):
+		'''
+		Deploys a pre-compiled Ducky script saved in P4wnP1/duckyscrips/


The DuckyScript mustn't be precompiled. In fact this Approach is more flexible, as language could be Chosen according to thee target on-demand, while a precompiled script would have the language hardcoded.
According the language, maybe SetkeyboardLanguage command should be mentioned here.

I apologize. Bad wording on my part. I even knew it isn't pre-compiled.

mame82 · 2017-09-13T16:02:14Z

hidtools/backdoor/P4wnP1.py

 		print FileSystem.cd(line)

 	def do_lpwd(self,  line):
+		'''
+		Print the name of the Pi's current directory


Pi's current Directory

should be replaced with 'P4wnP1's current working directory'

same for lcd and lls

mame82 · 2017-09-13T16:05:36Z

hidtools/backdoor/P4wnP1.py

+		'''
+		Upload a file from the Pi to the target
+		Usage: upload <Pi/directory.filetype> <target/directory.filetype>
+		'''


First Parameter is mandatory, second one optional.

In case target filename is omitted, the source filename is used.
In case path is omitted, the current working directory is used (on both P4wnP1 and remote host)

mame82 · 2017-09-13T16:05:58Z

hidtools/backdoor/P4wnP1.py

+		'''
+		Download a file from the Pi to the target
+		Usage: download <target/directory.filetype> <Pi/directory.filetype>
+		'''


Same as do_upload

jcstill · 2017-09-13T17:30:08Z

Thanks for this...

I will take care of it when I get home in a couple hours

mame82 · 2017-09-13T19:23:31Z

No rush, I'm not able to work on the code the next days.

Added mame's comments as well as made the formatting more pleasant. I am not sure what the correct usage for `CreateProcs` is. also someone please review and correct my `SetKeyboardLanguage`

jcstill · 2017-09-13T23:23:45Z

Added some of mame's comments as well as made the formatting more pleasant.
I am not sure what the correct usage for CreateProcs is.
also someone please review and correct my SetKeyboardLanguage

mame82 · 2017-09-18T18:10:42Z

Sorry, I'vedone code changes to add in mouse support to P4wnP1 with SendMouseScript.
Have to check if these are reflected on merge (github shows no conflicts ... not sure on this)

jcstill · 2017-09-18T18:39:21Z

Will update when I get home.
Maybe @Swiftb0y could help?

Swiftb0y · 2017-09-18T20:21:50Z

I'm not sure were I could be helpful here. I'm currently only able to push changes in the Evening.

jcstill · 2017-09-18T20:28:10Z

oh ok. thanks anyways

Mouse Update

Added mouse descriptions Would someone also look at my languages and correct me? Thanks

jcstill · 2017-09-18T21:12:18Z

hidtools/backdoor/P4wnP1.py

@@ -918,6 +1020,14 @@ def do_SendDuckyScript(self, line):
 		self.duckencoder.outhidDuckyScript(script)

 	def do_SendMouseScript(self, line):


@mame82,

Am I correct to believe that keyboard language does not apply here?

Descriptions

8119c8a

Added some descriptions about the backdoor shell commands

mame82 reviewed Sep 13, 2017

View reviewed changes

Update P4wnP1.py

2b64259

Added mame's comments as well as made the formatting more pleasant. I am not sure what the correct usage for `CreateProcs` is. also someone please review and correct my `SetKeyboardLanguage`

jcstill added 2 commits September 18, 2017 13:57

Merge pull request #10 from mame82/master

8a69bea

Mouse Update

Mouse

8caa75a

Added mouse descriptions Would someone also look at my languages and correct me? Thanks

jcstill commented Sep 18, 2017

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Descriptions #109

Descriptions #109

jcstill commented Sep 13, 2017

mame82 left a comment

mame82 Sep 13, 2017

mame82 Sep 13, 2017

jcstill Sep 13, 2017

mame82 Sep 13, 2017

mame82 Sep 13, 2017

mame82 Sep 13, 2017

mame82 Sep 13, 2017

jcstill Sep 13, 2017

mame82 Sep 13, 2017

mame82 Sep 13, 2017

mame82 Sep 13, 2017

jcstill commented Sep 13, 2017

mame82 commented Sep 13, 2017

jcstill commented Sep 13, 2017

mame82 commented Sep 18, 2017

jcstill commented Sep 18, 2017

Swiftb0y commented Sep 18, 2017

jcstill commented Sep 18, 2017

jcstill Sep 18, 2017 •

edited

Loading

		@@ -918,6 +1020,14 @@ def do_SendDuckyScript(self, line):
		self.duckencoder.outhidDuckyScript(script)

		def do_SendMouseScript(self, line):

Descriptions #109

Are you sure you want to change the base?

Descriptions #109

Conversation

jcstill commented Sep 13, 2017

mame82 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jcstill commented Sep 13, 2017

mame82 commented Sep 13, 2017

jcstill commented Sep 13, 2017

mame82 commented Sep 18, 2017

jcstill commented Sep 18, 2017

Swiftb0y commented Sep 18, 2017

jcstill commented Sep 18, 2017

jcstill Sep 18, 2017 • edited Loading

Choose a reason for hiding this comment

jcstill Sep 18, 2017 •

edited

Loading