Computers blindly trust USB devices connected to them. There’s no pop-up to confirm a device was plugged in, and no validation of whether the device should be trusted. This lets you do some nefarious things with a simple USB microcontroller.
We’ve recently seen two examples of this: the USBdriveby and the Teensyterpreter. Both devices are based on the Teensy development board. When connected to a computer, they act as a Human Interface Device to emulate a keyboard and mouse.
The USBdriveby targets OS X. When connected, it changes the DNS server settings to a custom IP, to allow for DNS spoofing of the victim’s machine. This is possible without a password through the OS X System Preferences, but it requires emulating both keystrokes and clicks. AppleScript is used to position the window in a known location, then the buttons can be reliably clicked by code running on the Teensy. After modifying DNS, a reverse shell is opened using netcat. This allows for remote code execution on the machine.
The Teensyterpreter gives a reverse shell on Windows machines. It runs command prompt as administrator, then enters a one-liner to fire up the reverse shell using Powershell. The process happens in under a minute, and works on all Windows versions newer than XP.
With a $20 microcontroller board you can quickly fire up remote shells for… “support purposes”. We’d like to see the two projects merge into a single codebase that supports both operating systems. Bonus points if you can do it on our Trinket Pro. Video demos of both projects after the break.
Continue reading “Plug Into USB, Get a Reverse Shell”
When implementing USB on a microcontroller, most people are going to reach for V-USB if they’re using an AVR, one of Microchip’s USB libraries if a PIC is involved, or any number of the USB libraries for various ARM processors. [Kevin] had a different idea. As a challenge to himself, he wrote a USB device driver for the Teensy 3.1 microcontroller board, getting as close to the bare metal as he could get.
Writing a USB device driver first required a literature review. There are a few peculiarities in the Freescale K20 family of microcontrollers – the one found in the Teensy 3.1 – that dictate the need for a specific memory layout, using several clocks, and handling all the USB descriptors. [Kevin] started with the clocks, every last one of which must be enabled. The clock is generated by the Multipurpose Clock Generator from a 16MHz crystal, PLL’ed to the frequencies the USB module needs, and sent out over the System Integration Module.
Following the flowcharts and sequences found in the Freescale reference guide told [Kevin] exactly what needed to be done with the startup sequence, and offered a few suggestions on what needed to be done to set up all the interrupts. [Kevin] spent an incredible amount of time documenting, programming, and smashing his head against the keyboard for this tutorial, but he does give everyone a great opportunity to learn from his struggles.
While [Kevin] has a mostly complete USB device driver, his work is far from done. That’s alright, because this project wasn’t meant to be a full-featured driver; it’s still missing real error handling, strings in the configuration, and a real VID/PID. That’s alright, it’s still a great exercise in building something from scratch, especially something that very few people have built successfully.
Oh, blatant Hackaday Store plug for the Teensy 3.1.
Years ago, [Greg] got a Wacom Artpad II graphics tablet through Freecycle. What’s the catch, you ask? The stylus was long gone. When he found out how expensive a direct replacement would be, the tablet was laid to rest in his spare parts box. Fast forward a few years to the era of the phone-tablet hybrid and [Greg]’s subsequent realization that some of them use Wacom stylii. Eight bucks later, he’s in business, except that the tablet is serial. Wacom no longer supports serial tablets, so he had to convert it to USB.
With the help of the WaxBee project and a Teensy 2.0, he would be able to emulate an Intuous2 tablet by sniffing and re-encoding the packets. Things got a little hairy when he went under the hood to remove the ADM202 TTL-to-RS232 chip with a Dremel—he accidentally gouged some of the pads it sat on as well as a few of the traces. Feeling frustrated, [Greg] took some high-res pictures of the board and posted them to a message board. As it turns out, those pictures helped him recreate the traces and get the tablet running. A little big of glue and tape later, he was in business. [Greg] even gave himself access to reprogram the Teensy.
[jimmayhugh] is a homebrewer and has multiple fermentation chambers and storage coolers scattered around his home. Lucky him. Nevertheless, multiple ways of making and storing beer requires some way to tell the temperature of his coolers and fermenters. There aren’t many temperature controllers that will monitor more than two digital thermometers or thermocouples, so he came up with his own. It’s called TeensyNet, and it’s able to monitor and control up to 36 1-wire devices and ties everything into his home network.
Everything in this system uses the 1-Wire protocol, a bus designed by Dallas Semiconductor that can connect devices with only two wires; data and ground. (To be a fly on the wall during that marketing meeting…) [jimmay] is using temperature sensors, digital switches, thermocouples, and even a graphic LCD with his 1-wire system, with everything controlled by a Teensy 3.1 and Ethernet module to push everything up to his network.
With everything connected to the network, [jimmay] can get on his personal TeensyNet webpage and check out the status of all the devices connected to any of his network controllers. This is something the engineers at Dallas probably never dreamed of, and it’s an interesting look at what the future of Home Automation will be, if not for a network connected relay.
Solar panels are a great, sustainable addition to your home’s energy scheme. They’re bound to get dirty, but they can’t withstand harsh chemicals and still be effective. While there are companies that will come out and clean your installation a few times a year, the service is a recurring cost that adds up quickly. With Scrobby, his entry into The Hackaday Prize, [Stefan] sought to build a highly affordable and sustainable solution that, after installation, requires no dangerous trips back up to the roof.
Scrobby is solar-powered and cleans using rainwater. The user can set and alter the cleaning schedule over Bluetooth from their phone. [Stefan]’s prototype was built around a Teensy 3.0, but he will ultimately use custom boards based on the Freescale KL26. In addition to the Bluetooth module, there are six ultrasonic sensors, rain and temperature sensors, and motor-driven spools for tethered movement.
Make the jump to see Scrobby get his prototype bristles installed and show off his abilities in [Stefan]’s demo video. To register for updates, check out Scrobby’s website. If you hurry, you can donate to Scrobby’s Kickstarter campaign. The question is, who will clean Scrobby’s solar panels?
This project is an official entry to The Hackaday Prize that sadly didn’t make the quarterfinal selection. It’s still a great project, and worthy of a Hackaday post on its own.
Continue reading “Scrobby’s on Your Roof, Cleaning Your Solar Panels”
A staple of every recording studio today, the Akai MPC began as a simple sampling groove box in the early 90s. The form factor of a few force sensitive pads assignable to different samples should be familiar to anyone with a little bit of MIDI gear, but these are rarely custom-made devices. Now, it runs on a Teensy. [Michele] created his own MPC-style MIDI pad controller with the Teensy 3.0, the Teensy audio adapter board, and an ingenious PCB design that uses replacement MPC pads.
[Michele]’s MPC was first featured in the MIDI hacklet, but back then the only working component was the pads themselves. The velocity sensitive pads are made of two copper traces laid on a single acetate sheet. A bit of Velostat is glued to the back of the pad so when the pad is pressed, it contacts both of the traces. The harder the pad is pressed, the lower the impedance, and with everything sent to an analog pin, each pad becomes a force sensitive resistor.
With the key feature of an MPC taken care of, [Michele] turned his attention to the sampling and software of his device. The new Teensy 3.0 audio adapter board – and a great new library – takes care of everything. [Michele] doesn’t have a proper video of his MPC up yet, but he was able to film a random guy playing his machine at Rome Maker Faire yesterday. You can check that out below.
Continue reading “The Teensy Becomes an MPC”
There are a few ways of playing .WAV files with a microcontroller, but other than that, doing any sort of serious audio processing has required a significantly beefier processor. This isn’t the case anymore: [Paul Stoffregen] has just released his Teensy Audio Library, a library for the ARM Cortex M4 found in the Teensy 3 that does WAV playback and recording, synthesis, analysis, effects, filtering, mixing, and internal signal routing in CD quality audio.
This is an impressive bit of code, made possible only because of the ARM Cortex M4 DSP instructions found in the Teensy 3.1. It won’t run on an 8-bit micro, or even the Cortex M3-based Arduino Due. This is a project meant for the Teensy, although [Paul] has open sourced everything and put it up on Github. There’s also a neat little audio adapter board for the Teensy 3 with a microSD card holder, a 1/8″ jack, and a connector for a microphone.
In addition to audio recording and playback, there’s also a great FFT object that will split your audio spectrum into 512 bins, updated at 86Hz. If you want a sound reactive LED project, there ‘ya go. There’s also a fair bit of synthesis functions for sine, saw, triangle, square, pulse, and arbitrary waveforms, a few effects functions for chorus, flanging, envelope filters, and a GUI audio system design tool that will output code directly to the Arduino IDE for uploading to the Teensy.
It’s really an incredible amount of work, and with the number of features that went into this, we can easily see the quality of homebrew musical instruments increasing drastically over the next few months. This thing has DIY Akai MPC/Monome, psuedo-analog synth, or portable effects box written all over it.