Plug Into USB, Get a Reverse Shell

Computers blindly trust USB devices connected to them. There’s no pop-up to confirm a device was plugged in, and no validation of whether the device should be trusted. This lets you do some nefarious things with a simple USB microcontroller.

We’ve recently seen two examples of this: the USBdriveby and the Teensyterpreter. Both devices are based on the Teensy development board. When connected to a computer, they act as a Human Interface Device to emulate a keyboard and mouse.

The USBdriveby targets OS X. When connected, it changes the DNS server settings to a custom IP, to allow for DNS spoofing of the victim’s machine. This is possible without a password through the OS X System Preferences, but it requires emulating both keystrokes and clicks. AppleScript is used to position the window in a known location, then the buttons can be reliably clicked by code running on the Teensy. After modifying DNS, a reverse shell is opened using netcat. This allows for remote code execution on the machine.

The Teensyterpreter gives a reverse shell on Windows machines. It runs command prompt as administrator, then enters a one-liner to fire up the reverse shell using Powershell. The process happens in under a minute, and works on all Windows versions newer than XP.

With a $20 microcontroller board you can quickly fire up remote shells for… “support purposes”. We’d like to see the two projects merge into a single codebase that supports both operating systems. Bonus points if you can do it on our Trinket Pro. Video demos of both projects after the break.

Continue reading “Plug Into USB, Get a Reverse Shell”

Brother Builds “Zerg-Berg” Coffee Table Media Server – 38(!) USB Drives

After [Travis]’s media server died a couple months ago, his brother [Nick] secretly plotted to replace it for Christmas. Admitting it to be an “asinine Rube Goldberg” arrangement, [Nick] wanted something custom and remarkable for his sibling. Rather than go the normal SATA route, 38 USB hot-swap laptop drives were clustered together inside a custom leather enclosure with a bronzed glass top.

[Nick] picked up 45 of the 500GB drives for only $350 and designed the project around those. He spent $1000 on matching metal docks for each of them, powered by $800 worth of PCIe quad independent USB controllers – no hubs. A $550 Xeon motherboard with 14 USB ports, 16GB of RAM, a basic video card and a 1000W power supply rounded out the electronics.

Under Windows 8.1 all drives are arranged in a single giant array under Storage Spaces, no raid.

Everything was built into a wood-framed coffee table wrapped in high-end leather that [Nick] spent 65 hours hand stitching himself. Fancy brass corner braces hold the frame square. All the wires were run underneath the table so the visible surfaces are clean and clear. The table structure is lifted up on legs made from half-inch square barstock bent into a hairpin and bolted to the underside.

All together [Travis]’s Zerg-Berg media server cost in the range of $4500. [Nick] intends it to be something that lasts him a very long time.

See the video below for [Nick]’s rationalization explanation of the hardware and methods chosen.

Continue reading “Brother Builds “Zerg-Berg” Coffee Table Media Server – 38(!) USB Drives”

USB On The Teensy 3 From The Ground Up

When implementing USB on a microcontroller, most people are going to reach for V-USB if they’re using an AVR, one of Microchip’s USB libraries if a PIC is involved, or any number of the USB libraries for various ARM processors. [Kevin] had a different idea. As a challenge to himself, he wrote a USB device driver for the Teensy 3.1 microcontroller board, getting as close to the bare metal as he could get.

Writing a USB device driver first required a literature review. There are a few peculiarities in the Freescale K20 family of microcontrollers – the one found in the Teensy 3.1 – that dictate the need for a specific memory layout, using several clocks, and handling all the USB descriptors. [Kevin] started with the clocks, every last one of which must be enabled. The clock is generated by the Multipurpose Clock Generator from a 16MHz crystal, PLL’ed to the frequencies the USB module needs, and sent out over the System Integration Module.

Following the flowcharts and sequences found in the Freescale reference guide told [Kevin] exactly what needed to be done with the startup sequence, and offered a few suggestions on what needed to be done to set up all the interrupts. [Kevin] spent an incredible amount of time documenting, programming, and smashing his head against the keyboard for this tutorial, but he does give everyone a great opportunity to learn from his struggles.

While [Kevin] has a mostly complete USB device driver, his work is far from done. That’s alright, because this project wasn’t meant to be a full-featured driver; it’s still missing real error handling, strings in the configuration, and a real VID/PID. That’s alright, it’s still a great exercise in building something from scratch, especially something that very few people have built successfully.

Oh, blatant Hackaday Store plug for the Teensy 3.1.

PeriUSBoost: A DIY USB Battery Pack

If you travel often, use your mobile devices a lot, or run questionable ROMs on your phone, you likely have an external USB battery pack. These handy devices let you give a phone, tablet, or USB powered air humidifier (yes, those exist) some extra juice.

[Pedro]’s PeriUSBoost is a DIY phone charging solution. It’s a switching regulator that can boost battery voltages up to the 5 volt USB standard. This is accomplished using the LTC3426, a DC/DC converter with a built in switching element. The IC is a tiny SOT-23 package, and requires a few external passives work.

One interesting detail of USB charging is the resistor configuration on the USB data lines. These tell the device how much current can be drawn from the charger. For this device, the resistors are chosen to set the charge current to 0.5 A.

While a 0.5 A charge current isn’t exactly fast, it does allow for charging off AA batteries. [Pedro]’s testing resulted in a fully charged phone off of two AA batteries, but they did get a bit toasty while powering the device. It might not be the best device to stick in your pocket, but it gets the job done.

12 Mbps Communication Between A PC and MCU

The world of hobby electronics have only started putting USB in projects for the last few years, and right now, pushing 1.5 Mbps down a USB port is good enough for most cases. This isn’t true for all cases; that’s a terrible data rate, really, and to get the most out of a USB connection, you can at least move up to USB Full Speed and 12 Mbps.

[Linas] is using the STM32F4 microcontroller for this example, an extremely large and very capable chip. [Linas] is using FTDI’s FT2232D USB UART to send data from an SPI port over USB. This chip does support 12 Mbps, but only after a few additions; an external EEPROM must be connected to the FTDI chip to provide a USB 2.0 device descriptor, otherwise the connection between the microcontroller and a computer is limited to 1.5 Mbps. Even using the USB on the STM32 would be a bottleneck in this case; [Linas] is moving data out of the processor using only the DMA controller – using the USB on the STM32 would eat up processor cycles in the microcontroller.

Thanks to the DMA controller inside the STM32, the microcontroller is capable of sending and receiving data through SPI at the same time. The STM32 is capable of reading and writing to the Tx and Rx buffer at the same time, but the computer is only capable of half-duplex operation – it can only read or write at any one time. [Linas] is setting up the DMA controller on the STM32 as a circular mode, putting everything in the buffer into the FTDI chip, and reading everything sent from the computer back into the STM32’s memory. After counting off the correct number of packets. the controller resets everything, moves the circular buffer back to the beginning, and starts the whole process over again.

The circuit was prototyped with an STM Discovery board. With Labview, [Linas] can see the bits coming out of the microcontroller, and send some bits back to the micro over USB. [Linas] has an extraordinarily detailed video tutorial on this project. You can check that out below.

Continue reading “12 Mbps Communication Between A PC and MCU”

Finding a Cheaper USB to Serial Chips

FTDI-gate wasn’t great for anybody, and now with hardware hobbyists and technological tinkerers moving away from the most popular USB to serial adapter, some other chip has to fill the void. The cheapest USB to serial chip on the market appears to be the CH340G, available for 20-40 cents apiece from the usual retailers. There is, however, almost no English documentation, and the datasheet for the CH340 family doesn’t include this chip. [Ian]’s here to help you out. He got his mitts on a few of these chips and managed to figure out the pinout and a few reference schematics. He even made an Eagle part for you. Isn’t that nice?

The CH340 series of chips do exactly what you would expect them to do: a full-speed USB device that emulates a standard serial interface, with speeds from 50bps to 2Mpbs. The chip supports 5V and 3.3V, and all the weird modem lines are supported. This chip even has an IrDA mode, because wireless communication in the 90s was exactly as rad as you remember.

With [Ian]’s help, we now have a cheap source of USB to serial chips. If you need the datasheet, here you go. The driver is a bit more difficult to find, but what you’re looking for is the CH341 family of chips. That can be found with a little bit of Google fu.

$15 Car Stereo Bluetooth Upgrade

We’ve seen all sorts of ways to implement Bluetooth connectivity on your car stereo, but [Tony’s] hack may be the cheapest and easiest way yet. The above-featured Bluetooth receiver is a measly $15 over at Amazon (actually $7.50 today—it’s Cyber Monday after all) and couldn’t be any more hacker-friendly. It features a headphone jack for plugging into your car’s AUX port and is powered via USB.

[Tony] didn’t want the receiver clunking around in the console, though, so he cracked it open and went about integrating it directly by soldering the appropriate USB pins to 5V and GND on the stereo. There was just one catch: the stereo had no AUX input. [Tony] needed to rig his own, so he hijacked the CD player’s left and right audio channels (read about it in his other post), which he then soldered to the audio output of the Bluetooth device. After shoving all the bits back into the dashboard, [Tony] just needed to fool his stereo into thinking a CD was playing, so he burned a disc with 10 hours of silence to spin while the tunes play wirelessly. Nice!