::PWNIE EXPRESS::

Build your own PwnPad Workshop!

Pwnie Express - We make cool things!

Why build your own Pwn Pad? ● ●

● ●

Cheaper (this is for all you broke hackers!) Incredibly useful platform for penetration testing and auditing Makes you look cool Always good to get exposure to how flashing of any mobile device works – good intro to Android

What can you do with a PwnPad? ●

Wired/Wireless Assessments

●

Bluetooth Assessments

●

Physical Drop Test

●

Lots of things! We'll go over other use cases once we start building.

What we will cover: ●

Setting up the build environment

●

Building the PwnPad

●

Using the PwnPad

●

Demos!

What you will need ●

Google Nexus7 tablet (32GB 4G preferred)

●

USB OTG Cable

●

USB Flash Drive 4GB or larger

●

Linux Laptop (Ubuntu 12.04 or greater preferred)

●

PwnPad Image and install scripts

●

Android Fastboot and ADB tools

●

Network Connectivity (for build machine only)

Installing fastboot and ADB KALI Linux mkdir /opt/android && cd /opt/android echo "deb-src http://debian.ens-cachan.fr/ftp/debian/ sid main contrib non-free" >> /etc/apt/sources.list apt-get update apt-get -y build-dep android-tools apt-get -y source --build android-tools dpkg -i android-tools-*.deb cd ~ rm -rf /opt/android sed -i 's/.*cachan\.fr.*//' /etc/apt/sources.list

Setting up your build environment: ●

●

● ● ● ●

(If not running Ubuntu 12.04) Install Android Tools – fastboot and adb Download the PwnPad Image available here: http://pwnieexpress.com/pages/community-downloads Or get it from us on a flash drive Extract Image and build script Copy Image (TWRP folder) to root of USB drive Chmod script, run build script and follow directions

Extract Image and build script: 1. Open root shell 2. Extract image: tar -jxvf pwnpad*.tar.bz2 3. Copy TWRP folder to root of USB drive: cp -R TWRP /media/usb1/ 4. Chmod build script, run build script: cd pwnpad_build_script/ chmod +x flash_pwnpad.sh ./flash_pwnpad.sh 5. Follow directions on screen!

WARNING! This installation process will permanently erase all data on your Nexus tablet device! Any data you wish to preserve should be backed up to an external system or hard drive before proceeding!

Flashing your Nexus 7 ●

Boot your Nexus 7 into Fastboot mode –

Power on the Nexus7 while holding Volume Down

Flashing your Nexus 7 ●

Follow the on-screen instructions! –

The flashing process can be restarted at any time

Unlock the bootloader – press power button

Flashing your Nexus 7 - TWRP

Flashing your Nexus 7 ●

● ●

Connect the USB drive to the OTG cable and plug it into the Nexus 7 Click Restore If “PwnPadv0a” doesn't immediately show up, click the back arrow and then re-click the Restore button

●

Click “pwnpadv0a”

●

Slide the slide to the right

Flashing your Nexus 7 ●

●

Once the flashing has completed, you will be prompted to “Reboot” Hold down the Volume Down button and select reboot –

●

●

This will bring you back to the Fastboot screen

Remove the OTG cable and plug the Nexus 7 back into the mini-USB cable conencted to your laptop Hit Enter in terminal window for script to finish

Once Your Pad is Built: DO NOT RUN ANDROID UPDATE! IT WILL BREAK EVERYTHING! ●

Open RootShell icon and hit enter, enter, enter, then type yes, and hit enter.

●

Connect to wireless for Internet access

●

Update PwnPad with the following cmd:

wget -O - http://pub.pwnieexpress.com/updates/pwn_pad/latest.sh | /bin/bash

Recommended Android Apps: Astro File Manager ● USB OTG Helper ● Android SSH (if you want SSH access to Android) ● Fing – great Android tool for quick network scans ● Droidwall (android firewall) ●

Wireless Tools: ●

Aircrack-NG 1.1 r2245

●

Kismet (New Core with Ubertooth support)

●

Wifite-2

●

Reaver

●

MDK3

●

EAPeak

●

Asleap-2.2

●

FreeRADIUS-WPE

●

Hostapd - Karma Patched

●

Bluetooth Toolsuite: bluez-utils, btscanner, bluelog

●

Ubertooth toolsuite

●

Proxmark3 Support (RFID sniffing/replaying)

●

Kisbee (Zigbee sniffing with Dragorns device)

Network Tools: ●

●

●

●

NET-SNMP (snmpwalk, snmpget, etc) Nmap

●

Macchanger

●

●

●

●

Hamster and Ferret

●

Metasploit 4

●

SET

Cryptcat Hping3

●

SSLstrip v9

Netcat

●

●

●

Tcpdump Tshark

●

●

John (JTR)

●

Hydra

●

Medusa 2.1.1

●

Pyrit

●

Scapy

Ngrep Dsniff Ettercap-ng 7.5.3 Assimilation

Easy-Creds v3.7.3 (custom modified)

Web Tools: ●

Nikto

●

Wa3f

PwnPad Adapters TP-Link 80211n - Atheros chipset ● Sena UD100 Bluetooth ● Trednet USB-Ethernet ●

Other Supported Adapters: (Not included) ● ● ● ● ●

Ubertooth Proxmark3 Kisbee (Dragorns Zigbee device) USB flash drives USB keyboard and mice

Capabilities and Use Cases: ●

Wireless and Wired Assessments

●

Rapid deployment

●

Bluetooth Assessments

●

Physical Drop test

●

Physical Penetration Tests

Wireless Assessments ●

Wireless Site Survey tool

●

Rouge AP/Device tracker

●

Passive Wireless Recon

●

Wireless client auditing (find vulnerable wireless clients

●

WEP/WPA cracking

●

RADIUS Security Testing

Bluetooth Assessments ●

Visablitity into your Bluetooth environment

●

Device Identity tracking and recon

●

Ubertooth Applications

●

Bluetooth Pentesting

Physical Drop Test ● ●

Plug into the wired network and walk away Remote Access via the out-of-band 4G connection

●

Data Exfiltration testing

●

Firewall Perimeter Testing

Other Use cases ●

On the fly Social Engineering attacks

●

MiTM to the MAX !!

●

Exploiting Vulnerable Systems

●

Showing Upper management why security is important

In Closing ●

Rapid Deployment

●

Pentesting on the Fly

●

Wireless Awareness

●

Finger Printing Devices

●

Virtual Identities

Thank You! Contact: awk[at]pwnieexpress.com kevin[at]pwnieexpress.com Irc: Freenode #pwnieexpress http://pwnieexpress.com