For over a year my free time has been spent turning this ‘LilyGo T-Dongle S3’ into hacking tool USB/WiFi/BT which I’ve named the USB Army Knife.

This device is cheap, tiny, has a screen, SPI port, button and can do a ton of stuff with the ESP32-S3 inside.

It has consumed me! 🧵 Lily go T dongle S3
First up look at that hidden micro SD card slot. With that kind of storage and the fact it’s so cheap it’s throwaway you can start planning attacks that live a long time.

The ESP32 inside has a full USB stick and can do your usual BadUSB/HID and run attacks. BUT… Image
ESP32 has a decent WiFi/BT stack which already has a load of attacks courtesy of ESP32 Marauder.

If only someone would integrate that and USB ducky functionality Image
Well that’s what I did. I also threw in USB networking so you can PCAP the device when you plug in and save it to the SD card.

Then I thought wouldn’t a nice web interface be grand. Basically I didn’t stop.
And here it is, expect me to bang on about this for a while because I don’t think there’s anything like it.

Oh it’s also got a agent with serial only comms. It can grab the screen for you which you view over the ESP32’s devices WiFi.

github.com/i-am-shodan/US…
Oh god, put the bad grammar down to my excitement

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with 丂卄ㄖᗪ卂几 - 👋 crack fingers

丂卄ㄖᗪ卂几 - 👋 crack fingers Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @therealshodan

Mar 31, 2024
Some questions relating to how the xz backdoor was going to be operationalised.

1) Sending your backdoor SSH key to all machines you’re interested in hacking is bad opsec. What was the plan to determine in advance if a box was vulnerable? SSH version is a poor choice.
2) how are Linux commands going to be encoded in the key. These keys are going to turn up and you don’t want them looking malicious straight out the door.
3) The backdoor hinges in a . character causing compilation of a file to fail. There are a million a one better ways to do this, why something so lame?
Read 4 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(