For over a year my free time has been spent turning this ‘LilyGo T-Dongle S3’ into hacking tool USB/WiFi/BT which I’ve named the USB Army Knife.
This device is cheap, tiny, has a screen, SPI port, button and can do a ton of stuff with the ESP32-S3 inside.
It has consumed me! 🧵
First up look at that hidden micro SD card slot. With that kind of storage and the fact it’s so cheap it’s throwaway you can start planning attacks that live a long time.
The ESP32 inside has a full USB stick and can do your usual BadUSB/HID and run attacks. BUT…
ESP32 has a decent WiFi/BT stack which already has a load of attacks courtesy of ESP32 Marauder.
If only someone would integrate that and USB ducky functionality
Well that’s what I did. I also threw in USB networking so you can PCAP the device when you plug in and save it to the SD card.
Then I thought wouldn’t a nice web interface be grand. Basically I didn’t stop.
And here it is, expect me to bang on about this for a while because I don’t think there’s anything like it.
Oh it’s also got a agent with serial only comms. It can grab the screen for you which you view over the ESP32’s devices WiFi.
Some questions relating to how the xz backdoor was going to be operationalised.
1) Sending your backdoor SSH key to all machines you’re interested in hacking is bad opsec. What was the plan to determine in advance if a box was vulnerable? SSH version is a poor choice.
2) how are Linux commands going to be encoded in the key. These keys are going to turn up and you don’t want them looking malicious straight out the door.
3) The backdoor hinges in a . character causing compilation of a file to fail. There are a million a one better ways to do this, why something so lame?