poisontap - Exploits locked/password protected computers over

项目说明

PoisonTap - siphons cookies, exposes internal router & installs web backdoor on locked computers

Created by <a href=" target=_blank></a> || <a href=" target=_blank>

When PoisonTap (<a href=" target="_blank">Raspberry Pi Zero</a> & Node.js) is plugged into a locked/password protected computer, it:

* emulates an Ethernet device over USB (or Thunderbolt)
* hijacks all Internet traffic from the machine (*despite* being a low priority/unknown 网络 interface)
* siphons and stores HTTP cookies and sessions from the web browser for the Alexa top 1,000,000 websites
* exposes the internal router to the attacker, making it accessible remotely WebSocket and DNS rebinding (thanks <a href=" target=_blank>Matt Austin</a> for rebinding idea!)
* installs a persistent web-based backdoor in HTTP cache for hundreds of thousands of domains and common Ja CDN URLs, all with access to the user's cookies poisoning
* allows attacker to remotely force the user to make HTTP requests and proxy back responses (GET & POSTs) with the user's cookies on any backdoored domain
* does not require the machine to be unlocked
* backdoors and remote access persist e device is removed and attacker sashays away

!PoisonTap

*(incredible HTML5 can by <a href=" target="_blank">Ara</a>)*

PoisonTap evades the following security mechanisms:

* <a href=" target=_blank>Password Protected Lock Screens</a>
* <a href=" target=_blank>Routing Table</a> priority and 网络 interface Service Order
* <a href=" target=_blank>Same-Origin Policy</a>
* <a href=" target=_blank>X-Frame-Options</a>
* <a href=" target=_blank>HttpOnly</a> Cookies
* <a href=" target=_blank>SameSite</a> cookie attribute
* <a href=" target=_blank>Two-Factor/Multi-Factor Authentication</a> (2FA/MFA)
* <a href=" target=_blank>DNS Pinning</a>
* <a href=" target=_blank>Cross-Origin Resource Sharing (CORS)</a>
* <a href=" target=_blank>HTTPS cookie protection</a> when <a href=" target=_blank>Secure</a> cookie flag & <a href=" target=_blank>HSTS</a> not enabled

------------

Demo

PoisonTap is built for the $5 <a href=" target="_blank">Raspberry Pi Zero</a> without any additional components other than a <a href=" target="_blank">micro-USB cable</a> & <a href=" target="_blank">microSD card</a>, or can work on any Raspberry Pi (1/2/3) with an Ethernet-to-USB/Thunderbolt dongle, or can work on other devices that can emulate USB gadgets such as <a href=" target="_blank">USB Armory</a> and <a href=" target=_blank>LAN Turtle</a>.

Li and more details a in the video:
<a href=" target="_blank"><img src= " alt="MagSpoof" border="1" /></a>

Point of Contact: <a href=" target=_blank></a> // <a href=" target=_blank>

Released: No 16, 2016

Source code and download: <a href=" target=_blank>

-----

How PoisonTap Works

PoisonTap produces a cascading effect by exploiting the existing trust in mechanisms of a machine and 网络, including USB/Thunderbolt, DHCP, DNS, and HTTP, to produce a snowball effect of information exfiltration, 网络 access and installation of semi-permanent backdoors.

!Network Hijacking

In a nutshell, PoisonTap performs the following:

*Network Hijacking*

* Attacker plugs PoisonTap (such as weaponized <a href=" target="_blank">Raspberry Pi Zero</a>) into a locked computer (even if computer is password protected)
* PoisonTap emulates an Ethernet device (eg, Ethernet over USB/Thunderbolt) -- by default, Windows, OS X and Linux recognize an ethernet device, automatically loading it as a low-priority 网络 device and performing a DHCP request across it, even when the machine is locked or password protected
* PoisonTap responds to the DHCP request and provides the machine with an IP address, however the DHCP response is crafted to tell the machine that the entire IPv4 space (0.0.0.0 - 255.255.255.255) is part of the PoisonTap's local 网络, rather than a small subnet (eg 192.168.0.0 - 192.168.0.255)
* Normally it would be irrelevant if a secondary 网络 device connects to a machine as it will be gi priority than the existing (trusted) 网络 device and won't supersede the gateway for Internet traffic, *but...*
* Any routing table / gateway priority / 网络 interface service order security is bypassed due to the priority of "LAN traffic" over "Internet traffic"
* PoisonTap exploits this 网络 access, even as a low priority 网络 device, because the *subnet* of a *low priority* 网络 device is gi priority than the *gateway* (default route) of the *highest priority* 网络 device
* This means if traffic is destined to 1.2.3.4, while normally this traffic would hit the default route/gateway of the primary (non-PoisonTap) 网络 device, PoisonTap actually gets the traffic because the PoisonTap "local" 网络/subnet supposedly contains 1.2.3.4, and every other IP address in existence ;)
* Because of this, all Internet traffic goes o, e the machine is connected to another 网络 device with higher priority and proper gateway (the true wifi, ethernet, etc.)

!Cookie Siphoning

*Cookie Siphoning*

* As long as a web browser is running the background, it is likely one of the open pages will perform an HTTP request in the background (for example to load a new ad, send data to an analytics platform, or simply continue to track your web mo) via AJAX or dynamic script/iframe tags
* You can see this for yourself, go into your de/inspector (typically Cmd+Shift+I or Ctrl+Shift+I), go to a heavily website, click on the 网络 tab, and watch as remote resources continue to be accessed even as you take no action on the page
* Upon this HTTP request, because all traffic exits onto the PoisonTap device, PoisonTap DNS spoofs on the fly to return its own address, causing the HTTP request to hit the PoisonTap web 服务端 (<a href=" target="_blank">Node.js</a>)
* If the DNS 服务端 is pointing to an internal IP (LAN) that PoisonTap cannot get pri for, the attack continues to function as the internal DNS 服务端 will produce public IP addresses for the domains attacked, and it is the public IP addresses that PoisonTap has already hijacked
* Once the internal DNS ser, the web browser hits the public IP, ultimately hitting the PoisonTap web 服务端 (Node.js) in either scenario
* When the Node web ser the request, PoisonTap responds with a response that can be interpreted as HTML or as Ja, both of which execute properly (many websites will load HTML or JS in background requests)
* The HTML/JS-agnostic page then produces many hidden iframes, each iframe across a different Alexa-top-1-million domain
* Any "X-Frame-Options" security on the domain is bypassed as PoisonTap is now the HTTP 服务端 and chooses which headers to send to the 客户端
* As every iframe HTTP request to a site is made (eg, ), the HTTP cookies are sent from the browser to the "public IP" hijacked by PoisonTap, which swiftly logs the cookies/authentication information, logging tens of thousands of the user's cookies into PoisonTap
* Any "HttpOnly" cookie security is bypassed and those cookies are captured as no Ja is executed on the domain itself, but rather only used to load the iframe in the first place
* Any Cross-Origin Resource Sharing or Same-Origin Policy security is bypassed as the domain being accessed appears legitimate to the browser
* Because we're capturing cookies rather than credentials, any 2FA/MFA implemented on the site is bypassed when the attacker uses the cookie to login. This is because we're not actually performing the login function but rather continuing an already logged-in session which does not trigger two-factor authentication
* If a 服务端 is using HTTPS, but the cookies do not explicitly set the <a href=" target="_blank">Secure</a> cookie flag, the HTTPS protection is bypassed and the cookie is sent to PoisonTap

!Internal Router Backdoor

*Remotely Accessible Web-Based Backdoors*

* While PoisonTap was producing thousands of iframes, forcing the browser to load each one, these iframes are not just blank pages at all, but rather HTML+Ja backdoors that are cached indefinitely
* Because PoisonTap force-caches these backdoors on each domain, the backdoor is tied to that domain, enabling the attacker to use the domain's cookies and launch same-origin requests in the future, even if the user is currently not logged in
* For example, when the iframe is loaded, PoisonTap accepts the di Internet traffic, responds to the HTTP request via the Node web 服务端
* Additional HTTP headers are added to cache the page indefinitely
* The actual response of the page is a combination of HTML and Ja that produces a persistent WebSocket out to the attacker's web 服务端 (over the Internet, not on the PoisonTap device)
* The WebSocket remains open allowing the attacker to, at any point in the future, connect back to the backdoored machine and perform requests across any origin that has the backdoor implemented (the Alexa top 1,000,000 sites -- see below)
* If the backdoor is opened on one site (e.g., nfl.com), but the user wishes to attack a different domain (e.g., pinterest.com), the attacker can load an iframe on nfl.com to the pinterest.com backdoor ()
* Again, any "X-Frame-Options", Cross-Origin Resource Sharing, and Same-Origin Policy security on the domain is entirely bypassed as the request will hit the cache that PoisonTap left rather than the true domain

<a href=" target="_blank">!Raspberry Pi Zero</a>

*Internal Router Backdoor & Remote Access*

* The one 网络 PoisonTap is not able to hijack is the actual LAN subnet of the true 网络 interface (for example, if the user's wifi subnet is 192.168.0.x, this 网络 is unaffected), *but...*
* PoisonTap force-caches a backdoor on a special host, specifically the target router's IP prepended to ".ip.samy.pl", e.g. 192.168.0.1.ip.samy.pl, essentially producing a persistent DNS rebinding attack
* When using PoisonTap as the DNS 服务端 ( using public DNS 服务端), PoisonTap responds with the specialized PoisonTap IP temporarily (1.0.0.1), meaning any requests at that moment will hit the PoisonTap web 服务端
* If instead the DNS 服务端 is set to the internal 网络 (e.g., 192.168.0.x), an additional specially crafted request is made to 1.0.0.1.pin.ip.samy.pl which tells my specialized DNS 服务端 (on the public Internet) to temporarily respond to any [ip.address].ip.samy.pl address with the "pinned" address (1.0.0.1) for several seconds
* PoisonTap then quickly sets a backdoor on which for the moment points to the PoisonTap device at 1.0.0.1, allowing the backdoor to be accessed and cached from the PoisonTap device
* DNS pinning and DNS rebinding security are bypassed due to exhausting the DNS pinning table, due to the hundreds of thousands of requests just pre made, and no rebinding needs to occur in the future, making this attack persistent over long periods of time (thanks to <a href=" target=_blank>Matt Austin</a> for sharing this attack with me!)
* Now that a backdoor is force-cached to any future requests to the 192.168.0.1.ip.samy.pl will hit the unpinned IP address, causing 192.168.0.1 to resol, pointing directly to the router
* This means if loading the 192.168.0.1.ip.samy.pl/PoisonTap host in an iframe remotely over the backdoor, you can now perform AJAX GET/POSTs to any other page on the internal router, entirely remotely, thus allowing remote access to the internal router
* This can lead to other attacks on the router which the attacker may ha had access to in the first place, such as default admin credentials on the router being used to o DNS servers, or other authentication being exposed

<img src=" alt="DNS Rebinding" />

#### Recap of the DNS server:

* [ip.addy].ip.samy.pl normally responds with [ip.addy]
* 192.168.0.1.ip.samy.pl -> 192.168.0.1 (A record)
* [ip.addy].pin.ip.samy.pl temporarily (~5 seconds) points *.ip.samy.pl to [ip.addy]
* 1.0.0.1.pin.ip.samy.pl -> 1.0.0.1
* 192.168.0.1.ip.samy.pl -> 1.0.0.1 (A record, short TTL)
* *(after ~5 seconds)*
* 192.168.0.1.ip.samy.pl -> 192.168.0.1 (A record)

Additional Remotely Accessible Web-Based Backdoors

* Additionally, PoisonTap replaces thousands of common, CDN-based Ja files, e.g. Google and jQuery CDNs, with the correct 代码 plus a backdoor that gives the attacker access to any domain loading the infected CDN-based Ja file
* Because a backdoor is left on each domain, this allows the attacker to remotely force the backdoored browser to perform same-origin requests (AJAX GET/POSTs) on any major domain, even if the does not currently have any open windows to that domain
* The backdoor will now live on any additional site that also uses one of these infected, HTTP-based, CDN Ja frameworks when the the site

-----

!PoisonTap

Securing Against PoisonTap

Ser Security

If you are running a web 服务端, securing against PoisonTap is simple:

* Use HTTPS exclusively, at the very least for authentication and authenticated content
* Honestly, you should use HTTPS exclusively and always redirect HTTP content to HTTPS, pre a user being tricked into pro credentials or other PII over HTTP
* Ensure Secure flag is enabled on cookies, pre HTTPS cookies from leaking over HTTP
* When using remote Ja resources, use the <a href=" target=_blank>Subresource Integrity</a> script tag attribute
* Use <a href=" target=_blank>HSTS</a> to prevent HTTPS downgrade attacks

Desktop Security

* Adding <a href=" target=_blank>cement</a> to your USB and Thunderbolt ports can be effective
* Closing your browser every time you walk away from your machine can work, but is entirely impractical
* Disabling USB/Thunderbolt ports is also effecti also impractical
* Locking your computer has no effect as the 网络 and USB stacks operate while the machine is locked, however, going into an encrypted sleep mode where a key is required to decrypt memory (e.g., File + deep sleep) solves most of the issues as your browser will no longer make requests, even if woken up

-----

Download

Source code: <a href=" target=_blank>

-----

Installation / File Breakdown

Note: If you find the device is NOT acting as an Ethernet controller automatically (older of Windows, for example), you can change the VID and PID in pi_startup.sh

Place dhcpd.conf in /etc/dhcp/dhcpd.conf and the rest of the files in /home/pi/poisontap, then reboot to ensure e is working.

There are a number of <a href=" target=_blank>files in the repo</a>, which are used on different sides. The list:

* backdoor.html - Whenever a URL is hit to exfiltrate cookies, this file is what is returned as the force-cached content. It contains a backdoor that produces an outbound websocket to samy.pl:1337 (adjustable to any host/port) that remains opens waiting for commands from the 服务端. This means when you load an iframe on a site, such as this is the content that gets populated (e PoisonTap is removed from the machine).
* backend_server.js - This is the Node.js 服务端 that you run on your Internet-accessible 服务端. It is what the backdoor.html connects to (eg, samy.pl:1337). This is the same 服务端 you connect to send commands to your PoisonTapped minion machines, eg

* pi_poisontap.js - This runs via Node.js on the Raspberry Pi Zero and is the HTTP ser for handling any HTTP requests intercepted by PoisonTap, storing siphoned cookies, and injecting the cached backdoors.
* pi_startup.sh - This runs upon startup on the Raspberry Pi Zero in order to set the device up to emulate an Ethernet-o gadget, set up our evil DHCP 服务端, allow traffic rerouting, DNS spoofing, and to launch pi_poisontap.js above.
* target_backdoor.js - This file is prepended to any CDN-related Ja files, thus backdooring them, e.g. Google CDN's jQuery URL.
* target\_injected\_xhtmljs.html - This is the 代码 that gets injected into unintentional/background HTTP/AJAX requests on the 's machine and spawns the entire attack. It is constructed in a way that it can be interpreted as HTML or as Ja and still execute the same 代码. Additionally, the amazing HTML5 canvas is by the incredible <a href=" target=_blank>Ara oen CodePen</a> and was too amazing not to include. This is the graphical craziness that appears when the page gets taken over by PoisonTap.
* poisontap.cookies.log - This file is generated once the user's machine starts sending HTTP requests to PoisonTap and logs the cookie from the browser along with the associated URL/domain it belongs to.

-----

Frequently Asked Questions

* Q: How do you add additional domains to be backdoored?
* A: The list of domains to be backdoored is set in target_injected_xhtmljs.html by the getDoms() function. This itself is populated by the alexa1m.sh script in the root of the repo. If you wish to add additional domains to this list, you can simply amend the return call in getDoms().
* Q: How do you use the captured cookies?
* A: You can use the Document.cookie API directly from the Ja console in your browser to set cookies. This StackO post also has a few Chrome-specific suggestions, for example the Cookie Inspector Chrome extension.
* Q: How do I clean Poisontap from a machine?
* A: You should clear the local OS DNS cache, as well as any browser caches. You may also need to in any logged-in sessions at the time, which may ha cookies. Ensure that these in existing cookies, rather than simply logging you out. (If you want to safetly work with a PoisonTap device on your current machine, make sure to exit any browser, then you should be able to safetly connect it to your machine).

-----

Contact

Point of Contact: <a href=" target=_blank></a>

You can see more of my projects or contact me at <a href=" target=_blank>

项目信息

开发语言：Ja

Star 数：6480

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Exploits locked/password protected computers over USB, drops persistent WebSocket-based backdoor, exposes internal router, and siphons cookies using Raspberry Pi Zero & Node.js.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。