Community Showcase: Raspberry Pi Zero W P4wnP1 A.L.O.A.

The Kali community has been hard at work (as always!), and we want to showcase what we think is a very cool project of Kali Linux on a (A Little Offensive Application)”.

It takes the standard Kali Linux image and adds custom software and some extra firmware designed for the Raspberry Pi Zero W to turn it into a Swiss Army knife of attacks and exfiltration.

This blog post will be a as well as from the community which cover additional attack scenarios as well as more payloads that people have written if you want to go deeper!

If you have a Raspberry Pi Zero W, we highly recommend giving this image a try.
We see this as a great tool in any tester’s toolkit!

Shopping List

• (optional but recommended)


• MicroUSB to USB-A cable (required if you are not using the above add-on board)


• MicroSD card (32GB or larger)


• .
  At the time of writing, the current version is 2022.3:
  
  
  CONSOLE Kopieren

  kali@kali:~/Downloads$ ls
  
  kali-linux-2022.3-raspberry-pi-zero-w-p4wnp1-aloa-armel.img.xz
  
  

  
  

  ---

  We will verify the download as well, by going back to the download page and clicking on the sum link on the Raspberry Pi Zero W (P4wnP1 A.L.O.A) line to get the SHA256 checksum:

  
  
  CONSOLE Kopieren

  kali@kali:~/Downloads$ echo "210635bb3dc7876b638a7035cd4dc60e0b134b19a6aec42a75f5995036b45840 kali-linux-2022.3-raspberry-pi-zero-w-p4wnp1-aloa-armel.img.xz" | sha256sum -c
  
  kali-linux-2022.3-raspberry-pi-zero-w-p4wnp1-aloa-armel.img.xz: OK
  
  

  
  

  ---

  Now that we have verified that we have downloaded the file and it matches, we write it to the microSD card, which on our system is /dev/sdb - on your system this may be different, do NOT just copy and paste what we have put here, because you WILL overwrite whatever you have on your system’s /dev/sdb if you do.

  
  

  The xzcat command will open the compressed image file and pipe it to the dd command, which will do the actual writing to the microSD card. The use of xzcat is a quick trick, as it removes having to actually uncompress the image first:

  
  
  CONSOLE Kopieren

  kali@kali:~/Downloads$ xzcat kali-linux-2022.3-raspberry-pi-zero-w-p4wnp1-aloa-armel.img.xz | sudo dd of=/dev/sdb bs=1M status=progress
  
  [sudo] password for kali:
  
  6421807104 bytes (6.4 GB, 6.0 GiB) copied, 101 s, 63.6 MB/s
  
  0+577993 records in
  
  0+577993 records out
  
  6442450944 bytes (6.4 GB, 6.0 GiB) copied, 162.961 s, 39.5 MB/s
  
  

  
  
  
  

  
  The speeds above are on our system, these will differ based on your system and the speed of the microSD card that you are using.
  

  
  
  
  

  ---

  Now that this is done, we can unplug the microSD card from the machine, and plug it in to our Raspberry Pi Zero W.
  If you are using a USB-A adapter similar to what we linked to in the “ (user: kali, password: kali) the timing will vary based on microSD card speed.

  
  

  Using the P4wnP1 A.L.O.A.

  
  

  Once it is booted, you will know everything is ready to go, when you see the default wireless network: 💥🖥💥 Ⓟ➃ⓌⓃ🅟❶.
  Handy if you do not have an HDMI monitor plugged in!

  
  

  Select the above SSID, and then we login with the password: MaMe82-P4wnP1.

  
  

  
  in our browser.

  
  

  ---

  Upon login we can see the list at the top: , , , .

  
  

  
  , which is a large database of known values used for USB devices.

  
  

  
  
  

  
  
  

  The default Wi-Fi mode is Access Point (AP), which allows for other devices to connect to P4wnP1’s wireless network.

  
  

  Alternatively, you can also set the P4wnP1 to be a client (client mode) on the network, instead of a AP. Using the pre-defined configurations, P4wnP1 will then connect to the network and behave like another device on the network.

  
  

  The final option, Client with Fallover to AP, gives you the “best of both worlds” as P4wnP1 will attempt to connect as a client, and if that fails, then switch to being a Access Point. Neat!

  
  

  For example, we will set it up in this fall over mode. So if the kali Wi-Fi network is in range and has the correct key, it should connect to that as a client, if not, if we are not in range, or it cannot see it, it will start up the access point network.

  
  

  
  
  

  
  
  

  ---

  For the Bluetooth network settings, the Personal Area Network profile (PAN) is used. Keep in mind that you typically have a range of 10 meters (33 ft) with Bluetooth connections.

  
  

  Some quick definitions for people who may not be familiar with Bluetooth Personal Area Network profiles:

  
  
  
  
  
  
  
  
  
  

  Profile	Definition
  PANU	Peer-to-Peer connection (one to one)
  PAN-GN	Group Ad-hoc Network (GN) of up to 8 devices
  PAN-NAP	Network Aggregation Point (NAP) can bridge the Bluetooth connection to the wireless connection

  So if you set the P4wnP1 to be in PAN-NAP (the default), you can connect up to 10 devices to the P4wnP1 over Bluetooth and share its network connection that way.

  
  

  If you were to set it up with PAN-GN, then up to 7 additional devices could connect to the P4wnP1, and can communicate with each other but there is no Internet access.

  
  

  And if you were to use PANU, then you can only transfer data between the device connected to the P4wnP1 and the P4wnP1 itself.

  
  

  Network Settings

  
  

  The next tab is Network Settings, where we can change the options for the different ways of connecting to the P4wnP1.

  
  

  You can connect via Bluetooth (bteth), USB (usbeth), or as we currently are, via Wi-Fi (wlan0).

  
  

  To make any changes, you select the interface, and make the change for that interface, including using DHCP or setting static IP values.
  You can also alter some DHCP options here. Under the hood,
  

  
  
  

  Trigger Actions

  
  

  Now we have triggers.

  
  

  Triggers are the main way of doing things with the P4wnP1, when certain conditions are met. You can think of a trigger action as a payload. Whatever you set up here, if the conditions are met, the actions you set happen.

  
  

  
  , HIDscripts are similar, but based upon JavaScript rather than bash.

  
  

  “HIDScripts” run on Raspberry Pi device and they interact with the enumerated “fake” hardware which is connected externally, however “bash scripts” run on the Raspberry Pi OS “internal”.

  
  

  To get you started, P4wnP1 pre-populates with a simple HIDScript (called hidtest1.js) that will launch notepad on a Windows computer, types out a phrase, then moves the mouse, and then repeats it without any delays. More about this can be found in our
  

  
  
  

  ---

  In the
  

  
  
  

  Generic Settings

  
  

  And finally we have our Generic Settings, where we can do things like use the Master Template Editor to control what the defaults are every time it boots as well as Reboot or Shutdown the P4wnP1 device, and also make a backup or restore the P4wnP1 database (so your settings and hard work is preserved).

  
  

  
  hidtest1.js to run a command and move the mouse about.

  
  

  First, let’s go into the web interface and click on trigger actions:

  
  

  
  
  

  
  
  

  ---

  In this case, we will choose: USB gadget connected to host:

  
  

  
  ”:

  
  

  
  to load. For this example we will load the default HIDscript that is written, called hidtest1.js, which will launch notepad, type out “Hello from P4wnP1 run” and then move the mouse to the right, then left, and then it will do it again, but much faster, to show the speed at which the P4wnP1 can run them.

  
  

  Any HIDScripts that you write, or get from the community, will show up in this list once they are added to your P4wnP1. The list below are just the default ones that come with the P4wnP1.

  
  

  
  
  

  
  
  

  Happy hacking!

  
  

  Installing A Package When Connected over SSH

  
  

  When you have Internet access on the P4wnP1, you have the full arsenal of Kali’s repositories available to you. So any package you can install in Kali on a Raspberry Pi Zero W will be available for use in bash scripts you may write. You can access those scripts via are:

  
  
  • kali / kali
  
  
  • root / toor
  
  

  We are now going to install the package we have already set up somewhere else.

  
  

  As a reminder, we always want to run sudo apt update before installing packages, to ensure we get the latest version:

  
  
  CONSOLE Kopieren

  kali@kali-raspberry-pi-zero-w-p4wnp1-aloa:~$ sudo apt update
  
  [...]
  
  kali@kali-raspberry-pi-zero-w-p4wnp1-aloa:~$
  
  kali@kali-raspberry-pi-zero-w-p4wnp1-aloa:~$ sudo apt -y install dnscat2-client
  
  Reading package lists... Done
  
  Building dependency tree... Done
  
  Reading state information... Done
  
  Suggested packages:
  
  dnscat2-server
  
  The following NEW packages will be installed:
  
  dnscat2-client
  
  0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
  
  [...]
  
  

  
  

  Now, we can just simply run the suggested command when setting up dnscat2-server on our other machine:

  
  
  CONSOLE Kopieren

  kali@kali-raspberry-pi-zero-w-p4wnp1-aloa:~$ dnscat --dns server=10.0.13.37,port=53 --secret=5672ddb107fe2f33e490a83e8d1036ca
  
  Creating DNS driver:
  
  domain = (null)
  
  host = 0.0.0.0
  
  port = 53
  
  type = TXT,CNAME,MX
  
  server = 10.0.13.37
  
  ** Peer verified with pre-shared secret!
  
  Session established!
  
  

  
  

  Happy hacking (again)!

  
  

  Credits

  
  

  The .

  
  

  or on our

Community Resources:

• Windows HID payload generator