maraduer exploit
    evil portal
        sd card
            patients:
                standard 32gb microsb hc I U1 Class 10, micro center
                marauder:
                    wifi dev board pro, latest release as of 09222024
                    CYD latest of 09222024
            fat32 investigations:
                windows:
                    compare:
                        partition magic
                        windows default formatter
                linux: [0]
                    find device: (and/or options)
                        dmesg
                        dmesg -w #while plugging in
                        cat /proc/partitions
                        sudo fdisk -l
                        lsblk
                    zreo out drive:
                        sudo dd if=/dev/zero of=/dev/sdX status=progress bs=32M conv=fdatasync # much faster this way [2]
                    create partition table/mbr:
                        sudo fdisk /dev/sdX
                            o # "create a new empty MBR (DOS) partition table"
                            w # write
                    create partitions:
                        sudo fdisk /dev/sdX
                            n # "new" "add a new partition"
                                (select all defaults)
                            t # "type" "change a partition type"
                            b # "0b" "W95 FAT32"
                            p # show partition info
                            w # write
                        create file system:
                            sudo mkfs.vfat -F 32 -n MARAUDERSD /dev/sdX1
                        mount: [1]
                            sudo mkdir /mnt/maraudersd
                            sudo mount /dev/sdX1  /mnt/maraudersd


Links:
    [0] https://lobotuerto.com/notes/format-a-usb-drive-as-fat32-in-linux
    [1] https://linuxconfig.org/howto-mount-usb-drive-in-linux
    [2] https://www.man7.org/linux/man-pages/man1/dd.1.html
    [2] https://stackoverflow.com/questions/68150702/what-does-the-conv-fdatasync-do-in-dd-command-in-linux

notes/todo:
    get exact specs on microsd
    dd specifc amount of data from sdX
        bs (blocksize r and w) defaults to 512 (Bytes) by default but listed explicitly for clarity
        16MB:
            16MB = 16,777,216 Bytes
            16,777,216 Bytes / 512 Bytes = 32,768 blocks of 512 Bytes
            sudo dd if=/dev/sdX of=//home/kali/marauderexploitdev/imgs/first-16M-sdcard-marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=512 count=32768 status=progress conv=fdatasync
        4MB:
            4MB = 4,194,304 Bytes
            4,194,304 Bytes / 512 Bytes = 8,192 Blocks of 512 Bytes
            sudo dd if=/dev/sdX of=/home/kali/marauderexploitdev/imgs/first-4M-sdcard-marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=512 count=32768 status=progress conv=fdatasync
        Full command to full dump:
            sudo dd if=/dev/sdX of=/home/kali/marauderexploitdev/imgs/full-sdcard-marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress conv=fdatasync
tasync
        1) zero out
        2) sanity checks/progression
            zeroed out drive for all 0s and filesize should be exact:
                sudo dd if=/dev/zero of=/dev/sdX status=progress bs=32M conv=fdatasync
                4MB Dump:
                    sudo dd if=/dev/sda of=/home/kali/marauderexploitdev/imgs/1-first-4MB-zerored
                    -marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=512 count=8192 status=progress conv=fdatasync
                hexdump reveals all zeros in 0-first-4M-sdcard-marauder_23092024-00.28.15-UTC.img
            after create partition table:
                4MB Dump:
                    sudo dd if=/dev/sda of=/home/kali/marauderexploitdev/imgs/1-first-4MB-mbr-marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=512 count=8192 status=progress conv=fdatasync
            after creating partitions:
                4MB Dump:
                    sudo dd if=/dev/sda of=/home/kali/marauderexploitdev/imgs/2-first-4MB-created-partitions-marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=5122 count=8192 status=progress conv=fdatasync

                    Primary
                    Number 1
                    First sector (2048-60579839, default 2048):
                    Last sector, +/-sectors or +/-size{K,M,G,T,P} (2048-60579839, default 60579839)
                    W95 FAT32

                    Disk /dev/sda: 28.89 GiB, 31016878080 bytes, 60579840 sectors
                    Disk model: Storage Device
                    Units: sectors of 1 * 512 = 512 bytes
                    Sector size (logical/physical): 512 bytes / 512 bytes
                    I/O size (minimum/optimal): 512 bytes / 512 bytes
                    Disklabel type: dos
                    Disk identifier: 0x85cf894c

                    Device     Boot Start      End  Sectors  Size Id Type
                    /dev/sda1        2048 60579839 60577792 28.9G  b W95 FAT32
            after create filesystem:
                Full Dump:
                    byobu
                    sudo dd if=/dev/sdb of=/home/kali/marauderexploitdev/imgs/3-full-created-filesystem-marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress conv=fdatasync
            after mount:
                sudo mkdir /mnt/maraudersd
                sudo mount /dev/sdX1 /mnt/maraudersd
                4MB Dump:
                    sudo dd if=/dev/sda of=/home/kali/marauderexploitdev/imgs/4-first-4MB-mounted-marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=8192 count=512 status=progress conv=fdatasync
            after a text file is added:
                4MB Dump:
                    sudo dd if=/dev/sda of=/home/kali/marauderexploitdev/imgs/5-first-4MB-textfile-marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=8192 count=512 status=progress conv=fdatasync
            after a dir and text file are added:
                4MB Dump:
                    sudo dd if=/dev/sda of=/home/kali/marauderexploitdev/imgs/6-first-4MB-dir-textfile-marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=8192 count=512 status=progress conv=fdatasync
            re-zero, remake parts, repeat 0-3
                sanity check
            after booting marauder:
                Full Dump:
                    sudo dd if=/dev/sdb of=/home/kali/marauderexploitdev/imgs/4-marauder-boot-reboot-sdb_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress conv=fdatasync
            add evil portal stuff
                Full Dump:
                    sudo dd if=/dev/sdb of=/home/kali/marauderexploitdev/imgs/5-evil-portal-files-added-sdb_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress
            after logging fron evilportal:
                Full Dump:
                    sudo dd if=/dev/sdb of=/home/kali/marauderexploitdev/imgs/6-evil-portal-files-logged-sdb_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress conv=fdatasync
            after breaking chars from fuzzing evil portal 0x00-0xFF:
                sudo dd if=/dev/sdb of=/home/kali/marauderexploitdev/imgs/7-evil-portal-fuzzed-0x00-0xFF-sdb_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress conv=fdatasync

Full setup auto: #prose kinda
#!/bin/bash
date=`date "+%d%m%Y-%H.%M.%S-%Z"`
lsblk
echo "Enter drive (sdX only no /dev/)
read drive
echo "Zeroing Out"
sudo dd if=/dev/zero of=/dev/$drive status=progress bs=32M conv=fdatasync # much faster this way
echo "Dumping Zeroed Out Drive $drive to /home/kali/marauderexploitdev/imgs/0-full-zeroed-$drive_$date.img"
sudo dd if=/dev/$drive of=/home/kali/marauderexploitdev/imgs/0-full-zeroed-$drive_$date.img bs=32M status=progress conv=fdatasync
echo "Creating MBR/Partition Table"
echo "o then w"
sudo fdisk /dev/$drive
echo "Dumping Full Partition Table/MBR Drive $drive to /home/kali/marauderexploitdev/imgs/1-full-partition-table-mbr-$drive_$date.img"
sudo dd if=/dev/$drive of=/home/kali/marauderexploitdev/imgs/1-full-partition-table-mbr-$drive_$date.img bs=32M status=progress
echo "Creating Partitions"
echo "n (all defaults), t, b, p, w"
sudo fdisk /dev/$drive
echo "Dumping Partitioned Drive $drive to /home/kali/marauderexploitdev/imgs/2-partitioned-$drive_$date.img"
sudo dd if=/dev/$drive of=/home/kali/marauderexploitdev/imgs/2-partitioned-$drive_$date.img bs=32M status=progress
echo "Creating Filessytem"
sudo mkfs.vfat -F 32 -n MARAUDLABEL /dev/$drive
echo "Dumping Fullly Formatted Disk $drive to /home/kali/marauderexploitdev/imgs/3-formatted-$drive_$date.img"
sudo dd if=/dev/$drive of=/home/kali/marauderexploitdev/imgs/3-formatted-$drive_$date.img bs=32M status=progress
"Mounting"
sudo mkdir /mnt/MARAUDLABEL
sudo mount /dev/$drive1 /mnt/MARAUDLABEL
sudo umount /mnt/MARAUDLABEL
echo "Dumping Mounted Then Unmounted Disk $disk to /home/kali/marauderexploitdev/imgs/4-mounted-unmounted-$drive_$date.img"


WORKFLOW:
    Pi5-USB:
        byobu
        lsblk
        export disk=sdX

        zero:
            sudo dd if=/dev/zero of=/dev/$disk status=progress bs=1M count=4K conv=fdatasync
        mbr/partition table:
            sudo fdisk /dev/$disk
                o # "create a new empty MBR (DOS) partition table
                w # write
        create partitions:
            sudo fdisk /dev/$disk
                n # "new" "add a new partition"
                    (select all defaults)
                t # "type" "change a partition type"
                b # "0b" "W95 FAT32"
                p # show partition info
                w # write
        # create filesystem:
            # sudo mkfs.vfat -F 32 -n MARAUDERSD "/dev/${disk}1"
        mount:
            ./mount-marauder-sd $disk
                # sudo mount /dev/($disk)1 /mnt/MARAUDLABEL
        add needed files:
            # sudo mkdir /mnt/MARAUDLABEL/scripts
            sudo cp marauder_cyd_microsd/index.html /mnt/MARAUDLABEL/
            sudo cp marauder_cyd_microsd/ap.config.txt /mnt/MARAUDLABEL/
        umount:
            ./umount-marauder-sd
                # sudo umount /mnt/MARAUDLABEL
        full dump:
            sudo dd if=/dev/$disk of=/home/kali/marauderexploitdev/imgs/<n>-<activity>-full-dump-$dis
k-`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress conv=fdatasync
        partial dump:
            sudo dd if=/dev/$disk of=/home/kali/marauderexploitdev/imgs/2-incremental-overrun-partial-dump-32MB-sda-`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=1M count=32 status=progress conv=fdatasync
    Pi4-Ether:
        byobu
        cd ~/marauddev
        source boofuzz/env/bin/activate
            # stored note in pyenv.txt
        connect to wifi:
            ./connect-wifi
        hex chars fuzz:
            python hex-chars-fuzzing.py
        boofuzz fuzz:
            python boofuzz-email-password.py
                # web status hosted at http://10.0.0.79:26000
                # results in boofuzz-results
                # clean results with rm boofuzz-results/*
            open previous results:
                boo open --ui-addr 10.0.0.79 --ui-port 26000 boofuzz-results/XYZ.db
                    # opens web interface at http://10.0.0.79:26000
    MarauderCYD SD:
        /ap.config.txt # one line ex "Guest-Wifi"
        /index.html # for default evilportal
        /*.html # files for selection
    MarauderCYD:
        with wifi selections:
            WIfI->General->Select EP HTML File->X
        with one html file:
            WiFi->Attacks-Evil Portal
    hexdumps:
        hexdump <files>
        xxd --offset <hex> --len <hex> <input filename> > <output filename> # <output filename>

# todo
    dump full zeroed:
        sudo dd if=/dev/$disk of=/home/kali/marauderexploitdev/imgs/1-zeroed-full-dump-$disk-`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress conv=fdatasync
            sanity check with hexdump
    dump with filesystem and minimal
        sudo dd if=/dev/$disk of=/home/kali/marauderexploitdev/imgs/1-filesystem-minimal-files-full-dump-$dis
k-`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress conv=fdatasync
        sanity check with hexdump
    dump after logging nominal email/passwords
        ffuf -w /usr/share/wordlists/john.lst -u "http://192.168.4.1/get?email=FUZZ&password=FUZZ" -fc all -rate 4 -t 1
        sudo dd if=/dev/$disk of=/home/kali/marauderexploitdev/imgs/1-logged-nominal-full-dump-$disk-`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress conv=fdatasync
        investigate:
            hd imgs/1-logged-nominal-full-dump-sda-23092024-13.19.02-UTC.img > 1-logged-nominal-f
ull-dump-sda-23092024-13.19.02-UTC.img.hex
                # hd is hexdump -c, normal canonical dump with decode
    resume fuzzing:
        ffuf -w /usr/share/wordlists/seclists/Fuzzing/big-list-of-naughty-strings.txt -u "http://192.168.4.1/get?email=FUZZ&password=FUZZ" -fc all -rate 4 -t 3
            mount
            dump
            reset
        python hex-chars-fuzzing.py
            mount
                check 
                umount
            dump
                hd
            reset
        python boo0fuzz-email-password.py
            mount
                check
                umount
            dump
                hd
            reset

injections:
    confirmed:
        nullbyte
        crlf
    possible:
        nullbytes(s)+some other bytes to break filesystem
    incremental overrun:
        Running 1489/10000 chars (X)
        Prepend:
        Append:
        Outfile: fuzzing-results/chars-10000-23092024-12.37.24.txt
            len = 1489
            payload = "%00"*len
            payload = "%FF"*len



Fuzzers:
    prerequisites: 
        cd ~/marauddev
        source boofuzz/env/bin/activate
        ./connect-wifi./
    incremental buffer overrun:
        python incremental-buff-overrun.py
    hex chars fuzzing:
        python hex-chars-fuzzing.py
    boofuzz var fuzz:
        python boofuzz-email-password.py
            # opens web monitor on http://10.0.0.79:26000
            open previous results:
                boo open --ui-addr 10.0.0.79 --ui-port 26000 boofuzz-results/XYZ.db
                # opens web interface at http://10.0.0.79:26000
    nominal entries:
        ffuf -w /usr/share/wordlists/john.lst -u "http://192.168.4.1/get?email=FUZZ&password=FUZZ" -fc all -rate 4 -t 2
    


# Disk reset scriptttt

#!/bin/bash
mountpoint=/mnt/MARAUDLABEL/
gb_to_zero=1

echo "WILL WIPE DISK USE WITH CARE"

echo -e "\nListing Disks"
lsblk
echo -e "\nEnter disk (e.x. sda or sdb - BE CAREFUL)"
read disk
block=/dev/$disk
echo -e "\nZeroing ${gb_to_zero}GB on Disk $block"
sudo dd if=/dev/zero of=$block status=progress bs=1M count="${gb_to_zero}K" conv=fdatasync
echo -e "\nCreating Partitions on $block"
sudo echo ',,b;' | sudo sfdisk $block
echo -e "\n\nEnter Disk (e.x. sda1 or sdb1)"
lsblk
read part
partition="/dev/${part}"
echo -e "\nMaking FAT32 Filesystem on $partition"
sudo mkfs.vfat -F 32 -n MARAUDERSD $partition
echo -e "\n$block Status:"
sudo sfdisk -l $block
echo -e "\nMounting $partition at $mountpoint"
sudo mount $partition $mountpoint
echo -e "\nCopying Minimal Files"
sudo cp marauder_cyd_microsd/index.html $mountpoint
sudo cp marauder_cyd_microsd/ap.config.txt $mountpoint
echo -e "\nListing"
ls -lah $mountpoint
echo -e "\numounting $partition from $mountpoint"
sudo umount $mountpoint
echo -e "\n\nYou May Now Use on Marauder"

# dump scripptttt

#!/bin/bash
number=2
tag=incremental-overrun-nullbyte
blocks=32
blocksize=1M
dumpsize=32M



echo -e "\nListing Disks"
lsblk
echo -e "\nEnter disk (e.x. sda or sdb - BE CAREFUL)"
read disk
block=/dev/$disk

timestamp=$(date "+%d%m%Y-%H.%M.%S-%Z")

filename="/home/kali/marauderexploitdev/imgs/${number}-${tag}-${dumpsize}-${timestamp}.img"

echo "sudo dd if=$block of=$filename bs=$blocksize count=$blocks status=progress conv=fdatasync"

ffuf -input-cmd 'dd bs=1 count=1K if=/dev/urandom' -u "http://10.0.0.80/get.php?email=FUZZ&password=FUZZ" -input-num 2000 -mc all -timeout 3 -v -ignore-body -sa -t 256 -rate 10


# beacons
sudo mdk4 wlan1 b -a -w tawn -c 1 -s 50
scapy:

SSID = b"youSeemFundamentallyFun" 
iface = 'wlan1'   
sender = 'ac:cb:12:ad:58:27'

dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', addr2=sender, addr3=sender)
beacon = Dot11Beacon()
essid = Dot11Elt(ID='SSID',info=SSID, len=len(SSID))

frame = RadioTap()/dot11/beacon/essid

sendp(frame, iface=iface, inter=0.100, loop=1)