domingo, 28 de maio de 2023

Hacking Everything With RF And Software Defined Radio - Part 3


Reversing Device Signals with RFCrack for Red Teaming


This blog was researched and automated by:
@Ficti0n 
@GarrGhar 
Mostly because someone didn't want to pay for a new clicker that was lost LOL

Websites:
Console Cowboys: http://consolecowboys.com 
CC Labs: http://cclabs.io

CC Labs Github for RFCrack Code:
https://github.com/cclabsInc/RFCrack


Contrived Scenario: 

Bob was tasked to break into XYZ  corporation, so he pulled up the facility on google maps to see what the layout was. He was looking for any possible entry paths into the company headquarters. Online maps showed that the whole facility was surrounded by a security access gate. Not much else could be determined remotely so bob decided to take a drive to the facility and get a closer look. 

Bob parked down the street in view of the entry gate. Upon arrival he noted the gate was un-manned and cars were rolling up to the gate typing in an access code or simply driving up to the gate as it opening automatically.  Interestingly there was some kind of wireless technology in use. 

How do we go from watching a car go through a gate, to having a physical device that opens the gate?  

We will take a look at reversing a signal from an actual gate to program a remote with the proper RF signal.  Learning how to perform these steps manually to get a better understanding of how RF remotes work in conjunction with automating processes with RFCrack. 

Items used in this blog: 

Garage Remote Clicker: https://goo.gl/7fDQ2N
YardStick One: https://goo.gl/wd88sr
RTL SDR: https://goo.gl/B5uUAR


 







Walkthrough Video: 




Remotely sniffing signals for later analysis: 

In the the previous blogs, we sniffed signals and replayed them to perform actions. In this blog we are going to take a look at a signal and reverse it to create a physical device that will act as a replacement for the original device. Depending on the scenario this may be a better approach if you plan to enter the facility off hours when there is no signal to capture or you don't want to look suspicious. 

Recon:

Lets first use the scanning functionality in RFCrack to find known frequencies. We need to understand the frequencies that gates usually use. This way we can set our scanner to a limited number of frequencies to rotate through. The smaller rage of frequencies used will provide a better chance of capturing a signal when a car opens the target gate. This would be beneficial if the scanning device is left unattended within a dropbox created with something like a Kali on a Raspberry Pi. One could access it from a good distance away by setting up a wifi hotspot or cellular connection.

Based on research remotes tend to use 315Mhz, 390Mhz, 433Mhz and a few other frequencies. So in our case we will start up RFCrack on those likely used frequencies and just let it run. We can also look up the FCID of our clicker to see what Frequencies manufactures are using. Although not standardized, similar technologies tend to use similar configurations. Below is from the data sheet located at https://fccid.io/HBW7922/Test-Report/test-report-1755584 which indicates that if this gate is compatible with a universal remote it should be using the 300,310, 315, 372, 390 Frequencies. Most notably the 310, 315 and 390 as the others are only on a couple configurations. 




RFCrack Scanning: 

Since the most used ranges are 310, 315, 390 within our universal clicker, lets set RFCrack scanner to rotate through those and scan for signals.  If a number of cars go through the gate and there are no captures we can adjust the scanner later over our wifi connection from a distance. 

Destroy:RFCrack ficti0n$ python RFCrack.py -k -f 310000000 315000000 390000000
Currently Scanning: 310000000 To cancel hit enter and wait a few seconds

Currently Scanning: 315000000 To cancel hit enter and wait a few seconds

Currently Scanning: 390000000 To cancel hit enter and wait a few seconds

e0000000000104007ffe0000003000001f0fffe0fffc01ff803ff007fe0fffc1fff83fff07ffe0007c00000000000000000000000000000000000000000000e0007f037fe007fc00ff801ff07ffe0fffe1fffc3fff0001f00000000000000000000000000000000000000000000003809f641fff801ff003fe00ffc1fff83fff07ffe0fffc000f80000000000000000000000000000000000000000000003c0bff01bdf003fe007fc00ff83fff07ffe0fffc1fff8001f0000000000000000000000000000000000000000000000380000000000000000002007ac115001fff07ffe0fffc000f8000000000000000000000000000000000000000
Currently Scanning: 433000000 To cancel hit enter and wait a few seconds


Example of logging output: 

From the above output you will see that a frequency was found on 390. However, if you had left this running for a few hours you could easily see all of the output in the log file located in your RFCrack/scanning_logs directory.  For example the following captures were found in the log file in an easily parseable format: 

Destroy:RFCrack ficti0n$ cd scanning_logs/
Destroy:scanning_logs ficti0n$ ls
Dec25_14:58:45.log Dec25_21:17:14.log Jan03_20:12:56.log
Destroy:scanning_logs ficti0n$ cat Dec25_21\:17\:14.log
A signal was found on :390000000
c0000000000000000000000000008000000000000ef801fe003fe0fffc1fff83fff07ffe0007c0000000000000000000000000000000000000000000001c0000000000000000050003fe0fbfc1fffc3fff83fff0003e00000000000000000000000000000000000000000000007c1fff83fff003fe007fc00ff83fff07ffe0fffc1fff8001f00000000000000000000000000000000000000000000003e0fffc1fff801ff003fe007fc1fff83fff07ffe0fffc000f80000000000000000000000000000000000000000000001f07ffe0dffc00ff803ff007fe0fffc1fff83fff07ffe0007c000000000000000000000000000000000000000000
A signal was found on :390000000
e0000000000104007ffe0000003000001f0fffe0fffc01ff803ff007fe0fffc1fff83fff07ffe0007c00000000000000000000000000000000000000000000e0007f037fe007fc00ff801ff07ffe0fffe1fffc3fff0001f00000000000000000000000000000000000000000000003809f641fff801ff003fe00ffc1fff83fff07ffe0fffc000f80000000000000000000000000000000000000000000003c0bff01bdf003fe007fc00ff83fff07ffe0fffc1fff8001f0000000000000000000000000000000000000000000000380000000000000000002007ac115001fff07ffe0fffc000f8000000000000000000000000000000000000000



Analyzing the signal to determine toggle switches: 

Ok sweet, now we have a valid signal which will open the gate. Of course we could just replay this and open the gate, but we are going to create a physical device we can pass along to whoever needs entry regardless if they understand RF. No need to fumble around with a computer and look suspicious.  Also replaying a signal with RFCrack is just to easy, nothing new to learn taking the easy route. 

The first thing we are going to do is graph the capture and take a look at the wave pattern it creates. This can give us a lot of clues that might prove beneficial in figuring out the toggle switch pattern found in remotes. There are a few ways we can do this. If you don't have a yardstick at home you can capture the initial signal with your cheap RTL-SDR dongle as we did in the first RF blog. We could then open it in audacity. This signal is shown below. 



Let RFCrack Plot the Signal For you: 

The other option is let RFCrack help you out by taking a signal from the log output above and let RFCrack plot it for you.  This saves time and allows you to use only one piece of hardware for all of the work.  This can easily be done with the following command: 

Destroy:RFCrack ficti0n$ python RFCrack.py -n -g -u 1f0fffe0fffc01ff803ff007fe0fffc1fff83fff07ffe0007c
-n = No yardstick attached
-g = graph a single signal
-u = Use this piece of data




From the graph output we see 2 distinct crest lengths and some junk at either end we can throw away. These 2 unique crests correspond to our toggle switch positions of up/down giving us the following 2 possible scenarios using a 9 toggle switch remote based on the 9 crests above: 

Possible toggle switch scenarios:

  1. down down up up up down down down down
  2. up up down down down up up up up 

Configuring a remote: 

Proper toggle switch configuration allows us to program a universal remote that sends a signal to the gate. However even with the proper toggle switch configuration the remote has many different signals it sends based on the manufacturer or type of signal.  In order to figure out which configuration the gate is using without physically watching the gate open, we will rely on local signal analysis/comparison.  

Programming a remote is done by clicking the device with the proper toggle switch configuration until the gate opens and the correct manufacturer is configured. Since we don't have access to the gate after capturing the initial signal we will instead compare each signal from he remote to the original captured signal. 


Comparing Signals: 

This can be done a few ways, one way is to use an RTLSDR and capture all of the presses followed by visually comparing the output in audacity. Instead I prefer to use one tool and automate this process with RFCrack so that on each click of the device we can compare a signal with the original capture. Since there are multiple signals sent with each click it will analyze all of them and provide a percent likelihood of match of all the signals in that click followed by a comparing the highest % match graph for visual confirmation. If you are seeing a 80-90% match you should have the correct signal match.  

Note:  Not every click will show output as some clicks will be on different frequencies, these don't matter since our recon confirmed the gate is communicating on 390Mhz. 

In order to analyze the signals in real time you will need to open up your clicker and set the proper toggle switch settings followed by setting up a sniffer and live analysis with RFCrack: 

Open up 2 terminals and use the following commands: 

#Setup a sniffer on 390mhz
  Setup sniffer:      python RFCrack.py -k -c -f 390000000.     
#Monitor the log file, and provide the gates original signal
  Setup Analysis:     python RFCrack.py -c -u 1f0fffe0fffc01ff803ff007fe0fffc1fff83fff07ffe0007c -n.  

Cmd switches used
-k = known frequency
-c = compare mode
-f = frequency
-n = no yardstick needed for analysis

Make sure your remote is configured for one of the possible toggle configurations determined above. In the below example I am using the first configuration, any extra toggles left in the down position: (down down up up up down down down down)




Analyze Your Clicks: 

Now with the two terminals open and running click the reset switch to the bottom left and hold till it flashes. Then keep clicking the left button and viewing the output in the sniffing analysis terminal which will provide the comparisons as graphs are loaded to validate the output.  If you click the device and no output is seen, all that means is that the device is communicating on a frequency which we are not listening on.  We don't care about those signals since they don't pertain to our target. 

At around the 11th click you will see high likelihood of a match and a graph which is near identical. A few click outputs are shown below with the graph from the last output with a 97% match.  It will always graph the highest percentage within a click.  Sometimes there will be blank graphs when the data is wacky and doesn't work so well. This is fine since we don't care about wacky data. 

You will notice the previous clicks did not show even close to a match, so its pretty easy to determine which is the right manufacture and setup for your target gate. Now just click the right hand button on the remote and it should be configured with the gates setup even though you are in another location setting up for your test. 

For Visual of the last signal comparison go to ./imageOutput/LiveComparison.png
----------Start Signals In Press--------------
Percent Chance of Match for press is: 0.05
Percent Chance of Match for press is: 0.14
Percent Chance of Match for press is: 0.14
Percent Chance of Match for press is: 0.12
----------End Signals In Press------------
For Visual of the last signal comparison go to ./imageOutput/LiveComparison.png
----------Start Signals In Press--------------
Percent Chance of Match for press is: 0.14
Percent Chance of Match for press is: 0.20
Percent Chance of Match for press is: 0.19
Percent Chance of Match for press is: 0.25
----------End Signals In Press------------
For Visual of the last signal comparison go to ./imageOutput/LiveComparison.png
----------Start Signals In Press--------------
Percent Chance of Match for press is: 0.93
Percent Chance of Match for press is: 0.93
Percent Chance of Match for press is: 0.97
Percent Chance of Match for press is: 0.90
Percent Chance of Match for press is: 0.88
Percent Chance of Match for press is: 0.44
----------End Signals In Press------------
For Visual of the last signal comparison go to ./imageOutput/LiveComparison.png


Graph Comparison Output for 97% Match: 







Conclusion: 


You have now walked through successfully reversing a toggle switch remote for a security gate. You took a raw signal and created a working device using only a Yardstick and RFCrack.  This was just a quick tutorial on leveraging the skillsets you gained in previous blogs in order to learn how to analyze  RF signals within embedded devices. There are many scenarios these same techniques could assist in.  We also covered a few new features in RF crack regarding logging, graphing and comparing signals.  These are just a few of the features which have been added since the initial release. For more info and other features check the wiki. 
Read more
  1. Pentest Tools Url Fuzzer
  2. Hacking Tools Download
  3. Pentest Tools For Mac
  4. Hacker Tools For Windows
  5. Hacking Tools 2019
  6. Hacker Hardware Tools
  7. Kik Hack Tools
  8. Underground Hacker Sites
  9. Pentest Box Tools Download
  10. Pentest Tools For Android
  11. Hacking Tools 2020
  12. Pentest Tools Bluekeep
  13. Hack Tools For Games
  14. Hacker Tools Online
  15. Pentest Tools Online
  16. Tools Used For Hacking
  17. Easy Hack Tools
  18. Hacking Tools And Software
  19. Pentest Tools Windows
  20. Hacking Tools Online
  21. Github Hacking Tools
  22. Wifi Hacker Tools For Windows
  23. World No 1 Hacker Software
  24. Pentest Tools Nmap
  25. Hacker Tools Free
  26. Pentest Tools Free
  27. Hacking App
  28. Hak5 Tools
  29. How To Hack
  30. Tools For Hacker
  31. Hack Tools Pc
  32. Termux Hacking Tools 2019
  33. How To Make Hacking Tools
  34. Hack Tools
  35. Pentest Tools
  36. Hacking Tools 2019
  37. Hacker Tools Free Download
  38. Hacking Tools For Games
  39. Hack Tools Mac
  40. Pentest Tools Linux
  41. Tools Used For Hacking
  42. Tools Used For Hacking
  43. Hack Tools Pc
  44. Pentest Tools Url Fuzzer
  45. Nsa Hacker Tools
  46. Pentest Tools Website Vulnerability
  47. Pentest Tools Apk
  48. Hack Rom Tools
  49. Hacking Tools Name
  50. Hacking Tools
  51. Hacker Tools Apk
  52. Hacker Tools 2019
  53. Pentest Tools For Windows
  54. World No 1 Hacker Software
  55. Hack Tools Download
  56. Pentest Tools Linux
  57. Hacks And Tools
  58. Hacker Tools 2020
  59. Hacking Tools Download
  60. What Are Hacking Tools
  61. Underground Hacker Sites
  62. Hack Tools For Windows
  63. Pentest Tools Subdomain
  64. Hacking Tools 2020
  65. Github Hacking Tools
  66. Hacker Tools 2020
  67. Hack Tools For Windows
  68. Best Pentesting Tools 2018
  69. Hacking Tools And Software
  70. Hack Tools For Pc
  71. Pentest Tools Download
  72. Hacking Tools Kit
  73. Hacker Tools 2019
  74. Pentest Tools Open Source
  75. Hacker Tool Kit
  76. Tools Used For Hacking
  77. Hacking Tools 2020
  78. Pentest Tools For Mac
  79. Ethical Hacker Tools
  80. Termux Hacking Tools 2019
  81. Hack Rom Tools
  82. Hack Tools Online
  83. Hacking Tools Kit
  84. Pentest Tools For Ubuntu
  85. Hacking Tools And Software
  86. Hacking Tools And Software
  87. Hack Tools Mac
  88. Pentest Tools For Windows
  89. Hack Tools For Mac
  90. Hacking Tools For Windows Free Download
  91. Hacking Tools Software
  92. Hack Tools For Pc
  93. Termux Hacking Tools 2019
  94. Hacking Tools For Kali Linux
  95. Hacking Tools Online
  96. Hacking Tools Software
  97. How To Make Hacking Tools
  98. Hacking Tools For Pc
  99. Pentest Tools List
  100. Hacking Apps
  101. Hacker Tools Mac
  102. Bluetooth Hacking Tools Kali
  103. Best Pentesting Tools 2018
  104. Hacker Tools Free Download
  105. Hack Tools
  106. Black Hat Hacker Tools
  107. Hacker
  108. How To Hack
  109. Hack Tools Download
  110. Hacker Tools List
  111. Nsa Hacker Tools
  112. Hacker Tools Github
  113. Pentest Tools List
  114. Hacker Tools For Mac
  115. Free Pentest Tools For Windows
  116. Pentest Tools Github
  117. Black Hat Hacker Tools
  118. Best Hacking Tools 2020
  119. Hack Tools Download
  120. Hack App
  121. Pentest Tools Find Subdomains
  122. Pentest Tools Nmap
  123. Hacker Security Tools
  124. Hacker Tools Apk Download
  125. Hack Tools 2019
  126. Hacking Tools Windows
  127. Hack Rom Tools
  128. Game Hacking
  129. Hack Tools
  130. Hacking Tools Github
  131. Pentest Tools Nmap
  132. Pentest Tools Free
  133. Hacker Tool Kit
  134. What Is Hacking Tools
  135. Pentest Tools For Android
  136. Termux Hacking Tools 2019
  137. Pentest Tools Website Vulnerability
  138. Hacker Tools Hardware
  139. Termux Hacking Tools 2019
  140. Hack Tool Apk No Root
  141. Wifi Hacker Tools For Windows
  142. Tools 4 Hack
  143. Hacker Tools For Mac
  144. Hack Tools
  145. Hacking Tools Kit
  146. Pentest Tools Website
  147. Pentest Tools Windows
  148. Usb Pentest Tools
  149. Hack Tools 2019
  150. Hack Rom Tools
  151. Hacker Tools 2019
  152. Hacking Tools Name
  153. Tools Used For Hacking
  154. Hacking Tools For Pc
  155. Best Hacking Tools 2020
  156. Hacking Tools For Pc
  157. Hack Tools Online
  158. Hack Tools For Ubuntu
  159. Pentest Tools Free
  160. Hacking Tools Windows 10
  161. Hacker
  162. Pentest Tools For Ubuntu
  163. Pentest Tools Tcp Port Scanner
  164. Hack Tools For Games
  165. Hacker Tools Mac
  166. Pentest Tools Review
  167. Nsa Hack Tools Download
  168. Hacker Tools For Mac

Nenhum comentário: