Hacking_and_Penetration_Testing_with_Low_Power_Devices

168 CHAPTER 7 Building an army of devices
and you should be rewarded with a log-in prompt on the drone. When using a USB
XBee adapter, the port will likely be /dev/ttyUSB0.
This same technique can be used to control multiple drones one at a time. In order
to switch from one drone to another, the DL address on the command console XBee
modem must be set to match the MY address of the target drone. The steps to change
drones are as follows: First, type “+++” into the terminal program and do not press
enter. The modem will respond with “OK” after about a second. Second, change the
DL value to match the drone MY address by typing “ATDLnnnn,” where nnnn is the
drone MY address, and press enter. Third, write the results to the modem by typing
“ATWR” and pressing enter. Finally, exit command mode by typing “ATCN” and
pressing enter. All of these commands must be entered before the time-out value set
on the modem is reached and it automatically exits command mode.
The TTY method has a couple of advantages over using Python. First of all, no
programming is required. Once the XBee modems are configured and TTY services
are running on the drones, penetration testing may commence. Secondly, interactive
programs can be run using this method. Finally, if the command console is connected
to a drone and it goes out of range, it will still be connected when back in range.
While this method is simpler than the Python method to be described next, it is
not recommended for any penetration tests with more than just a handful of drones.
Even then, I would be inclined to use Python. Running interactive programs is nice,
but keep in mind that the maximum connection speed is 250 kbps. Noise on the wireless
connection can also be an issue. A big limitation is that communication is only
possible with one drone at a time. When running in API mode, the command console
can talk to multiple drones and noise is less of a problem because data are transmitted
in packets with checksums.
REMOTE CONTROL via PYTHON
Using API mode is the most desirable situation. There are a number of options on
how to accomplish this. If you have an excess amount of free time, you can write
your own XBee communication program in the language of your choice. There is
a Java XBee-API library available from https://code.google.com/p/xbee-api/. A
Python XBee and ZigBee module is also available at https://code.google.com/p/
python-xbee/.
Given Python’s popularity with penetration testers, it seems like the logical choice
for our purposes. The current version of the Python XBee module is 2.1.0 as of this
writing. Despite its name, the XBee module works with ZigBee modems as well.
The XBee module is very easy to use. The following code snippet demonstrates
how to send packets using this module. One thing to keep in mind when operating the
XBee modems in API mode is that the maximum packet size is 100 bytes:
import serial
from xbee import XBee