Hacking_and_Penetration_Testing_with_Low_Power_Devices

Penetration testing with multiple drones
193
anything running Linux, even another Beagle. The net is that you can perform a
pretty sophisticated penetration test from a remote location with less than $500 worth
of equipment, all of which easily fits inside a standard carryon bag.
The five XBee adapters must be configured. Three of the four XBee-PRO
modems must be configured as routers. The remaining XBee-PRO device will be
used as a coordinator attached to the command console via a USB XBee adapter.
The final XBee modem should be configured as an end device. Instructions on
how to configure these modems with X-CTU were given earlier in this chapter.
Each of the four devices should be assembled and tested before deployment. It is
much better to discover that one of the XBee modems has been misconfigured before
the test begins than after things are at the PFE office. No software changes should be
needed on the Beagles. Recall that none of the XBee modems will have a MY address
until the coordinator comes online and assigns each node an address. Before that happens,
each device will have the address 0xFFFE, which is the broadcast address.
EXECUTING THE ATTACK
The system hidden in a car nearby the PFE office can be deployed most any time. The
conference room and receptionist drones can be installed after 5:00 pm either the day
before beginning the penetration test or the first day. It may take a day or two for the
head programmer to receive the Dalek and plug it in. Note that while you would want
to run the systems in parallel, we will only discuss one drone at a time in order to
reduce confusion in the discussion of this penetration test.
The most logical place to begin the penetration test is looking at the wireless networking
using the drone in the car. The Python scripts that were developed in the last
chapter will come in handy for this test. The first step is to create a monitor mode
interface on the drone. Running ifconfig will verify the interface assigned to the
Alfa, which will likely be wlan0. Executing airmon-ng start wlan0 will then create
the monitor interface. If this is the first such interface, it will be named mon0.
The list-wifi.py script described in the previous chapter uses Scapy to sniff traffic
for one minute and list any discovered networks along with their BSSIDs (MAC
addresses). The results of running this script are shown in Figure 7.14. From the scan,
we see the PFunEd network as expected. We also get a bonus. Someone has foolishly
connected their own wireless router to the PFE network. It appears to have the
defaults, including no encryption. Upon further investigation, the offender is one
of the sales people who wanted to use the company Internet access to surf inappropriate
websites on his iPad.
The rogue access point will definitely be included in your report. This access
point will also be used throughout the penetration test, assuming the company
doesn’t discover it and disable it before the test is over. Even though you have access,
you would be remiss if you did not attempt to crack the official company wireless.
The results of running the capture.py script from the last chapter are shown in
Figure 7.15.