Hacking Tutorials

Offensive Security Tool: DroneSploit

Offensive Security Tool: DroneSploit || This CLI framework is based on sploitkit and is an attempt to gather hacking techniques and exploits especially focused on drone hacking. For the ease of use, the interface has a layout that looks like Metasploit.

Setup

This project is available on PyPi and can be simply installed using Pip:

pip3 install dronesploit

Basics

Interface

 

DRONESPLOIT COMMAND EXAMPLES

Modules

This example shows an example of module for DroneSploit aimed to change the password or the SSID of a particular model of drone.

DRONESPLOIT MODULE EXAMPLE

Setup

This project is available on PyPi and can be simply installed using Pip:

pip3 install dronesploit

1. Startup

$ python3 main.py --help
usage: ./main.py [--dev] [-h] [-v]

Main

optional arguments:
  --dev          development mode (default: False)

extra arguments:
  -h, --help     show this help message and exit
  -v, --verbose  verbose mode (default: False)

The console is started using the launcher main.py. It may ask for sudo rights as it must have the permission for setting WiFi interfaces.

$ python3 main.py
[sudo] password for user:

[...]

At startup, a banner is shown and a summary of the available modules is shown.

68747470733A2F2F64686F6E6474612E6769746875622E696F2F64726F6E6573706C6F69742F646F63732F696D672F64726F6E6573706C6F69742E706E67

Some requirements can be unsatisfied at startup like in the picture above. The command show issues allows to identify how this can be fixed.

2.1 From the root console

 

dronesploit > help
[...]

This will display multiple sections in function of the context ;

  • General commands are always displayed. Example: Getting help in DroneSploit – General commands

HELP GENERAL

  • Level-specific commands are displayed according to the current console. Example: Getting help in DroneSploit – Specific commands:

HELP OTHERS

2.2 From the project console

dronesploit > select test
dronesploit[test] > help
[...]

Now being into the context of a project, we now see the general commands again but with the project commands as the section for level-specific commands; Example: Getting help in DroneSploit – Project-level commands:

HELP PROJECT

2.3 From the module console

 

dronesploit[test] > use auxiliary/wifi/deauth
dronesploit[test] auxiliary(wifi/deauth) > help
[...]

Now being into the context of a module, we now see the general commands again but with the module commands as the section for level-specific commands; Example: Getting help in DroneSploit – Module-level commands:

HELP MODULE

3. Listing available modules

This can be achieved by executing the following command:

MODULES

In the screenshot above, one can see two modules that are disabled, like shown at startup.

4. Enabling the WiFi monitor mode

The toggle command allows to toggle the WiFi mode for an interface. It autocompletes through the list of WiFi interfaces present on the system.

MONITOR MODE

When executed, it switches between the managed and monitor modes

MANAGED MODE

5. Scanning for targets

The scan command allows to quickly scan for targets (and requires a WiFi interface in monitor mode).

SCANNING

The targets command then allows to list the discovered targets and their characteristics.

TARGETS LIST

Targets are valid during a period of 5 minutes, meaning that they will still be displayed after this period, but when using the scan command again, the list will be updated (and targets that are not in the vicinity anymore will disappear).

6. Breaking into a target

Now that we have a target, we can start an attack. For this purpose, we start the appropriate attack module. Note that, in the example hereafter, the ESSID and INTERFACE options are automatically filled in with the current information.

WPA2 PSK ATTACK

The attack succeeded and the password is then known in the targets list.

TARGETS WITH PASSWORD

Sadly, lots of light commercial drones have the same default password ; the password command allows to fill in the password without having to run an attack.

TARGETS PASSWORD

7. Connecting to the target

At this point, we have a password for a target, we can know connect to it using the connectcommand.

TARGETS CONNECT

Like shown in the screenshot above, the targets list has now a row highlighted in bold to show that we are connected to this target.

We can also connect to another target.

TARGETS CONNECT ANOTHER

In the case herebefore, we call a module for which the required model of target can not be found as connected to the attack machine, therefore raising a warning. If we show the options for this module, we get several required values that are not filled in.

TARGETS MODULE REQUIRED OPTIONS

8. Executing a module

We can now use a module for the connected drone using the use command.

TARGETS MODULE OPTIONS

In this example, one can see that the value for the TARGET option is automatically filled in. The module is then directly ready to run.

Finally, we can run the module by using the run command.

TARGETS MODULE RUN

 

Offensive Security Tool: DroneSploit  Download

3 Comments