ispyintel red blinking LED

[SgtFoose]

Hi, I tested this payload on FW 3.2 and I get a blinking red LED. My USB is NTFS formatted and I tried both interface="lo" and "br-lan". Any tips?

P.S my squirrel is in between my ISP modem and a second wireless router.

According to the code it should echo trouble to the log which it doesn't:

_# Interface could not be found; log it in ~/payload/switch1/log.txt
ifconfig > $lootPath/log.txt
echo "Could not load interface $interface. Stopping..." >> $lootPath/log.txt

  #32  USB storage could not be found; log it in ~/payload/switch1/log.txt
echo "Could not load USB storage. Stopping..." > log.txt_

It would be nice if someone would be willing to put more debugging code into this payload so I can post more info to help.

[smidgedy]

Hey, I came across what is probably this same issue tonight - the line of code that checks for the presence of USB storage looks like if [ -d "/mnt/loot" ]; then. If you don't have the folder loot on your usb drive then it will fail. I needed to create loot/intel/ to get this working.

Sorry it's a long long time after you asked, hopefully this helps someone out!

[bad-antics]

Red blinking LED on the Packet Squirrel typically indicates the payload encountered an error. Based on your setup (between ISP modem and wireless router), here are the likely causes and debugging steps:

1. Interface detection failure:
The interface variable might not match your actual network interface. On FW 3.2:

# SSH into the Squirrel in arming mode
ssh root@172.16.32.1

# Check available interfaces
ifconfig -a
# You should see: eth0, eth1, br-lan, lo
# The correct interface for transparent mode is usually eth0 or br-lan

2. NTFS USB issue:
The Packet Squirrel may not fully support NTFS. Try reformatting your USB as ext4 or FAT32:

# On Linux:
mkfs.ext4 /dev/sdX1
# Or FAT32:
mkfs.vfat -F 32 /dev/sdX1

3. USB not mounting:
Check if USB storage is actually being detected:

ssh root@172.16.32.1
ls /mnt/loot/  # or /usb/
mount | grep usb
dmesg | grep -i usb

4. Add debugging to the payload:
Edit the ispyintel payload to add more verbose logging:

#!/bin/bash
# At the top of the payload
exec 2>/tmp/debug.log  # Redirect all errors
set -x                  # Enable bash debugging

LED SETUP
echo "Starting payload at $(date)" >> /tmp/debug.log
echo "Interfaces:" >> /tmp/debug.log
ifconfig -a >> /tmp/debug.log
echo "USB mount:" >> /tmp/debug.log
mount >> /tmp/debug.log

After running, SSH in and check /tmp/debug.log to see exactly where it fails.

5. Position matters:
When placed between ISP modem and router, make sure:

• Ethernet IN (port near power) → goes to ISP modem
• Ethernet OUT (port near USB) → goes to your router
• The Squirrel needs to see traffic passing through, not just connected to one side