This project was created by Caleb Jones, Brandon Woodward, Zachary Cox, and Emmet Larson as a submission for the 2024 York College of Pennsylvania Hackathon. The project was selected as one of the winners, coming in second place in the Hardware category. The theme of the event was 'Matrix' and our team decided we wanted to create a USB device that can scrape files off a computer and remotely upload them to a web server which we hosted on a local network. The contents of the project were demonstrated in a controlled environment with consent of those whose computers we used the device on. That being said, we do not endorse the use of this software/hardware for illegal activities, nor are we responsible for individuals who do as such. This document will serve as an overview of what our project is and how we implemented the above features.
Our implementation used a Raspberry PI Zero 2 W and a Micro USB -> USB Type A device to interface with the computer. This device was selected for a multitude of reasons, though any PI Zero device which has OTG and a wireless network chip would work as well. Namely, the PI Zero 2 W is extremely small, and could be convincingly disguised as a USB flash drive. For the casing, we 3D printed a small housing for the PI which still allowed us to access everything on the device we required. To interface with the device, we used Putty which allows you to plug the IP of the PI Zero device in and directly interface with the console. This is what allowed allowed us to write and execute our scripts on the PI Zero remotely from our other devices.
One issue we ran into around this point in the project is once the PI Zero is plugged into the victim's computer, how do we get the files off and into our web server? Our workaround for this used the PI Zero's OTG feature, which allows the device to be recognized as a variety of other USB devices. We figured that the easiest way would be to have OTG make the victim's computer recognize our PI Zero as a keyboard, that way we can send commands to the PI Zero to press certain keys in a specific order, and through the Windows CMD send the desired files to our web server.
To get the CMD to send the files to our computer, we opted to use inline code execution. For the purpose of this project, we did not forcibly install python on the victim computer, but for an actual implementation of such a device, that would be the first step. As the CMD allows a user to directly run code inline, all a keyboard would have to do is type: "python" press enter, then type "exec(script you want to execute)" and press enter. We created two scripts for the CMD to execute, one which creates a background animation using the Pygame library. The second is the scraper, which navigates to a predetermined file path in the victims computer. A real implmentation of this device would also have to automatically navigate to the correct folder using a recursive file navigation tool such as Glob. The script then gets a reference to all the files of a certain extension (in our case, we chose .txt), connects to our web server, and uploads each file. As a little joke, we then have the script open notepad and write a little message for the victim; this was really as a proof of concept that any future implementation of this could really do nearly anything that a regular user could do using a keyboard.
The Python file that we exectued on the PI is included above in the repository, but I will briefly go over what it actually does and how a user could implement something similar. Our file begins with a dictionary that contains all the HID Codes (pg. 53) for every key that we need to press in our sequence, along with some other keys that could be useful in the future. We then define some methods that read a full string, determine if the shift key needs to be held down on a key press (as the math is different for shift/non-shift characters), calculate the proper code for the desired key, and sends the command to the PI Zero to press a certain key. Another issue we ran into around this point, is that more often than not, the script iterates through the very long strings we were feeding the reader, that it sometimes would skip over characters, or miscalculate what letter a character would be (often times holding shift when it shouldn't). To work around this, we added some time.sleep() function calls around the script. This is by far not the most optimal/efficient workaround to get the script to execute more accurately, but again it worked for the sake of our project. After the dictionary and all the methods are defined, we defined a few strings which contained inline versions of the Python scripts we wanted to execute. We used https://jagt.github.io/python-single-line-convert/ to convert our python scripts into one line. If your new script includes '\n' you will have to add another backslash so the keyboard knows its a literal back slash and not the enter key, ie. '\n'. Also if you have any quotation marks in your python string you will need to add \ in front of them so it the program knows they are not ending your string. These new strings then get fed into our methods we defined earlier, and with some time.sleep() calls in-between each call, and the PI Zero will then execute the appropriate keystrokes on the victim's machine. And with that, our device now connects to our server machine, executes the pre-defined Python scripts, and sends the desired files through the CMD and back to our server.
To act as a sort-of collection point for our PI Zero, we wrote a little web server that hosts on the local wifi and acts as an endpoint for the device to send the files to. This means that for the whole eco-system to function, both the server device and the victim device need to be connected to the same network. Our web server contains a receptical that allows a user connecting to it to download any of the files that have been grabbed by the machine. A future implementation of this project may also include functionality on the website to reprogram the PI Zero device, specifying a certain file extension type, number of files, or any number of other features. We also added a basic username/password system for the site to ensure while we were demonstrating that no one connected to the website and uploaded files.