BadUsb nexus 7 2013 Lte

[Skycrazy]

I've been trying to resolve this issue for many hours. BadUsb creates the rndis on windows 7 but just displays the cable unplugged symbol. I've tried on different laptops, different cables and still the same issue. Tried reinstalling nethunter, reflashing nexus and reinstalling. Just updated with android 4.4.4 rom and installed nethunter. Reinstalled windows 7 on laptop. All with same result, also tried on windows 8 laptop. Would you possibly have any ideas how I could resolve this please.

[Skycrazy]

Maybe answering my own issue, but is it anything to do with the nexus 7 Lte wifi not being supported for these attacks?

[binkybear]

@Skycrazy - I made a note of the issue you are having in the forums also. Have you tried running tcpdump or tshark to see if any traffic is being generated?

[Skycrazy]

No traffic, muts mentioned to me about tethering. I think he might be right. I found this on https://code.google.com/p/android-developer-preview/issues/list
issue 48 - now closed 44 hours ago. would this possibly be the answer?

[binkybear]

Are you seeing interface rndis0 being created on your device? If so, what is the ip listed?

[Skycrazy]

Using kali terminal. ip link show - no rndis0 , but usb0. No ip address. Shows in windows network connections but displays network cable unplugged. Using tethering hotspot - ip link show , usb0 with ip address. Both devices using same driver in windows 7 yet badusb, no ip and cable un plugged. Hope this makes sense I tend to ramble and get in knots. Much appreciate. Your help.

[Skycrazy]

Apologies I meant with ifconfig -a not ip link show

[offensive-security]

That would explain a lot, although really really weird. You would need to exchange usb0 with any instances of rndis0 in all your scripts for things to work. I wonder why the interface is named differently?

[Skycrazy]

After reflashing and installing a few times using the rootkits, I decided to use the installer you just released, makes installing a lot easier. How ever same out come, changing all scripts to usb0 would this be the best course of action, would this have any affect on any other functions? I'd still like to know why this happens especially if its user error on my part. I'd like to know where I've gone wrong , also if I just change interface in BadUsb to usb0 should it have any effect? Can always see adapter created on win7 machine but never gets an ip. Many thanks for your help

[Skycrazy]

Just a thought would it be possible to rename usb0 to rndis0 at beginning of script and returning to default on exit or something along those lines.

[binkybear]

@Skycrazy - I just tested on N72013 and I appear to be having same issue as you. I don't see usb0 up though. Could you do me a favor and try starting badusb from command line and tell me if it just loops at waiting for the interface?

su
start-badusb

The commands are outside kali (chroot).

[Skycrazy]

BinkyBear I can confirm looping waiting for interface rndis0.

[Skycrazy]

su
Start-bad
Start-bad not found

/sdcard/files/startbadusb.sh

Waiting for interface rndis0 looping

[binkybear]

Looking at the dmesg the usb0 is def the one being assigned the interface (which you mentioned). I've replaced interface var in start-badusb (sorry about earlier wrong name). The interface starts/is assigned IP...but no luck with recognizing it.

The kernel looks good and has rndis enabled so I do think its related to usb0. Will update with more testing.

** edit 2 **

Noticed if you manually set usb tethering it creates usb0 also.

[Skycrazy]

Hey BinkyBear, yes same for me with the tethering- usb0. Was just reading some articles about similar issues with other device's, not related to nexus or nethunter. Would a temporary fix(or permanent) be possible using a udev rule to change from usb0 to rndis0. one of the articles I read claimed this happened because of a random mac being assigned at boot in kernal ? ?

[binkybear]

I can look into that. If you have a link to that article that would be interesting also.

[Skycrazy]

https://bugs.launchpad.net/linux-linaro/+bug/622429

Just realised it was a bug report on launchpad, ill dig through the numerous tabs and book marks I've got open if you think this could be helpful.

[Skycrazy]

https://bbs.archlinux.org/viewtopic.php?id=182369

[offensive-security]

I don't think this is a bug per-se. Try the following:

1. get a root shell on your nexus7 device.
2. our of interest, please post the output of getprop ro.product.board
3. mount -o rw,remount /system
4. change the INTERFACE variable in /system/xbin/start-badusb to usb0 instead of rndis0.
5. change the interface variable in /data/local/kali-armhf/etc/dnsmasq.conf to usb0.
6. run start-badusb in console and tell us how it went.

[Skycrazy]

Hey, getprop ro.product.board. results in deb

Using other commands resulted in connection with win 7

Default gateway 10.0.0.1
Default gateway 192.168.0.1

[offensive-security]

See if you can apply this patch to start-badusb:

diff --git a/flash/system/xbin/start-badusb b/flash/system/xbin/start-badusb
index 9fc19f2..5e7e0d0 100755
--- a/flash/system/xbin/start-badusb
+++ b/flash/system/xbin/start-badusb
@@ -1,5 +1,13 @@
 #!/system/bin/sh

+if [ `getprop ro.product.board` == "deb" ];then 
+        echo "Using usb0 Interface"
+        INTERFACE=usb0
+else
+        echo "Using rndis0 Interface"
+        INTERFACE=rndis0
+fi
+
 TMPDIR=/data/local/tmp
 mkdir -p $TMPDIR
 UPSTREAM_NS=8.8.8.8
@@ -33,10 +41,9 @@ echo 1 > /sys/devices/virtual/android_usb/android0/enable
 # Check whether it has applied the changes
 cat /sys/devices/virtual/android_usb/android0/functions
 cat /sys/devices/virtual/android_usb/android0/enable
-INTERFACE=rndis0

 # Wait until the interface actually exists
-while ! busybox ifconfig $INTERFACE > /dev/null 2>&1;do
+while ! busybox ifconfig $INTERFACE up;ifconfig $INTERFACE > /dev/null 2>&1;do
     echo Waiting for interface $INTERFACE
     busybox sleep 1
 done

With this patch and /data/local/kali-armhf/etc/dnsmasq.conf set to usb0, can you confirm that BadUSB works for you ?

[Skycrazy]

Having a brain freeze, could you give me commands to install patch please. Many thanks

[offensive-security]

Try this:

1. get root shell on your android
2. mount -o rw,remount /system
3. cd /system/xbin/ && rm start-badusb
4. curl -k -O https://raw.githubusercontent.com/offensive-security/kali-nethunter/rndis0-issues/flash/system/xbin/start-badusb
5. chmod 755 start-badusb

Don't forget to have interface=usb0 in /etc/dnsmasq.conf in the chroot.

[Skycrazy]

sorry for late reply, now usb0 shows in nethunter panel. Is created on windows 7. When started from Terminal. Also on windows asks for select network location?(home/worknet/publicnetwork). doesn't work from start badusb in webserver.

[binkybear]

harmon25 was able to get it working in the forums:

https://forums.kali.org/showthread.php?22918-BadUSB-tutorial-doesn-t-work-for-me&p=37955&viewfull=1#post37955

[Skycrazy]

Great news. Just read forum, thanks for everyones hard work. Much respect binkybear offensive-security and Harmon25.

[Skycrazy]

Just a quick comment. Forum method didn't work for me- however offensive-securitys method here enables me to run from terminal. Also starting tcpdump etc with -i usb works from terminal as kali menu doesn't find device. Thanks