0
  • 聊天消息
  • 系统消息
  • 评论与回复
登录后你可以
  • 下载海量资料
  • 学习在线课程
  • 观看技术视频
  • 写文章/发帖/加入社区
会员中心
创作中心

完善资料让更多小伙伴认识你,还能领取20积分哦,立即完善>

3天内不再提示

AutoGadgetFS:一款针对USB设备的安全测试工具

倩倩 来源:Alpha_h4ck 作者:Alpha_h4ck 2022-09-05 15:49 次阅读

关于AutoGadgetFS

AutoGadgetFS是一款开源框架,它可以帮助广大研究人员在无需深入了解USB协议的情况下对USB设备以及相关的主机/驱动器/软件进行评估。该工具基于Python 3开发,并且使用了RabbitMQ和WiFi访问来帮助研究人员对远程USB设备进行安全审计。在ConfigFS的帮助下,AutoGadgetFS允许用户迅速克隆和模拟设备而无需深入研究每一个实现细节。除此之外,该框架还允许用户创建自己的模糊测试器。

功能介绍

轻松查找、选择并连接到USB设备。

模拟任何USB HID设备。

以中间件设备身份执行AGFS嗅探HID设备(将通信保存到磁盘)。

设备嗅探(任何设备)。

多个Fuzzer允许您对设备或主机进行模糊测试。

随机Fuzzer(具有固定或随机长度的数据包)。

智能Fuzzer,可以从以前的USB通信中学习。

可以告诉Fuzzer哪些字节要模糊化,使包的其余部分保持不变。

小工具Fuzzer。

顺序Fuzzer。

控制传输枚举器。

从文件中重放数据包。

从保存的USBLyzer捕获重放数据包。

显示数据包的可视方式,以便于对通信信息进行逆向分析。

DFU模式下的设备警报,或者设备泄漏信息。

支持对USB设备和主机进行远程调试。

监控突然的界面变化。

工具要求

一台运行了Linux的主机(Debian/Ubuntu/Kali);

支持WiFi访问的树莓派Raspberry Pi Zero;

目标设备选择:虚拟机或单一主机;

两条USB线缆;

目标USB设备;

硬件调试器(可选);

工具配置图

设备测试

8293c79c-2c5b-11ed-ba43-dac502259ad0.jpg

设置中间件

82b3ca06-2c5b-11ed-ba43-dac502259ad0.jpg

设置中间件并支持设备调试

82ce6c62-2c5b-11ed-ba43-dac502259ad0.jpg

工具安装

Linux设备

sudo apt install python3 ipython3 git python3-pip rabbitmq-server dfu-util

sudo service rabbitmq-server start

git clone https://github.com/ehabhussein/AutoGadgetFS

cd AutoGadgetFS

sudo -H pip3 install -r requirements.txt

sudo python3 -m pip install prompt-toolkit~=2.0

sudo rabbitmq-plugins enable rabbitmq_management

http://localhost:15672/ to reach the web interface

sudo rabbitmqctl add_user autogfs usb4ever

sudo rabbitmqctl set_user_tags autogfs administrator

sudo service rabbitmq-server restart

安装完成后,请按照下列方式测试安装结果

sudo ipython3

Python 3.7.7 (default, Apr  1 2020, 1352)

Type 'copyright', 'credits' or 'license' for more information

IPython 7.9.0 -- An enhanced Interactive Python. Type '?' for help.

In [1]: import libagfs

In [2]: x = libagfs.agfs()

***************************************

AutoGadgetFS: USB testing made easy

***************************************

Enter IP address of the rabbitmq server: 127.0.0.1

In [3]: exit

sudo `python3` agfsconsole.py

***************************************

AutoGadgetFS: USB testing made easy

***************************************

Enter IP address of the rabbitmq server: 127.0.0.1

Give your project a name?!:

工具运行截图

中间人攻击

82e73f6c-2c5b-11ed-ba43-dac502259ad0.jpg

USB设备模糊测试

8382367a-2c5b-11ed-ba43-dac502259ad0.jpg

主机端基于代码覆盖的模糊测试

839deea6-2c5b-11ed-ba43-dac502259ad0.jpg

基于字节的模糊测试

83b66198-2c5b-11ed-ba43-dac502259ad0.jpg

AutoGadgetFS命令行终端

83cd8dd2-2c5b-11ed-ba43-dac502259ad0.jpg

基于流量学习的智能Fuzzer

In [44]: x.devSmartFuzz(engine="smart",samples=5,filename="/home/raindrop/PycharmProjects/AutoGadgetFs/binariesdb/Nud-Nuvoton-1046-20764-1590421333.5169587-Nuvoton-1046-20764-1590421600.8067

...: 274-device.bin")                               

[+]General Statistics

Full charset                : !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[]^_`abcdefghijklmnopqrstuvwxyz{|}~

Discarded charset           : !"#$%&'()*+,-./:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[]^_`ghijklmnopqrstuvwxyz{|}~

Final charset               : 0123456789abcdef

Word Length                 : 128

Lower Case index usage      : 92%

Lower Case index locations  : [1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 121, 122, 124, 125, 127]

Upper Case index usage      : 0%

Upper Case index locations  : []

Digit index usage           : 96%

Digit index locations       : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 123, 126]

NonAN index usage           : 0%

NonAN index locations       : []

Counter statistics          : Uppercase: 0 , Lowercase: 133071, Digits:212017 , NonAlphaNumeric:0

All char Frequencies        :

character:5 found:5012 times

character:2 found:22563 times

character:3 found:12197 times

character:8 found:15008 times

character:4 found:13275 times

character:0 found:98056 times

character:1 found:17861 times

character:f found:87823 times

character:d found:7221 times

character:7 found:9614 times

character:a found:11148 times

character:6 found:10472 times

character:b found:8189 times

character:9 found:7959 times

character:c found:9172 times

character:e found:9518 times

***********************

generated:5 Packets

***********************

Out[44]:

['5608305852bf2ffd61770e2c827542f20be0b0fcba09db916bd07e1734b04cb0352b1d278068064d19f033bfad6fa90e53d865693fd4fee0214f00000eb0aa2c',

 '3b083595f276e2f1353a535c32f0f59516fc9328f7673bb80262c4da11c93683afe6dcff8a7a83018d78f41498a0da4d141ebd39c361b1724f2b00000eb0aa2c',

 '0120961963495c4dab9470738b497eddde07b0d70b357795ad9554d7964761969a6d997205e17eada6fa84eb33dcfb11412f75e04c195001283900000eb0aa2c',

 '091065d52127bbc6e840e02f8e1316f1c4d9c92a23931c00cdbb8c158368852ef8fabd461b98812b51ec84e1ccc5c04aaa366fbafabec623bd3500000eb0aa2c',

 '7300cc61151b7af27a578e766f49bebb2de68c48b37a00df1030ae464f456928eedd035303e697208bf58217af728a2a346fda5c8aef0335b82e00000eb0aa2c'

In [46]: x.edap.packets                                                                                                                                                                       

Out[46]:

['5608305852bf2ffd61770e2c827542f20be0b0fcba09db916bd07e1734b04cb0352b1d278068064d19f033bfad6fa90e53d865693fd4fee0214f00000eb0aa2c',

 '3b083595f276e2f1353a535c32f0f59516fc9328f7673bb80262c4da11c93683afe6dcff8a7a83018d78f41498a0da4d141ebd39c361b1724f2b00000eb0aa2c',

 '0120961963495c4dab9470738b497eddde07b0d70b357795ad9554d7964761969a6d997205e17eada6fa84eb33dcfb11412f75e04c195001283900000eb0aa2c',

 '091065d52127bbc6e840e02f8e1316f1c4d9c92a23931c00cdbb8c158368852ef8fabd461b98812b51ec84e1ccc5c04aaa366fbafabec623bd3500000eb0aa2c',

 '7300cc61151b7af27a578e766f49bebb2de68c48b37a00df1030ae464f456928eedd035303e697208bf58217af728a2a346fda5c8aef0335b82e00000eb0aa2c']

帮助模式

In [15]: x.help("")                                
Currently supported methods:
__________________________________________________________________________________________________________________________________________________________________

Method               ||-->Description

----------------------------------------------------------------------------------------------------------------------------

MITMproxy            ||-->This method creates a connection to the RabbitMQ and listen on received messages on the todev queue

____________________________________________________________________________________________________________________________

MITMproxyRQueues     ||-->This method reads from the queue todev and sends the request to the device its self.
____________________________________________________________________________________________________________________________

SmartFuzz            ||-->This method is generates packets based on what it has learned from a sniff from either the host or the device
____________________________________________________________________________________________________________________________

chgIntrfs            ||-->This method allows you to change and select another interface
____________________________________________________________________________________________________________________________

clearqueues          ||-->this method clears all the queues on the rabbitMQ queues that are set up

____________________________________________________________________________________________________________________________

clonedev             ||-->This method does not need any parameters it only saves a backup of the device incase you need to share it or use it later.

____________________________________________________________________________________________________________________________

createctrltrsnfDB    ||-->creates a SQLite database containing values that were enumerated from control transfer enumeration

____________________________________________________________________________________________________________________________

createdb             ||-->create the sqlite table and columns from usblyzer captures

____________________________________________________________________________________________________________________________

decodePacketAscii    ||-->This method decodes packet bytes back to Ascii

____________________________________________________________________________________________________________________________

describeFuzz         ||-->This method allows you to describe a packet and select which bytes will be fuzzed

____________________________________________________________________________________________________________________________

devEnumCtrltrnsf     ||-->This method enumerates all possible combinations of a control transfer request

____________________________________________________________________________________________________________________________

devReset             ||-->This method Resets the device

____________________________________________________________________________________________________________________________

devWrite             ||-->To use this with a method you would write to a device make sure to run the startSniffReadThread(self,endpoint=None, pts=None, queue=None,channel=None)

____________________________________________________________________________________________________________________________

devctrltrnsf         ||-->This method allows you to send ctrl transfer requests to the target device

____________________________________________________________________________________________________________________________

deviceInfo           ||-->gets the complete info only for any usb connected to the host

____________________________________________________________________________________________________________________________

deviceInterfaces     ||-->get all interfaces and endpoints on the device

____________________________________________________________________________________________________________________________

devrandfuzz          ||-->this method allows you to create fixed or random size packets created using urandom

____________________________________________________________________________________________________________________________

devseqfuzz           ||-->This method allows you to create sequential incremented packets and send them to the device

____________________________________________________________________________________________________________________________

findSelect           ||-->This method enumerates all USB devices connected and allows you to select it as a target device as well as its endpoints

____________________________________________________________________________________________________________________________

help                 ||-->AutogadgetFS Help method

____________________________________________________________________________________________________________________________

hostwrite            ||-->This method writes packets to the host either targeting a software or a driver in control of the device

____________________________________________________________________________________________________________________________

hstrandfuzz          ||-->this method allows you to create fixed or random size packets created using urandom and send them to the host queue

____________________________________________________________________________________________________________________________

monInterfaceChng     ||-->Method in charge of monitoring interfaces for changes this is called from def startMonInterfaceChng(self)

____________________________________________________________________________________________________________________________

newProject           ||-->creates a new project name if you were testing something else

____________________________________________________________________________________________________________________________

releasedev           ||-->releases the device and re-attaches the kernel driver

____________________________________________________________________________________________________________________________

removeGadget         ||-->This method removes the gadget from the raspberryPI

____________________________________________________________________________________________________________________________

replaymsgs           ||-->This method searches the USBLyzer parsed database and give you the option replay a message or all messages from host to device

____________________________________________________________________________________________________________________________

searchmsgs           ||-->This method allows you to search and select all messages for a pattern which were saved from a USBlyzer database creation

____________________________________________________________________________________________________________________________

setupGadgetFS        ||-->setup variables for gadgetFS : Linux Only, on Raspberry Pi Zero best option

____________________________________________________________________________________________________________________________

showMessage          ||-->shows messages if error or warn or info

____________________________________________________________________________________________________________________________

sniffdevice          ||-->read the communication between the device to hosts

____________________________________________________________________________________________________________________________

startMITMusbWifi     ||-->Starts a thread to monitor the USB target Device

____________________________________________________________________________________________________________________________

startMonInterfaceChng||-->This method Allows you to monitor a device every 10 seconds in case it suddenly changes its interface configuration.

____________________________________________________________________________________________________________________________

startQueuewrite      ||-->initiates a connection to the queue to communicate with the host

____________________________________________________________________________________________________________________________

startSniffReadThread ||-->This is a thread to continuously read the replies from the device and dependent on what you pass to the method either pts or queue

____________________________________________________________________________________________________________________________

stopMITMusbWifi      ||-->Stops the man in the middle thread between the host and the device

____________________________________________________________________________________________________________________________

stopMonInterfaceChang||-->Stops the interface monitor thread

____________________________________________________________________________________________________________________________

stopQueuewrite       ||-->stop the thread incharge of communicating with the host machine

____________________________________________________________________________________________________________________________

stopSniffing         ||-->Kills the sniffing thread strted by startSniffReadThread()

____________________________________________________________________________________________________________________________

usblyzerparse        ||-->This method will parse your xml exported from usblyzer and then import them into a database

____________________________________________________________________________________________________________________________

In [16]: x.help("findSelect")                                                                                                                                                                 

****

[+]Help for findSelect Method:

[-]Signature: findSelect(self, chgint=None)

[+]findSelect Help:

This method enumerates all USB devices connected and allows you to select it as a target device as well as its endpoints

审核编辑 :李倩
声明:本文内容及配图由入驻作者撰写或者入驻合作网站授权转载。文章观点仅代表作者本人,不代表电子发烧友网立场。文章及其配图仅供工程师学习之用,如有内容侵权或者其他违规问题,请联系本站处理。 举报投诉
  • usb
    usb
    +关注

    关注

    60

    文章

    7900

    浏览量

    264003
  • 测试器
    +关注

    关注

    0

    文章

    54

    浏览量

    26151
  • 开源框架
    +关注

    关注

    0

    文章

    32

    浏览量

    9408

原文标题:AutoGadgetFS:一款针对USB设备的安全测试工具

文章出处:【微信号:技术让梦想更伟大,微信公众号:技术让梦想更伟大】欢迎添加关注!文章转载请注明出处。

收藏 人收藏

    评论

    相关推荐

    嵌入软件单元/集成测试工具专业分析

    引言 在现代软件开发过程中,单元测试作为确保代码质量的重要环节,得到了广泛的关注和应用。随着嵌入式系统的复杂性日益增加,对高效、可靠的单元测试工具的需求也愈加迫切。WinAMS作为一款专为嵌入
    的头像 发表于 11-19 16:41 155次阅读

    CAN总线测试工具选择与使用

    1. CAN分析仪 CAN分析仪是种高级的测试工具,能够实时捕获和分析CAN总线上的数据。它们通常具备以下功能: 数据捕获和存储 实时数据显示 信号诊断和错误检测 网络参数配置 模拟CAN消息发送 2. CAN接口卡 CAN接口卡是
    的头像 发表于 11-12 10:16 214次阅读

    是德科技为FiRa2.0认证版本提供UWB设备致性测试工具

    近日,是德科技(Keysight Technologies)宣布了项重要进展,该公司已正式为最新发布的FiRa 2.0认证版本中的物理层(PHY)致性测试提供了全面的验证测试工具
    的头像 发表于 08-14 11:20 505次阅读

    新品发布 | 多通道车载以太网仿真测试工具

    重磅推出多通道车载以太网/CANFD/LIN仿真测试工具—TC1054Pro产品助力行业进程。TOSUN01产品简介TC1054Pro是同星智能推出的一款多通道车
    的头像 发表于 07-27 08:21 843次阅读
    新品发布 | 多通道车载以太网仿真<b class='flag-5'>测试工具</b>

    CAN总线测试工具的主要功能

    和分析CAN帧: CAN测试工具能够捕获CAN总线上的CAN帧,并进行详细的分析。 这包括检测报文、过滤报文、发送报文等。 常见的工具如Canalyser、Canoe、Canalyzer等,都具备这
    的头像 发表于 06-25 16:02 996次阅读

    新加坡推出Project Moonshot -- 这是一款生成式人工智能测试工具包,用于应对LLM安全和安保挑战

    新加坡2024年6月3日 /美通社/ -- 新加坡通讯及新闻部部长Josephine Teo 女士推出了AI Verify- Project Moonshot,这是个易于使用的测试工具包,旨在
    的头像 发表于 06-03 19:59 210次阅读
    新加坡推出Project Moonshot -- 这是<b class='flag-5'>一款</b>生成式人工智能<b class='flag-5'>测试工具</b>包,用于应对LLM<b class='flag-5'>安全</b>和安保挑战

    工具工具——映射与调度、模拟与验证、开发与测试工具

    本篇文章将重点介绍工具链的工具相关知识,我们将从工具链的基本概念出发,重点介绍工具链中的映射和调度工具、模拟与验证
    的头像 发表于 05-16 14:30 2531次阅读
    <b class='flag-5'>工具</b>链<b class='flag-5'>工具</b>——映射与调度、模拟与验证、开发与<b class='flag-5'>测试工具</b>

    嵌入软件单元测试工具的作用

    嵌入软件单元测试工具是现代软件开发过程中不可或缺的环。它的作用在于帮助开发人员对软件中的各个单元进行测试,以确保其功能的正确性和稳定性。单元测试是软件开发过程中的
    的头像 发表于 04-23 15:31 410次阅读
    嵌入软件单元<b class='flag-5'>测试工具</b>的作用

    一款适合嵌入式工程师使用的在线工具

    一款适合嵌入式工程师使用的在线工具工具有如下功能,如下图所示: 1. 报文校验功能,如下图所示 2. UDP服务端测试工具:该UDP服务端
    发表于 04-09 22:20

    DEKRA被CSA指定为Zigbee统一测试工具开发和优化新功能和测试用例

    DEKRA德凯被CSA联盟(Connectivity Standards Alliance,CSA)指定负责为Zigbee统一测试工具(Zigbee Unified Test Harness,ZUTH)开发和优化新功能和测试用例。
    的头像 发表于 04-09 14:10 482次阅读

    如何在CY8CPROTO-062S2-43439中配置AIROC蓝牙测试和调试工具CYW43439?

    如何在 CY8CPROTO-062S2-43439 中配置 AIROC 蓝牙测试和调试工具CYW43439? 该设备在我的电脑中被检测到 KitProg3 USB-UART,并且还显示
    发表于 02-29 08:14

    Cybellum—信息安全测试工具

    Cybellum是一款信息安全测试与管理工具,帮助汽车OEM及其供应商在整个汽车生命周期内大规模评估和降低安全风险。它无需访问源代码,通过C
    的头像 发表于 01-26 16:48 598次阅读
    Cybellum—信息<b class='flag-5'>安全</b><b class='flag-5'>测试工具</b>

    Tessy—嵌入式软件单元测试/集成测试工具

    Tessy源自戴姆勒—奔驰公司的软件技术实验室,由德国Hitex公司负责销售及技术的支持服务,是一款专门针对嵌入式软件进行单元/集成测试工具。它可以对C/C++代码进行单元、集成
    的头像 发表于 01-15 14:39 779次阅读
    Tessy—嵌入式软件单元<b class='flag-5'>测试</b>/集成<b class='flag-5'>测试工具</b>

    网络安全测试工具有哪些类型

    网络安全测试工具是指用于评估和检测系统、网络和应用程序的安全性的类软件工具。这些工具可以帮助组
    的头像 发表于 12-25 15:00 1215次阅读

    redis集群性能测试工具有哪些

    Redis是种高性能的内存键值存储系统,它被广泛应用于各种互联网应用和大规模的数据存储中。为了评估Redis在不同场景下的性能,我们需要使用些性能测试工具来对Redis集群进行基准测试
    的头像 发表于 12-04 11:36 756次阅读