HIDra

An embedded firmware command and control server.

Communication

Commander : Textual Application

Server : Flask Application

Client : Custom ESP-32 Firmware

Setup

Commander (app/app.py)

Change BASE_URL if the C2 server is on a separate server. Then, simply run the following:

> python app.py

Server (server.py)

Recommendation is to run this with a public IP address for callbacks.

1. Create a virtual environment (Windows)

python -m venv .venv

./.venv/Scripts/activate.ps1

2. Install flask with dependencies

pip3 install flask

pip install -U Flask-SQLAlchemy

3. Run the flask app

flask run --app server.py --host=0.0.0.0 -p 80

Client (emb-firmware/)

Firmware was designed for the LilyGo T-Dongle S3 which is just an ESP32-S3 board with direct UART communication. Once the board is connected, do the following.

1. Install the platformio extension on VSCode

2. Open the emb-firmware directory in VSCode

3. Make a copy of wifi_setup.h.sample and name it wifi_setup.h

4. Change based on the known information. CALLBACK_IP is the only required variable. WIFI_SSID and WIFI_PASSWORD are useful but as long as the target host is connected to WiFi, the USB will find it

5. Upload firmware to the board with auto serial port setting

6. Plut in the USB to the target

Future Work

• Stream keyboard input directly to usb
• In-memory executables
• Drop reverse shell (with AMSI bypass)
• Enable and execute RDP

References

HTTP traffic: https://randomnerdtutorials.com/esp32-http-get-post-arduino/