RF pentesting
Today we will be looking into using a Raspberry Pi itself for RF transmission, hiding files, and scripting some bash scripts. We can freely transmit on the 88-108 band without a licence if:
- We don’t interfere with any other service on that spectrum,
- The power output is below 100mW 3. Used only for personal use (car fm transmitters)FCC.
“This device complies with part 15 of the FCC Rules. Operation is subject to the following two conditions: (1) This device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation.”
The Raspberry Pi though does send out unfiltered RF so use with caution as it can create harmonic waves that can interfere with other devices or signals further down the spectrum.
Steganography is a fun an interesting way to hide files and combined with encryption might even be “unbreakable” .
Prerequisites
Any Linux distro (Ubuntu shell on Windows is fine) Raspberry pi Pifm (LIBRARY) Putty Arduino IDE
Transmitting FM signals from a Raspberry Pi
Firstly, let’s do a git clone of the PiFm library
git clone https://github.com/rm-hull/pifm.git
cd pifm
It uses the hardware on the Raspberry Pi that is actually meant to generate spread-spectrum clock signals on the GPIO pins to output FM Radio energy. This means that all you need to do to turn the Raspberry-Pi into a (ridiculously powerful) FM Transmitter is to plug in a wire as the antenna (as little as 20 cm will do) into GPIO pin 4 and run the code posted below.
The python library calls a C program. The C program maps the Peripheral Bus (0x20000000) in physical memory into virtual address space using /dev/mem and mmap. To do this, it needs root access, hence the sudo. Next, it sets the clock generator module to enabled and sets it to output on GPIO4 (no other accessible pins can be used).
Modulation is done by adjusting the frequency using the fractional divider between 103.325Mhz and 103.275Mhz, which makes the audio signal.
LETS GET TO THE SPICY STUFF
Steps to play sound:
sudo python
>>> import PiFm
>>> PiFm.play_sound("sound.wav")
Default frequency is 103.3 so tune your radio app on your phone to that frequency
Let’s take this a bit further pick your favourite song from YouTube, download it as a wav file using https://www.saveclipbro.com/
To make things easier, we can just right-click on “Download your file” button and select “copy link location” then paste the link like this into “putty” or what ever ssh client you are using.
wget https://www.saveclipbro.com/download/93b38dec-328b-4c12-8a8d-ec796fb51a5a
This will download the file in the directory we are in
now using
sudo ./pifm thefileyoudownloaded.wav 103.3 22050 stereo
We can play the file on 103.3 in full stereo!! But there is a big problem, the audio does not sound right. This is because we are trying to play a file in a different bitrate than it’s actually in. To find out the bitrate, we can do a simple command like this.
file file.wav
Make a note of the bit rate and change the bitrate parameter in the command we used before to play the file to the bitrate of the file
sudo ./pifm thefileyoudownloaded.wav 103.3 48100 stereo
Steganography
Steganography is the art of hiding something in something else. It’s very useful when you need to hide stuff (like your porn folder ^^) doing this is easy and can be expanded very easily (but can be easily detected if you are not careful. For starters pic some files you want to hide a put them in a zip folder, you will also need a JPG image (preferably a high quality one).
Now it is clear that we want to hide youfiles.zip inside apicture.jpg image. We will use the Linux cat command which has different functions like displaying files, creating new ones and combining copies of them. The cat command will read the images file first, secret_files.zip, and we will concatenate them together. After you have opened the terminal change the directory to the directory where you have your files, mine are inside Desktop, so I type:
cd Desktop/articles
In my terminal and press Enter.
Make sure all the files are inside the directory by using the ls command which stands for listing all files and subdirectories inside a directory and copy your filenames inside a text document because you will need them in the next command. Time to hide my zip archive inside my image.
cat myimage.jpg yourfiles.zip > newimage.jpg
Explanation
cat reads the image file
cat reads the zip file
cat concatenates the image and the zip file together in a new file, bugatti.jpg (You can put any name you like)
Press Enter and a new file will be created. The new file is newimage.jpg which looks like a regular image file but if we try to operate with unzip command on it, the unzip command will extract the zip archive that is inside the image.
Type
ls
and your file will should be there
The file that is important to us is youfile.jpg because our secret files are inside this image, so feel completely free to delete other files when you use this method. It looks like a normal JPEG file and it will open as an image
If notice the file is larger than before, that is because we have hidden files in the image its self (and is a dead give away if its too much to an experienced user).
To pull out the files, just use
unzip yourfile.jpg
This can become really handy when you want to send an email and hide something if someone were to hijack the recipient or inject a payload in a system by just sending an image.