This article details the "OpenStick" project, which involves repurposing affordable Qualcomm MSM8916-based 4G WiFi dongles (specifically the UZ801 v3.0) into versatile Single Board Computers (SBCs) running Debian Bookworm Linux. The project aims to create a remote pentesting device leveraging the stick's built-in 4G modem and GPS capabilities. The guide covers the comprehensive process from initial firmware backup using EDL mode and flashing a custom Debian image, to establishing network connectivity via WiFi and 4G/LTE. A significant focus is placed on manipulating USB gadget functions (RNDIS, HID, Mass Storage) using tools like gt and gc, enabling advanced applications such as Man-in-the-Middle attacks with Bettercap, network traffic analysis with TCPDump/Tshark, and keyboard injection with DroidDucky. The article also addresses anonymous remote access via Tor and provides essential troubleshooting steps for recovery.
OpenStick Project: Repurposing 4G Dongles into Linux Pentesting Devices
Project Introduction (OpenStick):
The OpenStick project, initiated by Handsome Yingyang and further detailed by Zoltán Mizse, transforms 4G WiFi routers into Linux or OpenWRT-capable Single Board Computers.
The primary goal is to create a remote pentesting device with features like a built-in 4G modem and GPS, superior to a Raspberry Pi Zero W2 in these aspects.
Requires specific Qualcomm MSM8916 chipset models (e.g., UFI001B, UF896, UZ801, SP970), typically found on AliExpress or Amazon for $12-15. The UZ801 v3.0 is recommended for stability.
Initial Setup and Firmware Management:
ADB (Android Debug Bridge): Enabled by connecting to the stick's default WiFi hotspot (SSID: 4G-UFI-XX, PSK: 1234567890), navigating to http://192.168.100.1/usbdebug.html, and logging in with admin/admin. Root access is then gained using setprop service.adb.root 1; busybox killall adbd.
EDL (Emergency Download Mode): Essential for creating a full firmware backup before flashing new software. Achieved via adb reboot edl and using Bjoern Kerler’s EDL tool to edl rf uz801-stock.bin for a full image or edl rl uz801_stock --genxml for individual partition backups. This step is crucial for recovery.
Fastboot: Used to flash the new OpenStick firmware. The device enters Fastboot mode via adb reboot bootloader and is verified with fastboot devices.
Flashing and Login:
The article focuses on flashing a custom Debian Bookworm image (available from download.wvthoog.nl) by unzipping and running flash.sh.
SSH Access: After flashing, the stick automatically creates an RNDIS USB gadget device (IP: 192.168.200.1) and a WiFi hotspot (SSID: 4G-UFI-XX, PSK: 1234567890). SSH login uses ssh user@<IP> with password 1.
Internet Connectivity:
WiFi: Configured using nmcli to connect to an external access point after deleting the default hotspot connection.
4G/LTE: Leverages the built-in modem. Configuration involves modifying the SIM card PIN and APN using nmcli (profile "lte") and activating the connection. mmcli -m 0 and ip a show wwan0 verify connectivity.
Basic USB Gadget Usage:
The OpenStick kernel supports USB Gadget functions, enabling the stick to emulate various USB devices.
RNDIS (Remote Network Driver Interface Specification): Creates a virtual Ethernet link, making the stick act as a router.
HID (Human Interface Device): Allows injection of keystrokes, similar to a Rubber Ducky.
MSD (Mass Storage Device): Transforms the stick into a USB mass storage device. Requires creating an image file and formatting it (e.g., dd, fdisk, mkfs.vfat).
Tools:GT (Gadget Tool) from libusbgx is preferred for loading scheme files (/usr/local/etc/gt/templates) or creating custom gadgets. GC (Gadget Controller) by Handsome Yingyang offers simpler commands for common functions.
Advanced Usage:
Systemd: USB gadgets can be loaded at startup using the gt@<usb_gadget> systemd service.
Custom Gadget Creation: Users can define and export their own USB gadgets using gt create, gt func create, gt config create, gt set, and gt save.
Tor: Installation allows anonymous SSH access to the stick over the Tor network using its onion link.
Examples for Penetration Testing:
MITM (Man-in-the-Middle): By enabling an ECM (Ethernet Control Module) gadget, traffic can be routed through the stick, allowing analysis with Bettercap (installed and updated on the OpenStick).
Traffic Sniffing: When in RNDIS mode, all host PC traffic is routed through the stick by default. tcpdump or tshark can capture this traffic on usb0 and stream it to Wireshark on a remote PC via socat.
Rubber Ducky: Utilizing the HID gadget, DroidDucky scripts can execute predefined keystroke payloads (e.g., rickroll.txt).
Troubleshooting:
Fastboot button: Holding the reset button for 5 seconds while plugging in forces Fastboot mode, allowing recovery or entry into EDL.
EDL pins: Shorting specific headers on the PCB while plugging in forces EDL mode for recovery if the bootloader is unresponsive.
Community members report issues with modem functionality on different versions (e.g., UZ801 v3.2) often solved by replacing /lib/firmware files with original modem.bin content.
Freezing issues might be related to multi-core stability, with some users disabling cores for reliability.
Key Takeaways:
The OpenStick project offers a highly affordable and versatile platform for remote computing and penetration testing.
Its combination of low cost, 4G connectivity, and customizable USB functions makes it a powerful tool despite its small form factor.
A strong emphasis on backing up original firmware is crucial for successful experimentation and recovery.