Abstract:

This article serves as a comprehensive technical guide for repurposing specific 4G LTE USB dongles, particularly the UZ801 v3.0 model featuring a Qualcomm MSM8916 chipset, into a versatile, low-cost Single Board Computer (SBC) running Debian Linux, dubbed "OpenStick." The tutorial details the entire modification process, from initial setup by enabling ADB on the stock firmware and creating a critical full-system backup in EDL mode, to flashing a custom Debian Bookworm image. The core functionality highlighted is the use of the USB Gadget framework, which allows the device's USB port to be dynamically reconfigured to act as a network adapter (RNDIS), a mass storage device, or a Human Interface Device (HID) for executing keystroke injection attacks. The guide also covers advanced applications such as configuring the built-in 4G modem for internet access, setting up Tor for anonymous remote access, and practical penetration testing examples using tools like Bettercap and TCPDump.

Repurposing a 4G Dongle into a Pentesting "OpenStick"

• Project Goal: To convert an inexpensive 4G WiFi dongle with a Qualcomm MSM8916 chipset (e.g., UZ801 v3.0) into a portable Linux-based Single Board Computer (SBC) for remote access and penetration testing.
• Initial Setup and Backup: The process begins by enabling ADB on the stock Android firmware via a hidden webpage (/usbdebug.html). It is critical to then boot into EDL (Emergency Download Mode) to create a full backup of the device's storage, as this is needed to restore partitions like the modem if they are corrupted.
• Flashing Debian Linux: The stock Android system is replaced by flashing a custom Debian Bookworm image using Fastboot. This gives the user a full-featured Linux environment on the stick.
• Dynamic USB Functionality: The stick's key feature is its ability to change its USB function on the fly using the USB Gadget framework. It can be configured to act as:
  • RNDIS: A network adapter, providing internet access to a host computer.
  • HID (Human Interface Device): A keyboard/mouse, allowing for "Rubber Ducky" style automated keystroke injection attacks on a target machine.
  • Mass Storage: A standard USB flash drive.
• Internet and Remote Access: The guide details how to connect the stick to the internet using nmcli, either by connecting to a WiFi network or by configuring the built-in 4G/LTE modem with the correct APN. For persistent remote access, Tor can be set up to create an onion service, allowing SSH access from anywhere.
• Penetration Testing Applications: The OpenStick can be used for several security tasks:
  • Traffic Sniffing: Using tools like Bettercap for Man-in-the-Middle (MITM) attacks or using tcpdump to capture all network traffic passing through the device when it acts as a router.
  • Payload Execution: The HID gadget functionality allows for running DroidDucky scripts to automate tasks on a connected computer.
• Device Recovery: The tutorial provides troubleshooting steps for recovering a "bricked" device, either by holding the reset button to force Fastboot mode or by physically shorting EDL pins on the PCB for a low-level flash.