This article provides a comprehensive tutorial on the "OpenStick" project, which involves repurposing specific 4G WiFi routers equipped with the Qualcomm MSM8916 chipset into versatile, low-cost Single Board Computers (SBCs) running Debian Linux. The primary application demonstrated is creating a remote penetration testing device. The guide details the entire process, from gaining initial access via ADB and creating critical firmware backups in EDL mode to flashing a custom Debian Bookworm image using Fastboot. A core focus is the powerful USB Gadget framework, which allows the stick to emulate various devices such as network adapters (RNDIS/ECM), keyboards for keystroke injection (HID), and mass storage drives. The article showcases advanced use cases, including setting up anonymous remote access via Tor, performing man-in-the-middle attacks with Bettercap, sniffing network traffic with Tshark/TCPDump, and executing "Rubber Ducky" style payloads.
Repurposing a 4G Dongle: A Guide to Creating a Remote Pentesting Tool
Intro & OpenStick Project: The project aims to convert a cheap 4G WiFi stick into a powerful, portable pentesting tool running Linux. This is driven by the Raspberry Pi shortage and the stick's built-in 4G modem and GPS capabilities. The project specifically requires a stick with a Qualcomm MSM8916 chipset, with the UZ801 v3.0 model being the focus of the tutorial.
ADB (Initial Access): To begin, the user must enable Android Debug Bridge (ADB) access. This is done by connecting to the stick's default WiFi network and navigating to a hidden debug page (http://192.168.100.1/usbdebug.html) in a web browser.
EDL (Firmware Backup): Before flashing, it is critical to back up the original firmware. The stick is rebooted into Emergency Download (EDL) mode (adb reboot edl), allowing direct read/write access to its internal storage. Using the edl tool, a full backup of all partitions is created to prevent bricking the device or losing crucial data like the modem's IMEI.
Fastboot & Flash (Installing Debian): With backups secured, the new firmware is installed via Fastboot mode (adb reboot bootloader). The author provides a custom-built Debian Bookworm image, which is flashed onto the device using a simple script.
Login & Connectivity: After flashing, the stick is accessible via SSH in two ways: through a USB network connection (RNDIS) at 192.168.200.1 or via a new WiFi hotspot. The device can connect to the internet using its WiFi or the built-in 4G/LTE modem, which is configurable using standard Linux network tools (nmcli).
Basic Usage (USB Gadget Framework): A key feature of the custom firmware is its extensive support for the USB Gadget framework, allowing the stick to emulate different USB devices on the fly. Key functions include:
RNDIS: Emulates a USB Ethernet adapter, ideal for sharing the 4G internet connection.
HID: Emulates a Human Interface Device, such as a keyboard, enabling keystroke injection attacks similar to a USB Rubber Ducky.
Mass Storage: Configures the stick to appear as a standard USB flash drive.
Advanced Usage & Pentesting Examples: The tutorial demonstrates several advanced applications:
Tor for Anonymity: Tor is configured to allow anonymous SSH access to the device over the internet, bypassing cellular carrier NAT restrictions.
Man-in-the-Middle (MITM): By using Bettercap, the stick can perform ARP spoofing on a network to intercept and analyze traffic.
Traffic Sniffing: Tools like tcpdump and tshark can capture network traffic, which can be streamed remotely to a computer running Wireshark for deep packet inspection.
Rubber Ducky Payloads: The HID gadget mode can be used with scripts to automate keystroke sequences on a target computer, executing commands or opening websites.
Troubleshooting: The guide provides recovery methods for a bricked device. A non-responsive stick can be forced into Fastboot mode by holding its reset button or, in a worst-case scenario, forced into EDL mode by shorting specific pins on the circuit board.