This article provides a comprehensive tutorial for the "OpenStick" project, which transforms specific Qualcomm MSM8916-based 4G USB dongles into versatile, remotely accessible Single Board Computers (SBCs) running Debian Linux. The guide details the entire process, starting with enabling ADB on the stock firmware, performing a critical full-system backup using EDL (Emergency Download Mode) to preserve device-specific data like IMEI, and flashing a custom Debian Bookworm image via Fastboot. Key features of the resulting device include SSH access over both USB (RNDIS) and WiFi, full 4G/LTE internet connectivity, and the ability to dynamically change its USB function using the USB Gadget framework. The tutorial demonstrates practical applications, including configuring the stick as a network adapter, a mass storage device, and a Human Interface Device (HID) for keystroke injection, positioning it as a powerful tool for remote penetration testing. Advanced topics cover automating gadget loading with Systemd, creating custom USB configurations, and enabling anonymous remote access via Tor.
Repurposing a 4G Dongle: A Guide to the OpenStick Project
Project Goal: Transform a cheap 4G USB WiFi router (with a Qualcomm MSM8916 chipset) into a versatile Single Board Computer running Debian Linux, ideal for remote penetration testing.
Hardware Requirements: The tutorial focuses on the UZ801 v3.0 model but lists other compatible sticks. Acquiring the correct version from online sellers can be challenging.
Enabling ADB: The first step is to enable ADB (Android Debug Bridge) through the stick's stock web management page to gain initial shell access.
Critical Firmware Backup: Before flashing, it is crucial to reboot the stick into EDL (Emergency Download Mode). This mode allows for a complete backup of the internal eMMC storage, which is essential for preserving the modem's unique IMEI information and for future recovery.
Flashing Debian: After backing up, the device is rebooted into Fastboot mode. A custom Debian Bookworm image is then flashed onto the stick using a provided script, replacing the original Android firmware.
Remote Access: Once flashed, the OpenStick can be accessed via SSH in two ways: through a USB RNDIS (Ethernet) connection at a static IP (192.168.200.1) or by connecting to its self-generated WiFi hotspot.
Internet Connectivity: The device can connect to the internet either by joining an existing WiFi network or by using its primary feature: the built-in 4G/LTE modem, configured using standard Linux command-line tools (nmcli).
Dynamic USB Functionality (USB Gadgets): A core feature is the ability to change the stick's USB identity on the fly. It can emulate various devices, including:
RNDIS: A USB Ethernet adapter (the default mode).
HID: A Human Interface Device, allowing it to act like a keyboard or mouse to inject keystrokes (similar to a Rubber Ducky).
Mass Storage: A standard USB flash drive.
Advanced Pentesting Applications: The guide demonstrates how to leverage the device for security tasks, such as performing Man-in-the-Middle (MITM) attacks with Bettercap, sniffing network traffic with tcpdump and tshark, and enabling anonymous remote access to the device over the Tor network.
Troubleshooting and Recovery: For a bricked device, the tutorial provides recovery methods, including using a reset button to enter Fastboot or physically shorting pins on the PCB to force EDL mode for a complete re-flash from a backup.