Bash Bunny Switch not working & won't upgrade or restore

[JayKay494]

Brand new bash bunny. Firmware 1.3_267

Connected to my laptop, it powers up, and gets to state where LED is flashing blue slowly.

I can successfully connect to the serial console, and see the mass storage device in Windows or Linux.

Problem 1: Regardless of which switch position, it wont run any payload. I tried setting \payloads\switch1\payload.txt & \payloads\switch2\payload.txt to:

LED R 100
ATTACKMODE HID
source bunny_helpers.sh
QUACK GUI r
QUACK DELAY 100
QUACK STRING Switch Position is $SWITCH_POSITION
QUACK DELAY 100
LED G

I unplug it, set switch to Position 1, plug it into a windows laptop, but nothing happens. Same for position 2. And nothing happens in arming mode either.

Problem 2: Firmware wont update

I downloaded the latest ch_fw_1.6_305.tar.gz from https://downloads.hak5.org/bunny and copied it to the root of the filesystem (as seen by Windows).

Check the sha256sum is correct on the bashbunny's version of the tar.gz file.

Safely ejected the Bash Bunny

Connected it to the laptop again, and waited.

It just follows the normal boot process and starts flashing blue slowly within a few seconds of connecting. there is no flashing red to indicate it is applying the update.

 

Problem 3: Wont restore from recovery partition

I tried the process mentioned by @Darren Kitchen to create 3 failed boots and force it to do a recovery. But it also doesn't work. I plugged it into a USB power bank (not a computer), waited until green light went off (after ~2sec), disconnected, repeated 3 times, then plugged it in and waited. there was no flashing red/police light. It just booted normally.

 

Questions:

A) Is there a way to debug the switch position from within the serial console?

B) Is there a way to manually run the firmware update from inside the serial console?

 

Any help appreciated.

 

[Darren Kitchen]

You can manually perform a firmware recovery from the serial console using the update_recovery script, which I believe is in /usr/loca/bunny/. Standard precautions apply. 

[MD5HC]

Same problem.

Mine is new (bought 2 years ago and never used) Plugged it for first time today. Did the update process but same issue as above.

1. Green light goes on, then blue blinking updated never happen

2. Tried the updater 1.1 and tried to do the firmware recovery by unplugging 3 times when the green light goes out

All that happens when you plug it back in is Green Light then Blue blinking.

Version onboard is 1.3.67 I just wanted to update it to latest.
Not tried the switches as it only has default payload.

 

[MD5HC]

Oh, I tried plugging it into just a USB power source. No change in behaviour

Also tried downloading firmware 1.6 and tried with that. Nothing. Green light then blue blinking.

[MD5HC]

Looks like exactly the same problem as the OP.

Switch position 1 or 2 does nothing.
All I did with payload 1 is make the led magenta but even in position 1 all you get is Green then blue flashing and mass storage.

[dark_pyrro]

To see if the switch itself is behaving correctly, you can try this

Put the Bunny in arming mode

Serial into the Bunny using MiniCom or PuTTy (or whatever)
https://docs.hak5.org/bash-bunny/beginner-guides/getting-root-on-a-bash-bunny-from-the-serial-console

Run
cat /sys/class/gpio_sw/PA8/data
if the result is 0 then switch1 is used

Run
cat /sys/class/gpio_sw/PL4/data
if the result is 0 then switch2 is used

Run
cat /sys/class/gpio_sw/PL3/data
if the result is 0 then switch3 (arming mode) is used

It's possible to flip the switch while the Bunny is running in arming mode in order to try all positions

[MD5HC]

Thank you so much. I think it was an issue with the switch.
All I did was move it between positions and because I had the firmware in there I got the beautiful red and blue flashies and all works now.

YAY 🙂

 

[dark_pyrro]

Good that you seem to have gotten it sorted

The test above can of course also be scripted. Run the script in each switch position and the "zero" should do a House of Pain... Jump around!

#!/bin/bash

clear
echo ""
echo "Testing Bunny switches"
echo ""
echo ""
echo "The output that returns a 0 (zero) represents the current switch"
echo ""
echo "Testing Switch1"
cat /sys/class/gpio_sw/PA8/data
echo "Testing Switch2"
cat /sys/class/gpio_sw/PL4/data
echo "Testing Switch3 (arming mode)"
cat /sys/class/gpio_sw/PL3/data
echo ""