Jump to content

PacketSquirrel is permanently in arming mode


Recommended Posts

Hello,

My PacketSquirrel is permanently in arming mode (blue led flashing). When I switch to try the 3 different payloads, it keeps flashing blue and accessible via ssh. I have tried all the switch positions, rebooted after switching, nothings seems to work.

I have also formatted the USB with the 'reformat_usb' command. Still same behavior.

Additionally, it does not show in C2 after placing the device.config file in the /etc directory.

Any tips will be greatly appreciated.

@borrigan

 

 

 

Link to comment
Share on other sites

You could test if the switch is really changing position (hardware wise), just ssh into the Squirrel (when in arming mode) and then flip the hardware switch and run the SWITCH command/script in each position. It shall report back the current switch that the Squirrel has selected.

What payloads are you using in each of the switches? What are you expecting to happen?

What firmware version are you using? Latest available?

Regarding C2, you need to tell more in detail about your C2 setup in order to troubleshoot further (without revealing anything "personal"). Where is it installed (internet or on a LAN)? With what string is the C2 instance started? Started manually or as a service? Etc. Is the Packet Squirrel your first device when it comes to C2 or do you have other already working/connected devices?

  • Upvote 1
Link to comment
Share on other sites

Hi, thank you so much for your reply. I tested the SWITCH command and ran it 4 times, starting with the switch in the 1 position (tcpdump paylod), then switching to 2, 3 and 4. Here are the results:

root@squirrel:~# SWITCH
switch1
switch3

root@squirrel:~# SWITCH
switch2
switch3

root@squirrel:~# SWITCH
switch3

root@squirrel:~# SWITCH
switch3
switch4

Weirdly, it always shows switch3, together with the other positions. And, I still have the blue blinking light, independently of the selected switch (I can always SSH into the device).

Version of firmware is: v1.23.2

Regarding C2, I am running it on a LightSail VM in AWS. I have a ScreenCrab in C2 as well, running perfectly fine. I download the device.config for a new PacketSquirrel into the /etc folder, but it never gets recognized by C2. 

Thank you so much!

Link to comment
Share on other sites

The output of the SWITCH command/script looks really weird. You should only get one output per run.

That firmware version is really old and the version number looks somewhat odd. You should start with upgrading the firmware. The latest is 3.2.

The firmware version might also explain why it's not showing in C2. The C2 client was added in firmware 2.0 and also had a fix in 3.1.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...