HID Implants 101
Modern, easy, cheap and disposable HID implants

Overview

I recently purchased a WHID injector, if you want one you can buy one here or here. If you’re not familiar with the device then I would suggest checking out this talk by the creator, Luca Bongiorni at Hack in Paris 2018. The WHID injector is as Luca describes it “a bash bunny on steroids” and looking over the specs it seems he is spot on:

The device looks like this:

WHID Injector

Pretty innocuous right? Now all that’s required to pwn a target is to plug it in, connect to the AP over WiFi and run our payload of choice. But what about if you are out on a pen test and there is no available workstation? I mean generally speaking it’s not usually possible to just lean over the receptionists desk and plug in a USB. This is where HID implants come into play.

Methodology

In this section I will walk through the steps required to easily and cheaply get a HID implant up and running. It’s pretty basic stuff so even if you have never touched a soldering iron or a multimeter before, with a bit of luck you should be able to manage it without burning or electrocuting yourself.

Prep

You are going to need a few tools to get the job done:

Selecting a device

For the device that is going to contain the WHID Injector we have a few general requirements to meet:

  1. Someone should want / have a reason to plug it at work. (Nothing naughty)
  2. A device with a simple circuit
  3. Cheap, there’s a chance we won’t be getting it back
  4. Enough space to hide the WHID Injector
  5. 5V running over usb A (C is possible too but slightly more complex)

Scouting around I found a small 5v Desktop Fan that met all of the above requirements. You can buy the same one for $9.95 here.

Flea Market - Desktop Fan

Breaking it down

Opening the fan up presents a nice simple circuit with plenty of room for the implant:

Fan Opened

Looking at the internals the circuit is as simple as it comes with only 2 wires, 5V (RED WIRE) and GROUND (BLACK/WHITE WIRE). The 5V wire runs to a post on the switch, the other post on the switch runs to the Fans motor. The GROUND wire runs directly to the motor. When the switch is in the disconnected state the circuit is broken and when it is connected the circuit is live:

Fan Circuit

Now we are going to have to transfer data to and from our target host and for this to occur we are going to need a new cable with 2 more wires, DATA POSITIVE and DATA NEGATIVE. For background on what these wires do check this post here. Any USB A <-> USB A cable should do and when you cut one end off and strip it back it should look like this:

Stripped Cable

Snip the old cable off, pull it out, feed the new cable through the back of the fan and solder everything up according to this circuit diagram:

Fan Circuit

When you are done it should look something like this (yes my soldering was terrible, but it works so who cares):

Soldered Circuit

Now clean everything up, individually wrap the soldered sections on the wire with electrical tape, hot glue the solder points on the WHID injector to add a bit of strength to the connections and shrink wrap. I also snipped off the usb connecter with some clippers but you should probably desolder it instead if you have the time:

Glued Connections

Shrink Wrapped

Now you can test everthing out and make sure it works! If you followed the circuit diagram correctly then the WHID Injector will be up and running whenever the fan is plugged in regardless of wether it is switched on or not.

Fan Test

All that remains is to pack the WHID Injector inside the empty area within the plastic motor housing, hot glue everything in place and re-assemble:

Packed

Complete

Testing it out I can connect to the AP and everything works as it should:

Esploit

Proof of Concept:

WHID PoC

Now you could either leave this laying around your targets work area if it’s an internal pen test or if external you can package it back up with an invoice and send it to the business address :) Happy Hunting!

Red Team

******
Written by Shain Lakin on 26 March 2021