RoganDawes/P4wnP1
P4wnP1
P4wnP1 is a hardware-based USB HID attack platform and peripheral emulator. It functions as a tool for emulating USB keyboards and mice to execute automated keystroke payloads, as well as a WiFi-enabled remote access tool that provides a wireless bridge for network relay and SSH access.
The project is distinguished by its ability to establish covert bidirectional communication channels and remote shells using raw HID reports, specifically to bridge air-gapped systems. It further enables wireless network interception and the routing of network traffic over WiFi to facilitate man-in-the-middle operations.
The platform includes capabilities for automating password cracking via emulated keyboard input and extracting browser credentials and system data to internal or external mass storage. It also supports executing payloads directly within system memory to avoid leaving a footprint on the target disk.
Features
- HID Covert Channels - Emulates keyboards and mice to execute automated keystroke payloads and establish covert HID communication channels.
- DuckyScript Payload Runners - Runs Rubber Ducky compatible scripts on demand, triggered remotely through HID, WiFi, Bluetooth, or internet relay.
- Air-Gapped Remote Access - Relays HID backdoor sessions over WiFi or Bluetooth to provide remote shell access to isolated, air-gapped targets.
- HID-Based Shell Relays - Relays interactive shell sessions over raw HID reports between air-gapped targets and WiFi-connected attacker devices.
- WiFi Bridge Tools - Provides wireless bridge access and SSH connectivity to air-gapped systems through emulated USB peripherals and network interfaces.
- Multi-Trigger Payload Runners - Executes DuckyScript and custom bash payloads triggered by HID, WiFi, Bluetooth, or keyboard LED events for automated target interaction.
- Composite USB Device Emulations - Provides composite USB device emulation combining HID, mass storage, and network interfaces from a single hardware device.
- Composite USB Interface Emulations - Presents the device as a composite USB interface combining HID, mass storage, RNDIS, CDC ECM, and serial connections simultaneously.
- In-Memory Payload Execution - Delivers and runs multi-stage PowerShell payloads entirely in system memory without writing to disk.
- Remote Keystroke Injection - Sends arbitrary keystrokes or executes DuckyScript payloads on the target from a backdoor shell over HID or WiFi.
- Lock Screen Credential Theft - Automates credential theft from a locked Windows machine by capturing hashes through network redirection, cracking them, and typing the password to unlock the target.
- Event-Triggered Bash Payloads - Executes bash payloads when events occur like network link up, target IP assignment, or SSH login.
- HID Brute-Force Tools - Automates brute-force unlocking of Windows 10 login screens using weak password lists through HID keyboard emulation.
- HID File Transfers - Uploads and downloads files between the device and the target over the raw HID channel.
- Man-in-the-Middle Frameworks - Spoofs network interfaces to route target traffic through the device for interception and relay over WiFi.
- RNDIS Gateway Spoofers - Spoofs RNDIS network interfaces to force target traffic through the device for man-in-the-middle interception.
- RNDIS Gateway Spoofing - Fakes a high-speed RNDIS network interface to force the target to route traffic through the device for man-in-the-middle attacks.
- RNDIS MITM Bridges - Spoofs RNDIS network interfaces to intercept and route target traffic over WiFi for credential theft and network analysis.
- Lock Screen Backdoors - Plants a SYSTEM-level command shell accessible from the lock screen via sticky keys using a registry-based approach without filesystem changes.
- USB Mass Storage Exfiltrators - Types a PowerShell script via keyboard to dump stored credentials from Microsoft Edge or Internet Explorer and saves them to a USB drive.
- Browser Credential Dumpers - Extracts stored browser credentials from targets and copies them to an emulated USB mass storage drive for exfiltration.
- Remote Process Management - Creates, interacts with, and kills multiple remote processes on the target through the covert HID channel.
