hardware-pentest

name	hardware-pentest
description	Guides hardware and physical access penetration testing with UART/JTAG/SPI analysis, firmware extraction, and logic analyzer techniques. Use when engagement ROE includes firmware extraction, debug interface access, or physical device compromise.

Hardware Pentest

Prerequisites

• Physical access and hardware testing require explicit ROE authorization.
• Device ownership or written permission for destructive extraction (chip-off, flash dump).
• ESD-safe workspace and appropriate programmers (CH341A, Bus Pirate, J-Link).

Workflow

Task Progress:
- [ ] Confirm physical access scope and device inventory
- [ ] Gather OSINT (datasheets, FCC IDs, open-source components)
- [ ] Acquire firmware (download, OTA intercept, UART/JTAG/SPI dump)
- [ ] Extract and analyze filesystem (binwalk, strings)
- [ ] Identify hardcoded creds, backdoors, and attack surface

Phase 1: OSINT and reconnaissance

Information gathering

MSF: No direct module. Use OSINT sources and CLI triage.

CLI fallback:

strings firmware.bin | grep -iE "version|copyright|build"
binwalk firmware.bin
file firmware.bin
# FCC ID lookup, vendor firmware pages, Shodan/Censys for exposed interfaces

Phase 2: Physical access attacks

BIOS/UEFI and live access

MSF: No direct module. Use physical access techniques.

CLI fallback:

# Default BIOS passwords, CMOS battery reset, live USB boot
# SAM editing, single-user mode / init=/bin/sh on Linux

HID implants

MSF: No direct module. Use Rubber Ducky/BadUSB payloads.

CLI fallback:

# Rubber Ducky / BadUSB keystroke injection
# Bash Bunny for network attacks from USB form factor

Phase 3: Debug interface identification

UART

MSF: No direct module. Use serial console tools.

CLI fallback:

baudrate -f /dev/ttyUSB0
screen /dev/ttyUSB0 115200
# USB-TTL adapter, multimeter for GND/TX identification

JTAG

MSF: No direct module. Use OpenOCD.

CLI fallback:

openocd -f interface/jlink.cfg -f target/stm32f1x.cfg
# JTAGulator for pin identification

SPI flash

MSF: No direct module. Use flashrom.

CLI fallback:

flashrom -p ch341a_spi -r firmware_dump.bin
flashrom -p buspirate_spi:dev=/dev/ttyUSB0 -r dump.bin

Phase 4: Firmware extraction and analysis

Non-destructive acquisition

MSF: No direct module. Use binwalk and extraction tools.

CLI fallback:

binwalk firmware.bin
binwalk -e firmware.bin
binwalk -A firmware.bin
unsquashfs squashfs-root
jefferson jffs2.img -d jffs2-root/
extract-ikconfig kernel.bin
strings firmware.bin | grep -iE "password|admin|root|key|token"
grep -r "passwd" extracted_rootfs/etc/
find extracted_rootfs -perm -4000
find extracted_rootfs -name "*.pem" -o -name "*.key"

Phase 5: Bootloader and runtime analysis

U-Boot console

MSF: No direct module. Use serial console interaction.

CLI fallback:

# Interrupt boot, then:
printenv
setenv bootargs console=ttyS0,115200 init=/bin/sh
boot

Firmware emulation

MSF: No direct module. Use QEMU/Firmadyne.

CLI fallback:

qemu-system-arm -M virt -kernel zImage -drive file=rootfs.img
# Firmadyne / FirmAE for automated IoT emulation

Phase 6: Network service testing

After firmware RE reveals open ports/services:

Network scan of embedded device

MSF MCP (preferred):

msf_db_nmap(
  engagement_id="<id>",
  targets="<device_ip>",
  nmap_args="-sV -p-"
)
msf_service_info(host="<device_ip>", only_up=true)

CLI fallback:

nmap -sV -p- <device_ip>
nmap -sV --script default,vuln -p 22,23,80,443,8080,8443 <device_ip>

Service module search

MSF MCP (preferred):

msf_search_modules(query="<embedded_service>")
msf_search_modules(query="telnet")
msf_search_modules(query="upnp")
msf_module_check(
  engagement_id="<id>",
  module_type="exploit",
  module_name="<module/path>",
  options={"RHOSTS": "<device_ip>"}
)

CLI fallback:

wsl -e bash -lc "msfconsole -q -x 'search telnet; search upnp; exit'"
# Test default credentials, exposed telnet/SSH, UPnP, MQTT, CoAP, web admin panels

Impact escalation

Stage	Technique
Access	UART shell, default creds, JTAG debug
Firmware	Extract, modify, reflash
Creds	Hardcoded passwords, private keys in firmware
Network	Pivot to internal network via compromised IoT
Persistence	Modified firmware with backdoor

Metasploit integration

After firmware RE reveals network services, bridge to MSF for service exploitation. IoT and embedded targets often lack MSF modules; document manual PoCs in evidence when no module exists.

Related skills

• hacktricks-methodology - network service pentest on extracted firmware services
• reversing-pentest - binary analysis of extracted binaries
• forensics-pentest - artifact analysis from device dumps
• telnet-pentest - embedded devices often expose telnet
• ssh-pentest - embedded devices often expose SSH