Poison

what it does

idea of this Poison turns an ESP32-S3-N16R8 into a tool that lets you send keystrokes (individual keys, combinations, numbers, func keys, super key, etc) and mouse (d-pad with fuckin scroll wheel), media keys (vol up/down, etc) if you can plug it in. supported targets: android, ios, windows and linux based oses.

here is the basic idea: if you find a laptop or server that is unlocked or locked and sitting there, you plug this shit in. it immediately acts as a keyboard and the esp will open up an access point over wifi. connect to the ap (it has pin lock) and now you got complete access to that shit. you now have control over that computer from 15 meters i guess. just dont let anyone see the esp connected to the target so you wont get caught. do your shennanigans 15m away.

how it works

under the hood Poison is two things at once: a USB input device and a WiFi webserver, running on the same chip.

• the esp32-s3 has native USB OTG. the firmware (arduino core 3.3.10, TinyUSB underneath) makes it enumerate as one composite USB device: HID keyboard + HID mouse + media keys + serial, all at the same time. the os thinks it's a normal keyboard and mouse. no drivers, no software on the target.
• HID is just raw USB reports: 8 bytes per press (1 modifier byte + 6 keycodes). modifier bits: ctrl=0x01, shift=0x02, alt=0x04, super=0x08. press = send the report, release = send an empty report. combos are literally just mods + key in the same report, so ctrl+shift+f5 is nothing special to the usb layer.
• the web dashboard is served by the esp itself. web server on port 80, DNS captive portal on port 53 so phones pop the page open automatically. the entire ui is one html file flashed into the firmware, so there is nothing to install on the operator side either.
• radio runs an wifi access point (its open for up to 8 clients) and station mode joining your home network at the same time, control it from your phone on the ap or reach it over LAN.
• pin lock: every api call requires pin, and the dashboard stores the pin in localStorage after login so you only type it once. security aint that top notch, i know.
• typing flows through a 1024 byte queue processed in the main loop, so keystrokes stream out in the background while the web server keeps answering your clicks
• nothing is ever installed on the target. unplug the thing and its gone without a trace.

why do we need ESP32-S3 for ts?

older microcontrollers like the standard ESP32 cant be this sexy. this shit acts as an HID mouse + HID keyboard + media keys all at once. the esp32-s3 is one of the few cheap and available boards that has native usb support, allowing it to impersonate input devices. others got like keyboard only but no wifi. some needs an external usb chip to inject keys which is gay. and also this sucker is dual core 240mhz. can run a web dashboard, send keys, and do a LOT of other shit that this Poison project doesnt do. you cant fight this stack son.

youll need

you will need:

• ESP32-S3-N16R8:

• notepad at best to write the code

instructions

setup (one time, on your own machine):

1. install arduino-cli and the esp32 core 3.3.10: arduino-cli core install esp32:esp32
2. grab the firmware: poison.ino + dashboard.h in the same folder.
3. optional: change the default pin (DASH_PIN in the .ino) and reflash.
4. plug the esp into your machine with usb-c.
5. enter download mode: hold BOOT, tap RST, release BOOT.
6. build with:

   arduino-cli compile --fqbn esp32:esp32:esp32s3:USBMode=default,CDCOnBoot=default,PartitionScheme=huge_app ~/poison
   

7. flash with:

   arduino-cli upload --fqbn esp32:esp32:esp32s3:USBMode=default,CDCOnBoot=default,PartitionScheme=huge_app -p /dev/ttyACM0 ~/poison
   

8. tap RST (not BOOT) to boot the app. the "Goober" ap should appear within a few seconds. if it doesn't, tap RST once more — wifi init is flaky on the first boot right after a flash.

deployment:

8. plug the esp into the target's usb port. works whether the machine is locked or unlocked — the os enumerates usb HID before login.
9. on your phone: wifi -> the wifi ap -> browse to 192.168.4.1 or captive portal may open it automatically.
10. enter the pin (default shadow).
11. range is like 15m, line of sight, the wifi ap, not bluetooth. keep eyes on the esp if you can, or just be quick.
12. to end it: unplug. that's it. or tap RST to kill the ap while keeping the hid alive.

disclaimer

i am not responsible for how you use this. dont do anything retarded. i got nun to do with it.

credits roll

project of MaxTac's DaemonNet