Packet Squirrel Mark II (Ethernet MitM Hacking Hardware)
- Biohazard
- 6 days ago
- 7 min read
Packet Squirrel Mark II (Man-in-the-Middle Multi-Tool)
The Packet Squirrel Mark II is a matchbook-sized Ethernet implant that sits inline between a target device and the network. Packets go in one RJ45 port and out the other — what happens in between is entirely up to your payload. It's a full Linux box running OpenWrt with a 4-way physical payload-select switch, DuckyScript support, VPN (OpenVPN + WireGuard), Cloud C2 remote access, and 20+ new low-level network manipulation commands over the original model.
Hardware Specifications
Component | Detail |
CPU | Atheros AR9331 SoC @ 400 MHz MIPS |
RAM | 64 MB DDR2 |
Flash Storage | 16 MB onboard |
Ethernet | 2× RJ45 10/100 (not Gigabit — auto-negotiates down) |
USB | 1× USB 2.0 Type-A host port (storage: ext4, exFAT, FAT32, NTFS; optional full-disk encryption) |
Power | USB-C (power only — 5V, ~120 mA average / 0.2 A) |
Switch | 4-way physical slider (positions 1/2/3 = payloads, 4 = arming mode) |
Button | Momentary push button (reboot, factory reset, firmware recovery, scriptable) |
LED | RGB multi-color indicator (scriptable) |
Wireless | ❌ None — purely wired |
Dimensions | 50 × 40 × 15 mm |
Weight | 24 grams |
Boot Time | 30–40 seconds (first boot: several minutes for key generation and storage init) |
The Physical Switch - Four Modes
This is the defining interface. The slider on the bottom has four positions:
Position | Function |
1 | Payload 1 — runs /root/payloads/payload1.sh |
2 | Payload 2 — runs /root/payloads/payload2.sh |
3 | Payload 3 — runs /root/payloads/payload3.sh |
A (4) | Arming & Configuration Mode |
In arming mode (position A), the Packet Squirrel creates a NAT network on the Target port (172.16.32.0/24), spins up a Web UI at http://172.16.32.1:1471, and enables SSH at 172.16.32.1. From here you configure payloads, set Cloud C2, update firmware, retrieve loot, or drop into a root shell.
Slide to position 1, 2, or 3, and it automatically runs the corresponding payload with no interaction required. The LED gives instant feedback — blinking blue means arming mode, blinking green means booting, flashing red/blue means no payload found, and custom colors/patterns are payload-defined.
Six Networking Modes (NETMODE)
Payloads declare their network mode with NETMODE. This is what controls how traffic flows between the two Ethernet ports:
Mode | Behavior | VPN / C2 | Stealth |
NAT | Router mode. Target gets 172.16.32.x via DHCP. Squirrel NATs traffic out Network port. | ✅ | Low — target sees new IP |
BRIDGE | Layer-2 transparent bridge AND obtains its own IP from the network. Target keeps original IP. | ✅ | Medium — Squirrel visible as network device |
TRANSPARENT | Pure layer-2 bridge. No IP obtained. Invisible on the network. Target keeps original IP. | ❌ | Maximum — invisible |
JAIL | Target is cut off from the network. Squirrel itself stays connected. Target gets no IP. | ✅ | N/A — target isolated |
ISOLATE | Both target and Squirrel are disconnected from everything. No network at all. | ❌ | N/A — completely offline |
BRIDGE_L2 | Like BRIDGE but without obtaining an IP on the Squirrel. | ❌ | High |
The key innovation over the original Packet Squirrel is that VPN is no longer a separate mode. In any mode where the Squirrel has an IP (NAT, BRIDGE, JAIL), you can simultaneously connect via WireGuard or OpenVPN. No mode-switching, no compromise between stealth and remote access.
New DuckyScript Commands (Mark II Exclusive)
The Mark II introduces 20+ new DuckyScript commands for real-time, reactive network manipulation:
Traffic Interception & Manipulation
Command | What It Does |
DYNAMICPROXY | Transparent TCP proxy — intercept traffic on a specified port, log client AND server data. Think of it as an inline TCP logger that captures both sides of the conversation. |
KILLPORT | Terminate all TCP connections on a specified port via TCP RST injection. Kill all HTTP, SSH, or RDP traffic on the wire. |
KILLSTREAM | Terminate TCP streams whose content matches a regular expression. Kill any connection where the data contains password, confidential, or a specific URL pattern. |
SPOOFDNS | Manipulate DNS queries via packet injection. Force DNS responses to redirect traffic without configuring a DNS server. |
SELFDESTRUCT | Factory reset the Squirrel, wipe attached USB storage, and enter TRANSPARENT mode. Clean exit strategy. |
Storage & USB
Command | Purpose |
USB_WAIT | Block until USB storage is detected and mounted |
USB_FREE | Check available space on USB storage |
USB_STORAGE | Manage attached USB drives |
USB Encryption | Full-disk encryption support for USB storage via advanced payloads |
Pre-Loaded Payloads
The Mark II ships with several ready-to-use payloads:
Packet Sniffing — Log all traffic to USB in PCAP format. Pull the drive, open in Wireshark. Full network capture with zero configuration.
DNS Interception — SPOOFDNS to redirect DNS queries. Redirect traffic silently.
Network Blackhole — JAIL mode to isolate devices that match traffic patterns.
Capture Print Jobs — Intercept and log print jobs sent to network printers.
VPN Tunnel — WireGuard or OpenVPN to your C2 infrastructure from any mode with an IP.
Dynamic Proxy Logging — DYNAMICPROXY to capture both sides of TCP conversations.
Cloud C2 Integration
Connect the Squirrel to a Cloud C2 server (self-hosted Python server, or Hak5-hosted). From the C2 web dashboard:
Remote root shell — drop into the Squirrel's Linux terminal from anywhere.
Deploy/switch payloads — change what runs on each switch position remotely.
Exfiltrate loot — pull PCAP files, logs, and captured data.
Pivot through the LAN — use the Squirrel as a foothold to reach other hosts on the target network.
Manage multiple Squirrels — all from a single C2 console.
When combined with JAIL or BRIDGE mode, you have persistent remote access to the target network through a device smaller than a deck of cards.
Deployment Scenarios
1. The Classic: Inline Network Tap
Plant the Squirrel between a target workstation and the wall jack. Position 1 = TRANSPARENT packet capture to USB. Position 2 = VPN tunnel for remote access. Position 3 = SELFDESTRUCT. Slide to position 1, plug in, walk away. Come back days later, retrieve the USB drive loaded with PCAPs.
2. Behind a Network Printer
Printers are security's forgotten children. Plant the Squirrel between a printer and the network. TRANSPARENT mode — invisible. Log every print job. Every document, every fax, every scan-to-email. Nobody inspects the printer's Ethernet cable.
3. Remote Access Drop Box
BRIDGE mode + WireGuard VPN. The Squirrel bridges traffic transparently for the target device while maintaining its own encrypted tunnel back to you. You get a foothold on the target network with remote shell access via Cloud C2. The target device works normally. The network sees another MAC address (the Squirrel), but in a large enterprise that's noise.
4. Reactive Network Defense (Blue Team)
JAIL mode + KILLSTREAM. Deploy between a sensitive network segment and the rest of the LAN. If KILLSTREAM detects traffic matching a C2 beacon pattern or data exfiltration signature, the Squirrel automatically isolates the offending device. Instant physical segmentation triggered by pattern match.
5. DNS Hijacking for Credential Capture
SPOOFDNS in BRIDGE mode. When the target tries to resolve login.company.com, the Squirrel injects a DNS response pointing to your phishing server or EvilGinx instance. Redirect is near-instant and invisible to the user — the browser shows the correct URL, but the traffic goes to you.
6. Print Job Interception
Plant between a printer and the network with a payload configured for port 9100 (raw print) or 515 (LPR). DYNAMICPROXY captures every document sent to the printer. Medical records, legal documents, HR files, financial reports — anything that gets printed, you get a copy.
7. Multi-Squirrel Distributed Deployment
Deploy three Squirrels: one behind the receptionist's PC, one behind the CEO's printer, one in an IDF closet between a switch and the uplink. All phone home to the same Cloud C2 server. You now have simultaneous network capture, print interception, and remote access across the organization.
Comparison: Packet Squirrel Mark II vs. Other Hak5 Network Implants
Aspect | Packet Squirrel Mk II | WiFi Pineapple | Key Croc | Screen Crab | O.MG Cable |
Attack surface | Ethernet (wired) | WiFi (wireless) | USB keyboard | HDMI video | USB (any) |
Inline MITM | ✅ Network traffic | ✅ WiFi clients | ✅ Keystrokes | ✅ HDMI signal | ❌ (endpoint implant) |
Covertness | High (matchbook-sized) | Medium (box + antennas) | Medium (inline adapter) | High (inline dongle) | Extreme (identical to cable) |
Remote access | ✅ VPN + Cloud C2 | ✅ Cloud C2 | ✅ WiFi + Cloud C2 | ✅ WiFi + Cloud C2 | ✅ WiFi + C2 (Elite) |
Stealth mode | ✅ TRANSPARENT (invisible) | N/A (broadcasts) | ❌ (always USB device) | ✅ (passive passthrough) | ✅ (dormant when idle) |
Scriptable triggers | Push-button, switch position | Recon events, alerts | MATCH keyword patterns | Timer, interval | WiFi beacons, geofence |
Payload language | Bash, Python, DuckyScript | Modules, scripts | DuckyScript 2.0, Bash | config.txt | DuckyScript |
Storage | USB port (NTFS/EXT4) | MicroSD | 8 GB SSD | MicroSD | Internal |
Wireless | ❌ | ✅ WiFi | ✅ WiFi | ✅ WiFi | ✅ WiFi |
Best for | Persistent network tap, remote pivot, reactive filtering | WiFi recon, rogue AP, credential harvesting | Keystroke intel, pattern-triggered payloads | Screen capture, visual intel | Ultimate deniable implant |
Limitations
10/100 Ethernet only — not Gigabit. In modern networks this will auto-negotiate down. Behind a workstation or printer, 100 Mbps is rarely a bottleneck. Between a switch and an uplink, this could cause noticeable slowdowns or alert monitoring systems watching for link-speed drops.
No WiFi — purely wired. Needs Ethernet. Cannot be accessed or managed wirelessly. Pair it with a Cloud C2 connection for remote access.
No PoE — requires USB-C power. On the upside, it only draws ~120 mA, so a USB power bank can run it for days. A standard USB port on a printer, PC, or monitor can power it.
64 MB RAM / 16 MB flash — limited by modern standards. You're not running Metasploit on this. It's purpose-built: packet capture, VPN, lightweight manipulation. The USB port handles storage for PCAPs and logs.
Boot time — 30–40 seconds. During boot, the target device's network will be briefly interrupted. This is the one moment the implant could be noticed. Powering it from a separate source (not the target device) and leaving it running mitigates this.
Quickstart
Plug USB-C power into the Squirrel. Slide switch to position A (arming mode).
Connect your laptop to the Target Ethernet port.
Browse to http://172.16.32.1:1471 — the Web UI loads.
SSH in at 172.16.32.1 (root / hak5squirrel).
Configure payloads for positions 1–3.
Optionally configure Cloud C2 and VPN.
Slide switch to desired payload position.
Plug the Squirrel inline between target device and network.
Walk away. Retrieve USB or access remotely.
Final Thoughts?
The Packet Squirrel Mark II is the wired counterpart to the WiFi Pineapple and the network complement to Key Croc (USB) and Screen Crab (HDMI). Each covers a different physical access vector. Deploy all four and you have complete I/O and network compromise of a target workstation — keystrokes, screen, network traffic, and remote pivot — all from hardware implants smaller than your phone.
Comments