Pire

> [!INFO]
> The project takes its name, **Pire** (pronounced *pee-reh*), from Turkish. It translates to Flea, symbolizing a tiny, undetectable agent that latches onto a host and jumps across the network infrastructure to bite.

[[Pire]] is an embedded security framework developed for the #raspberry-pi. While it functions as a security analysis tool, its primary architecture is designed to serve as a **Physical Drop-Box** for #red-team engagements.

![Pire](/images/pire.webp)

## The Purpose

The core philosophy of Pire is **"Leave Behind & Pivot."**

In a physical penetration test, an operative might gain physical access to a building for only a few minutes. [[Pire]] is designed to be plugged into an ethernet port and left behind. It immediately establishes a secure, outbound connection to our C2 infrastructure, turning a generic #raspberry-pi into a persistent **Pivot Point** inside the target's internal network.

* **Drop:** Plug the device into the target network.
* **Beacon:** The device initiates an encrypted outbound connection to the C2 server.
* **Pivot:** The attacker connects securely to the C2 server, which bridges the connection to the [[Pire]] device, allowing full access to the internal network.

```mermaid title="Red Team Topology"
graph LR
Attacker[Attacker Machine]
C2[Command & Control Server]
Firewall{Corp Firewall}

subgraph "Target Internal Network"
Pire[Pire Device]
InternalServer[Internal DB]
InternalPC[Employee PC]
end

Pire -- "1. Outbound Beacon" --> Firewall
Firewall --> C2
Attacker -- "2. Issue Command" --> C2

Pire -. "3. Scan or Exploit" .-> InternalServer
Pire -. "4. Sniff Traffic" .-> InternalPC
```

## Architecture

[[Pire]] utilizes a robust **Pull-Based C2 Architecture**. Unlike traditional servers that listen for incoming connections (which are often blocked by corporate firewalls), [[Pire]] acts as a client. It runs on a stripped-down #arch-linux ARM installation and uses #python to periodically "phone home" to the C2 server. This architecture ensures stealth and persistence.

The agent checks the C2 server for new tasks, fetches them, executes them using its asynchronous #celery workers, and then uploads the results back to the mothership. To facilitate real-time interaction, it establishes a **Reverse SSH Tunnel**, giving the operator a stable shell inside the secure network without needing to punch holes in the firewall.

### The Beacon Logic

```mermaid title="C2 Communication Flow"
graph LR
Pire[Pire Agent] -- "1. Poll for Tasks" --> C2[C2 Server]
C2 -- "2. Deliver Payload" --> Pire

subgraph "Internal Execution"
Pire --> Worker[Celery Worker]
Worker --> Tool[Metasploit / Nikto]
end

Tool -- "3. Capture Output" --> Pire
Pire -- "4. Upload Results" --> C2
```

## Capabilities

The platform functions as an autonomous **Red Team Implant**. Its modular plugin system allows it to perform complex offensive tasks autonomously once deployed.

* **Vulnerability Exploitation:** Integrated wrappers for #metasploit automate internal exploit checking and payload delivery.
* **Web Fuzzing:** Performs directory fuzzing to map internal web applications and discover hidden endpoints.
* **Web Recon:** Automatically triggers #nikto scans against discovered internal web portals to identify misconfigurations.
* **Cluster Management:** A "Mother Ship" interface allows an operator to manage multiple [[Pire]] devices deployed across different branch offices simultaneously.
* **Packet Capture:** Runs a database-backed sniffer to log sensitive traffic for later exfiltration and analysis.
* **Wireless Offense:** Equipped with plugins specifically for #WiFi de-auth attacks and WPA handshake capturing.