CIRCO v2: Stealth Hardware Implant for Network Credential Harvesting
Emilio Couto demonstrates CIRCO v2, a stealthy Raspberry Pi hardware implant camouflaged inside a PoE injector that tricks enterprise network automation systems into exposing credentials.
Summary
Camouflaged Physical Network Implants
Physical red team engagements frequently require covert implants capable of evading discovery by facility staff and security controls while remaining connected to target networks.
Hardware Architecture of CIRCO v2
Emilio Couto presents CIRCO v2, an offensive platform built on a Raspberry Pi form factor and housed within a nondescript PoE injector or surface-mount network outlet box.
Stealth Telemetry and Anti-Tamper Controls
The device incorporates hardware sensors—including ambient light detectors to trigger self-erasure or alert ops upon enclosure opening—and MAC/IP spoofing to evade 802.1X and NAC monitoring.
Autonomous Credential Harvesting and Exfiltration
Couto demonstrates CIRCO's automated decoy services and honeypots that bait IT management systems into authenticating, capturing plaintext credentials via Net-Creds and exfiltrating data covertly.
Related talks
Demo Labs·40 min
PyRDP
A demonstration of PyRDP, a Python tool for Remote Desktop Protocol interception, credential capture, and honeypot deployment.
Presentations Panels·44 min
Switches Get Stitches
Exploring layer 2 network protocol vulnerabilities, VLAN hopping, trunking exploits, and switch configuration weaknesses.
Village Presentations·27 min
Joseph Muniz · Aamir Lakhani
Joseph Muniz and Aamir Lakhani demonstrate building weaponized Raspberry Pi drop boxes for stealthy physical network penetration testing.