UZ801 4G USB Modem

(Openstick Debian Bookworm)

Features

• 4G Modem
• Wireless Programmable USB rubber ducky
• Wireless Adapter
• Rogue AP
• Sniffers
• Network Scanner and so much more...

Requirements

• Aarch64 architecture
• Android Phone with USB OTG support
• OTG USB Cable
• UZ801 USB MODEM (Shopee) (Amazon)
• Termux App
• Termux API

Download File

Termux

pkg update && pkg upgrade -y && pkg install axel tar -y

axel -o https://github.com/xiv3r/uz801-usb-pentest/releases/download/file/debian_uz801_v3.tar.xz

tar -xvf debian_uz801_v3.tar.xz
cd debian_uz801_v3

Installation

Install Logs

Install the ADB and FASTBOOT in termux

pkg update && pkg install wget -y && wget -qO- https://raw.githubusercontent.com/xiv3r/adb-fastboot-termux/refs/heads/main/install | bash

Connect the UZ801 usb modem to the OTG

Power-On the USB MODEM through the Android OTG connection

Connect to the WiFi 4G-UFI-XX

Open the gateway to unlock the adb (it will reboot)

http://192.168.100.1/usbdebug.html

After booting

Open the termux terminal

List active device

adb devices

Enable fastboot mode

adb reboot bootloader

List fastboot active device

fastboot devices

Go to the termux and Flash the Firmware

cd debian_uz801_v3

./flash.sh

SSH Access

for AP 4G-UFI-XX

ssh user@192.168.100.1

For RNDIS USB

ssh user@192.168.200.1

User/Root Password:1

Screenshot

Customized by Me

Internet via WIFI

Internet via WiFi (disable AP mode) USB mode only.

SSH is accessible through router USB WAN RNDIS port ssh user@192.168.200.1 and the AP ssh user@192.168.1.10 where it is connected.

sudo nmcli connection delete hotspot

Connect to a Wifi AP

sudo nmcli dev wifi connect "SSID" password "PASSWORD"

Check connection status

sudo ip address 

Internet via 4G/LTE

Internet via 4G (AP mode only) accessible through ssh user@192.168.100.1

Set the Provider APN

sudo nmcli connection modify lte gsm.apn <your_apn>

Activate the 4G connection

sudo nmcli connection up lte

Check the 4G connection status

sudo mmcli -m 0

Check the IP status

sudo ip address

Update and Upgrade

update

sudo apt update 

upgrade

sudo apt upgrade -y

Install additional tool

sudo apt install nmap -y

Check hosts configuration in /etc/dnsmasq.conf after upgrading dnsmasq with (Y).

Add the following if not yet configured. this will ensures that RNDIS and SSH are accessible through usb0 and wlan0.

dhcp-range=interface:wlan0,192.168.100.100,192.168.100.150,12h
dhcp-range=interface:usb0,192.168.200.100,192.168.200.150,12h

Official Repo

rm /etc/apt/sources.list.d/*
nano /etc/apt/sources.list

deb https://deb.debian.org/debian bookworm main contrib non-free non-free-firmware
deb-src https://deb.debian.org/debian bookworm main contrib non-free non-free-firmware

deb https://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware
deb-src https://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware

deb https://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware
deb-src https://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware

Enable USB Tethering

Enable IP forwarding

sudo echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sudo sysctl -p

Load RNDIS driver

sudo gt load --path /usr/local/etc/gt/templates rndis-os-desc.scheme

Unplug the 4G Modem

Enable AP

delete the existing wifi station config (internet via wifi)

sudo nmcli connection delete Asus_Router

Enable custom hotspot AP

sudo nmcli connection add type wifi ifname wlan0 con-name hotspot autoconnect yes ssid 4G-UFI-XX 802-11-wireless.mode ap 802-11-wireless.band bg wifi-sec.key-mgmt wpa-psk wifi-sec.psk "1234567890" ipv4.addresses 192.168.100.1/24 ipv4.method manual ipv6.method auto ipv6.addr-gen-mode default

• SSID: 4G-UFI-XX
• PASSWORD: 1234567890

LED Controls

add to the /etc/rc.local to enable after boot

first enable root

sudo -i

red

echo "panic" >/sys/class/leds/red:power/trigger

green

echo "phy0tx" >/sys/class/leds/green:wlan/trigger

blue

echo "phy0rx" >/sys/class/leds/blue:wan/trigger

additional options for led trigger control

cat /sys/class/leds/blue:wan/trigger
cat /sys/class/leds/red:power/trigger
cat /sys/class/leds/green:wlan/trigger

Performance Tunning

enable rc.local

echo >/etc/rc.local && systemctl enable rc-local && chmod 755 /etc/rc.local

allow to overcommit the memory for better performance

sudo echo vm.overcommit_memory=1 >>/etc/sysctl.conf
sudo echo vm.overcommit_ratio=100 >>/etc/sysctl.conf
sudo sysctl -p

[ Overclock the CPU ]

add the following nano /etc/rc.local

#!/bin/sh

# CPU & Frequency tunning
echo performance | tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq | tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_min_freq

# Add the Led trigger settings here


exit 0

Recovery

Install ADB and FASTBOOT in termux if not yet installed.

pkg update && pkg install wget -y && wget -qO- https://raw.githubusercontent.com/xiv3r/adb-fastboot-termux/refs/heads/main/install | bash

hold the reset button while powering on the 4G USB Modem through OTG and released it after 5 seconds to enable fastboot mode.

cd debian_uz801_v3

fastboot devices

fastboot erase rootfs

fastboot -S 200M flash rootfs debian/rootfs.img

More Details

View the PDF

Limitations

• Firmware image lacks of iptables and netfilter kernel modules.

Credits

Firmware image and Documentation

👉 Wim van 't Hoog