Right now I've got Martin (a 4GB Raspberry Pi 4) sitting on the desk. No cables, not connected to any Wi-Fi (…yet), running on battery. No HDMI, no mouse, no keyboard. I come in over SSH from another box:
ssh kali@192.168.X.X(Because I can. Because you can.)
It carries two antennas: one Wi-Fi, one 4G/LTE. The 4G/LTE HAT, besides the antenna connector, has a modem socket where I've slotted an Arduino Pro 4G (which itself mounts a Quectel EC200A); the Raspberry picks it up on the fly. Both the HAT and the dual-battery carrier are from 52Pi; nice gear, by the way.
Deploy, bail out and operate
Martin is built so you plant it somewhere, walk away, and it stays reachable for you or your crew. The really cool part of a mini-computer like this happens remotely: SSHing into an IP that only exists inside your VPN, and 500 km away (just as an example) Martin greets you with a reassuring:
kali@kali-raspberrypi:~$The 4G link with its dedicated SIM leans on Tailscale, which builds a private WireGuard mesh between machines. Its infrastructure handles the initial handshake and gets through carrier-grade NAT via DERP servers without opening a single port or wrestling with someone else's router.
Each machine grabs a fixed address inside, so you can imagine the rest: ssh to that IP. Part of this research (the Hackeed Martin line) is replacing that central control plane with Headscale, the free, self-hosted alternative, running on another… Raspberry Pi, for instance, so the network doesn't depend on third parties.
With that out of the way, Martin is free to do its own thing: audit the surrounding Wi-Fi with Kali and its usual gear, operating on site but driven from wherever you are.
We ran the tests with Kali because it's well known that the drivers for Alfa network cards usually have good support on that distribution. But they'll probably work just as well on BlackArch or Parrot OS or whatever you use for pentesting.
Toward the MK2: from sandwich to the perfect carrier
The MK1 shows all its guts in the open, but the next revision aims to compress volume, drop components that don't contribute to a "drop-box" like this and improve power management.
Looking at options for migrating to Compute Module (CM4 / CM5), the one that's caught my eye the most so far is the TOFU from Oratek (Switzerland); a brutal piece of kit, though with an industrial focus. For Martin, the goal would be to design a bespoke carrier at the exact classic Raspberry Pi form factor (85.6 × 56.5 mm):
- Bottom side: M.2/mPCIe socket for the 4G/LTE modem and a flush nano-SIM slot.
- Top side: Room for the CM4/CM5 and only the connectivity that matters for auditing:
- 2× USB 2.0 (for keyboard and mouse if needed).
- 1× USB 3.0 (for high-power Wi-Fi injection or external storage).
- 1× USB-C with data and charging support.
- 1× Gigabit Ethernet (key for pivoting onto wired networks; maybe your audit doesn't need a Wi-Fi adapter…).
- 1× HDMI (for local diagnostics on the bench only).
- Physical power button: clean GPIO-driven shutdown with no "yanked" power cuts.
But hey, that's what we're thinking now; the possibilities are endless… It might even make more sense to use one of these smaller boards from Radxa (one of Raspberry's direct competitors), which also happens to share the same form factor as a Raspberry Pi Zero. These, though, are more powerful; quite a few heat sinks are sold for them, which makes me think they must dump a lot of heat. But hey, 4 GB of RAM in a Pi Zero form factor is pretty wild if you think about it. A carrier similar to the current battery one but with a single cell would leave us with a much more compact device; less autonomy, sure, and a board that pulls four times the power…
The Power Path and battery challenge
The current 52Pi battery carrier does the job, but has room to grow for this use case: it integrates USB ports built for powerbank duty and recharging isn't transparent. The ideal for the MK2 is to integrate a chip with Power Path Management or similar… so the USB-C port behaves like on a laptop. Plug the charger in and it powers the system while topping up the cells; unplug it and it switches to battery with no microcuts or weird reboots. Right now you can't charge and use it at the same time, so if only for that this isn't a commercial product yet, but it'd be pretty cool if it were. Do you agree?
Credits and origins
Two notes before closing:
- The idea isn't new: Xcape Inc. has been working on this concept for years with their PiRAT. What you have here is another way to build the gadget: open, hand-assembled, with each component referenced to its manufacturer so anyone can replicate it or order it pre-built on demand.
- The name is beyond fixing: Martin comes from Lockheed Martin, the makers of the F-117 Nighthawk. That aircraft came out of the XST (Experimental Survivable Testbed) program: slip in where you're not meant to be seen, hold up and keep responding. Taking some liberties, we're after the same thing: get in, stay in and maintain persistence on the perimeter.
Any ideas or suggestions to make the device more compact, lighter or more discreet are more than welcome.