12-13-2023, 10:57 PM
(This post was last modified: 12-13-2023, 11:26 PM by ikmodule.
Edit Reason: fixed linux script sample - added duckuino
)
Sup, it's ikmodule. I love BadUSBs; I own a Hak5 Rubber Ducky, Bash Bunny Mk II, OMG Plug, Digispark, etc. It's a powerful tool for both intel and offensive techniques. Today I'll be explaining the basics of BadUSBs, how DuckyScript works (REALLY SIMPLE) and sample scripts.
WHAT IS A BADUSB?
A BadUSB is itself a USB stick that injects some type of payload into a target machine. It could be either an HID attack [Human Interface Device] acting as a keyboard or as a mouse, an Ethernet [useful for DNS poisoning and captive portals], or a Storage Client [allowing you to move files target=>USB or USB=>target].
You can buy one from Hak5 [https://shop.hak5.org] or make your own with a Digispark or Arduino Nano.
[Check Digispark tutorial here: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjbgc7nuI2DAxWSDkQIHX96AnoQwqsBegQIDxAF&url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DfGmGBa-4cYQ&usg=AOvVaw391P5Ki1hEM6oO0mdnwAC6&opi=89978449]
WHAT IS DUCKYSCRIPT?
DuckyScript is the name of the language used for coding BadUSBs. [Check Hak5 for reference].
It has different versions of the script.
This has a direct impact on the script's "power." It measures how "deep" the scripts can go.
1.0 Featuring HID
2.0 Featuring HID Ethernet [Both Win and Linux] and Storage Attacks
3.0 Featuring HID Language and OS Detection and Keystroke Reflection [Side-Channel Exfiltration]
Why 3.0 doesn't have Ethernet nor Storage Attacks? 3.0 is meant to work with the latest RubberDucky, which is a HID and HID-only device; the other features are related to the fact that the device is a pure HID.
"BASICS" OF DUCKYSCRIPT
Don't know coding? Don't worry; this thing is the EASIEST language on earth.
SAMPLE SCRIPT WIN
A basic script for your target device to open a notepad and write whatever you want will look something like this.
SAMPLE SCRIPT LINUX
The same script but for Linux
NOTE: IF YOU HAVE A DIGI OR ARDUINO USE THIS WEBSITE TO TRANSLATE THE SCRIPT FROM DUCKY TO ARDUINO
[ https://d4n5h.github.io/Duckuino/ ]
This is enough for you to get started with BadUSBs as a prank device. If you want to see the dark side of these little tools, want to learn about PowerShell and Linux intrusion techniques with these bad boys, let me know by replying to this thread
If you have any questions related to the topic, contact me.
WHAT IS A BADUSB?
A BadUSB is itself a USB stick that injects some type of payload into a target machine. It could be either an HID attack [Human Interface Device] acting as a keyboard or as a mouse, an Ethernet [useful for DNS poisoning and captive portals], or a Storage Client [allowing you to move files target=>USB or USB=>target].
You can buy one from Hak5 [https://shop.hak5.org] or make your own with a Digispark or Arduino Nano.
[Check Digispark tutorial here: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjbgc7nuI2DAxWSDkQIHX96AnoQwqsBegQIDxAF&url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DfGmGBa-4cYQ&usg=AOvVaw391P5Ki1hEM6oO0mdnwAC6&opi=89978449]
WHAT IS DUCKYSCRIPT?
DuckyScript is the name of the language used for coding BadUSBs. [Check Hak5 for reference].
It has different versions of the script.
RubberDucky V1, Digispark, and Arduino Nano use DuckyScript 1.0
Bash Bunny [MK I & II], O.MG Cables/Plugs, Key Croc, LAN Turtle, and other Hak5 devices use DuckyScript 2.0
The latest Rubber Ducky [USB-A USB-C] uses DuckyScript 3.0
This has a direct impact on the script's "power." It measures how "deep" the scripts can go.
1.0 Featuring HID
2.0 Featuring HID Ethernet [Both Win and Linux] and Storage Attacks
3.0 Featuring HID Language and OS Detection and Keystroke Reflection [Side-Channel Exfiltration]
"BASICS" OF DUCKYSCRIPT
Don't know coding? Don't worry; this thing is the EASIEST language on earth.
REM: Note, comment. This part of the script will not be executed.
DELAY: The amount of time between keystrokes. 1000 = 1 sec, 500 = 0.5 sec, 3000 = 3 secs, and so on.
STRING: What you want the HID [let's call it the digital keyboard] to type
ENTER/ALT/ESC (...): Want the digital keyboard to press a certain key? Just type its name! It's that simple.
GUI: The Windows key.
SAMPLE SCRIPT WIN
A basic script for your target device to open a notepad and write whatever you want will look something like this.
REM This will open the windows runbox
GUI r
DELAY 500
REM This will type in the app we want to open
STRING notepad.exe
DELAY 1000
REM This will confirm the task and execute the command
ENTER
DELAY 1500
REM Now here we write our message
STRING I love pine but dont tell him </3
REM And this is it, can't be easier.SAMPLE SCRIPT LINUX
The same script but for Linux
REM Open console
CTRL-ALT t
DELAY 500
STRING nano iloveupine.txt
DELAY 200
ENTER
DELAY 200
STRING [ Your message ]
DELAY 100
CTRL x
DELAY 500
STRING y
DELAY 200
ENTER
DELAY 1000
CTRL DNOTE: IF YOU HAVE A DIGI OR ARDUINO USE THIS WEBSITE TO TRANSLATE THE SCRIPT FROM DUCKY TO ARDUINO
[ https://d4n5h.github.io/Duckuino/ ]
This is enough for you to get started with BadUSBs as a prank device. If you want to see the dark side of these little tools, want to learn about PowerShell and Linux intrusion techniques with these bad boys, let me know by replying to this thread
If you have any questions related to the topic, contact me.