How to Modify the USB Rubber Ducky with Custom Firmware « Null Byte :: WonderHowTo

The USB Rubber Ducky comes with two software components, the payload script to be deployed and the firmware which controls how the Ducky behaves and what kind of device it pretends to be. This firmware can be reflashed to allow for custom Ducky behaviors, such as mounting USB mass storage to copy files from any system the Duck is plugged into.The USB Rubber Ducky, featured onMr. Robotstealing login credentials, is a device designed to fit inside the "shell" of a cheap USB case to disguise itself as a normal USB mass storage drive. When plugged in, however, it acts like a keyboard, rapidly typing any instructions you program into it. Human interface device (HID) attacks work because computers have to trust keyboards — it's how humans communicate with them.In this tutorial, I'll go over how to flash custom firmware to the Ducky usingDucky Flasherand show some examples of firmware options to expand the number of ways you can deploy your Duck!Ready to flash firmware on the Rubber Ducky plugged into a Raspberry Pi.Image by SADMIN/Null ByteWhy Use the Rubber Ducky in the First Place?In our previous article on the Rubber Ducky, we learned how to load and use keystroke injection attacks. For a refresher on that, skip over to the following link to review.HID Attack Basics:Load & Use Keystroke Injection Payloads on the USB Rubber DuckyIf you're looking to compromise a computer, evading detection is a primary concern. In most cases, Windows Defender or anantivirusprogram will swoop in to stop a harmful automated process that might damage the system. If you were to tell Windows to destroy itself from the command line, however, it will for the most part just do it.The Rubber Ducky abuses this trust by allowing you to accomplish actions that might otherwise arouse suspicion or take too much time to do manually within a brief window of physical access. Aside from outputting whatever commands you tell it to, the Ducky allows you to bake in delays when needed to accommodate old or slow computers.What Can You Do with It?The USB Rubber Ducky can do anything you can type into a terminal window, which is a dangerous amount of things. This includes downloading and running any program you want from the internet immediately. For computers with internet access, it's often best to do all the work on the downloadable payload and focus on making a few seconds of access count without being detected.Don't Miss:Automate Hacking on the Raspberry Pi with the USB Rubber DuckyYou can schedule embarrassing emails to government officials containing local .jpeg files with suspicious file names. You can add backdoor accounts or reverse SSH shells. Pretty much anything you could accomplish behind the keyboard at the computer, you can automate into a few seconds of contact with the USB Rubber Ducky.What Can't You Do with It?You can't put information back on the Ducky since it just reads a .bin binary file that tells it how to send keystroke commands to the computer as a keyboard. This means you can't introduce files from the Ducky, you can't download files from the computer to the Duck directly, and you can't do some crazy stuff like run a VM from the Ducky to attack the host computer.These limitations are addressed by downloading components off the internet or appropriating existing Windows, macOS (OS X), or Linux services. Rather than try to drop in some crazy custom malware, simply knowing how to use services via Windows commands in terminal will allow you to accomplish what you want the "official" way but at lightning speed.Just Kidding — You Can Do That with FirmwareOne of the core concepts of hacking is taking something meant for one purpose and giving it new life, and firmware hacking is a key component of that. Firmware is the system that runs below the operating system of any computer and controls the low-level behavior of the device. This can be changed, unlocking the device to do basically anything the hardware will allow. Many people"root" their phonesby modifying this firmware to give it new life.Most manufacturers don't allow this, as they want to ensure product quality and consistency. Most manufacturers also aren't Hak5, who create some of the most intresting and widely accessible pen-testing tools on the market, such as our beloved USB Rubber Ducky.You can flash the firmware of the USB Rubber Ducky on the Kali Pi 2, Pi 3, and Pi Zero W.Image by SADMIN/Null ByteDon't Miss:Build a Kali Linux Hacking Computer for Under $40 with the Raspberry Pi 3The USB Rubber Ducky's firmware has always been open to the community, and it wasn't long until custom firmware versions began to emerge. The Twin Duck, allowing for the USB storage to be mounted, and the Detour Duck, allowing for staged payloads to be triggered depending on certain variables, were among the first to be widely used.This variety in behavior has greatly enhanced the USB Rubber Ducky's practicality as an attack vector, and in my subsequent articles, I'll introduce payloads utilizing each main firmware type.Ducky FlasherTheDucky Flasher, originally written bykmichael500to flash different popular firmware forks to the USB Rubber Ducky. Written in Python, it works on Windows, macOS (OS X), and our Kali Linux Raspberry Pi! This makes the Pi a perfect place to write payloads and firmware to a Ducky on the go, giving the flexibility of changing both device behavior and payloads in a matter of seconds. This increased flexibility, coupled with the attention from cameos in major TV shows, has lead to the development of many new and interesting Ducky scripts. To take advantage of these, let's get familiar with Ducky Flasher.What You NeedUSB Rubber DuckymicroSD to USB adaptercomputer (try a Kali Pi— Null Byte's Kali Linux build for the Raspberry Pi)DFU ProgrammerDucky FlasherAll of these Pis can flash firmware to your USB Rubber Ducky. Here, we see the Pi 2, 3, and Zero W ready to flash some Duck.Image by SADMIN/Null ByteStep 1: Installing Dependencies & Fetching Ducky FlasherTo mess with firmware, we'll need to put our USB Rubber Ducky in DFU programming mode. This is done by holding down the small button on the USB Rubber Ducky as you plug it into the computer's USB port. This will allow us to write to the Ducky and modify the firmware. To prepare our computer for this, we'll need to install DFU programmer.In Kali Linux, this command is:sudo apt-get install dfu-programmerOnce this is complete, you can download Ducky Flasher by running:wgethttps://github.com/hak5darren/USB-Rubber-Ducky/raw/master/Flash/ducky-flasher1.0.zipWhen the .zip file has downloaded, unzip it with:unzip ducky-flasher1.0.zipNow we're ready to install Ducky Flasher!Step 2: Installing Ducky FlasherTo install Ducky Flasher, we'll change directory into the newly unzipped folder, run the setup configuration file, and then run the Ducky Flasher as sudo. For this to work, you should plug in your Ducky in DFU mode. If you want to just test it and flash later, you can skip this for now.In terminal, run:cd ducky-flasher1.0sudo python setup.pysudo ducky-flasherIf you run into any problems, make sure you have Python installed.Step 3: Running Ducky Flasher & Flashing Your First FirmwareTo begin, hold down the small button on the USB Rubber Ducky as you insert it into the USB port of the computer you are running Ducky Flasher on. Make sure you've changed directory to the one Ducky Script is in, and then run:sudo ducky-flasherIf you've broken your Ducky with custom firmware, now you can fix it. Select1to restore the original firmware.It's as simple as that. If your Ducky was in DFU mode, you should see the following.If your Duck isn't in DFU mode, you'll see the following screenshot. If this happens, try again or contact Hak5 if the Ducky simply will not switch to DFU mode.Sad duck.Firmware FlavorsNow you'll be able to explore the various flavors of firmware the Ducky can run and experiment with different ways each gives you unique control over the interaction with the target computer. To demonstrate a proof of concept for this, I developed a payload for Null Byte to grab a specific file off of macOS using the Twin Duck custom firmware, which I'll cover in my next article.Stay tuned for more articles on the USB Rubber Ducky. You can ask me questions here or @sadmin2001 onTwitterorInstagram.Follow Null Byte onTwitterandGoogle+Follow WonderHowTo onFacebook,Twitter,Pinterest, andGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by SADMIN/Null ByteRelatedHow To:Steal macOS Files with the USB Rubber DuckyHacking macOS:How to Steal Signal Conversations from a MacBook with a USB Rubber DuckyHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHow To:Load & Use Keystroke Injection Payloads on the USB Rubber DuckyHow To:Use the USB Rubber Ducky to Disable Antivirus Software & Install RansomwareHow To:Hack MacOS with Digispark Ducky Script PayloadsHow To:Automate Hacking on the Raspberry Pi with the USB Rubber DuckyHow To:Run USB Rubber Ducky Scripts on a Super Inexpensive Digispark BoardHow To:Catch USB Rubber Duckies on Your Computer with USBRipNews:Hak5 Just Released the Packet SquirrelHow To:Make Your Own Bad USBHow To:Steal Usernames & Passwords Stored in Firefox on Windows 10 Using a USB Rubber DuckyAndroid for Hackers:How to Backdoor Windows 10 Using an Android Phone & USB Rubber DuckyHow To:Inject Keystrokes into Logitech Keyboards with an nRF24LU1+ TransceiverHow To:Decorate rubber ducky shaped cupcakesHacking macOS:How to Use One Python Command to Bypass Antivirus Software in 5 SecondsHow To:Build a Beginner Hacking Kit with the Raspberry Pi 3 Model B+How To:Find the rubber ducky easter egg in CrackdownHow To:Install the Xposed Framework on Your Samsung Galaxy S6 or S6 EdgeHow To:Unroot & Restore a Samsung Galaxy S6 Back to StockPSA:Unlocking Your Pixel's Bootloader Does NOT Void Your WarrantyBuyer's Guide:Top 20 Hacker Holiday Gifts for Christmas 2017How To:Use Social Engineering to Find Out More Information About a CompanyHow To:Unroot & Restore a Galaxy S5 Back to StockHow To:Install an Off-the-Shelf Hard Drive in an Xbox 360 (Get 10x the GB for Your Money)How To:Use Social Engineering to Gain Unauthorized Access to a Hotel RoomHow To:1-Click Root Many Android Devices with Kingo Android RootHow To:Use Odin to Flash Samsung Galaxy Stock FirmwareHow To:Unroot & Relock Your Modded Nexus 5 Back to Factory ConditionHow To:Upgrade the Pioneer MEP-7000 Firmware 2.02How To:Add Your Own Custom Screensaver Images to Your Kindle Lock ScreenHow To:Root Your Samsung Galaxy S4 (Or Almost Any Other Android Phone) In One Easy ClickNews:NAB 2010 - SmallHD Demo their new DP-SLR MonitorNews:Jailbreak your PS3!How To:Jailbreak an iOS 4.3 iPhone 4, iPad or iPod Touch with PwnageToolNews:MAME Arcade cabinet+How To:Conceal a USB Flash Drive in Everyday ItemsNews:Canon 7D's Firmware Update v1.2.1: 4/17/10News:Down the CommodeNews:StreetRally