How to Load & Use Keystroke Injection Payloads on the USB Rubber Ducky « Null Byte :: WonderHowTo

Keystroke injection attacks are popular because they exploit the trust computers have in human interface devices (HIDs). One of the most popular and easily accessible keystroke injection tools is theUSB Rubber DuckyfromHack5, which has a huge range of uses beyond simple HID attacks. The USB Rubber Ducky can be used to attack any unlocked computer in seconds or to automate processes and save time.Quacking Like a KeyboardThis tutorial will begin exploring keystroke injection attacks with the USB Rubber Ducky. This device, which looks like a normal USB stick, is capable of tricking computers into believing it is a trusted keyboard input device. The USB Rubber Ducky exploits this trust and allows you to dump complex commands into a terminal window at superhuman speeds. This, combined with a community effort to create and share payloads, makes the USB Rubber Ducky a powerful tool against any computer.Image by SADMIN/Null ByteDucky ScriptingThe USB Rubber Ducky is programmed using Ducky Script, which is really simple and in all caps. Each command is on a new line, and commands like ALT and CTRL are familiar. To write in Ducky Script, you simply imagine you were sitting in front of the keyboard and needed to accomplish a task using only the keyboard. Using key shortcuts and terminal commands, it's possible to achieve specific actions with relatively little code.Don't Miss:How to Make Your Own Bad USBTo get started, check out this payload for macOS that opens a terminal window, jacks up the volume on the computer, and then navigates to a YouTube link to play at full volume.DELAY 1000GUI SPACESTRING terminalDELAY 500ENTERDELAY 4000STRING osascript -e 'set volume 7'DELAY 500ENTERDELAY 500STRING openhttps://youtu.be/_hI0qMtdfngDELAY 500ENTERIn this example, DELAY allows time for the USB drive to connect to the computer, GUI SPACE opens the app search bar, TERMINAL then ENTER opens a terminal window, and the last two commands set the volume and open a new browser window to an excellent song playing on YouTube at full blast. A DELAY is usually used to ensure the computer has time to switch to a new window or finish the last command before proceeding. You can see more detailed examples of Ducky Scriptat the USB Rubber Ducky's website.Dropping Fscking LoadsThe purpose of the USB Rubber Ducky is to deploy payloads onto target computers in seconds. Fortunately for us, the community has lots of payloads available to be used, remixed, and tested. Not all work as advertised, but I picked one to jack up the volume and play an excellent song on YouTube to test it out on a Mac. When it comes to targets, the USB Rubber Ducky can tailor a variety of payloads to Windows, macOS (previously Mac OS X), Android, iOS, and Linux systems to have you dropping single or multi-stage payloads in no time.Using & Loading PayloadsTo use or create a payload, we can't just put our TXT file directly into the USB Rubber Ducky to inject it. First, we need to process the script into a binary file that can be loaded onto the card and injected. To do so, we'll need:oneUSB Rubber Ducky(includes a microSD card)a computer to edit and encode payloads onadditional microSD cardsfor more payloads (optional)amicroSD card adapterorUSB card readerto load files to the DuckytheUSB Rubber Ducky EncoderStep 1: Edit a Payload in Ducky ScriptTo begin editing or creating a payload, you can create a text document in GNU nano,Vim, or TextEdit to start a blank TXT file. In terminal, the command to create a new text file namedducky.txtwith nano is:nano ducky.txtThen just type your Ducky Script into the window. Once you're done, hitCtrl Xto exit,Yto save changes, andEnterto commit changes. You should now have a file calledducky.txt.Step 2: Create a Ducky Binary FileIn order to load a payload, we have to put it on the microSD card in the USB Rubber Ducky. I have a little SD card case full of payloads, which gives me a lot of flexibility in storing and managing which to deploy. To use a payload, we must first convert the TXT file to a binary BIN file for the USB Rubber Ducky to execute.USB Rubber Ducky can drop a lot of loads.Image by SADMIN/Null ByteDownload the Duck Encoder and other Ducky tools by typing the following in terminal to clone the git repo.git clonehttps://github.com/hak5darren/USB-Rubber-Ducky.gitNavigating to the USB-Rubber-Ducky folder, you should see a variety of files including the friendly Ducky_Encoder_GUI.jar. Open this file, and a friendly Java GUI should pop up to help guide you through the encoding process.Input file:Select the ducky.txt file you previously created.Layout file:Select "US" unless you are in another part of the world, as this sets the keyboard layout. The default is "be" which will not work for English keyboards. If you mismatch keyboard layout with the target computer, the script will just type garbled nonsense, so this is very important.Output file:Type "inject.bin."When ready, just click on "Export bin" button. This should create a BIN file in the same folder (unless you selected a different location). This BIN file is the one that we can load into the USB Rubber Ducky to execute as a payload!Step 3: Load the Ducky UpRemove the microSD card from the USB Rubber Ducky and connect it to your computer via an adapter or card reader. Delete any previousinject.binfiles on the microSD card and transfer yourinject.binfile over to it. It's as simple as that! Once it's done transferring, the payload should be ready to drop onto any unsuspecting computer.Loading quality loads.Image by SADMIN/Null ByteStep 4: Deploy the DuckyLoad the microSD card back into the USB Rubber Ducky, and you're ready to inject. Practice scripts on computers running the same operating system to work out any bugs and make sure you don't miss your chance to a stray unanticipated pop-up window. Ducky payloads can be derailed by even the slightest mistake, so be sure to test and retest your payloads in the lab before deployment.USB Rubber Ducky and microSD card adapter.Image by SADMIN/Null ByteEach time you want to create a payload, the process will be the same. Write the code, encode the binary, load the duck, and deploy. This is the basic process for using the USB Rubber Ducky!Thanks for reading, and make sure to keep an eye on Null Byte for more hacking tutorials. You can ask me questions here or @sadmin2001 onTwitterorInstagram.Don't Miss:The Cheap USB Kill Stick That Destroys Any Computer You WantFollow Null Byte onTwitterandGoogle+Follow WonderHowTo onFacebook,Twitter,Pinterest, andGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by SADMIN/Null ByteRelatedHow To:Modify the USB Rubber Ducky with Custom FirmwareHow To:Automate Hacking on the Raspberry Pi with the USB Rubber DuckyHow To:Steal macOS Files with the USB Rubber DuckyHacking macOS:How to Steal Signal Conversations from a MacBook with a USB Rubber DuckyAndroid for Hackers:How to Backdoor Windows 10 Using an Android Phone & USB Rubber DuckyHow To:Use the USB Rubber Ducky to Disable Antivirus Software & Install RansomwareHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHow To:Hack MacOS with Digispark Ducky Script PayloadsHow To:Catch USB Rubber Duckies on Your Computer with USBRipHow To:Run USB Rubber Ducky Scripts on a Super Inexpensive Digispark BoardNews:Hak5 Just Released the Packet SquirrelHow To:Inject Keystrokes into Logitech Keyboards with an nRF24LU1+ TransceiverHacking macOS:How to Use One Python Command to Bypass Antivirus Software in 5 SecondsHow To:Steal Usernames & Passwords Stored in Firefox on Windows 10 Using a USB Rubber DuckyHow To:Make Your Own Bad USBAndroid for Hackers:How to Backdoor Windows 10 & Livestream the Desktop (Without RDP)Hacking Gear:10 Essential Gadgets Every Hacker Should TryHow To:Decorate rubber ducky shaped cupcakesHacking Windows 10:How to Dump NTLM Hashes & Crack Windows PasswordsHow To:Use Microsoft.com Domains to Bypass Firewalls & Execute PayloadsHow To:Top 10 Things to Do After Installing Kali LinuxHacking macOS:How to Use One Tclsh Command to Bypass Antivirus ProtectionsHow To:Find the rubber ducky easter egg in CrackdownBuyer's Guide:Top 20 Hacker Holiday Gifts for Christmas 2017Hack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow To:Build a Beginner Hacking Kit with the Raspberry Pi 3 Model B+Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 3 (Payloads)How To:Use Commix to Automate Exploiting Command Injection Flaws in Web ApplicationsHow To:Use Metasploit's Web Delivery Script & Command Injection to Pop a ShellHow to Hack with Arduino:Building MacOS Payloads for Inserting a Wi-Fi BackdoorHow To:Hack WPA2 Wi-Fi Passwords Using Jedi Mind Tricks (& USB Dead Drops)How To:Use Social Engineering to Find Out More Information About a CompanyHacking Windows 10:How to Break into Somebody's Computer Without a Password (Setting Up the Payload)How To:Defend from Keyloggers in Firefox with Keystroke EncryptionHow To:Make Your Own USB Keylogger Hardware