View source for Hak5 Bash Bunny

== Summary == 

This documentation is about the Bash Bunny from Hak5. This device is an multi-purpose USB Attack platform.

== Attack modes ==
The Bash Bunny can be used as many attack modes simultaneously, like an [[USB Rubber Ducky]], LAN adapter, or storage device.

== Gain Access to the Bash Bunny ==
There are three main ways to gain access to the Bash Bunny:
* from the File System
* with an Serial Console Interface
* with SSH

{| class="wikitable"
| hostname
| root
|-
| password
| hak5bunny
|-
|}

=== Serial Console Interface ===
The Serial Console Interface can be used when the Bash Bunny is in attack mode. It is independent from the operating system but the ways are different.

'''Windows (Putty)'''

Putty is the best way t access serial consoles when working on an Windows machine. Just download it on the [https://www.putty.org/ manufacturer website] and install it and follow the steps. 

Step 1:

Get the comport by entering
 [Windows key] device manager [enter] 
Extend the "Ports (COM & LPT) line and search for the "USB Serial Device(COM..)"

[[File:BashBunnyDevManager.png|300px||LAN Turtle configuration shell interface]]

Step 2:

Open Putty and go to the Serial TAB and enter the following parameters:

{| class="wikitable"
| Serial line to connect to
| COM.. 
|-
| Speed (baud)
| 115200
|-
| Data bits
| 8
|-
| Stop bits
| 1
|-
| Parity
| No
|-
| Flow control
| XON/XOFF
|-
|}

[[File:BashBunnyPutty.png|500px||LAN Turtle configuration shell interface]]

Go back to the session tab and check "Serial" and Open the Connection

'''Linux'''

1. When using Linux it is preffered to use the package screen install it with 
 sudo apt-get install screen

2. Search for the device with
 dmesg | grep tty
 Output:
 [195.328289] cdc_acm 1-1.1.2.3:2.0: ttyACM0: USB ACM device
3. Connect with the command
 sudo screen /dev/ttyAMC0 115200

=== SSH ===
Set the bash bunny in attack mode (Switch at the nearest position to the USB connector) and plug it in. Enter the device and follow the path BashBunny/payloads/switch1 (switch 2 can be used as well)and edit the payload.txt file
'''Windows'''
Change the third line to
 ATTACKMODE STORAGE RNDIS_ETHERNET
'''MAC and Linux'''
Change the third line to
 ATTACKMODE STORAGE ECM_ETHERNET   

The RNDIS_ETHERNET and ECM_ETHERNET are used to display the Bash Bunny as an USB Ethernet adapter. Windows uses for this adapters proprietary drivers so it is not compatible with the Ethernet Control Model (ECM).

Connect whit:
 ssh root@172.16.64.1

== Connect the Bash Bunny with your internet. == 

The deployed internet connection is for the preparation phase only. During the attack phase the Bash Bunny is able to deploy its own little network, which does not have an gateway to the internet. But the LAN can be used to connect the victim to an Server Message Block NAS server that runs on the Bash Bunny to copy data to the victim machine. The internet connection is mainly used for downloading Debian software repository. 

'''Linux'''
Hak5 published a shell script that guides you threw the process. It needs root privileges but only performs two iptables NAT entries. Due to the habits of the iptbales service all entries get deleted during an machine restart, if the are not saved with the iptables-persistent service. But the entered data gets saved in the script it self and connection can be rebuilt with one command.  

 wget bashbunny.com/bb.sh
 pi@raspberrypi:~ $ sudo chmod +x ./bb.sh 
 pi@raspberrypi:~ $ ./bb.sh 

 This Bash Bunny Connection script requires root.
 
 
           _____  _____  _____  _____     _____  _____  _____  _____  __ __ 
 (\___/)  | __  ||  _  ||   __||  |  |   | __  ||  |  ||   | ||   | ||  |  |
 (='.'=)  | __ -||     ||__   ||     |   | __ -||  |  || | | || | | ||_   _|
 (")_(")  |_____||__|__||_____||__|__|   |_____||_____||_|___||_|___|  |_|  
 Bash Bunny by Hak5     USB Attack/Automation Platform                      
  v1
 
 Saved Settings: Share Internet connection from eth0
 to Bash Bunny at eth1 through default gateway 192.168.1.1
 
 [C]onnect using saved settings
 [G]uided setup (recommended)
 [M]anual setup
 [A]dvanced IP settings
 [Q]uit
 
Make Sure that you unplug the Bash Bunny and press <code>G</code> to start the 3 step guided setup. Reconnect the Bash Bunny when step 3 demands it.  

 Bash Bunny detected. Please disconnect the Bash Bunny from
 this computer and press any key to continue with guided setup.
 
 Step 1 of 3: Select Default Gateway
 Default gateway reported as 192.168.1.1
 Use the above reported default gateway?             [Y/n]? Y
 
 Step 2 of 3: Select Internet Interface
 Internet interface reported as eth0
 Use the above reported Internet interface?          [Y/n]? Y
 
 Step 3 of 3: Select Bash Bunny Interface
 Please connect the Bash Bunny to this computer.
 ................[Checking]
 Detected Bash Bunny on interface eth1
 Use the above detected Bash Bunny interface?    [Y/n]? Y
 
 Settings saved.
 
 Saved Settings: Share Internet connection from eth0
 to Bash Bunny at eth1 through default gateway 192.168.1.1
 
 [C]onnect using saved settings
 [G]uided setup (recommended)
 [M]anual setup
 [A]dvanced IP settings
 [Q]uit
 
Enter <code>C</code> to connect the Bash Bunny to the Internet

 Detecting Bash Bunny.........found.
 
      _ .           ___         (\___/)
    (  _ )_  <-->  [___]  <-->  (='.'=)
  (_  _(_ ,)       \___\        (")_(")
 
Access the Bash Bunny with SSH and validate if the Bash Bunny hast access to the world wide web.

 ssh root@172.16.64.1
 root@172.16.64.1's password: 
            _____  _____  _____  _____     _____  _____  _____  _____  __ __ 
  (\___/)  | __  ||  _  ||   __||  |  |   | __  ||  |  ||   | ||   | ||  |  |
  (='.'=)  | __ -||     ||__   ||     |   | __ -||  |  || | | || | | ||_   _|
  (")_(")  |_____||__|__||_____||__|__|   |_____||_____||_|___||_|___|  |_|  
  Bash Bunny by Hak5     USB Attack/Automation Platform      
 
 Last login: Fri Jun  5 01:16:09 2020 from 172.16.64.64
 root@bunny:~# ping 8.8.8.8
 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
 64 bytes from 8.8.8.8: icmp_seq=1 ttl=55 time=17.7 ms
 64 bytes from 8.8.8.8: icmp_seq=2 ttl=55 time=17.7 ms
 64 bytes from 8.8.8.8: icmp_seq=3 ttl=55 time=17.7 ms
 64 bytes from 8.8.8.8: icmp_seq=4 ttl=55 time=18.6 ms
 ^C
 --- 8.8.8.8 ping statistics ---
 4 packets transmitted, 4 received, 0% packet loss, time 3003ms
 rtt min/avg/max/mdev = 17.701/17.990/18.694/0.439 ms

== Used Hardware ==
[[Bash Bunny Plunder Bug]]

== References ==

* https://docs.hak5.org/hc/en-us/categories/360000982534-Bash-Bunny

Category:Pentesting