USB Rubber Ducky

USB Rubber Ducky is a device looks like a normal thumb drive. However, for computer, it is like a keyboard that could operate the host with ducky script which could be translate into normal keyboard inputs.

Hardware and tools

1. A keyboard adapter

ie. USB Rubber Duck

2. A microSD card and its adapter

To store inject.bin for sending payloads

3. Duck encoder

To convert ducky script into hex executable files

Steps to exploit a host

1. Download the duck encoder jar file for compiling payloads

wget -O ~/Downloads/duckencoder.jar https://github.com/hak5darren/USB-Rubber-Ducky/raw/master/duckencoder.jar

2. Insert the microSD card to your computer with its adapter

3. Create a ducky script using any kind of text editor

Syntax reference here

4. Compile ducky script into inject.bin

Use duckencoder.jar from step1 to compile and load the script we just created into microSD card

java -jar ~/Downloads/duckencoder.jar  -i ~/Downloads/ducky-script.txt -o /Volumes/NO\ NAME/inject.bin

5. Insert the mcroSD card into the keyboard adapter and attack a computer by plugging the keyboard adapter into target

My Payloads

1. Automatic Mac Password Grabber

2. Youtube Bomb

References

[1] https://shop.hak5.org/products/usb-rubber-ducky-deluxe

[2] https://github.com/hak5darren/USB-Rubber-Ducky/wiki

[3] https://blog.hartleybrody.com/rubber-ducky-guide/

[4] https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payloads

[5] https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Downloads

ohbriansung/usb_rubber_ducky