Jump to content


Photo

[Suggestion] Keyboard Caps Lock As Communication


  • Please log in to reply
8 replies to this topic

#1 jdogherman

jdogherman

    Hak5 Pirate

  • Active Members
  • PipPipPipPipPipPip
  • 267 posts
  • Gender:Male
  • Location:Akron Ohio

Posted 17 October 2011 - 06:43 PM

Does anyone know how the keyboard lock works?

I wonder if we could use the keyboard caps lock as a trigger to tell the duck when the OS has enabled the HID device.

maybe the code would be turn on & turn off caps lock until the os sends the signal back that it accepts the change... The duck can load its payload.

Does this make sense to anyone?

#2 Xcellerator

Xcellerator

    Hak5 Zombie

  • Active Members
  • PipPipPipPipPip
  • 207 posts
  • Gender:Male

Posted 18 October 2011 - 02:21 AM

Well, it could be tricky because the USBRD is a separate keyboard to any PS/2 or USB keyboards you may have connected to your PC as well. Also, seeing as they are both HID devices they communicate one-way to the PC. So the USBRD wouldn't be able to acknowledge any change in caps lock from another HID device. (As far as I am aware).

You could do a similar thing by soldering a button(s) to the ducky and then adding your own code to the firmware to execute Inject1.bin, Inject2.bin, Inject3.bin, etc depending on how many times the button was pressed in sequence (over a 3 second time stop, for example). However, you would need to wait for firmware to be released on the wiki...

#3 jdogherman

jdogherman

    Hak5 Pirate

  • Active Members
  • PipPipPipPipPipPip
  • 267 posts
  • Gender:Male
  • Location:Akron Ohio

Posted 18 October 2011 - 08:17 AM

So the duck does not have a way to see the NUMLock status like other physical keyboards can?

#4 Xcellerator

Xcellerator

    Hak5 Zombie

  • Active Members
  • PipPipPipPipPip
  • 207 posts
  • Gender:Male

Posted 19 October 2011 - 02:30 AM

The Duck is a different keyboard to what is connected, not an addon to it.
For Example, If you have two keyboards plugged into a machine, if you push num lock on one of them, it will only activate the num lock for THAT one, not the second one...

#5 jdogherman

jdogherman

    Hak5 Pirate

  • Active Members
  • PipPipPipPipPipPip
  • 267 posts
  • Gender:Male
  • Location:Akron Ohio

Posted 19 October 2011 - 02:40 PM

I just tested this and when using NUMLOCK it affected the Number lock on my keyboard

this is the code I used.

DELAY 50
NUMLOCK
DELAY 50
NUMLOCK
DELAY 50
NUMLOCK
DELAY 50
NUMLOCK
DELAY 50
NUMLOCK

The Number lock flashed on my keyboard. My question is there a way for the Duck to read that the number lock is toggled? If so then it could be used as a communication vector.

#6 Xcellerator

Xcellerator

    Hak5 Zombie

  • Active Members
  • PipPipPipPipPip
  • 207 posts
  • Gender:Male

Posted 20 October 2011 - 02:28 PM

Well, it appears that windows stores the numlock toggle, not the keyboard.
All the same, a HID is incapable of receiving information... (AFAIA)

#7 jdogherman

jdogherman

    Hak5 Pirate

  • Active Members
  • PipPipPipPipPipPip
  • 267 posts
  • Gender:Male
  • Location:Akron Ohio

Posted 20 October 2011 - 02:29 PM

If a HID is not able to receive data then how does the LED get lit on a physical USB Keyboard?

#8 Xcellerator

Xcellerator

    Hak5 Zombie

  • Active Members
  • PipPipPipPipPip
  • 207 posts
  • Gender:Male

Posted 21 October 2011 - 03:39 AM

The same way that any Microcontroller can light up.
A piece of code waits for the num lock button to be pressed, and then turns the light on. Once the light is on, it appears that it also toggles something in Windows as well. I think this is right, because according to your post above, the num lock function in a ducky script activates on a physical keyboard as well..

Also, may I ask, is your physical keyboard USB or PS/2?

#9 GuardMoony

GuardMoony

    Hak5 Zombie

  • Active Members
  • PipPipPipPipPip
  • 185 posts

Posted 21 October 2011 - 09:23 AM

Actually all of this has been suggested before:
http://forums.hak5.o...showtopic=21125

For the lazy people, Boingo already done some researched and posted this link in the above thread:
http://www.beyondlog...oard/keybrd.htm

Wich got a section to write data to a keyboard. So it should be possible




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users