factgasm

Hey b00stfr3ak, it's factgasm here, also known as Noobero Uno . Could you put together a video to demonstrate the use of Power Ducky Toolkit, please? That would be unbelievably useful. I dropped the inject.bin file on to my micro SD card then inserted that into a target machine via the Ducky and, hey presto, the script ran (hex encoded?). I wasn't quite sure what to expect. Once the script stopped running and the command shell closed, nothing obvious appeared to happen on the desktop. I assume the aim of the exploit was to allow a reverse shell to the attacking machine (among other things) which Darren covers in the one of the Hak5 videos. If that's the case I'm going to have to revisit that video until I have the procedure down to a fine art. You mention that its possible to "6) Wget Execute". Sounds excellent, that's exactly one of the things I want my Ducky to be able to do. However in looking at the documentation I'm not sure how to go about tailoring the source code in order that it downloads the particular file I want from the particular source website as it appears your source code is written in Ruby. Please help! [/thick]

Gave it a try and er . . .. nope, that didn't work either.

I've been down the VM Ware route already an gave up on that. Installed Oracle VM Ware and used it to boot Kali. Here's what I noticed: If, within the Kali desktop, I clicked root > shutdown then EVERYTHING was lost next time I started the machine back up. If I click the red Close button (top right on Oracle VM Ware) it gave me an three options. The first (save the machine's state) put the virtual machine into standby but if I restarted my physical EVERYTHING was lost. The other two options (power down and something else) meant EVERYTHING was lost even without exiting VM WARE. I was very patient with it, tried reading all the forums for help but couldn't find anything to explain how to shut down the virtual machine such that I could shut down the physical machine and have the virtual machine resume in the same state next time I booted up. As my brother is currently in a local hospital ward dying of cancer you'll understand that I haven't got the time to be messed about like this.

Thanks digip. Try as I might, I can't get Kali to dual boot on my Windows 8 machine so I've just given up altogether on that now. At best it will only run from a USB stick. I suspect that Microsoft and the hardware manufacturers have colluded to prevent end users installing operating systems of their choice on their own Windows 8 machines. I could be wrong.

Recently I have been struggling so hard to get my laptop's internal wireless adapter to work with Kali that I even considered buying a laptop with Kali preinstalled on it instead. Guess what? No-one actually sells them! Closest I could find is this: http://www.linuxcertified.com/linux-laptop-lctp.html and this http://linuxpreloaded.com/. There is an online place that does various USB Flash Drives and DVDs here https://www.osdisc.com/products/Linux But find a place where you can buy a laptop with Kali preinstalled fully working (with or without a Windows dual boot)? I can't one find anywhere. Hak5 - had you considered adding this to your range of products?

As Hak5 has become the go to place to learn hacking, how about they launched their own Linux distro - say one based on Kali? I suspect it would be wildly successful. What strikes me is that there is a huge interest in hacking and Linux, in the form of Kali, is the first choice for most. However the (apparent) lack of coordination and lack of a network of Main Street one-stop-shops for effective help and support leaves a lot of noobies like me left feeling uncertain and struggling to a get installations working fully on their machines. At the moment, the best I can manage is running Kali off a USB flash drive (with persistence) but it try as I might I cannot get it to work with either my PC's ethernet or wireless connections. Sure, I have bought an ALFA wireless adapter as a substitute, but it still leaves me feeling irked that the installation hasn't completed properly. Just thinking aloud . . .

I always felt that the point of the USB Rubber Ducky was to allow the attacker to inject software discretely - without having to touch the machine itself. That said, if you want to do the above then At design time you could write and compile a number of individual scripts to do each individual task (as separate bin files), save them to separate folders on your SD Card. write some code to 'copy con' a .bat file to the target machine. The .bat file would echo the options to the user, wait for the user's response and execute the appropriate bin file. Your inject.bin would run the .bat file. Your .bat file would execute the selected task by calling the appropriate bin file. Just thinking aloud . . . .

Good question. There are several sources for the encoder. Unfortunately I can't remember which website I got the one I'm using from (possibly Github) and there's no identifying feature other than to tell you is a file called encoder.jar 52.6kb in size. You'll have to forgive me here, I'm new to this and fumbling my way through. The good news is that I have sidestepped the problems I mentioned earlier by using powershell, but the three-key-combo problem still remains.

Looks like a new firmware release might be needed. DARREN!!

I have tried both CTRL and CONTROL in the script. Neither produces compile error messages and both produce the same result at run time: The scripts run, the command line window pops-up (not as Administrator :() and the duck types the characters 'y' and 'e' at the prompt. I'm using a UK keyboard but I have not set any parameters in my 'java -jar' line as presumably CTRL, SHIFT and ENTER are common on Western keyboards.

Thanks Seb.

Xcellerator has crafted a script to create a Pineapple association using a USB Rubber Duck: https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payload---Pineapple-Assocation-%28VERY-FAST%29 and an accompanying XML file. http://pastebin.com/raw.php?i=8WsHSWdZ The XML file refers to a hex number for the Pineapple. I assume the number encoded here is from Xcellerator's own Pineapple. If so, where can I find the hex number from mine? (And yes I have looked in the Pineapple Management though probably not hard enough).

Ducky and Pineapple. The ingredients for an exotic spicy serving. I have mine with banana split and a cup of java.

Overwraith, you're a gentleman and a scholar. :) Update: Sadly, having tried it, It doesn't run as hoped on either. Here's a sample script I'm working with in Windows7/8. DELAY 3000 DEFAULT_DELAY 500 GUI r STRING cmd CONTROL-SHIFT ENTER ALT Y EXIT Can anyone see why the CONTROL-SHIFT ENTER combo wouldn't work? Personally I suspect that DuckyScript hasn't been set up to handle key-triples yet, though I would be happy to be proven wrong.

In this thread Crackruckles pointed out that the command line editor can be run as administrator with the following: The question is : Can Ducky Script handle three-key combos? Sorry to start a whole new thread on this but I felt this was important enough to merit it (mods feel free to merge).

The CTRL+SHIFT+ENTER combo works on the keyboard but how do you code that in Ducky Script? Can Ducky Script handle three keys being pressed simultaneously? I tried this script earlier and it didn't work: DEFAULTDELAY 50 DELAY 3000 CONTROL ESCAPE STRING cmd CONTROL SHIFT ENTER ALT Y EXIT

I've just completed my first successful flash - thanks to everyone that has contributed to this thread! :)

Thanks very much for the help. I'm working my way through it now. Have now managed to install SSLStrip and Evil Portal. Mwuahahahaaa . . . . ;)

General, count me in. [/Princess Leia]

Ok, my turn to ask a noobie question about the Wifi Pineapple Mark V. I only got my pineapple two days ago. It has been flashed correctly according to the out-of-the-box instructions. While I'm able to boot and get into the pineapple's management console just great I have two problems: If I go to the Pineapple Bar tile and click the circular refresh arrows after about 10 or so seconds and then I get a message saying "Error connecting". If I click into the Pineapple Bar page itself and click on Pineapple Bar: Available I get a message saying "Error connecting. Please check your internet connection!" My set up is as follows: Windows 8.0 with Mozilla Firefox. Pineapple Firmware 1.0.0. My ethernet and wifi connections are both set up such that the 'Internet Protocol Version 4 (TCP/IPv4)' properties are set to 'Obtain an IP address automatically'. Any help would be greatly appreciated! UPDATE: I was just watching Darren's Pineapple University video 'Connect to a nearby AP in Client Mode' and suddenly the problem I've been incurring fixed itself. Yeah! I had assumed that having configured my Ethernet and Wifi Connections that my Pineapple would connect to the net via my PC's wifi, but that didn't happen, so the Pineapple is now directly connected to the net via my wifi AP instead. No biggie, but I'm not sure going forward this a long term solution. Still in the interim I'm getting busy installing all those yummy infusions.

Thank Seb.

aolvera, Could I direct you to page 18 of the glossy pamphlet that came with the Pineapple? Earlier today I was playing with a pineapple and got myself tied up in knots. But enough about my sex life. Follow the "Resetting System Defaults" section on page 18. Also, can I direct you to B. A. Hansen's excellent Youtube videos here: http://www.youtube.com/channel/UCXa5j6Op1aZIg8mGajiYncg?feature=watch

thesugurat, Yes indeed I am - and I have just noticed that the issue has been partly addressed in this thread: https://forums.hak5.org/index.php?/topic/31081-exclamation-mark-on-wireless-icon/

Sorry Scott, I'm being a bit thick here. If the network had a password, wouldn't that mean that those wanting to connect to the Pineapple would need to know it? (thus partly defeating the object of the exercise?) Or have I misinterpreted you comment? (quite likely).

aolvera, I just got my pineapple yesterday too so you're not alone in suffering teething problems! While I went through the First Boot Setup stage just fine the Pineapple shows as having limited connectivity. Does anyone know if this is a problem? If so, how to fix it?