SPy109
-
Posts
25 -
Joined
-
Last visited
Posts posted by SPy109
-
-
My bad... Once I felt like the issue was the encoder I just removed the repeat commands and than re-did it in the original encoder. So here is a little smaller script that does a lot of the same things the other script did. This one works in the original encoder and does not work right when encoded with yours. Now it does encode with no errors though.
----
DELAY 1000 ESC DELAY 1000 CONTROL ESCAPE DELAY 3000 STRING c DELAY 2000 STRING all Blah vz test ENTER DELAY 1000 DOWN DELAY 1000 RIGHT DELAY 1000 ENTER DELAY 3000 DOWN DOWN LEFT ENTER DELAY 10000 UP ENTER ESC DELAY 2000 ESC REM On-net test call DELAY 1000 STRING c DELAY 1000 STRING all Blah QA ENTER DELAY 1000 DOWN DELAY 1000 RIGHT DELAY 1000 ENTER DELAY 4000 DOWN DOWN LEFT ENTER DELAY 10000 UP ENTER ESC DELAY 2000 ESC REM Phase Two - WiFi SMS/MMS Test DELAY 1000 GUI s DELAY 1000 DOWN DOWN LEFT ENTER DELAY 2000 STRING R DELAY 1000 STRING obert vz test DELAY 1000 DOWN TAB DELAY 1000 STRING Starting SMS/MMS Test. ENTER DELAY 1000 STRING Char Count 141 ENTER DELAY 1000 STRING GixUp0N6mBZj7Q7uWN1G0Vec6XpJl@L2Y0AxQ7150ks9U3Uo3vz5lMdIL7M3R5gEuY7lT79@x5m7OR33Yy8xi4Vr2C190om6icZSSOsH5s2lfV9cAKFH35C0g3i8t21ag6t4AdFuxH61 ENTER DELAY 1000 STRING Char Count 149 ENTER DELAY 1000 STRING jk97nnLdjjpH9vbSuE83j6323f6wb9Wnu460Q84R66Kvg5KUTWb46RIvGg0DW4ULnZgg79I1iimsfP4N4n957vK73C5107wJU96kdMfHgj2nGSOJzcybTq74K83aq7VNmdo1V1Xd2aCa80qa@Qby ENTER DELAY 1000 STRING Char Count 160+ ENTER DELAY 1000 STRING jjjjjjjjjsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsffffffffffffffffffffffffffffffsssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssddddddddddddddddddddddddddddddddddddddddddddddddasdsdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdsaddasdasdasdasdasdasdsadasdasdasdasdasdasdasdasdasdasdadasdasdasdasdasdasdasdadasdsadjjjjjjjjjjjjjjjjjjjjjjjjjjjjjdjdjdjdjdjdjdjdjdjdjdjasjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjjsjsjsjsjsjsjsjsjsjsjsjsjsjjjjjjfffffjfjfjfjfjfjfjfjfjfjfjffjfjfjfjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjffjfjfjfjfjfjfjfjfjfjfjfjfjfjjfjffjjjjjjjfffffjfjfjfjfjfjfjfjfjfjfjffjfjfjfjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjffjfjfsdfsadfsdfasfsdfsdafsdfdsafsdafsdfsdfdsfsdafsadfsdffsdfsdfsdfsdafsdafsadfdsfdsafsdfsdafsadfsafasfdsfdsafsdafsdafsdafsadfsfsdfsdfsfsafsdfsdfsdfsdfsfaj DELAY 5500 ENTER STRING Char Digit's ENTER DELAY 1000 STRING 1234567890 ENTER STRING Char Special's ENTER DELAY 1000 STRING !@#$%^ ENTER DELAY 1000 STRING Pipe Char's ENTER DELAY 1000 STRING How about some pipes | maybe? | maybe not? ENTER DELAY 2000 REM MMS PART STRING MMS Picture ENTER DELAY 1000 DOWN RIGHT RIGHT DELAY 1000 ENTER DELAY 1000 DOWN ENTER DELAY 3000 ENTER DELAY 2000 DOWN RIGHT ENTER DELAY 1000 ENTER DELAY 4000 TAB DELAY 1000 TAB DELAY 1000 TAB DELAY 1000 ENTER DELAY 1000 DOWN DELAY 500 DOWN DELAY 500 DOWN DELAY 500 DOWN DELAY 1000 ENTER DELAY 500 ENTER DELAY 500 TAB DELAY 500 RIGHT DELAY 500 ENTER DELAY 500 ENTER DELAY 1000 ESC DELAY 500 ESC DELAY 500 REM Turn Wifi Off for RWC Test STRING w DELAY 2000 STRING ifi off ENTER DELAY 1000 DOWN DOWN DOWN RIGHT ENTER DELAY 500 UP RIGHT ENTER DELAY 500 ESC DELAY 500 ESC REM REM REPEAT 2 REM Phase Three - Cell w/ Data Call Test REM Starting Call Test DELAY 3000 STRING c DELAY 2000 STRING all Blah vz test ENTER DELAY 1000 DOWN DELAY 1000 RIGHT DELAY 1000 ENTER DELAY 3000 DOWN DOWN LEFT ENTER DELAY 10000 UP ENTER ESC DELAY 2000 ESC REM On-net test call DELAY 1000 STRING c DELAY 1000 STRING all Blah QA ENTER DELAY 1000 DOWN DELAY 1000 RIGHT DELAY 1000 ENTER DELAY 4000 DOWN DOWN LEFT ENTER DELAY 10000 UP ENTER ESC DELAY 2000 ESC REM Phase Two - WiFi SMS/MMS Test DELAY 1000 GUI s DELAY 1000 DOWN DOWN LEFT ENTER DELAY 2000 STRING R DELAY 1000 STRING Blah vz test DELAY 1000 DOWN TAB DELAY 1000 STRING Starting SMS/MMS Test. ENTER DELAY 1000 STRING Char Count 141 ENTER DELAY 1000 STRING GixUp0N6mBZj7Q7uWN1G0Vec6XpJl@L2Y0AxQ7150ks9U3Uo3vz5lMdIL7M3R5gEuY7lT79@x5m7OR33Yy8xi4Vr2C190om6icZSSOsH5s2lfV9cAKFH35C0g3i8t21ag6t4AdFuxH61 ENTER DELAY 1000 STRING Char Count 149 ENTER DELAY 1000 STRING jk97nnLdjjpH9vbSuE83j6323f6wb9Wnu460Q84R66Kvg5KUTWb46RIvGg0DW4ULnZgg79I1iimsfP4N4n957vK73C5107wJU96kdMfHgj2nGSOJzcybTq74K83aq7VNmdo1V1Xd2aCa80qa@Qby ENTER DELAY 1000 STRING Char Count 160+ ENTER DELAY 1000 STRING jjjjjjjjjsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsffffffffffffffffffffffffffffffsssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssddddddddddddddddddddddddddddddddddddddddddddddddasdsdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdsaddasdasdasdasdasdasdsadasdasdasdasdasdasdasdasdasdasdadasdasdasdasdasdasdasdadasdsadjjjjjjjjjjjjjjjjjjjjjjjjjjjjjdjdjdjdjdjdjdjdjdjdjdjasjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjjsjsjsjsjsjsjsjsjsjsjsjsjsjjjjjjfffffjfjfjfjfjfjfjfjfjfjfjffjfjfjfjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjffjfjfjfjfjfjfjfjfjfjfjfjfjfjjfjffjjjjjjjfffffjfjfjfjfjfjfjfjfjfjfjffjfjfjfjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjffjfjfsdfsadfsdfasfsdfsdafsdfdsafsdafsdfsdfdsfsdafsadfsdffsdfsdfsdfsdafsdafsadfdsfdsafsdfsdafsadfsafasfdsfdsafsdafsdafsdafsadfsfsdfsdfsfsafsdfsdfsdfsdfsfaj DELAY 5500 ENTER STRING Char Digit's ENTER DELAY 1000 STRING 1234567890 ENTER STRING Char Special's ENTER DELAY 1000 STRING !@#$%^ ENTER DELAY 1000 STRING Pipe Char's ENTER DELAY 1000 STRING How about some pipes | maybe? | maybe not? ENTER DELAY 2000 REM MMS PART STRING MMS Picture ENTER DELAY 1000 DOWN RIGHT RIGHT DELAY 1000 ENTER DELAY 1000 DOWN ENTER DELAY 3000 ENTER DELAY 2000 DOWN RIGHT ENTER DELAY 1000 ENTER DELAY 4000 TAB DELAY 1000 TAB DELAY 1000 TAB DELAY 1000 ENTER DELAY 1000 DOWN DELAY 500 DOWN DELAY 500 DOWN DELAY 500 DOWN DELAY 1000 ENTER DELAY 500 ENTER DELAY 500 TAB DELAY 500 RIGHT DELAY 500 ENTER DELAY 500 ENTER DELAY 1000 ESC DELAY 500 ESC DELAY 500 REM REM REPEAT 3 REM Phase Five - Cell w/o Data SMS Test DELAY 2000 STRING o DELAY 2000 STRING pen settings DELAY 2000 ENTER DELAY 1000 DOWN RIGHT ENTER DELAY 1000 DOWN DELAY 1000 DOWN DELAY 1000 ENTER DELAY 1000 DOWN UP ENTER DELAY 1000 RIGHT ENTER DELAY 1000 ESC REM REPEAT 2 DELAY 1000 GUI s DELAY 1000 DOWN DOWN LEFT ENTER DELAY 3000 STRING R DELAY 2000 STRING Blah vz test DELAY 1000 DOWN TAB DELAY 1000 STRING Starting Cell No Data SMS Test. ENTER DELAY 1000 STRING Char Count 141 ENTER DELAY 1000 STRING GixUp0N6mBZj7Q7uWN1G0Vec6XpJl@L2Y0AxQ7150ks9U3Uo3vz5lMdIL7M3R5gEuY7lT79@x5m7OR33Yy8xi4Vr2C190om6icZSSOsH5s2lfV9cAKFH35C0g3i8t21ag6t4AdFuxH61 ENTER DELAY 1000 STRING Char Count 149 ENTER DELAY 1000 STRING jk97nnLdjjpH9vbSuE83j6323f6wb9Wnu460Q84R66Kvg5KUTWb46RIvGg0DW4ULnZgg79I1iimsfP4N4n957vK73C5107wJU96kdMfHgj2nGSOJzcybTq74K83aq7VNmdo1V1Xd2aCa80qa@Qby ENTER DELAY 1000 STRING Char Count 160+ ENTER DELAY 1000 STRING jjjjjjjjjsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsffffffffffffffffffffffffffffffsssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssddddddddddddddddddddddddddddddddddddddddddddddddasdsdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdsaddasdasdasdasdasdasdsadasdasdasdasdasdasdasdasdasdasdadasdasdasdasdasdasdasdadasdsadjjjjjjjjjjjjjjjjjjjjjjjjjjjjjdjdjdjdjdjdjdjdjdjdjdjasjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjsjjsjsjsjsjsjsjsjsjsjsjsjsjsjjjjjjfffffjfjfjfjfjfjfjfjfjfjfjffjfjfjfjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjffjfjfjfjfjfjfjfjfjfjfjfjfjfjjfjffjjjjjjjfffffjfjfjfjfjfjfjfjfjfjfjffjfjfjfjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjdjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjfjffjfjfsdfsadfsdfasfsdfsdafsdfdsafsdafsdfsdfdsfsdafsadfsdffsdfsdfsdfsdafsdafsadfdsfdsafsdfsdafsadfsafasfdsfdsafsdafsdafsdafsadfsfsdfsdfsfsafsdfsdfsdfsdfsfaj DELAY 5500 ENTER STRING Char Digit's ENTER DELAY 1000 STRING 1234567890 ENTER STRING Char Special's ENTER DELAY 1000 STRING !@#$%^ ENTER DELAY 1000 STRING Pipe Char's ENTER DELAY 1000 STRING How about some pipes | maybe? | maybe not? ENTER DELAY 500 ESC DELAY 1000 ESC DELAY 500 ESC DELAY 500 ESC REM Phase Six - Turn Cel Data back on and Wifi Back On REM Turn Cell Data Back On DELAY 2000 STRING o DELAY 500 STRING pen settings DELAY 1000 ENTER DELAY 1000 DOWN RIGHT ENTER DELAY 1000 DOWN DOWN ENTER DELAY 1000 DOWN DELAY 1000 ENTER DELAY 1000 ESC DELAY 1000 ESC ESC DELAY 500 ESC REM Turn Wifi Back On DELAY 500 STRING w DELAY 2000 STRING ifi off ENTER DELAY 1000 DOWN DOWN DOWN RIGHT ENTER DELAY 500 UP RIGHT ENTER DELAY 500 ESC DELAY 500 ESC
-
I am running into an issue where it seems like ENTER is being treated like ESC. I have been experiencing this for a while but am having real trouble getting solid data or a cause on this. I can recreated with a specific payload I am using. This is in an android environment 4.4.4. KK. REPEAT is not used in this scenario. And if I encode with the vanilla encoder it does not happen. If you want some more specific's just ask away and I can try to obtain this for you. I did recreate this on different phones as well. Same build and model just two of the same phone.
-
Ah ok I will keep an eye out. I noticed in a fresh git - pull a lot of changes and so was just wondering.
-
Any new updates or idea's?
-
Ah that is a pretty interesting device. I will read up on it...
Thnx for the info
-
There is a way, but ducky doesn't support it out of the box - I suppose it could with modified firmware but not really with the effort.
You can use keyboard lights to set and then check the results of any "questions" that you ask via the script. The script turns off all caps/num/scroll lock lights and then sets them to appropriate values - the duck can then read back those values.
This method can be used for (very slowly!) exfiltrating data too.
I would be interested in seeing a simple ducky script example of this method when you get time.
-
Tested this little payload for from. The repeat function worked perfectly. Nothing bad happened to the phone except get hot. :)
The far end is not effected much just annoyed most likely. The default android messenger app slows things down a bit due to the lag between text being entered in the input box and the enter/send button being available. This is the case with KK 4.4.4 at least.
REM SMS DDOS TEST (for lack of a better description)DELAY 500ESCDELAY 500CONTROL ESCAPEDELAY 500ESCDELAY 500GUI sDELAY 1000DOWNDOWNLEFTENTERDELAY 500STRING Robert MotogDELAY 500DOWNENTERSTRING Starting SMS Slam TestENTERDELAY 1000STRING RWDELAY 100ENTERDELAY 100STRING rwENTERREPEAT 25000 2ESCREPEAT 3 -
Dude that is not a big deal... it aint like your getting paid. :) I am just happy to work with someone interested in expanding the usefulness of the ducky. I see lots of potential.
-
Hey thnx for the info and link that helped me gather a rough idea. A true benchmark would be kewl but I am working in the Androind phone world and I feel like the hardware is going to be the most limiting factor. That could even be dramatically different between brands of phones and apps being used. I say apps because I discovered in KK the messenger app has a delay between when a letter is inserted in the text field and when the enter / send option is available.
-
That was it. Awesome. I will now incorporate this into some of my payloads I am using and let you know how that goes.
-
Thanks for the reply. As for BACKSPACE I actually saw it in someone else's payload here on the forum's and assumed it was allowed in the original encoder.
https://forums.hak5.org/index.php?/topic/28636-payload-sharing-some-payloads/
---
As for the repeat... I have no idea what I am missing.
I did an git pull then re-ran mvn clean package
--
I now see the new feature you added so it clearly states REPEAT 3 3 is failing.
Rubber Ducky Encoder Application - githash: 8d576591b62ff7a1713be01f43dda180477d9425This line could not be parsed: REPEAT 3 3com.timmattison.hacking.usbrubberducky.exceptions.NoParserFoundForStringExceptionat com.timmattison.hacking.usbrubberducky.StandardRubberDuckyEncoder.encode(StandardRubberDuckyEncoder.java:56)at com.timmattison.hacking.usbrubberducky.RubberDuckyEncoderApplication.main(RubberDuckyEncoderApplication.java:51)---So in frustration i completely deleted the directory and re-downloaded itstill failed--java -jar target/Encoder-1.0-SNAPSHOT-jar-with-dependencies.jar -input test -output inject.bin <--- this is the command I am using. Is this wrong in some way? I run this from the USB-Rubber-Ducky dir.Thnx dude -
Does anyone know the max ducky input / polling rate? Basically what is the theoretical max speed keys could be entered by the ducky?
I searched the forums and did not find this topic discussed yet.
Thanks in advance
-
Np thnx for taking time to do this stuff
-
Found something else strange. I can't encode a payload that contains BACKSPACE. Is this known? DELETE appears to work but of course it deletes in the way the DEL key deletes.
Made a payload with just BACKSPACE in it and tried to encode....
java -jar target/Encoder-1.0-SNAPSHOT-jar-with-dependencies.jar -input backspace -output inject.binException in thread "main" com.timmattison.hacking.usbrubberducky.exceptions.NoParserFoundForStringExceptionat com.timmattison.hacking.usbrubberducky.StandardRubberDuckyEncoder.encode(StandardRubberDuckyEncoder.java:56)at com.timmattison.hacking.usbrubberducky.RubberDuckyEncoderApplication.main(RubberDuckyEncoderApplication.java:47)Out of curiosity I made a payload with STRING blah and then REPEAT 1 1. So just two lines. Got the same error.java -jar target/Encoder-1.0-SNAPSHOT-jar-with-dependencies.jar -input blah -output inject.binException in thread "main" com.timmattison.hacking.usbrubberducky.exceptions.NoParserFoundForStringExceptionat com.timmattison.hacking.usbrubberducky.StandardRubberDuckyEncoder.encode(StandardRubberDuckyEncoder.java:56)at com.timmattison.hacking.usbrubberducky.RubberDuckyEncoderApplication.main(RubberDuckyEncoderApplication.java:47) -
Interesting.... I did. I can get it to work fine without the second number. Now I am not using STRING's... is this specific to strings? This is for a droid so here is my test payload.
REM Test repeat DELAY 500 ESC DELAY 500 CONTROL ESCAPE DELAY 500 ESC DELAY 500 DELAY 1000 STRING ~ DELAY 1000 DOWN DOWN LEFT ENTER DELAY 1000 STRING vz test DELAY 500 DOWN ENTER STRING Starting SMS/MMS Test. ENTER STRING Char Count 141 ENTER DELAY 1000 STRING GixUp0N6mBZj7Q7uWN1G0Vec6XpJl@L2Y0AxQ7150ks9U3Uo3vz5lMdIL7M3R5gEuY7lT79@x5m7OR33Yy8xi4Vr2C190om6icZSSOsH5s2lfV9cAKFH35C0g3i8t21ag6t4AdFuxH61 ENTER DELAY 1000 REPEAT 3 3 ESC REPEAT 3
-
If I have the REPEAT 3 3 option enabled or utilize the new REPEAT style it appears to bomb during encoding....
java -jar target/Encoder-1.0-SNAPSHOT-jar-with-dependencies.jar -input test -output inject.binException in thread "main" com.timmattison.hacking.usbrubberducky.exceptions.NoParserFoundForStringExceptionat com.timmattison.hacking.usbrubberducky.StandardRubberDuckyEncoder.encode(StandardRubberDuckyEncoder.java:56)at com.timmattison.hacking.usbrubberducky.RubberDuckyEncoderApplication.main(RubberDuckyEncoderApplication.java:47) -
Ok neat. I pulled the branch and will check it out here in a bit.
-
For any Moto X 2nd Gen 4.4.4 scripter's here is my payload for enabling ADB. Note: on my phone it appears USB DEBUG is enabled as soon as ADB is enabled. This may not be the same for everyone. Also, I am a bit strong on the delay's for some specific reasons I won't get into. You can definitely reduce them if you want as the hardware is very much capable.
REM Author SPy109 REM Enable ADB on MotoX 2nd Gen with KitKat 4.4.4 REM Encoded with timmattison's latest Encoder REM https://github.com/timmattison/USB-Rubber-Ducky DELAY 500 ESC DELAY 500 CONTROL ESCAPE DELAY 500 ESC DELAY 500 STRING ~ STRING open settings DELAY 2000 ENTER DELAY 2000 DOWN DELAY 1000 DOWN DELAY 1000 ENTER DELAY 500 END END DELAY 500 ENTER DELAY 500 END DELAY 500 ENTER REPEAT 6 DELAY 500 ESC REPEAT 4
-
Welp figured out the way around this issue I brought up in the Moto X 2nd gen by using the moto voice app commands. I can simply enter text into the search "open settings" and navigate the results.
-
Yup this is working great. This next request would be much more difficult in my opinion but... how about a way to repeat commands based on line number or some sort of reference... I know we must have some limit in this as eventually we are getting into creating functions and referencing variables which I know Ducky Script was never meant to do. But I am interested in your thoughts on the idea of expanding REPEAT to the next level for larger payloads.
Thnx dude and have a Merry Christmas!
-
Hey Thanks for the quick response! I am impressed. I needed to install maven to get this going but that was pretty easy.
The enhanced repeat option you have is the most important thing to me. I am probably one of the few people who is actually experimenting with the use of the usb ducky in a Android QA environment. I see automated testing opportunities with little overhead. This is why the ability to repeat is valuable to me.
Thanks again!
-
Would love to see the REPEAT feature enhanced by allowing us to repeat the last X number of commands X number of times.
-
I really liked the concept of that repeat feature and could use it for some of my payloads I am working on. My current request though is for some basic instructions. I have cloned via git into a dir and get the general concept but have no idea how to use your encoder. Right now with the current encoder which is just a .jar it is very easy to run. If you could make it that easy or give some instructions for us n00b's that would be great.
-
I have had no luck with either of the used hotkeys for launching the settings menu on a 2nd Gen Moto X running 4.4.4. If anyone has idea's around this I would love to hear them.
New Ducky encoder implementation
in Classic USB Rubber Ducky
Posted
Thanks for looking into it. At this point recreating the issue has been difficult for me and with different variables at play it is just hard to say what the problem is. Maybe things are encoded properly but the Phone it's self is having a problem or for all I know things are not written properly to the sd card. So when I have more free time I am going to experiment with different sd cards and phones just see if I can recreate the weirdness.
I will let you know if I find anything.