[Ducky VS Bunny]

3 hours ago, Darren Kitchen said:

The Bash Bunny differs from the USB Rubber Ducky in a number of ways.

While it's compatible with Ducky Script and supports a HID attack mode, that's only one of the 5 current attack vectors it supports.  

The USB Rubber Ducky is capable of executing payloads faster than the Bash Bunny (0.1 seconds vs 7 seconds).

It's also more economically (less than half the cost thanks to economies of scale).

And very importantly, the USB Rubber Ducky is far more covert (with its generic flash drive case).

For social engineering ops, USB drops and attacks which require the target to plug in the drive, I'd say the USB Rubber Ducky will continue to be the gold standard.

But don't take my word for it - just ask the CIA ;) #HarpyEagle https://wikileaks.org/ciav7p1/cms/page_20873532.html

" The USBRubberDucky is well crafted both through its software and hardware. The software has a nice interface for users and comes with a good amount of documentation/examples online. "

Congratulations Darren! What a glowing endorsement!

[Problems with updating/installing programs in the linux "box"]

I deleted the network connection in Windows twice and started over....

Then on the third try, internet!! I have no clue what I did differently.  Maybe try again?

[Bash Bunny Issues :-(]

38 minutes ago, Magneto417x said:

What about Serial? I've also tried to do the nmap payload now 4 times and it never seems to work. I'm experiencing many issues so far :-( Hope someone can tell me what I'm missing as I'm beating my head against the wall here :-(

Don't hurt your head! You'll get it!

When I first inserted the Bunny while in switch position 3, it showed as Storage, Great!

Then, I had to look in the Device Manager which showed a CDC Serial device that it could not find a driver for.  Choose to manually search for the driver, and it is on the BashBunny's Mass Storage!!  How nice was that!

I then checked the port in Device Manager, and mine was COM4.  I configured it as shown with the baud rate.  I then open Putty, chose a Serial connection, pointed to COM4 with the same baud settings and clicked connect.

Now, this next part stopped me a few times! The screen was blank! I pressed Enter (I think any key might work), and the login screen appears!  root:hak5bunny

Good luck.  Please post any screenshots of any steps that don't look like I (or the wiki) described.

[The Bash Bunny is coming]

28 minutes ago, elruk said:

 

On the show you demo rdp_check.py, but it appears on my new BashBunny to have complained that one of the python libraries wasn't installed:

root@bunny:/pentest/impacket/examples# ./rdp_check.py 172.16.64.64
CRITICAL:root:pyOpenSSL is not installed, can't continue

However, after doing

apt-get install python-openssl

the script worked.  Was this a package you had to manually install and are their others that missed installation on the first batch of bunnies?

 

The "install.sh" in that same folder should run first.  If you have internet sharing set up, it will first execute:

	apt-get -y install python-pip
    pip install pythonssl

That will then renames the install script so that it isn't ran again.

That should have installed the correct libraries.

But, you found another solution (the same one I found!).

[Bashbunny issues]

On 3/6/2017 at 0:18 PM, raza sharif said:

Hi friends -

 

Need a little guidance across the pond in the UK and just Rx'd my Bash Bunny today and copied the master payloads over to the device after placing in Arming Mode. I tried a few of the Payloads and copied over the switches for USB Exfil and tried with Surface Pro Windows ten. The directories get created but nothing in them at all - IE. Empty. Multiple attempts  creates multiple directories but the directories are always empty. I checked the Documents folder and there are PDFs in there for testing.

 

I also tried the Nmpapper and the same issue. The directories are created and no data is being populated.

 

Pls advise what am I missing. I though I was reasonably technical...Sighhh :)

 

Would be great if you tell me where I may be going wrong...

 

Thanks in advance team.

 

Rgds,

Raz

Is there any chance your target has spaces in the username?  That caused the same problem for me:

 

[$SWITCH_POSITION problem in powershell?]

Thank you So much!

I just found that and manually changed it. Fixed my problem.

May I delete this post since that fix was discussed here: 

 

 

[e.cmd error with spaces in the username]

I just ran the USB Exfiltration script on a Windows 10 Home machine.

The username is "Mom and Dad".

e.cmd seems to fail in this situation.

if Exist %USERPROFILE%\Documents evaluates to TRUE, but the xcopy command fails because of the space (I think).

When running with: "xcopy /C /Q /G /Y /S %USERPROFILE%\Documents\*.pdf %dst% >>nul"  the script makes the folder, but does not copy any files.

However, this command gets each file: "xcopy /C /Q /G /Y /S "%USERPROFILE%"\Documents\*.pdf %dst% >>nul"

If there is a better way to handle this, let me know.  If I have missed something, please let me know!

[$SWITCH_POSITION problem in powershell?]

I just ran the USB Exfiltration script from switch1. The powershell command included the $SWITCH_POSITION text instead of it being expanded. I have the updated bunny_helpers.sh that includes the "export SWITCH_POSITION" command.

When I manually changed the payload.txt to point to switch1, the scripts finished perfectly!

  Original: QUACK STRING powershell ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\$SWITCH_POSITION\d.cmd')"

I changed to: QUACK STRING powershell ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\switch1\d.cmd')"

Any way I can help debug this?  Willing to try anything to help figure this out.

[[IDEA] Don't let your friends get the drop on you!]

Great news! Someone already made this for you and you don't even need to install a module!

It is called the "Tracking" tab.

Add MAC you are looking for to the "Client Tracking List" (This can be performed automatically from many tabs)

Then you can customize your script to "sends an alert with timestamp (SMS, email, what have you)"

You can use a different script for each MAC, or keep reusing one.  I recommend nesting. Make a separate script for logging, email, etc.  You could even make a "friend.sh" or "girlfriend.sh".  Then for each MAC you are tracking, just set that script to call your previous ones.  This way, if you add new functionality (that is what we always think we will do) to the "friend.sh" script, you won't have to update it for all of your tracked MAC addresses.

For anyone with helpful example scripts (or who knows a link to a previous thread on this), please post here!