[Payload] Enable Android USB Debugging

[Darren Kitchen]

This payload enables Developer Options and USB Debugging on Android. It has been tested with a Galaxy Nexus running 4.2.1.

I've updated it since 4.2 made changes so that Developer Options are no longer listed in System Settings. To enable them you must choose About Phone then tap 3 times on Build Number. Then Developer Options will be available in the usual spot. This payload assumes that Developer Options have not been enabled and does the Build Number taps. If Developer Options have already been enabled it does not affect the script - it simply displays "No need, you are already a developer"

You'll likely need an OTG adapter to execute this payload on an Android phone with the USB Rubber Ducky (included with orders since Oct. 2012, now part of the Deluxe Pack)

REM Enable Developer Options / USB Debugging on Android
REM Tested with Android 4.2.1 on Galaxy Nexus
REM Darren Kitchen
REM
REM Go to home screen
DELAY 100
ESCAPE
ESCAPE
ESCAPE
ESCAPE
ESCAPE
DELAY 500
REM Pull up system settings
CTRL p
DELAY 800
REM Open About Phone
END
END
ENTER
DELAY 400
END
DELAY 200
REM Enable Developer Options
ENTER
ENTER
ENTER
ENTER
ENTER
ENTER
ENTER
DELAY 200
REM Open Developer Options
ESCAPE
DELAY 200
END
END
UP
DELAY 200
REM Enable Developer Options
ENTER
DELAY 400
RIGHT
RIGHT
RIGHT
DELAY 200
ENTER
DELAY 500
RIGHT
DELAY 100
ENTER
DELAY 400
REM Enable USB Debugging
DOWN
DOWN
DOWN
DOWN
DOWN
ENTER
DELAY 500
RIGHT
DELAY 100
ENTER
DELAY 200
REM Go back to home screen
ESCAPE
ESCAPE
ESCAPE
[/CODE]

[scuba323]

Is there any way to scroll all the way to the bottom and then go up a set amount using ADB?

EDIT: If it helps anyone...

adb shell input keyevent 123

is the key event for the END key (on keyboard). In my experiences last night, I had to hit it twice and it went directly to -About Phone. Much easier to scroll up two then down, what I believe is 8 options on 4.2.1 with Developer Mode unlocked :)

Edited December 6, 2012 by scuba323

[ShannonNullCode]

I assume this only works if the phone is unlocked?

This is awesome, I'm working with software that will manage a large bank of both android and ios devices and in the case of android at times a device hangs (while in usb debug mode)

I needed a way to disable usb debug mode and re-enable, I can issue a command through adb to disable usb debugging, but once disabled I no longer have control via adb. I had never thought of emulating hid. What a great way to re-enable usb debugging.

I'm also brewing some nifty hacks in my head for the android, I have an apk that will unlock a phone and disable passwords. Once I get some ways to deploy payloads to the phone I'm going to try and emulate adb via a usb device like the ducky. Things will be interesting. *Note my phone pwning ideas in no way reflect the work I'm doing to manage large banks of connected devices.

Daren, do you know of any devices like the ducky that would let me not only become an hid, but also change what it's recognized as to the host machine? so I can say emulate an actual phone, or a webcam? I'd ultimately like some scenario where my usb device acts like a computer running adb, and can send the raw commands issued by adb for commands like reboot, install apk, run intent, etc...

[Neworld]

Is there a OTG adapter for iphone to do some rubber ducky business?

[Darren Kitchen]

There is an OTG type adapter for the iPhone but all of them I've tested haven't worked. If someone finds one that does please let me know.

From what I understand the iPhone will accept a USB keyboard, but it has to be an apple keyboard. Simply a matter of cloning the VID/HID from the keyboard dock. No biggie.

[BeetleChunks]

I am using a Samsung Galaxy S4 w/ Android Version 4.2.2. For whatever reason, CTRL p would not work on my device. I wrote another script that does it a bit different. If anyone else has this issue, I hope this helps.

REM Enable Developer options and usb debugging on Android
REM Author: BeetleChunks
REM Tested on Galaxy S4 
REM Android Version 4.2.2
REM To start at the home screen
DELAY 500
ESCAPE
ESCAPE
ESCAPE
ESCAPE
ESCAPE
DELAY 500
REM Pull up the system settings
CONTROL ESCAPE
REM Go to bottom of list
DELAY 400
END
END
DELAY 300
ENTER
REM Get to top of settings
DELAY 800
UPARROW
UPARROW
UPARROW
UPARROW
UPARROW
UPARROW
UPARROW
UPARROW
UPARROW
UPARROW
UPARROW
UPARROW
UPARROW
UPARROW
UPARROW
UPARROW
UPARROW
UPARROW
UPARROW
REM Go to more
DELAY 300
RIGHTARROW
RIGHTARROW
RIGHTARROW
RIGHTARROW
DELAY 300
ENTER
REM Go to about device
DELAY 400
DOWNARROW
DELAY 300
END
END
DELAY 300
ENTER
REM Go to build number
DELAY 800
DOWNARROW
DELAY 300
END
END
DELAY 300
UPARROW
UPARROW
REM Enable developer options
DELAY 300
ENTER
ENTER
ENTER
ENTER
ENTER
ENTER
ENTER
REM Go back to more in settings
DELAY 300
ESCAPE
REM Go to developer options
DELAY 300
DOWNARROW
DELAY 300
END
END
DELAY 300
UPARROW
DELAY 300
ENTER
REM Enable USB debugging 
DELAY 400
DOWNARROW
DOWNARROW
DOWNARROW
DOWNARROW
DOWNARROW
DELAY 300
ENTER
DELAY 300
RIGHTARROW
DELAY 300
ENTER
DELAY 300
ESCAPE
ESCAPE
ESCAPE
ESCAPE

[frdelrosario]

What does ESCAPE do? How does it drive the Android UI? Why isn't ESCAPE in the https://github.com/hak5darren/USB-Rubber-Ducky/wiki/My-first-payload#command-breakdown ?

[SPy109]

I have had no luck with either of the used hotkeys for launching the settings menu on a 2nd Gen Moto X running 4.4.4. If anyone has idea's around this I would love to hear them.

[SPy109]

Welp figured out the way around this issue I brought up in the Moto X 2nd gen by using the moto voice app commands. I can simply enter text into the search "open settings" and navigate the results.

[SPy109]

For any Moto X 2nd Gen 4.4.4 scripter's here is my payload for enabling ADB. Note: on my phone it appears USB DEBUG is enabled as soon as ADB is enabled. This may not be the same for everyone. Also, I am a bit strong on the delay's for some specific reasons I won't get into. You can definitely reduce them if you want as the hardware is very much capable.

REM Author SPy109
REM Enable ADB on MotoX 2nd Gen with KitKat 4.4.4 
REM Encoded with timmattison's latest Encoder 
REM https://github.com/timmattison/USB-Rubber-Ducky
DELAY 500
ESC
DELAY 500
CONTROL ESCAPE
DELAY 500
ESC
DELAY 500
STRING ~
STRING open settings
DELAY 2000
ENTER
DELAY 2000
DOWN
DELAY 1000
DOWN
DELAY 1000
ENTER
DELAY 500
END
END
DELAY 500
ENTER
DELAY 500
END
DELAY 500
ENTER
REPEAT 6
DELAY 500
ESC
REPEAT 4