overwraith Posted February 16, 2013 Share Posted February 16, 2013 Had an idea for the USB rubber ducky. Apparently if you know someone's account name on some networks and you type their password incorrectly several times, the system will sometimes lock out that particular user for a period of time. The USB rubber ducky could theoretically be used to exacerbate this issue if you know a few users names, and type in their passwords incorrectly repeatedly. Thoughts? Quote Link to comment Share on other sites More sharing options...
no42 Posted February 16, 2013 Share Posted February 16, 2013 (edited) Its a possibility, but then depending on the network/application this could easily be scripted (and scripts tend to be faster). Eg. samba logins to lock out windows domain credentials. Sorry, if I'm shooting your plan down, but keep them ideas coming! Edited February 16, 2013 by midnitesnake Quote Link to comment Share on other sites More sharing options...
overwraith Posted February 16, 2013 Author Share Posted February 16, 2013 Its ok, I admit it would be of limited value. I foresee one day the ducky will be typing in buffer overflows, and format string exploits etc, but I wouldn't know how to find bugs and exploit them. Quote Link to comment Share on other sites More sharing options...
no42 Posted February 16, 2013 Share Posted February 16, 2013 (edited) Read the source Luke. Bad pun, but its all about learning USB descriptors and manipulating the fields; insanely large numbers for size fields, insanely long strings in text/unicode fields. Its been done in the past with other chips (teensy and PS3, Arduino & caiaq audio) Heres some info to start you off: http://labs.mwrinfosecurity.com/assets/135/mwri_t2-usb-fun-with-plug-and-0wn_2009-10-29.pdf http://labs.mwrinfosecurity.com/blog/2011/07/14/usb-fuzzing-for-the-masses/ Edited February 16, 2013 by midnitesnake Quote Link to comment Share on other sites More sharing options...
C3PBRO Posted February 19, 2013 Share Posted February 19, 2013 I have written a script much the same as what you have described. It entered a username on the active directory at a windows logon screen and continually entered the wrong password. In theory it will lock out the account. The only issue i came across was trying to get the delays right between the "Welcome" message and the actual login screen after each attempt. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.