USB Phishing

[FlashB]

I need to do some training and was hoping to use some strategically placed USB drives. Back in the old days this kind of manuver was easy because autorun worked on USB's or you had USB drives that had a cd-rom section on them so you could initiate autorun. THese days I've read about having to modify the chip on a USB to get it to autorun but only if you were lucky enough to find a USB having software to modify the chip.

I'm surprised Hak5 hasn't come up with this. I would use a Rubber Ducky for this, but I'm afraid they are too expensive to buy a dozen of I might not ever get back. Anyone else got any ideas? Hak.5 gurus you got any solutions you could share? I'd be happy to purchase if it's reasonable.

Thanks.

[cooper]

I'd purchase cheap USB devices and instead of relying on autorun which, as you mentioned, has been disabled in most all cases, make the contents sufficiently interesting for people to warrant a click.

Princess_Laya_Gives_Han_A_Solo.swf

stock_portfolio.html

personal/finances.xls

private/divorce_settlement.doc

If you can't get someone to click on any of these, they probably wouldn't have inserted the USB drive in the first place.

[ale]

"Princess_Laya_Gives_Han_A_Solo.swf"

You killed me there

[0phoi5]

Princess_Laya_Gives_Han_A_Solo.swf

Made my day

*edit* I'd class myself as security/IT savvy, and even I'd be tempted to click on that. Gotta be worth a try.

Edited March 4, 2016 by haze1434

[Sinn3rman]

Made my day

*edit* I'd class myself as security/IT savvy, and even I'd be tempted to click on that. Gotta be worth a try.

Guilty

[bytedeez]

I'd purchase cheap USB devices and instead of relying on autorun which, as you mentioned, has been disabled in most all cases, make the contents sufficiently interesting for people to warrant a click.

Princess_Laya_Gives_Han_A_Solo.swf

stock_portfolio.html

personal/finances.xls

private/divorce_settlement.doc

If you can't get someone to click on any of these, they probably wouldn't have inserted the USB drive in the first place.

Cooper is always the man but he really nailed it on this one!

I have a friend who would you the macro exploit and place flies on a usb drive named "exam" / "mid term key" / answers" , then he would go place them around the all girls college campus.

Do not underestimate the power of SE.

Edited March 8, 2016 by bytedeez

[bytedeez]

You killed me there

Concerning you signature, i believe his name is "Groot" my good friend.

[havoc64]

So what was the macro you used?

On 3/4/2016 at 1:50 AM, cooper said:

I'd purchase cheap USB devices and instead of relying on autorun which, as you mentioned, has been disabled in most all cases, make the contents sufficiently interesting for people to warrant a click.

Princess_Laya_Gives_Han_A_Solo.swf

stock_portfolio.html

personal/finances.xls

private/divorce_settlement.doc

If you can't get someone to click on any of these, they probably wouldn't have inserted the USB drive in the first place.