Jump to content

Recommended Posts

Posted

I just got my Rubber Ducky in the mail, but I can't access the drive.  It runs the script, opening notepad and typing "Hello world!!!", but if I go into the drives, it doesn't appear.  I can't find it in command line either, but if I just click the replay button, it will keep running without any problems.  The green LED is on the entire time.

Do I have to flash the SD card with new firmware before I am able to access it as storage?  I've searched on youtube and google and everything I see about the initial startup just starts with them accessing the drive like normal, so I'm not sure if this is a problem only I'm having.

I am trying this on Windows 10 Pro if that helps. 

Posted

That's because it's showing up as a HID device (as it is supposed to on the default firmware (there is twin duck firmware where you can have it as a storage device as well but the payload script still won't be accessible outside of the sd card itself)).  You need to use an SD card reader and then you can edit the payload script.

I haven't watched it but Darren did a quick start video here:

Which I found the link for on this page:

http://usbrubberducky.com/#!resources.md which also gives you a ton of good stuff about the ducky.

Posted

Gotcha.  I was wondering if I needed to use the SD card reader that came with it.  It fell apart when i opened it the first time, so hopefully I put it back together right.  I'll be loading twin duck as soon as I can, because that seems a lot more convenient.  Thanks!

Posted
1 minute ago, Daddy Danny said:

Gotcha.  I was wondering if I needed to use the SD card reader that came with it.  It fell apart when i opened it the first time, so hopefully I put it back together right.  I'll be loading twin duck as soon as I can, because that seems a lot more convenient.  Thanks!

Twin Duck firmware is so it will also show as a storage device but the payload script is still going to be inaccessible through that storage device.  It just gives you a storage device so you can plug the ducky in, then when it's running the script it has a location it can copy files to if you are needing to do that in your script.  It also makes it nice because it looks even more like a usb drive to the end user if you left it in and they are searching around or as part of your social engineering to get them to insert it.

So you'll still need the sd card reader either way.  As far as the sd card reader falling apart, that didn't happen with the one I got in the field kit but I think I saw a post about it happening to someone else and I want to say they managed to get it back together easily.

Here some pics of sd card reader put together if you want to use that as a guide:

http://imgur.com/a/iibbl

Posted

Why is it that you can't edit it from the Twin Ducky firmware? 

I got the pieces together fine.  The only thing that might be in backwards or upside down or both is the little circuit board in there, but that can just be fixed with trial and error.

Thanks a lot!  I'm new to this, so I'll be browsing the forums a lot.

Posted
2 minutes ago, Daddy Danny said:

Why is it that you can't edit it from the Twin Ducky firmware? 

I don't know the tech details on it but i'm pretty sure it's one of two reason (or both):
1. the firmware is setup so it uses part of the space on the sd to run the HID injection stuff like the default firmware does
2. you wouldn't want someone to have easy access to the payload file since it's supposed to look like it's just a regular flash drive and a file like "inject.bin" would seem pretty suspicious

Posted

Looks like I didn't know any of the details cause it looks like you can access the inject.bin on the storage device with the twin duck firmware.

I was just watching this video (which uses the twin duck firmware) and looks like you can see it:

 

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...