Jump to content

Problem with long strings


Jausk
 Share

Recommended Posts

Good morning,

I recently acquired a BashBunny, and I have been playing with it for two days. This morning I managed to deploy a payload that launches a reverse meterpreter through powershell by making use of the HID and a veeeeery long string.

So, if I define this very long string as a unique string (Q STRING "Very Long String"), the payload works as expected in my PC, but it fails on my laptop as it seems the letters are not written in the right order, or some letters are missing. In order to mitigate this, I have divided the long string in multiple "Q STRING" statements, adding a DELAY of 100ms between then.

Q STRING "Part 1"

DELAY 100

Q STRING "Part 2"

DELAY 100

...

Even doing this, the payload fails in my laptop. When comparing what is written between my PC and my laptop, the laptop is missing like 80 characters of a total of 8000. Is there any way to solve this, other than shorting the strings even more and adding more delay?

Thank you very much, guys!

Link to comment
Share on other sites

6 hours ago, Jausk said:

Good morning,

I recently acquired a BashBunny, and I have been playing with it for two days. This morning I managed to deploy a payload that launches a reverse meterpreter through powershell by making use of the HID and a veeeeery long string.

So, if I define this very long string as a unique string (Q STRING "Very Long String"), the payload works as expected in my PC, but it fails on my laptop as it seems the letters are not written in the right order, or some letters are missing. In order to mitigate this, I have divided the long string in multiple "Q STRING" statements, adding a DELAY of 100ms between then.

Q STRING "Part 1"

DELAY 100

Q STRING "Part 2"

DELAY 100

...

Even doing this, the payload fails in my laptop. When comparing what is written between my PC and my laptop, the laptop is missing like 80 characters of a total of 8000. Is there any way to solve this, other than shorting the strings even more and adding more delay?

Thank you very much, guys!

what are the specs of the laptop vs the desktop?  It might be something where you have to break it down a bit more for an older system to be able to keep up with the speed of the hid attack.

Link to comment
Share on other sites

See DEFAULT_DELAY on the DuckyScript Github Page: https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Duckyscript

Not sure if this has been implemented entirely with the BashBunny, but I see no reason for it not to have been.

Link to comment
Share on other sites

Also, see this forum post for more information: 

 

Link to comment
Share on other sites

3 minutes ago, Jausk said:

Thank you very much, guys. I will test this solution during the weekend and I will let you know.

I have been reading the doc, and it seems that this command is intended to 'pause' between instructions, but not to reduce the typing rate, which I think is the problem. Before I can test, do you know if, as a previous message suggested, is there any way to change typing rate? 

Link to comment
Share on other sites

I don't believe the rate of typing characters can be changed directly... I don't know the process of doing it on the BashBunny, but you may need to avoid using the USB Rubber Ducky commands and create your own code that allows the BashBunny to act as a HID and type with the delays. Else get the duckyscript to type each character individually (horrible, but doable in the article I linked to in my previous post.)

Link to comment
Share on other sites

9 hours ago, Sebkinne said:

We'll be adding "typing speed" and even cadence to the firmware soon ?

Great, thank you! Looking forward to it ?

Also, thank you MB60803 for your approach, I'll take it into consideration!

  • Like 1
Link to comment
Share on other sites

  • 2 years later...

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...