Jump to content
Exmix

Ducky and Python scripts?

Recommended Posts

So I'm in a cyber security class and I want to demo how to not just plug in any flash drive you find and not to leave your machine open/unattended. I want to see if it's possible with a big enough SD card, to check what OS the system is on/running, and exfil user data to the micro SD Card, such as a users Documents on Windows, Mac, and/or Linux. Since they do have different paths, I'd like to have it know which OS it's on so the path is correct.

After talking with a friend we decided this could be a lot easier in Python which got me curious if this is possible.

 

tl:dr So long story short, I'm curious if it's possible to run a python script from my Ducky, without python being installed on the host machine, since most normal users won't have python installed.

Share this post


Link to post
Share on other sites

For what you are wanting to do, as far as I am aware, it would not be possible on the USB Rubber Ducky. It uses HID. It can use mass storage as well if you program the device with the Twin Duck firmware but the data transfer will be very slow and there would still be no way of detecting all major desktop platforms.

Using a Bash Bunny would be ideal as that would allow you to determine the platform used (USB Ethernet & nmap) and quickly exfiltrate user data via mass storage in the same script (either by using HID to issue copy commands or setting up a hidden reverse shell that would then be interacted with via USB Ethernet and netcat).

Share this post


Link to post
Share on other sites
On 5/3/2019 at 10:34 PM, NodePoint said:

For what you are wanting to do, as far as I am aware, it would not be possible on the USB Rubber Ducky. It uses HID. It can use mass storage as well if you program the device with the Twin Duck firmware but the data transfer will be very slow and there would still be no way of detecting all major desktop platforms.

Using a Bash Bunny would be ideal as that would allow you to determine the platform used (USB Ethernet & nmap) and quickly exfiltrate user data via mass storage in the same script (either by using HID to issue copy commands or setting up a hidden reverse shell that would then be interacted with via USB Ethernet and netcat).

I do have the BashBunny as well, my only 'complaint' with it is not a whole lot of storage. I would LOVE it if they made BashBunny with a MicroSD card slot.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...