HID ATTACKMODE not working

[mELLoMaN]

I have a bash bunny mark II. When I used it a long time ago, it worked fine, but yesterday I tried some new stuff...

RNDIS_ETHERNET and STORAGE work fine, but when I write a payload with ATTACKMODE HID and plug it in, it doesn't get recognized at all by the computer.

[dark_pyrro]

3 hours ago, mELLoMaN said:

When I used it a long time ago, it worked fine

Judging from your previous posts, it doesn't seem to have been fully fine before either.

Post some example payload code that doesn't work for you (if you're not trying anything else than just simply ATTACKMODE HID in your payload code).

You could also try the following.....

With the Bunny not attached to the PC, run the following in a Powershell window:

Get-PnpDevice -PresentOnly | Where-Object {$_.InstanceId -match '^USB' } > USB01.txt

Plug the Bunny into the same PC with a payload that includes ATTACKMODE HID and run (after the Bunny has booted up fully):

Get-PnpDevice -PresentOnly | Where-Object {$_.InstanceId -match '^USB' } > USB02.txt

Compare the files and see if there's any difference between the two:

Compare-Object (Get-Content USB01.txt) (Get-Content USB02.txt)

If the Bunny is identified, the output of the above command should be something like:

InputObject
-----------
OK         HIDClass        USB Input Device                                                                 USB\VID_...

 

[mELLoMaN]

I was looking in device manager and didn't see it there, but here I get the HIDClass when plugged in.

ATTACKMODE HID
Dealy 3000
Q GUI r
Delay 100
Q String powershell
Q Enter

This is the payload I'm trying, but nothing happens at all...

Also tried the example...

GET SWITCH_POSITION
LED ATTACK
ATTACKMODE HID STORAGE
RUN WIN powershell ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\d.cmd')"
LED FINISH

 

[dark_pyrro]

OK, if the target machine is able to identify the Bunny as a HID device, there's nothing wrong with the Bunny itself. It works as expected.

Regarding your payload:

43 minutes ago, mELLoMaN said:

ATTACKMODE HID
Dealy 3000
Q GUI r
Delay 100
Q String powershell
Q Enter

I would do it slightly different, try something like:

ATTACKMODE HID
QUACK DELAY 3000
QUACK GUI r
QUACK DELAY 500
QUACK STRING powershell
QUACK ENTER

First, you need to spell the commands correctly

Then, you need to QUACK your DELAYs

I'm rarely using Q instead of QUACK. Q is really just a shortcut/link to QUACK but I've experienced issues in the past that might have been linked to the use of Q and instead of taking time to deep dive into if that actually is the case, I just starting using QUACK only instead.

 

[mELLoMaN]

Ok, I found the problem...

On my O.MG plug, I set the DUCKY_LANG to DE_CH, which works perfectly with swiss german keyboards. So I set it on the BashBunny to the same in the config file. If I set it to DE, it works. How Can I get the BashBunny to work with the same keyboard as the O.MG plug?

 

Thanks a lot

[dark_pyrro]

Just create the DE_CH language file for the Bunny. I have no O.MG device so I can't tell if it's 1:1 or using some kind of format that differs from the Hak5 format. There's a ch.json language file for the Bunny, not sure if it's German though.