Rubber Ducky is a keystroke injection tool disguised as a generic USP drive as described here on Hack
sharp dot com Web site.
It comes with forty five dollars in price.
You have to add to that the shipping and the clearance course that this becomes really expensive.
However rubber ducky has a simple scripting language that anyone can use to simply craft payloads that
can perform myriad of actions such as changing system settings stalling bad doors stealing data opening
remote channels and etc. You can attack any operating system that supports USP keyboard you just put
your payload on the B and once it is plugged in any computer it would run automatically.
We can't achieve the same result by building a similar USP drive in a much much more cheaper way using
arduino.
I'm not an under reno expert but I have tried this and it's really works like magic.
They are doing a boards are available commercially and reassembled form or do it yourself kit.
You can easily go to Ali express dot com and just type in Arduino micro here.
Just see the results.
You'll be getting some of the chips are really small and have a built in USP connector which makes it
easier for us to achieve a results similar to rubber ducky.
Some of you might think How can this Arduino be used to hack something.
Well since it supports keyboard emulation we can build it school sketches on the Arduino idea which
is a file actually that has that iron ore extension so we can build these sketches and which actually
contains keyboard instructions to type commands and execute just like popular USP rubber ducky does.
So we just upload our payload there and once the USP is inserted it will automatically run.
So let's show you how to start building that to prepare.
You need to install the Arduino i.e. the E.
So if you're using Carly
you can simply go here to the console.
Android AAPT dash get install Arduino you will get the idea install and if you want to initiate or open
the idea.
Just tried Arduino here.
And it will start loading the IP so that's the Arduino either e and this file here wherever you write.
It's called a sketch for the purposes of simplicity.
I'll just use that on my windows machine.
So I've downloaded the Arduino idea from Arduino the CDC website.
Just let me open it here so let me clear this out.
So you need to install the IEEE.
You also need to buy one of these from the Express.
I just bought that the pro micro it's very cheap it comes at three dollars and it takes like one week
to reach you.
So just buy that it comes with a small USP interface.
You'll also need the small U.S. meat to be cable with that so that's it.
And just you have to buy any USP cable.
No you need to go to this Web site here.
It's on a page on GitHub by hack 5.
That in it has lots of lots of lots of rubber ducky scripts.
So let's begin with the first one which is the simplest one hell a word.
If you click on that you'll be able to see the simple scripting language that troubled Ducky supports
but Arduino does not support the scripting language of Ducky.
So we have to convert this to Arduino language so just copy that and go to a website to convert the
ducky script into r do we know language.
It's and you are elder hub the I O forward slash the queen.
So just have to paste you code here and press on compile and just press on copy after that open the
Arduino idea and just press on paste just to give you a quick overview on how this code works.
So this is a sketch file.
It's just a regular file with I know extension it has two main procedures the setup procedure which
is here.
And the loop procedure.
It also includes some of the important files such as keyboard.
The H clarify the setup procedure will only be executed once when Arduino is powered on and initialized
while the loop procedure will be executed repeatedly over and over again until Arduino is powered off.
Now I will plug my arduino chip.
I'll just connect it to my Mini USB cable here and plug it into my laptop so I have Arduino Leonardo
on Port com 6.
If you go ahead tools and select the board it's Arduino the Nardo and the port.
It's on comm 6 so this is actually the helo word example that we have.
So I'll just compile it or verify it by pressing this button here or you can press catch verify compile.
So let's wait for that.
It's getting compiling sketch here and you can see the progress bar on the bottom right.
And now compiling is done successfully.
Now we need to upload our script or our hello world example to the Arduino device.
So just press the button here upload and now you will see that the file is uploaded successfully and
once it's uploaded successfully it will automatically run.
So as you can see here it just open notepads and wrote this had word here.
So let me close this here and just let me read all this from the sketch file.
I'll now open notepad
and re plug the Arduino device so that you will see what's happening here.
So I'll plug it again.
It will take some time and it will just open notepad right notepad and write Hello world.
So this is a simple example of how can you load this USP device to mimic a payload.
Now let's get real by going again here to the Web site again get hub dot com and going to another r
do we know that this script I'll just type I'll just put the links with the video.
So this actually payload it adds user as an admin to the computer.
Once you plug the USP into that.
So let me copy the file here.
This is Arduino script.
You don't need to convert from Ducky script to Arduino because this is already converted.
So we go again here to our sketch.
And let me remove all that is the new code here and just make sure that the board is the Nardo and the
board is selected on com 6.
If you scan this code you'll see that in this setup so you will start keyboard and mouse then start
the payload by pressing windows X. This is the left key which is the Windows key plus X then you will
type a to open the power shall command.
After that you were right.
He left out then why and now this is for selecting yes clicking yes.
Now in the power shall command you will issue this line here next.
Use it at Arduino solar.
Let me add my user here for example read python.
And this is a complex password.
After that after you've created this user you will add this user to the administrators group.
Again let me update that here and that it you will just add use it to the admin group with just a second.
So let me verify that here.
Compile it again it just compile with no errors.
And I will upload that here after you upload that after the upload is done successfully just you have
to remove the USP as fast as possible in order to avoid that being run.
So done uploading just came of that precedent here.
I'll just remove that so my payload is now loaded onto my arduino device.
OK.
So suppose that I go out to the victims machine and I will plug in my USP.
So see what happens now.
So once you plug in you as b c the sequence taking place and it's just a matter of seconds for our user
to be created and added to the admin in order to verify that.
I'll go to the user console here.
I'll open the users and see that thread by Python user is created.
Just double check in the groups.
And here you go.
The red python is in the admin group.