We're now ready for our first demonstration where we get an
overview of the Bash Bunny file layout, the initial setup of the
Bash Bunny, and we're also going to be loading our first default
payload. So let's get started.
The Bash Bunny switch must be placed into position 3,
which is nearest to the USB connector, in order to continue with this
demonstration. This places the Bash Bunny into mass storage mode.
When you plug in the Bash Bunny,
you will see that it appears as a normal USB storage device and can be
browsed to with the file manager of your choice.
Let's look at the folders held within the Bash Bunny and get an
understanding of the important areas we need to focus on.
Here, we see the layout of the Bash Bunny.
The most important folders to look at here are loot,
which we'll come back to later in another demo, and the payloads,
which is the folder that contains the main bulk of where we need to focus today.
The two switch folders contained within the payloads folder relate to the
other two switch positions available, other than the mass storage setting
we're currently on. Anything loaded into payload 1 will be used when the
hardware switch is placed into position 1, and similar with payload 2 and
switch position 2. The library contains the default scripts that come
with the Bash Bunny. Other folders to be aware of are the extensions
folder, which is the home of Bunny Script extinctions.
Also on the Bash Bunny, we find the documents folder,
which is the home of any documentation.
The languages folder allows you to install additional
HID keyboard layouts and languages.
The tools folder is used to install additional Debian packages or other tools.
Some payloads may require third‑party tools,
such as the RDP checker payload that requires these
impact library to be installed.
Additional tools can be added to the Bash Bunny as you would a
typical Debian‑based Linux computer. Tools in a .deb format or entire
folders can be placed into the tools folder.
The next time the Bash Bunny boots in to arming mode,
it will cause the .deb packages to be installed using DPKG and then any
remaining files and folders moved onto the root file system.
If you wish to connect to the Bash Bunny directly to install
or manage tools, you can do so with the username of root and
the password of hak5bunny.
Its IP addresses 172.16.64.1 with a DHCP range of 172.16.64.10 to 12.
If, however,
you wish to interact with the Bash Bunny directly via the serial port,
you can use the following settings, 115200 board, 8 data bits, no parity
bit, and 1 stop bit. On the Mac, you can connect using screen and log in
using the root username and password of hak5bunny. We can now interact
with the Bash Bunny like a normal Linux computer. To set ourselves up for
the next demonstration, let's look in the library and drill down into the
credentials folder.
We know that our target environment is going to be a Mac laptop,
so let's focus on the macinfograbber payload. To install the
payload, we simply copy and paste the text file into the
switch position of our choice.
Let's copy it now into payload position 1.
Before we go ahead and use the Bash Bunny to deliver this payload,
let's take a quick look at the script itself.
As you can see,
it's a simple script that sets a few variables, and then using
a scripting language called Bunny Script,
can do call on the Bash Bunny to perform certain actions.
In this script, we're pretending to be a human interface device, or HID,
such as a keyboard. One of the best functions of the Bash Bunny is that
we can set the color of the LED to give us visual feedback so that we
know that we have completed our attack.
At this point,
we're ready to eject the Bash Bunny and use it to attack our target environment.