Payload Triggering Tricks - USB Rubber Ducky Mods for Red Team Engagements - Hak5

Can we trick our target into triggering a payload on their own computer, while logged in and working? We find out with some crafty payload tricks -- this time on Hak5!

0:00 - Intro
2:03 - Setup
3:17 - Payload Writing
4:22 - Cloning USB devices with ATTACKMODE
5:51 - Passive Windows Detection Extension
9:08 - Activity Detection with DuckyScript 3
12:08 - SMB Canary Keystroke Injection
15:10 - Payload Arming
15:45 - Testing the Payload
17:22 - USB Rubber Ducky Mouse Implant Tips
17:53 - Thank you Hak5 community
18:21 - Review

____________________________________________
Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.

[rationalbushcraft]

Good to see Darren back. Always love his presentation style.

[supernerd]

We're all so lucky this potential criminal mastermind is actually just a totally wholesome dude

[stanislavsmetanin]

Daren is back. 🤝 Very welcome back. Nice to watch your tutorials. ✅️

[Jango]

To improve the payload I would drop a cobalt strike payload etc into memory so that each time the user turns on their computer we get a useable shell back. Seems like a lot of effort to go to for an NTLM hash. I could see this type of attack being super useful in shared open plan offices where loads of different people will use the same mouse over the course of a week.

[ogzsxftw]

Absolutely awesome, I really hope pen testing can become my career some day

[pentesterpif]

Omg yes! 🙌 thank you glytch and Darren for this. Please make many more videos like this going over attack scenarios and payloads fully described. I’m new to the pentest world and just used your devices for basic stuff but I could think of thousand real world ways to use it just couldn’t figure out how to use the duckyscript and payload structure to make it work. @hak5 and Darren is there more advanced lessons and deep overviews like this in the duckyscript advanced course?? I have the book but it’s just the basic how tos of everything.

[MorrWorm]

I wasn’t expecting Darren to be down there not gonna lie.

[mathbc]

17:19 LAN Manager (LM) hash.LAN Manager (LM) hash of your password in Active Directory and local Security Accounts Manager (SAM) databases.

[accrevoke]

How to improve ideas:
- set check KBM idle timer for 4 min 59, then auto execute
- use system proxy and passthrough current user credential
- multiple vulnerable protocols (http, imap, pop3, smtp, rdp)
- on fail, collect info like trust site settings, edge ie enterprise compatibility list, office suite trusted location, EDR exclusion list...

[bluegizmo]

Never underestimate the power of self preservation! Even if an employee suspects something fishy about a fast pop-up on their screen that typed in a bunch of stuff, or if they suspect something after plugging in a random flash drive, or whatever, they will almost never tell management or I.T. what happened for fear of getting in trouble because maybe they did something wrong (even if they didn't) or they should've realized their mistake before doing it, or some other guilty feeling reason.

[kapzvara]

Great video thanks for this very interesting.

[MorrWorm]

Seriously though like I love hak5 gear. Unfortunately 50% of inventory is out of stock it seems. I haven’t confirmed those numbers. It just feels that way. I’ve been wanting a coconut for so long

[saviorvx]

i wonder if you can spawn a topmost window maybe two that will coverup the script running shell, thats tim delaYED 15mins in so that they dont suspect the mouse asap but have it work during work

[leoac]

How do you stop Windows from enabling USB devices automatically?
Is there a service which can be set to "manual"?

[binaryglitch]

God, you were just a kid when I first started watching...

[TalkingSasquach]

better question, what was Darren doing under that desk before?

[leoac]

If the password happens to be an integer, that CAPSLOCK may not be triggered at all, and if it is, it may take a while. In addition, that IF is not taking into account the possibility of CAPSLOCK already being TRUE, for whatever reason.

[themodesttraveler]

it would of been easier for you and for glitch . to just use a OMG cable and solder it the new mouse . then it would just be a simple cable replacement . which you could of done to any mouse . rubber ducky is just so big and bulky and they are so many third party products that are smaller . I just don't get it

[iblackfeathers]

users nowadays are very specific with their mouse and mouse preferences in the workplace. they will notice if their real mouse is replaced with a crappy generic mouse. you may have to research which user has a feasible mouse to mod to appear identical to their existing one.

[myname-mzlo]

if they use old logitech wireless mouse why not just nrf24 mousejack it ?