hak5
/
usbrubberducky-payloads
mirror of https://github.com/hak5/usbrubberducky-payloads.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

bump version, add to authors

pull/221/head
Dallas Winger 2023-02-04 04:40:25 -05:00
parent 675f530197
commit f9c1d905cb
No known key found for this signature in database
GPG Key ID: 59CE387CBF3FCA01
2 changed files with 30 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
payloads/library/remote_access/ReverseDuckyPolymorph/README.md
View File

@ -1,28 +1,28 @@
**Title: ReverseDuckyPolymorph**
<p>Author: 0iphor13<br>
OS: Windows<br>
Version: 1.0<br>
Requirements: DuckyScript 3.0, PayloadStudio v. 1.3.0 minimum</p>
**What is ReverseDuckyPolymorph?**
#
*One of the biggest problems when publishing payloads, exploits, POCs, etc. is static detection. If X hundred or thousand people use your script it's more than burned.*
*So I created ReverseDuckyPolymorph to fight static detection. Everytime this payload will be used by your Ducky, the variables change and therefore are harder to pin point.*
*This of course is no guarantee for bypassing every AV, but it may help to bypass certain protections for a longer time.*
#
**Instruction**
Using ReverseDuckyPolymorph is easy and straight forward.
- First, start a listener on your attacking machine via the tool of your choice.
- Second, define the IP-Address and Port of your listening machine
![alt text](https://github.com/0iphor13/usbrubberducky-payloads/blob/master/payloads/library/remote_access/ReverseDuckyPolymorph/media/listener.png)
- Third, compile the payload, using payloadstudio in version 1.3.0 minimum, transfer it onto your Ducky and you are good to go.
#
Every session you will gain via this payload will result in a different ID to verify a different pattern.
![alt text](https://github.com/0iphor13/usbrubberducky-payloads/blob/master/payloads/library/remote_access/ReverseDuckyPolymorph/media/ID.png)
Credit for DS 3.0 implentation and ideas:
- Korben
- Nikhil Mittal
**Title: ReverseDuckyPolymorph**
<p>Author: 0iphor13, Korben<br>
OS: Windows<br>
Version: 1.1<br>
Requirements: DuckyScript 3.0, PayloadStudio v. 1.3.0 minimum</p>
**What is ReverseDuckyPolymorph?**
#
*One of the biggest problems when publishing payloads, exploits, POCs, etc. is static detection. If X hundred or thousand people use your script it's more than burned.*
*So I created ReverseDuckyPolymorph to fight static detection. Everytime this payload will be used by your Ducky, the variables change and therefore are harder to pin point.*
*This of course is no guarantee for bypassing every AV, but it may help to bypass certain protections for a longer time.*
#
**Instruction**
Using ReverseDuckyPolymorph is easy and straight forward.
- First, start a listener on your attacking machine via the tool of your choice.
- Second, define the IP-Address and Port of your listening machine
![alt text](https://github.com/0iphor13/usbrubberducky-payloads/blob/master/payloads/library/remote_access/ReverseDuckyPolymorph/media/listener.png)
- Third, compile the payload, using payloadstudio in version 1.3.0 minimum, transfer it onto your Ducky and you are good to go.
#
Every session you will gain via this payload will result in a different ID to verify a different pattern.
![alt text](https://github.com/0iphor13/usbrubberducky-payloads/blob/master/payloads/library/remote_access/ReverseDuckyPolymorph/media/ID.png)
Credit for DS 3.0 implentation and ideas:
- Korben
- Nikhil Mittal

4
payloads/library/remote_access/ReverseDuckyPolymorph/payload.txt
View File

@ -1,6 +1,6 @@
REM Title: ReverseDuckyPolymorph
REM Author: 0iphor13
REM Version 1.0
REM Author: 0iphor13, Korben
REM Version 1.1
REM Target: Windows / Linux(?) (Not tested with Powershell on Linux)
REM Requirements: DuckyScript 3.0, PayloadStudio v. 1.3.0 minimum