Skip to content

Commit

Permalink
Merge pull request #4 from arrase/storage
Browse files Browse the repository at this point in the history
Storage
  • Loading branch information
arrase authored Apr 1, 2017
2 parents eedd9f8 + f6a47e4 commit 671c8f8
Show file tree
Hide file tree
Showing 5 changed files with 64 additions and 41 deletions.
52 changes: 13 additions & 39 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,51 +1,25 @@
# Raspiducky

Credits to Original Authors:
A Keyboard emulator like Rubber Ducky build over Raspberry Pi Zero

* Duckberry Pi: Jeff L. (Renegade_R - [email protected])
* DroidDucky by Andrej Budincevic (https://github.com/anbud/DroidDucky)
* hardpass by girst (https://github.com/girst/hardpass)

### Install:

1) Flash the latest Raspbian Jessie image to an SD card

2) Copy all the files (hid-gadget-test.c, duckpi.sh, usleep.c, run_payload.sh, hid.sh) to /home/pi

3) Compile the hid-gadget-test program, this handles moving the text to the Human Interface Device driver:

gcc hid-gadget-test.c -o hid-gadget-test

4) Compile usleep, this is a basic function which is not natively supported in Raspbian and is used to account for delays in the program:

make usleep

5) Ensure all files and scripts are executable (chmod 755 <file>)
### Configuration

6) Activate the dwc2 drivers which allows the device to function in host mode when not connected to a PC:
* Run install script

echo "dtoverlay=dwc2" | sudo tee -a /boot/config.txt
chmod 777 install.sh
./install.sh

9) Place dwc2 and libcomposite in the modules file to boot with the OS:
* Install a payload

echo "dwc2" | sudo tee /etc/modules
echo "libcomposite" | sudo tee /etc/modules

10) Copy the following into your /etc/rc.local file. This allows you to place a "payload.dd" script in the "boot" drive that appears when you plug the SD card into a computer, it will then copy the file and format it for Unix (because Windows machines format the text differently):

/home/pi/hid.sh
sleep 3
/home/pi/run_payload.sh

11) Copy the actual payload into /boot, this directory can also be accessed in Windows by simply placing your micro SD card into a card reader and copying it to the drive that appears.

cat payloads/open_terminal/open_mint_terminal.dd payloads/backdoor/bind_shell.dd > /boot/payload.dd

12) Place SD card into the Raspberry Pi Zero, plug it into the target host machine via USB cable in the peripheral micro USB port, NOT THE POWER PORT. A power cord is not required as the Pi Zero will take power directly from the host machine.

13) Watch the script execute on the host machine
cat payloads/open_terminal/open_mint_terminal.dd payloads/backdoor/bind_shell.dd > /boot/payload.dd

### Resources:

* Premade Ducky Scripts: https://github.com/hak5darren/USB-Rubber-Ducky/wiki
* Original USB Rubber Ducky: http://usbrubberducky.com/#!index.md

### Credits:

* Duckberry Pi: Jeff L. (Renegade_R - [email protected])
* DroidDucky by Andrej Budincevic (https://github.com/anbud/DroidDucky)
* hardpass by girst (https://github.com/girst/hardpass)
Binary file removed hid-gadget-test
Binary file not shown.
21 changes: 19 additions & 2 deletions hid.sh
Original file line number Diff line number Diff line change
@@ -1,8 +1,7 @@
#!/bin/bash

# modprobe libcomposite
. /etc/raspiducky/raspiducky.conf

# KEYBOARD
cd /sys/kernel/config/usb_gadget/
mkdir -p g1
cd g1
Expand All @@ -15,6 +14,8 @@ echo "fedcba9876543210" > strings/0x409/serialnumber
echo "Parasite Team" > strings/0x409/manufacturer
echo "Raspiducky" > strings/0x409/product
N="usb0"

# KEYBOARD
mkdir -p functions/hid.$N
echo 1 > functions/hid.usb0/protocol
echo 1 > functions/hid.usb0/subclass
Expand All @@ -27,5 +28,21 @@ echo 250 > configs/c.$C/MaxPower
ln -s functions/hid.$N configs/c.$C/
# End KEYBOARD

# STORAGE
if [ -e $STORAGE_FILE ]
then
[ -d $STORAGE_MOUNT ] || mkdir $STORAGE_MOUNT
mount -o loop,rw -t vfat $STORAGE_FILE $STORAGE_MOUNT
mkdir -p functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/removable
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo $STORAGE_FILE > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.$C/
fi
# End STORAGE

ls /sys/class/udc > UDC

30 changes: 30 additions & 0 deletions install.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
#!/bin/bash

INSTALL_DIR=/home/pi

gcc hid-gadget-test.c -o $INSTALL_DIR/hid-gadget-test
cp usleep $INSTALL_DIR/
cp duckpi.sh $INSTALL_DIR/
cp hid.sh $INSTALL_DIR/
cp run_payload.sh $INSTALL_DIR

chmod 777 $INSTALL_DIR/hid-gadget-test
chmod 777 $INSTALL_DIR/usleep
chmod 777 $INSTALL_DIR/duckpi.sh
chmod 777 $INSTALL_DIR/hid.sh
chmod 777 $INSTALL_DIR/run_payload.sh

[ -d /etc/raspiducky ] || sudo mkdir /etc/raspiducky
[ -f /etc/raspiducky/raspiducky.conf ] || sudo cp raspiducky.conf /etc/raspiducky/raspiducky.conf

sudo echo "dtoverlay=dwc2" >> /boot/config.txt
sudo echo "dwc2" >> /etc/modules
sudo echo "libcomposite" >> /etc/modules

cat /etc/rc.local | awk '/exit\ 0/ && c == 0 {c = 0; print "\n/home/pi/hid.sh\nsleep 3\n/home/pi/run_payload.sh\n"}; {print}' /etc/rc.local

if ! [ -e /home/pi/usbdisk.img ]
then
dd if=/dev/zero of=/home/pi/usbdisk.img bs=1024 count=10000
mkfs.vfat /home/pi/usbdisk.img
fi
2 changes: 2 additions & 0 deletions raspiducky.conf
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
STORAGE_FILE=/home/pi/usbdisk.img
STORAGE_MOUNT=/media/storage

0 comments on commit 671c8f8

Please sign in to comment.