5 ms·

Real-World Rubber Ducky Attacks with Empire Stagers

39 points by sc0tfree 9y ago

pavel_lishin 9y ago
These all rely on a user being logged in, right? So the Watergate approach doesn't seem as useful, unless the machines are unlocked by default.
- dmurray 9y ago
  There's a delay command, so you can plug it in, ideally to a USB port that is out of sight, and have the attack execute itself the next day.
  - LeifCarrotson 9y ago
    More precisely, it's using the Windows schtasks (1) tool. You can unplug the USB device, and it will still run not only the next day, but every day. (1) https://msdn.microsoft.com/en-us/library/windows/desktop/bb736357(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/bb7...
    - dmurray 9y ago
      You can trigger that from the keyboard while the computer is locked?
- sp332 9y ago
  But you might be able to pull the plaintext password https://www.youtube.com/watch?v=JON76zbiL1o&t=110 https://www.youtube.com/watch?v=JON76zbiL1o&t=110 or at least the password hash https://www.youtube.com/watch?v=BH4M7djZfew&t=1273 https://www.youtube.com/watch?v=BH4M7djZfew&t=1273 pretty quickly using alternate ducky payloads.
- peterwwillis 9y ago
  A locked screen doesn't mean there's not an active session; most people just lock their screen and walk away, they don't usually log out. If the machine is on and you have physical port access, you can get into it, past the lock screen, and into an active session with a variety of attacks. Even if you can't get into it, there's always cold boot attacks. And even without these attacks, you can leave the ducky and code to execute the next time the machine is unlocked and a user present.
vuln 9y ago
If you're going to get close enough to the machine to interface with it I would rather use PoisonTap[1] which tricks the machine to route everything through the poisontap and add in semi-persistence with the use of cached backdoors. Some will say 'Well what if the corporation uses a webproxy like bluecoat.' There is a simple work around you go buy a domain that is already categorized as something like 'Business/Economy' which most corporations allow. [1]https://samy.pl/poisontap/ https://samy.pl/poisontap/
- 616c 9y ago
  This combined with cloud fronting is all the rage in pentest write-ups now. https://www.mdsec.co.uk/2017/07/categorisation-is-not-a-security-boundary/ https://www.mdsec.co.uk/2017/07/categorisation-is-not-a-secu...

39 points by sc0tfree 9y ago

These all rely on a user being logged in, right? So the Watergate approach doesn't seem as useful, unless the machines are unlocked by default.

dmurray 9y ago
There's a delay command, so you can plug it in, ideally to a USB port that is out of sight, and have the attack execute itself the next day.
- LeifCarrotson 9y ago
  More precisely, it's using the Windows schtasks (1) tool. You can unplug the USB device, and it will still run not only the next day, but every day. (1) https://msdn.microsoft.com/en-us/library/windows/desktop/bb736357(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/bb7...
  - dmurray 9y ago
    You can trigger that from the keyboard while the computer is locked?
sp332 9y ago
But you might be able to pull the plaintext password https://www.youtube.com/watch?v=JON76zbiL1o&t=110 https://www.youtube.com/watch?v=JON76zbiL1o&t=110 or at least the password hash https://www.youtube.com/watch?v=BH4M7djZfew&t=1273 https://www.youtube.com/watch?v=BH4M7djZfew&t=1273 pretty quickly using alternate ducky payloads.
peterwwillis 9y ago
A locked screen doesn't mean there's not an active session; most people just lock their screen and walk away, they don't usually log out. If the machine is on and you have physical port access, you can get into it, past the lock screen, and into an active session with a variety of attacks. Even if you can't get into it, there's always cold boot attacks. And even without these attacks, you can leave the ducky and code to execute the next time the machine is unlocked and a user present.

vuln 9y ago

If you're going to get close enough to the machine to interface with it I would rather use PoisonTap[1] which tricks the machine to route everything through the poisontap and add in semi-persistence with the use of cached backdoors. Some will say 'Well what if the corporation uses a webproxy like bluecoat.' There is a simple work around you go buy a domain that is already categorized as something like 'Business/Economy' which most corporations allow. [1]https://samy.pl/poisontap/ https://samy.pl/poisontap/

616c 9y ago
This combined with cloud fronting is all the rage in pentest write-ups now. https://www.mdsec.co.uk/2017/07/categorisation-is-not-a-security-boundary/ https://www.mdsec.co.uk/2017/07/categorisation-is-not-a-secu...