From e37c3f30cf15324764a54bd156d296e3636812dc Mon Sep 17 00:00:00 2001 From: dabailey Date: Wed, 3 Feb 2021 18:52:44 -0600 Subject: [PATCH] Initial code commit --- README.md | 28 ++++++++++++++++ duckyinpython.py | 83 ++++++++++++++++++++++++++++++++++++++++++++++++ payload.dd | 4 +++ 3 files changed, 115 insertions(+) create mode 100644 duckyinpython.py create mode 100644 payload.dd diff --git a/README.md b/README.md index 51237c8..1ba94ce 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,30 @@ # pico-ducky Create a USB Rubber Ducky like device using a Raspberry PI Pico + +Download circuitpython for pico board: +https://circuitpython.org/board/raspberry_pi_pico/ + +Plug the Pico board into a USB port. +The board will show up as a removable media device. +Copy the UF2 file to the root of the media device. + +The Pico board will reboot after installing the firmware image. + +Download additional libraries: +https://github.com/adafruit/Adafruit_CircuitPython_Bundle + +https://github.com/adafruit/Adafruit_CircuitPython_Bundle/releases/tag/20210130 + +from zip file, unpack adafruit_hid folder. +copy adafruit_hid to the lib folder. + +Circuitpy HID +https://learn.adafruit.com/circuitpython-essentials/circuitpython-hid-keyboard-and-mouse + + +# Ducky Script Python +Copy duckyinpython.py to the root of the media device as code.py +$ cp duckyinpython.py //code.py + +Copy your Ducky Scipt file as payload.dd +$ cp /path to media device>/payload.dd diff --git a/duckyinpython.py b/duckyinpython.py new file mode 100644 index 0000000..3c2599e --- /dev/null +++ b/duckyinpython.py @@ -0,0 +1,83 @@ +import usb_hid +from adafruit_hid.keyboard import Keyboard +from adafruit_hid.keyboard_layout_us import KeyboardLayoutUS +from adafruit_hid.keycode import Keycode +import time + +duckyCommands = ["WINDOWS", "GUI", "APP", "MENU", "SHIFT", "ALT", "CONTROL", "CTRL", "DOWNARROW", "DOWN", +"LEFTARROW", "LEFT", "RIGHTARROW", "RIGHT", "UPARROW", "UP", "BREAK", "PAUSE", "CAPSLOCK", "DELETE", "END", +"ESC", "ESCAPE", "HOME", "INSERT", "NUMLOCK", "PAGEUP", "PAGEDOWN", "PRINTSCREEN", "SCROLLLOCK", "SPACE", +"TAB", "ENTER", " a", " b", " c", " d", " e", " f", " g", " h", " i", " j", " k", " l", " m", " n", " o", " p", " q", " r", " s", " t", +" u", " v", " w", " x", " y", " z", " A", " B", " C", " D", " E", " F", " G", " H", " I", " J", " K", " L", " M", " N", " O", " P", +" Q", " R", " S", " T", " U", " V", " W", " X", " Y", " Z"] + +keycodeCommands = [Keycode.WINDOWS, Keycode.GUI, Keycode.APPLICATION, Keycode.APPLICATION, Keycode.SHIFT, Keycode.ALT, Keycode.CONTROL, +Keycode.CONTROL, Keycode.DOWN_ARROW, Keycode.DOWN_ARROW ,Keycode.LEFT_ARROW, Keycode.LEFT_ARROW, Keycode.RIGHT_ARROW, Keycode.RIGHT_ARROW, +Keycode.UP_ARROW, Keycode.UP_ARROW, Keycode.PAUSE, Keycode.PAUSE, Keycode.CAPS_LOCK, Keycode.DELETE, Keycode.END, Keycode.ESCAPE, +Keycode.ESCAPE, Keycode.HOME, Keycode.INSERT, Keycode.KEYPAD_NUMLOCK, Keycode.PAGE_UP, Keycode.PAGE_DOWN, Keycode.PRINT_SCREEN, +Keycode.SCROLL_LOCK, Keycode.SPACE, Keycode.TAB, Keycode.ENTER, Keycode.A, Keycode.B, Keycode.C, Keycode.D, Keycode.E, Keycode.F, Keycode.G, +Keycode.H, Keycode.I, Keycode.J, Keycode.K, Keycode.L, Keycode.M, Keycode.N, Keycode.O, Keycode.P, Keycode.Q, Keycode.R, Keycode.S, Keycode.T, +Keycode.U, Keycode.V, Keycode.W, Keycode.X, Keycode.Y, Keycode.Z, Keycode.A, Keycode.B, Keycode.C, Keycode.D, Keycode.E, Keycode.F, +Keycode.G, Keycode.H, Keycode.I, Keycode.J, Keycode.K, Keycode.L, Keycode.M, Keycode.N, Keycode.O, Keycode.P, +Keycode.Q, Keycode.R, Keycode.S, Keycode.T, Keycode.U, Keycode.V, Keycode.W, Keycode.X, Keycode.Y, Keycode.Z] + +def convertLine(line): + newline = [] + print(line) + for j in range(len(keycodeCommands)): + if line.find(duckyCommands[j]) != -1: + newline.append(keycodeCommands[j]) + print(newline) + return newline + +def runScriptLine(line): + for k in line: + kbd.press(k) + kbd.release_all() + return + +def sendString(line): + layout.write(line) + return + +def parseLine(line): + if(line[0:3] == "REM"): + #comments - ignore + print("") + elif(line[0:5] == "DELAY"): + time.sleep(float(line[6:])/1000) + elif(line[0:6] == "STRING"): + sendString(line[7:]) + elif(line[0:13] == "DEFAULT_DELAY"): + defaultDelay = int(line[14:]) * 10 + elif(line[0:12] == "DEFAULTDELAY"): + defaultDelay = int(line[13:]) * 10 + else: + newScriptLine = convertLine(line) + runScriptLine(newScriptLine) + return + +kbd = Keyboard(usb_hid.devices) +layout = KeyboardLayoutUS(kbd) + +#sleep a the start to allow the device to be recognized by the host computer +time.sleep(.5) + +defaultDelay = 0 +duckyScriptPath = "payload.dd" +f = open(duckyScriptPath,"r",encoding='utf-8') +print("Running payload.dd") +previousLine = "" +duckyScript = f.readlines() +for line in duckyScript: + if(line[0:6] == "REPEAT"): + for i in range(int(line[7:])): + #repeat the last command + parseLine(previousLine) + time.sleep(float(defaultDelay)/1000) + else: + parseLine(line) + previousLine = line + time.sleep(float(defaultDelay)/1000) + +print("Done...") diff --git a/payload.dd b/payload.dd new file mode 100644 index 0000000..880a2e8 --- /dev/null +++ b/payload.dd @@ -0,0 +1,4 @@ +REM Testing Script +STRING atom test.txt +DELAY 2000 +GUI L