mirror of
https://github.com/dbisu/pico-ducky.git
synced 2026-01-21 17:26:00 +00:00
Compare commits
16 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
e6de3e98dc | ||
|
|
018fce3592 | ||
|
|
3fd60760c6 | ||
|
|
21ffbeb415 | ||
|
|
895fc7af58 | ||
|
|
11467900c5 | ||
|
|
fc0c2556e0 | ||
|
|
bb5c33f068 | ||
|
|
39537f4802 | ||
|
|
ca5c012d8d | ||
|
|
21cf5ffdf2 | ||
|
|
df615dd645 | ||
|
|
003cede2b3 | ||
|
|
83eba10713 | ||
|
|
7d15900ef6 | ||
|
|
269612753a |
74
README.md
74
README.md
@@ -20,13 +20,13 @@
|
|||||||
|
|
||||||
Install and have your USB Rubber Ducky working in less than 5 minutes.
|
Install and have your USB Rubber Ducky working in less than 5 minutes.
|
||||||
|
|
||||||
1. Download [CircuitPython for the Raspberry Pi Pico](https://circuitpython.org/board/raspberry_pi_pico/).
|
1. Download [CircuitPython for the Raspberry Pi Pico](https://circuitpython.org/board/raspberry_pi_pico/). *Updated to 7.0.0
|
||||||
|
|
||||||
2. Plug the device into a USB port. It will show up as a removable media device named `RPI-RP2`.
|
2. Plug the device into a USB port while holding the boot button. It will show up as a removable media device named `RPI-RP2`.
|
||||||
|
|
||||||
3. Copy the downloaded `.uf2` file to the root of the Pico (`RPI-RP2`). The device will reboot and after a second or so, it will reconnect as `CIRCUITPY`.
|
3. Copy the downloaded `.uf2` file to the root of the Pico (`RPI-RP2`). The device will reboot and after a second or so, it will reconnect as `CIRCUITPY`.
|
||||||
|
|
||||||
4. Download `adafruit-circuitpython-bundle-6.x-mpy-YYYYMMDD.zip` [here](https://github.com/adafruit/Adafruit_CircuitPython_Bundle/releases/latest) and extract it outside the device.
|
4. Download `adafruit-circuitpython-bundle-7.x-mpy-YYYYMMDD.zip` [here](https://github.com/adafruit/Adafruit_CircuitPython_Bundle/releases/latest) and extract it outside the device.
|
||||||
|
|
||||||
5. Navigate to `lib` in the recently extracted folder and copy `adafruit_hid` to the `lib` folder in your Raspberry Pi Pico.
|
5. Navigate to `lib` in the recently extracted folder and copy `adafruit_hid` to the `lib` folder in your Raspberry Pi Pico.
|
||||||
|
|
||||||
@@ -43,6 +43,74 @@ The easiest way to so is by using a jumper wire between those pins as seen bello
|
|||||||
|
|
||||||

|

|
||||||
|
|
||||||
|
### USB enable/disable mode
|
||||||
|
|
||||||
|
If you need the pico-ducky to not show up as a USB mass storage device for stealth, follow these instructions.
|
||||||
|
Enter setup mode.
|
||||||
|
Copy boot.py to the root of the pico-ducky.
|
||||||
|
Copy your payload script to the pico-ducky.
|
||||||
|
Disconnect the pico from your host PC.
|
||||||
|
Connect a jumper wire between pin 18 and pin 20.
|
||||||
|
This will prevent the pico-ducky from showing up as a USB drive when plugged into the target computer.
|
||||||
|
Remove the jumper and reconnect to your PC to reprogram.
|
||||||
|
The default mode is USB mass storage enabled.
|
||||||
|
|
||||||
|

|
||||||
|
|
||||||
|
### Changing Keyboard Layouts
|
||||||
|
|
||||||
|
Copied from [Neradoc/Circuitpython_Keyboard_Layouts](https://github.com/Neradoc/Circuitpython_Keyboard_Layouts/blob/main/PICODUCKY.md)
|
||||||
|
|
||||||
|
#### How to use one of these layouts with the pico-ducky repository.
|
||||||
|
|
||||||
|
**Go to the [latest release page](https://github.com/Neradoc/Circuitpython_Keyboard_Layouts/releases/latest), look if your language is in the list.**
|
||||||
|
|
||||||
|
#### If your language/layout is in the bundle
|
||||||
|
|
||||||
|
Download the `py` zip, named `circuitpython-keyboard-layouts-py-XXXXXXXX.zip`
|
||||||
|
|
||||||
|
**NOTE: You can use the mpy version targetting the version of Circuitpython that is on the device, but on Raspberry Pi Pico you don't need it - they only reduce file size and memory use on load, which the pico has plenty of.**
|
||||||
|
|
||||||
|
#### If your language/layout is not in the bundle
|
||||||
|
|
||||||
|
Try the online generator, it should get you a zip file with the bundles for yout language
|
||||||
|
|
||||||
|
https://www.neradoc.me/layouts/
|
||||||
|
|
||||||
|
#### Now you have a zip file
|
||||||
|
|
||||||
|
#### Find your language/layout in the lib directory
|
||||||
|
|
||||||
|
For a language `LANG`, copy the following files from the zip's `lib` folder to the `lib` directory of the board.
|
||||||
|
**DO NOT** modify the adafruit_hid directory. Your files go directly in `lib`.
|
||||||
|
**DO NOT** change the names or extensions of the files. Just pick the right ones.
|
||||||
|
Replace `LANG` with the letters for your language of choice.
|
||||||
|
|
||||||
|
- `keyboard_layout_win_LANG.py`
|
||||||
|
- `keycode_win_LANG.py`
|
||||||
|
|
||||||
|
Don't forget to get [the adafruit_hid library](https://github.com/adafruit/Adafruit_CircuitPython_HID/releases/latest).
|
||||||
|
|
||||||
|
This is what it should look like **if your language is French for example**.
|
||||||
|
|
||||||
|

|
||||||
|
|
||||||
|
#### Modify the pico-ducky code to use your language file:
|
||||||
|
|
||||||
|
At the start of the file comment out these lines:
|
||||||
|
|
||||||
|
```py
|
||||||
|
from adafruit_hid.keyboard_layout_us import KeyboardLayoutUS as KeyboardLayout
|
||||||
|
from adafruit_hid.keycode import Keycode
|
||||||
|
```
|
||||||
|
|
||||||
|
Uncomment these lines:
|
||||||
|
*Replace `LANG` with the letters for your language of choice. The name must match the file (without the py or mpy extension).*
|
||||||
|
```py
|
||||||
|
from keyboard_layout_win_LANG import KeyboardLayout
|
||||||
|
from keycode_win_LANG import Keycode
|
||||||
|
```
|
||||||
|
|
||||||
## Useful links and resources
|
## Useful links and resources
|
||||||
|
|
||||||
### Docs
|
### Docs
|
||||||
|
|||||||
20
boot.py
Normal file
20
boot.py
Normal file
@@ -0,0 +1,20 @@
|
|||||||
|
from board import *
|
||||||
|
import digitalio
|
||||||
|
import storage
|
||||||
|
import usb_hid
|
||||||
|
|
||||||
|
usb_hid.disable()
|
||||||
|
usb_hid.enable((usb_hid.Device.KEYBOARD,))
|
||||||
|
|
||||||
|
noStorageStatus = False
|
||||||
|
noStoragePin = digitalio.DigitalInOut(GP15)
|
||||||
|
noStoragePin.switch_to_input(pull=digitalio.Pull.UP)
|
||||||
|
noStorageStatus = not noStoragePin.value
|
||||||
|
|
||||||
|
if(noStorageStatus == True):
|
||||||
|
# don't show USB drive to host PC
|
||||||
|
storage.disable_usb_drive()
|
||||||
|
print("Disabling USB drive")
|
||||||
|
else:
|
||||||
|
# normal boot
|
||||||
|
print("USB drive enabled")
|
||||||
181
duckyinpython.py
181
duckyinpython.py
@@ -1,37 +1,69 @@
|
|||||||
|
# License : GPLv2.0
|
||||||
|
# copyright (c) 2021 Dave Bailey
|
||||||
|
# Author: Dave Bailey (dbisu, @daveisu)
|
||||||
|
|
||||||
import usb_hid
|
import usb_hid
|
||||||
from adafruit_hid.keyboard import Keyboard
|
from adafruit_hid.keyboard import Keyboard
|
||||||
from adafruit_hid.keyboard_layout_us import KeyboardLayoutUS
|
|
||||||
|
# comment out these lines for non_US keyboards
|
||||||
|
from adafruit_hid.keyboard_layout_us import KeyboardLayoutUS as KeyboardLayout
|
||||||
from adafruit_hid.keycode import Keycode
|
from adafruit_hid.keycode import Keycode
|
||||||
|
|
||||||
|
# uncomment these lines for non_US keyboards
|
||||||
|
# replace LANG with appropriate language
|
||||||
|
#from keyboard_layout_win_LANG import KeyboardLayout
|
||||||
|
#from keycode_win_LANG import Keycode
|
||||||
|
|
||||||
|
import supervisor
|
||||||
|
|
||||||
import time
|
import time
|
||||||
import digitalio
|
import digitalio
|
||||||
from board import *
|
from board import *
|
||||||
|
led = digitalio.DigitalInOut(LED)
|
||||||
|
led.direction = digitalio.Direction.OUTPUT
|
||||||
|
|
||||||
duckyCommands = ["WINDOWS", "GUI", "APP", "MENU", "SHIFT", "ALT", "CONTROL", "CTRL", "DOWNARROW", "DOWN",
|
duckyCommands = {
|
||||||
"LEFTARROW", "LEFT", "RIGHTARROW", "RIGHT", "UPARROW", "UP", "BREAK", "PAUSE", "CAPSLOCK", "DELETE", "END",
|
'WINDOWS': Keycode.WINDOWS, 'GUI': Keycode.GUI,
|
||||||
"ESC", "ESCAPE", "HOME", "INSERT", "NUMLOCK", "PAGEUP", "PAGEDOWN", "PRINTSCREEN", "SCROLLLOCK", "SPACE",
|
'APP': Keycode.APPLICATION, 'MENU': Keycode.APPLICATION, 'SHIFT': Keycode.SHIFT,
|
||||||
"TAB", "ENTER", " a", " b", " c", " d", " e", " f", " g", " h", " i", " j", " k", " l", " m", " n", " o", " p", " q", " r", " s", " t",
|
'ALT': Keycode.ALT, 'CONTROL': Keycode.CONTROL, 'CTRL': Keycode.CONTROL,
|
||||||
" u", " v", " w", " x", " y", " z", " A", " B", " C", " D", " E", " F", " G", " H", " I", " J", " K", " L", " M", " N", " O", " P",
|
'DOWNARROW': Keycode.DOWN_ARROW, 'DOWN': Keycode.DOWN_ARROW, 'LEFTARROW': Keycode.LEFT_ARROW,
|
||||||
" Q", " R", " S", " T", " U", " V", " W", " X", " Y", " Z", "F1", "F2", "F3", "F4", "F5", "F6", "F7", "F8", "F9", "F10", "F11", "F12"]
|
'LEFT': Keycode.LEFT_ARROW, 'RIGHTARROW': Keycode.RIGHT_ARROW, 'RIGHT': Keycode.RIGHT_ARROW,
|
||||||
|
'UPARROW': Keycode.UP_ARROW, 'UP': Keycode.UP_ARROW, 'BREAK': Keycode.PAUSE,
|
||||||
keycodeCommands = [Keycode.WINDOWS, Keycode.GUI, Keycode.APPLICATION, Keycode.APPLICATION, Keycode.SHIFT, Keycode.ALT, Keycode.CONTROL,
|
'PAUSE': Keycode.PAUSE, 'CAPSLOCK': Keycode.CAPS_LOCK, 'DELETE': Keycode.DELETE,
|
||||||
Keycode.CONTROL, Keycode.DOWN_ARROW, Keycode.DOWN_ARROW ,Keycode.LEFT_ARROW, Keycode.LEFT_ARROW, Keycode.RIGHT_ARROW, Keycode.RIGHT_ARROW,
|
'END': Keycode.END, 'ESC': Keycode.ESCAPE, 'ESCAPE': Keycode.ESCAPE, 'HOME': Keycode.HOME,
|
||||||
Keycode.UP_ARROW, Keycode.UP_ARROW, Keycode.PAUSE, Keycode.PAUSE, Keycode.CAPS_LOCK, Keycode.DELETE, Keycode.END, Keycode.ESCAPE,
|
'INSERT': Keycode.INSERT, 'NUMLOCK': Keycode.KEYPAD_NUMLOCK, 'PAGEUP': Keycode.PAGE_UP,
|
||||||
Keycode.ESCAPE, Keycode.HOME, Keycode.INSERT, Keycode.KEYPAD_NUMLOCK, Keycode.PAGE_UP, Keycode.PAGE_DOWN, Keycode.PRINT_SCREEN,
|
'PAGEDOWN': Keycode.PAGE_DOWN, 'PRINTSCREEN': Keycode.PRINT_SCREEN, 'ENTER': Keycode.ENTER,
|
||||||
Keycode.SCROLL_LOCK, Keycode.SPACE, Keycode.TAB, Keycode.ENTER, Keycode.A, Keycode.B, Keycode.C, Keycode.D, Keycode.E, Keycode.F, Keycode.G,
|
'SCROLLLOCK': Keycode.SCROLL_LOCK, 'SPACE': Keycode.SPACE, 'TAB': Keycode.TAB,
|
||||||
Keycode.H, Keycode.I, Keycode.J, Keycode.K, Keycode.L, Keycode.M, Keycode.N, Keycode.O, Keycode.P, Keycode.Q, Keycode.R, Keycode.S, Keycode.T,
|
'BACKSPACE': Keycode.BACKSPACE,
|
||||||
Keycode.U, Keycode.V, Keycode.W, Keycode.X, Keycode.Y, Keycode.Z, Keycode.A, Keycode.B, Keycode.C, Keycode.D, Keycode.E, Keycode.F,
|
'A': Keycode.A, 'B': Keycode.B, 'C': Keycode.C, 'D': Keycode.D, 'E': Keycode.E,
|
||||||
Keycode.G, Keycode.H, Keycode.I, Keycode.J, Keycode.K, Keycode.L, Keycode.M, Keycode.N, Keycode.O, Keycode.P,
|
'F': Keycode.F, 'G': Keycode.G, 'H': Keycode.H, 'I': Keycode.I, 'J': Keycode.J,
|
||||||
Keycode.Q, Keycode.R, Keycode.S, Keycode.T, Keycode.U, Keycode.V, Keycode.W, Keycode.X, Keycode.Y, Keycode.Z,
|
'K': Keycode.K, 'L': Keycode.L, 'M': Keycode.M, 'N': Keycode.N, 'O': Keycode.O,
|
||||||
Keycode.F1, Keycode.F2, Keycode.F3, Keycode.F4, Keycode.F5, Keycode.F6, Keycode.F7, Keycode.F8, Keycode.F9,
|
'P': Keycode.P, 'Q': Keycode.Q, 'R': Keycode.R, 'S': Keycode.S, 'T': Keycode.T,
|
||||||
Keycode.F10, Keycode.F11, Keycode.F12]
|
'U': Keycode.U, 'V': Keycode.V, 'W': Keycode.W, 'X': Keycode.X, 'Y': Keycode.Y,
|
||||||
|
'Z': Keycode.Z, 'F1': Keycode.F1, 'F2': Keycode.F2, 'F3': Keycode.F3,
|
||||||
|
'F4': Keycode.F4, 'F5': Keycode.F5, 'F6': Keycode.F6, 'F7': Keycode.F7,
|
||||||
|
'F8': Keycode.F8, 'F9': Keycode.F9, 'F10': Keycode.F10, 'F11': Keycode.F11,
|
||||||
|
'F12': Keycode.F12,
|
||||||
|
|
||||||
|
}
|
||||||
def convertLine(line):
|
def convertLine(line):
|
||||||
newline = []
|
newline = []
|
||||||
print(line)
|
# print(line)
|
||||||
for j in range(len(keycodeCommands)):
|
# loop on each key - the filter removes empty values
|
||||||
if line.find(duckyCommands[j]) != -1:
|
for key in filter(None, line.split(" ")):
|
||||||
newline.append(keycodeCommands[j])
|
key = key.upper()
|
||||||
print(newline)
|
# find the keycode for the command in the list
|
||||||
|
command_keycode = duckyCommands.get(key, None)
|
||||||
|
if command_keycode is not None:
|
||||||
|
# if it exists in the list, use it
|
||||||
|
newline.append(command_keycode)
|
||||||
|
elif hasattr(Keycode, key):
|
||||||
|
# if it's in the Keycode module, use it (allows any valid keycode)
|
||||||
|
newline.append(getattr(Keycode, key))
|
||||||
|
else:
|
||||||
|
# if it's not a known key name, show the error for diagnosis
|
||||||
|
print(f"Unknown key: <{key}>")
|
||||||
|
# print(newline)
|
||||||
return newline
|
return newline
|
||||||
|
|
||||||
def runScriptLine(line):
|
def runScriptLine(line):
|
||||||
@@ -43,6 +75,7 @@ def sendString(line):
|
|||||||
layout.write(line)
|
layout.write(line)
|
||||||
|
|
||||||
def parseLine(line):
|
def parseLine(line):
|
||||||
|
global defaultDelay
|
||||||
if(line[0:3] == "REM"):
|
if(line[0:3] == "REM"):
|
||||||
# ignore ducky script comments
|
# ignore ducky script comments
|
||||||
pass
|
pass
|
||||||
@@ -50,35 +83,53 @@ def parseLine(line):
|
|||||||
time.sleep(float(line[6:])/1000)
|
time.sleep(float(line[6:])/1000)
|
||||||
elif(line[0:6] == "STRING"):
|
elif(line[0:6] == "STRING"):
|
||||||
sendString(line[7:])
|
sendString(line[7:])
|
||||||
|
elif(line[0:5] == "PRINT"):
|
||||||
|
print("[SCRIPT]: " + line[6:])
|
||||||
|
elif(line[0:6] == "IMPORT"):
|
||||||
|
runScript(line[7:])
|
||||||
elif(line[0:13] == "DEFAULT_DELAY"):
|
elif(line[0:13] == "DEFAULT_DELAY"):
|
||||||
defaultDelay = int(line[14:]) * 10
|
defaultDelay = int(line[14:]) * 10
|
||||||
elif(line[0:12] == "DEFAULTDELAY"):
|
elif(line[0:12] == "DEFAULTDELAY"):
|
||||||
defaultDelay = int(line[13:]) * 10
|
defaultDelay = int(line[13:]) * 10
|
||||||
|
elif(line[0:3] == "LED"):
|
||||||
|
if(led.value == True):
|
||||||
|
led.value = False
|
||||||
|
else:
|
||||||
|
led.value = True
|
||||||
else:
|
else:
|
||||||
newScriptLine = convertLine(line)
|
newScriptLine = convertLine(line)
|
||||||
runScriptLine(newScriptLine)
|
runScriptLine(newScriptLine)
|
||||||
|
|
||||||
kbd = Keyboard(usb_hid.devices)
|
kbd = Keyboard(usb_hid.devices)
|
||||||
layout = KeyboardLayoutUS(kbd)
|
layout = KeyboardLayout(kbd)
|
||||||
|
|
||||||
|
# turn off automatically reloading when files are written to the pico
|
||||||
|
supervisor.disable_autoreload()
|
||||||
|
|
||||||
# sleep at the start to allow the device to be recognized by the host computer
|
# sleep at the start to allow the device to be recognized by the host computer
|
||||||
time.sleep(.5)
|
time.sleep(.5)
|
||||||
|
|
||||||
# check GP0 for setup mode
|
led.value = True
|
||||||
# see setup mode for instructions
|
|
||||||
progStatus = False
|
|
||||||
progStatusPin = digitalio.DigitalInOut(GP0)
|
def getProgrammingStatus():
|
||||||
progStatusPin.switch_to_input(pull=digitalio.Pull.UP)
|
# check GP0 for setup mode
|
||||||
progStatus = not progStatusPin.value
|
# see setup mode for instructions
|
||||||
|
progStatusPin = digitalio.DigitalInOut(GP0)
|
||||||
|
progStatusPin.switch_to_input(pull=digitalio.Pull.UP)
|
||||||
|
progStatus = not progStatusPin.value
|
||||||
|
return(progStatus)
|
||||||
|
|
||||||
|
|
||||||
defaultDelay = 0
|
defaultDelay = 0
|
||||||
if(progStatus == False):
|
|
||||||
# not in setup mode, inject the payload
|
def runScript(file):
|
||||||
duckyScriptPath = "payload.dd"
|
global defaultDelay
|
||||||
|
|
||||||
|
duckyScriptPath = file
|
||||||
f = open(duckyScriptPath,"r",encoding='utf-8')
|
f = open(duckyScriptPath,"r",encoding='utf-8')
|
||||||
print("Running payload.dd")
|
|
||||||
previousLine = ""
|
previousLine = ""
|
||||||
duckyScript = f.readlines()
|
for line in f:
|
||||||
for line in duckyScript:
|
|
||||||
line = line.rstrip()
|
line = line.rstrip()
|
||||||
if(line[0:6] == "REPEAT"):
|
if(line[0:6] == "REPEAT"):
|
||||||
for i in range(int(line[7:])):
|
for i in range(int(line[7:])):
|
||||||
@@ -90,6 +141,62 @@ if(progStatus == False):
|
|||||||
previousLine = line
|
previousLine = line
|
||||||
time.sleep(float(defaultDelay)/1000)
|
time.sleep(float(defaultDelay)/1000)
|
||||||
|
|
||||||
|
def selectPayload():
|
||||||
|
payload = "payload.dd"
|
||||||
|
# check switch status
|
||||||
|
# payload1 = GPIO4 to GND
|
||||||
|
# payload2 = GPIO5 to GND
|
||||||
|
# payload3 = GPIO10 to GND
|
||||||
|
# payload4 = GPIO11 to GND
|
||||||
|
payload1Pin = digitalio.DigitalInOut(GP4)
|
||||||
|
payload1Pin.switch_to_input(pull=digitalio.Pull.UP)
|
||||||
|
payload1State = not payload1Pin.value
|
||||||
|
payload2Pin = digitalio.DigitalInOut(GP5)
|
||||||
|
payload2Pin.switch_to_input(pull=digitalio.Pull.UP)
|
||||||
|
payload2State = not payload2Pin.value
|
||||||
|
payload3Pin = digitalio.DigitalInOut(GP10)
|
||||||
|
payload3Pin.switch_to_input(pull=digitalio.Pull.UP)
|
||||||
|
payload3State = not payload3Pin.value
|
||||||
|
payload4Pin = digitalio.DigitalInOut(GP11)
|
||||||
|
payload4Pin.switch_to_input(pull=digitalio.Pull.UP)
|
||||||
|
payload4State = not payload4Pin.value
|
||||||
|
|
||||||
|
|
||||||
|
if(payload1State == True):
|
||||||
|
payload = "payload.dd"
|
||||||
|
|
||||||
|
elif(payload2State == True):
|
||||||
|
payload = "payload2.dd"
|
||||||
|
|
||||||
|
elif(payload3State == True):
|
||||||
|
payload = "payload3.dd"
|
||||||
|
|
||||||
|
elif(payload4State == True):
|
||||||
|
payload = "payload4.dd"
|
||||||
|
|
||||||
|
else:
|
||||||
|
# if all pins are high, then no switch is present
|
||||||
|
# default to payload1
|
||||||
|
payload = "payload.dd"
|
||||||
|
|
||||||
|
|
||||||
|
return payload
|
||||||
|
|
||||||
|
progStatus = False
|
||||||
|
progStatus = getProgrammingStatus()
|
||||||
|
|
||||||
|
if(progStatus == False):
|
||||||
|
# not in setup mode, inject the payload
|
||||||
|
payload = selectPayload()
|
||||||
|
print("Running ", payload)
|
||||||
|
runScript(payload)
|
||||||
|
|
||||||
print("Done")
|
print("Done")
|
||||||
else:
|
else:
|
||||||
print("Update your payload")
|
print("Update your payload")
|
||||||
|
|
||||||
|
while True:
|
||||||
|
time.sleep(1.0)
|
||||||
|
led.value = False
|
||||||
|
time.sleep(1.0)
|
||||||
|
led.value = True
|
||||||
|
|||||||
BIN
images/usb-boot-mode.png
Normal file
BIN
images/usb-boot-mode.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 2.1 MiB |
Reference in New Issue
Block a user