mirror of
https://github.com/dbisu/pico-ducky.git
synced 2026-01-21 09:15:59 +00:00
Compare commits
21 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
d4957e2e95 | ||
|
|
6516c8bbe4 | ||
|
|
3a7411e55e | ||
|
|
e51a769cdd | ||
|
|
f02c061543 | ||
|
|
8a4e710725 | ||
|
|
852e8694dd | ||
|
|
2876f80140 | ||
|
|
0988524506 | ||
|
|
e11b087b75 | ||
|
|
f79fe2cb48 | ||
|
|
3d101c82d4 | ||
|
|
3fd60760c6 | ||
|
|
21ffbeb415 | ||
|
|
895fc7af58 | ||
|
|
11467900c5 | ||
|
|
fc0c2556e0 | ||
|
|
bb5c33f068 | ||
|
|
39537f4802 | ||
|
|
ca5c012d8d | ||
|
|
21cf5ffdf2 |
34
.github/ISSUE_TEMPLATE/bug_report.md
vendored
Normal file
34
.github/ISSUE_TEMPLATE/bug_report.md
vendored
Normal file
@@ -0,0 +1,34 @@
|
||||
---
|
||||
name: Bug report
|
||||
about: Create a report to help us improve
|
||||
title: ''
|
||||
labels: ''
|
||||
assignees: ''
|
||||
|
||||
---
|
||||
|
||||
**Describe the bug**
|
||||
A clear and concise description of what the bug is.
|
||||
|
||||
**To Reproduce**
|
||||
Steps to reproduce the behavior:
|
||||
1. Go to '...'
|
||||
2. Click on '....'
|
||||
3. Scroll down to '....'
|
||||
4. See error
|
||||
|
||||
**Expected behavior**
|
||||
A clear and concise description of what you expected to happen.
|
||||
|
||||
**Screenshots**
|
||||
If applicable, add screenshots to help explain your problem.
|
||||
|
||||
**Debug info**
|
||||
If possible, include debug serial data.
|
||||
On Windows, use PuTTY, connect to the debug serial port (commonly COM3, but could vary)
|
||||
|
||||
On Linux, use minicom (minicom -b 115200 -o -D /dev/ttyACM0, where ttyACM0 corresponds to your device)
|
||||
|
||||
|
||||
**Additional context**
|
||||
Add any other context about the problem here.
|
||||
56
README.md
56
README.md
@@ -20,21 +20,30 @@
|
||||
|
||||
Install and have your USB Rubber Ducky working in less than 5 minutes.
|
||||
|
||||
1. Download [CircuitPython for the Raspberry Pi Pico](https://circuitpython.org/board/raspberry_pi_pico/). *Updated to 7.0.0
|
||||
1. Clone the repo to get a local copy of the files. `git clone https://github.com/dbisu/pico-ducky.git`
|
||||
|
||||
2. Plug the device into a USB port. It will show up as a removable media device named `RPI-RP2`.
|
||||
2. Download [CircuitPython for the Raspberry Pi Pico](https://circuitpython.org/board/raspberry_pi_pico/). *Updated to 7.0.0
|
||||
|
||||
3. Copy the downloaded `.uf2` file to the root of the Pico (`RPI-RP2`). The device will reboot and after a second or so, it will reconnect as `CIRCUITPY`.
|
||||
3. Plug the device into a USB port while holding the boot button. It will show up as a removable media device named `RPI-RP2`.
|
||||
|
||||
4. Download `adafruit-circuitpython-bundle-7.x-mpy-YYYYMMDD.zip` [here](https://github.com/adafruit/Adafruit_CircuitPython_Bundle/releases/latest) and extract it outside the device.
|
||||
4. Copy the downloaded `.uf2` file to the root of the Pico (`RPI-RP2`). The device will reboot and after a second or so, it will reconnect as `CIRCUITPY`.
|
||||
|
||||
5. Navigate to `lib` in the recently extracted folder and copy `adafruit_hid` to the `lib` folder in your Raspberry Pi Pico.
|
||||
5. Download `adafruit-circuitpython-bundle-7.x-mpy-YYYYMMDD.zip` [here](https://github.com/adafruit/Adafruit_CircuitPython_Bundle/releases/latest) and extract it outside the device.
|
||||
|
||||
6. Click [here](https://raw.githubusercontent.com/dbisu/pico-ducky/main/duckyinpython.py), press CTRL + S and save the file as `code.py` in the root of the Raspberry Pi Pico, overwriting the previous file.
|
||||
6. Navigate to `lib` in the recently extracted folder and copy `adafruit_hid` to the `lib` folder on your Raspberry Pi Pico.
|
||||
|
||||
7. Find a script [here](https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payloads) or [create your own one using Ducky Script](https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Duckyscript) and save it as `payload.dd` in the Pico.
|
||||
7. Copy `adafruit_debouncer.mpy` and `adafruit_ticks.mpy` to the `lib` folder on your Raspberry Pi Pico.
|
||||
|
||||
8. Be careful, if your device isn't in [setup mode](#setup-mode), the device will reboot and after half a second, the script will run.
|
||||
8. Copy `asyncio` to the `lib` folder on your Pico.
|
||||
|
||||
9. Copy `boot.py` from your clone to the root of your Pico.
|
||||
|
||||
10. Copy `duckyinpython.py` as `code.py` in the root of the Raspberry Pi Pico, overwriting the previous file.
|
||||
Linux: `cp duckyinpython.py </path/to/pico/code.py`
|
||||
|
||||
11. Find a script [here](https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payloads) or [create your own one using Ducky Script](https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Duckyscript) and save it as `payload.dd` in the Pico.
|
||||
|
||||
12. Be careful, if your device isn't in [setup mode](#setup-mode), the device will reboot and after half a second, the script will run.
|
||||
|
||||
### Setup mode
|
||||
|
||||
@@ -46,11 +55,10 @@ The easiest way to so is by using a jumper wire between those pins as seen bello
|
||||
### USB enable/disable mode
|
||||
|
||||
If you need the pico-ducky to not show up as a USB mass storage device for stealth, follow these instructions.
|
||||
Enter setup mode.
|
||||
Copy boot.py to the root of the pico-ducky.
|
||||
Enter setup mode.
|
||||
Copy your payload script to the pico-ducky.
|
||||
Disconnect the pico from your host PC.
|
||||
Connect a jumper wire between pin 18 and pin 20.
|
||||
Connect a jumper wire between pin 18 (`GND`) and pin 20 (`GPIO15`).
|
||||
This will prevent the pico-ducky from showing up as a USB drive when plugged into the target computer.
|
||||
Remove the jumper and reconnect to your PC to reprogram.
|
||||
The default mode is USB mass storage enabled.
|
||||
@@ -86,7 +94,6 @@ For a language `LANG`, copy the following files from the zip's `lib` folder to t
|
||||
**DO NOT** change the names or extensions of the files. Just pick the right ones.
|
||||
Replace `LANG` with the letters for your language of choice.
|
||||
|
||||
- `keyboard_layout.py`
|
||||
- `keyboard_layout_win_LANG.py`
|
||||
- `keycode_win_LANG.py`
|
||||
|
||||
@@ -112,8 +119,33 @@ from keyboard_layout_win_LANG import KeyboardLayout
|
||||
from keycode_win_LANG import Keycode
|
||||
```
|
||||
|
||||
##### Example: Set to German Keyboard (WIN_DE)
|
||||
|
||||
```py
|
||||
from keyboard_layout_win_de import KeyboardLayout
|
||||
from keycode_win_de import Keycode
|
||||
```
|
||||
|
||||
Copy the files keyboard_layout_win_de.mpy and keycode_win_de.mpy to the /lib folder on the Pico board
|
||||
```
|
||||
adafruit_hid/
|
||||
keyboard_layout_win_de.mpy
|
||||
keycode_win_de.mpy
|
||||
```
|
||||
|
||||
|
||||
|
||||
## Useful links and resources
|
||||
|
||||
### How to recover your Pico if it becomes corrupted or doesn't boot.
|
||||
|
||||
[Reset Instructions](RESET.md)
|
||||
|
||||
### Installation Tool
|
||||
|
||||
[raspberrypi5621](https://github.com/raspberrypi5621) Created a tool to convert a blank RPi Pico to a ducky.
|
||||
You can find the tool [here](https://github.com/raspberrypi5621/pyducky)
|
||||
|
||||
### Docs
|
||||
|
||||
[CircuitPython](https://circuitpython.readthedocs.io/en/6.3.x/README.html)
|
||||
|
||||
7
RESET.md
Normal file
7
RESET.md
Normal file
@@ -0,0 +1,7 @@
|
||||
# Instructions on how to reset a Raspberry Pi Pico
|
||||
Follow these instructions if your Pico ends up in an odd state
|
||||
|
||||
1. Download the reset firmware from [flash_nuke.uf2](https://datasheets.raspberrypi.com/soft/flash_nuke.uf2)
|
||||
2. While holding the BOOTSEL button on the Pico, plug in the USB cable to your computer.
|
||||
3. When the RPI-RP2 drive shows up on your computer, copy the flash_nuke.uf2 file to the Pico
|
||||
4. After the device reboots, follow the Install instructions [here](https://github.com/dbisu/pico-ducky/blob/main/README.md)
|
||||
225
duckyinpython.py
225
duckyinpython.py
@@ -1,3 +1,7 @@
|
||||
# License : GPLv2.0
|
||||
# copyright (c) 2021 Dave Bailey
|
||||
# Author: Dave Bailey (dbisu, @daveisu)
|
||||
|
||||
import usb_hid
|
||||
from adafruit_hid.keyboard import Keyboard
|
||||
|
||||
@@ -10,9 +14,33 @@ from adafruit_hid.keycode import Keycode
|
||||
#from keyboard_layout_win_LANG import KeyboardLayout
|
||||
#from keycode_win_LANG import Keycode
|
||||
|
||||
import supervisor
|
||||
|
||||
import time
|
||||
import digitalio
|
||||
from digitalio import DigitalInOut, Pull
|
||||
from adafruit_debouncer import Debouncer
|
||||
from board import *
|
||||
import pwmio
|
||||
import asyncio
|
||||
|
||||
led = pwmio.PWMOut(LED, frequency=5000, duty_cycle=0)
|
||||
|
||||
def led_pwm_up(led):
|
||||
for i in range(100):
|
||||
# PWM LED up and down
|
||||
if i < 50:
|
||||
led.duty_cycle = int(i * 2 * 65535 / 100) # Up
|
||||
time.sleep(0.01)
|
||||
def led_pwm_down(led):
|
||||
for i in range(100):
|
||||
# PWM LED up and down
|
||||
if i >= 50:
|
||||
led.duty_cycle = 65535 - int((i - 50) * 2 * 65535 / 100) # Down
|
||||
time.sleep(0.01)
|
||||
|
||||
# led = digitalio.DigitalInOut(LED)
|
||||
# led.direction = digitalio.Direction.OUTPUT
|
||||
|
||||
duckyCommands = {
|
||||
'WINDOWS': Keycode.WINDOWS, 'GUI': Keycode.GUI,
|
||||
@@ -26,6 +54,7 @@ duckyCommands = {
|
||||
'INSERT': Keycode.INSERT, 'NUMLOCK': Keycode.KEYPAD_NUMLOCK, 'PAGEUP': Keycode.PAGE_UP,
|
||||
'PAGEDOWN': Keycode.PAGE_DOWN, 'PRINTSCREEN': Keycode.PRINT_SCREEN, 'ENTER': Keycode.ENTER,
|
||||
'SCROLLLOCK': Keycode.SCROLL_LOCK, 'SPACE': Keycode.SPACE, 'TAB': Keycode.TAB,
|
||||
'BACKSPACE': Keycode.BACKSPACE,
|
||||
'A': Keycode.A, 'B': Keycode.B, 'C': Keycode.C, 'D': Keycode.D, 'E': Keycode.E,
|
||||
'F': Keycode.F, 'G': Keycode.G, 'H': Keycode.H, 'I': Keycode.I, 'J': Keycode.J,
|
||||
'K': Keycode.K, 'L': Keycode.L, 'M': Keycode.M, 'N': Keycode.N, 'O': Keycode.O,
|
||||
@@ -35,11 +64,11 @@ duckyCommands = {
|
||||
'F4': Keycode.F4, 'F5': Keycode.F5, 'F6': Keycode.F6, 'F7': Keycode.F7,
|
||||
'F8': Keycode.F8, 'F9': Keycode.F9, 'F10': Keycode.F10, 'F11': Keycode.F11,
|
||||
'F12': Keycode.F12,
|
||||
}
|
||||
|
||||
}
|
||||
def convertLine(line):
|
||||
newline = []
|
||||
print(line)
|
||||
# print(line)
|
||||
# loop on each key - the filter removes empty values
|
||||
for key in filter(None, line.split(" ")):
|
||||
key = key.upper()
|
||||
@@ -54,7 +83,7 @@ def convertLine(line):
|
||||
else:
|
||||
# if it's not a known key name, show the error for diagnosis
|
||||
print(f"Unknown key: <{key}>")
|
||||
print(newline)
|
||||
# print(newline)
|
||||
return newline
|
||||
|
||||
def runScriptLine(line):
|
||||
@@ -66,6 +95,7 @@ def sendString(line):
|
||||
layout.write(line)
|
||||
|
||||
def parseLine(line):
|
||||
global defaultDelay
|
||||
if(line[0:3] == "REM"):
|
||||
# ignore ducky script comments
|
||||
pass
|
||||
@@ -73,10 +103,19 @@ def parseLine(line):
|
||||
time.sleep(float(line[6:])/1000)
|
||||
elif(line[0:6] == "STRING"):
|
||||
sendString(line[7:])
|
||||
elif(line[0:5] == "PRINT"):
|
||||
print("[SCRIPT]: " + line[6:])
|
||||
elif(line[0:6] == "IMPORT"):
|
||||
runScript(line[7:])
|
||||
elif(line[0:13] == "DEFAULT_DELAY"):
|
||||
defaultDelay = int(line[14:]) * 10
|
||||
elif(line[0:12] == "DEFAULTDELAY"):
|
||||
defaultDelay = int(line[13:]) * 10
|
||||
elif(line[0:3] == "LED"):
|
||||
if(led.value == True):
|
||||
led.value = False
|
||||
else:
|
||||
led.value = True
|
||||
else:
|
||||
newScriptLine = convertLine(line)
|
||||
runScriptLine(newScriptLine)
|
||||
@@ -84,35 +123,171 @@ def parseLine(line):
|
||||
kbd = Keyboard(usb_hid.devices)
|
||||
layout = KeyboardLayout(kbd)
|
||||
|
||||
# turn off automatically reloading when files are written to the pico
|
||||
supervisor.disable_autoreload()
|
||||
|
||||
# sleep at the start to allow the device to be recognized by the host computer
|
||||
time.sleep(.5)
|
||||
|
||||
# check GP0 for setup mode
|
||||
# see setup mode for instructions
|
||||
progStatus = False
|
||||
progStatusPin = digitalio.DigitalInOut(GP0)
|
||||
progStatusPin.switch_to_input(pull=digitalio.Pull.UP)
|
||||
progStatus = not progStatusPin.value
|
||||
led_pwm_up(led)
|
||||
|
||||
#init button
|
||||
button1_pin = DigitalInOut(GP22) # defaults to input
|
||||
button1_pin.pull = Pull.UP # turn on internal pull-up resistor
|
||||
button1 = Debouncer(button1_pin)
|
||||
|
||||
#init payload selection switch
|
||||
payload1Pin = digitalio.DigitalInOut(GP4)
|
||||
payload1Pin.switch_to_input(pull=digitalio.Pull.UP)
|
||||
payload2Pin = digitalio.DigitalInOut(GP5)
|
||||
payload2Pin.switch_to_input(pull=digitalio.Pull.UP)
|
||||
payload3Pin = digitalio.DigitalInOut(GP10)
|
||||
payload3Pin.switch_to_input(pull=digitalio.Pull.UP)
|
||||
payload4Pin = digitalio.DigitalInOut(GP11)
|
||||
payload4Pin.switch_to_input(pull=digitalio.Pull.UP)
|
||||
|
||||
def getProgrammingStatus():
|
||||
# check GP0 for setup mode
|
||||
# see setup mode for instructions
|
||||
progStatusPin = digitalio.DigitalInOut(GP0)
|
||||
progStatusPin.switch_to_input(pull=digitalio.Pull.UP)
|
||||
progStatus = not progStatusPin.value
|
||||
return(progStatus)
|
||||
|
||||
|
||||
defaultDelay = 0
|
||||
|
||||
def runScript(file):
|
||||
global defaultDelay
|
||||
|
||||
duckyScriptPath = file
|
||||
try:
|
||||
f = open(duckyScriptPath,"r",encoding='utf-8')
|
||||
previousLine = ""
|
||||
for line in f:
|
||||
line = line.rstrip()
|
||||
if(line[0:6] == "REPEAT"):
|
||||
for i in range(int(line[7:])):
|
||||
#repeat the last command
|
||||
parseLine(previousLine)
|
||||
time.sleep(float(defaultDelay)/1000)
|
||||
else:
|
||||
parseLine(line)
|
||||
previousLine = line
|
||||
time.sleep(float(defaultDelay)/1000)
|
||||
except OSError as e:
|
||||
print("Unable to open file ", file)
|
||||
|
||||
def selectPayload():
|
||||
global payload1Pin, payload2Pin, payload3Pin, payload4Pin
|
||||
payload = "payload.dd"
|
||||
# check switch status
|
||||
# payload1 = GPIO4 to GND
|
||||
# payload2 = GPIO5 to GND
|
||||
# payload3 = GPIO10 to GND
|
||||
# payload4 = GPIO11 to GND
|
||||
payload1State = not payload1Pin.value
|
||||
payload2State = not payload2Pin.value
|
||||
payload3State = not payload3Pin.value
|
||||
payload4State = not payload4Pin.value
|
||||
|
||||
|
||||
if(payload1State == True):
|
||||
payload = "payload.dd"
|
||||
|
||||
elif(payload2State == True):
|
||||
payload = "payload2.dd"
|
||||
|
||||
elif(payload3State == True):
|
||||
payload = "payload3.dd"
|
||||
|
||||
elif(payload4State == True):
|
||||
payload = "payload4.dd"
|
||||
|
||||
else:
|
||||
# if all pins are high, then no switch is present
|
||||
# default to payload1
|
||||
payload = "payload.dd"
|
||||
|
||||
|
||||
return payload
|
||||
|
||||
|
||||
async def blink_pico_led(led):
|
||||
print("starting blink_pico_led")
|
||||
led_state = False
|
||||
while True:
|
||||
if led_state:
|
||||
#led_pwm_up(led)
|
||||
print("led up")
|
||||
for i in range(100):
|
||||
# PWM LED up and down
|
||||
if i < 50:
|
||||
led.duty_cycle = int(i * 2 * 65535 / 100) # Up
|
||||
await asyncio.sleep(0.01)
|
||||
led_state = False
|
||||
else:
|
||||
#led_pwm_down(led)
|
||||
print("led down")
|
||||
for i in range(100):
|
||||
# PWM LED up and down
|
||||
if i >= 50:
|
||||
led.duty_cycle = 65535 - int((i - 50) * 2 * 65535 / 100) # Down
|
||||
await asyncio.sleep(0.01)
|
||||
led_state = True
|
||||
await asyncio.sleep(0)
|
||||
|
||||
async def monitor_buttons(button1):
|
||||
global inBlinkeyMode, inMenu, enableRandomBeep, enableSirenMode,pixel
|
||||
print("starting monitor_buttons")
|
||||
button1Down = False
|
||||
while True:
|
||||
button1.update()
|
||||
|
||||
button1Pushed = button1.fell
|
||||
button1Released = button1.rose
|
||||
button1Held = not button1.value
|
||||
|
||||
if(button1Pushed):
|
||||
print("Button 1 pushed")
|
||||
button1Down = True
|
||||
if(button1Released):
|
||||
print("Button 1 released")
|
||||
if(button1Down):
|
||||
print("push and released")
|
||||
|
||||
if(button1Released):
|
||||
if(button1Down):
|
||||
# Run selected payload
|
||||
payload = selectPayload()
|
||||
print("Running ", payload)
|
||||
runScript(payload)
|
||||
print("Done")
|
||||
button1Down = False
|
||||
|
||||
await asyncio.sleep(0)
|
||||
|
||||
|
||||
|
||||
progStatus = False
|
||||
progStatus = getProgrammingStatus()
|
||||
|
||||
if(progStatus == False):
|
||||
# not in setup mode, inject the payload
|
||||
duckyScriptPath = "payload.dd"
|
||||
f = open(duckyScriptPath,"r",encoding='utf-8')
|
||||
print("Running payload.dd")
|
||||
previousLine = ""
|
||||
duckyScript = f.readlines()
|
||||
for line in duckyScript:
|
||||
line = line.rstrip()
|
||||
if(line[0:6] == "REPEAT"):
|
||||
for i in range(int(line[7:])):
|
||||
#repeat the last command
|
||||
parseLine(previousLine)
|
||||
time.sleep(float(defaultDelay)/1000)
|
||||
else:
|
||||
parseLine(line)
|
||||
previousLine = line
|
||||
time.sleep(float(defaultDelay)/1000)
|
||||
payload = selectPayload()
|
||||
print("Running ", payload)
|
||||
runScript(payload)
|
||||
|
||||
print("Done")
|
||||
else:
|
||||
print("Update your payload")
|
||||
|
||||
led_state = False
|
||||
|
||||
async def main_loop():
|
||||
global led,button1
|
||||
pico_led_task = asyncio.create_task(blink_pico_led(led))
|
||||
button_task = asyncio.create_task(monitor_buttons(button1))
|
||||
await asyncio.gather(pico_led_task, button_task)
|
||||
|
||||
asyncio.run(main_loop())
|
||||
|
||||
Reference in New Issue
Block a user