8 Commits
v3.2 ... main

Author SHA1 Message Date
Dave
58875cd1b6 Update for CircuitPython 10.x support 2026-01-10 15:40:24 -06:00
XtramCZ
04eeacac09 Small improvements (#195)
* fixed crashes on one-line scripts, auto .dd

* Delete button

* Additional crash fix

* Disable read-only

---------

Co-authored-by: Dave <dbisu@users.noreply.github.com>
2026-01-10 12:17:16 -06:00
IDoNotHaveAUsernam3
c3184a5390 Fix "The next four lines" to replace four with five (#338) 2026-01-10 12:01:10 -06:00
Tzur Soffer
fb55875e3c Variable and expression bugfixes (#325)
* Fix evaluating with Booleans

* replaced re with a function (this feature of re is not supported on circutpython)

* Fixed internalVar in expression + allows for +=, *=, etc in variable math

* Removed added +=, *=, etc operations as they are not in the official language

Removed added +=, *=, etc operations as they are not in the official language. I added them in a previous commit and removed them in this one.

* Fix duplicate lines
2026-01-10 12:00:15 -06:00
Linusx
986c919616 Update webapp.py / web ui (#144)
* Update webapp.py

PS: Font will work on most devices (preinstalled), else it doesn't really matter

* Update webapp.py
2026-01-10 11:57:08 -06:00
Dave
10bc8b9489 Moved pin definitions into pins.py to help support different board form factors 2026-01-10 11:11:19 -06:00
ooqe
5ac23fdaf0 Fix syntax error in await runScript call (#336) 2025-11-25 16:53:40 -06:00
Cheesy
d730a804e0 Adds Keystroke Reflection Exfoliation (#335)
* Adds Hak5's Keystroke Reflection Exfoliation

Adds a way to read in caps, scroll, and num lock so that you can export information from the attack into a loot.bin. Has some caveats on how it works

* Fixed programing status bug
2025-11-16 19:15:54 -06:00
8 changed files with 276 additions and 133 deletions

View File

@@ -27,19 +27,19 @@ Install and have your USB Rubber Ducky working in less than 5 minutes.
If using a Pico board: If using a Pico board:
Copy the adafruit-circuitpython-raspberry_pi_pico-en_US-9.2.1.uf2 file to the root of the Pico (RPI-RP2). The device will reboot and after a second or so, it will reconnect as CIRCUITPY. Copy the adafruit-circuitpython-raspberry_pi_pico-en_US-10.0.3.uf2 file to the root of the Pico (RPI-RP2). The device will reboot and after a second or so, it will reconnect as CIRCUITPY.
If using a Pico W board: If using a Pico W board:
Copy the adafruit-circuitpython-raspberry_pi_pico_w-en_US-9.2.1.uf2 file to the root of the Pico (RPI-RP2). The device will reboot and after a second or so, it will reconnect as CIRCUITPY. Copy the adafruit-circuitpython-raspberry_pi_pico_w-en_US-10.0.3.uf2 file to the root of the Pico (RPI-RP2). The device will reboot and after a second or so, it will reconnect as CIRCUITPY.
If using a Pico 2 board: If using a Pico 2 board:
Copy the adafruit-circuitpython-raspberry_pi_pico2-en_US-9.2.1.uf2 file to the root of the Pico (RPI-RP2). The device will reboot and after a second or so, it will reconnect as CIRCUITPY. Copy the adafruit-circuitpython-raspberry_pi_pico2-en_US-10.0.3.uf2 file to the root of the Pico (RPI-RP2). The device will reboot and after a second or so, it will reconnect as CIRCUITPY.
If using a Pico 2W board: If using a Pico 2W board:
Copy the adafruit-circuitpython-raspberry_pi_pico2_w-en_US-9.2.1.uf2 file to the root of the Pico (RPI-RP2). The device will reboot and after a second or so, it will reconnect as CIRCUITPY. Copy the adafruit-circuitpython-raspberry_pi_pico2_w-en_US-10.0.3.uf2 file to the root of the Pico (RPI-RP2). The device will reboot and after a second or so, it will reconnect as CIRCUITPY.
4. Copy the lib folder to the root of the CIRCUITPY 4. Copy the lib folder to the root of the CIRCUITPY
@@ -84,16 +84,16 @@ Install and have your USB Rubber Ducky working in less than 5 minutes.
1. Clone the repo to get a local copy of the files. `git clone https://github.com/dbisu/pico-ducky.git` 1. Clone the repo to get a local copy of the files. `git clone https://github.com/dbisu/pico-ducky.git`
2. Download [CircuitPython for the Raspberry Pi Pico](https://circuitpython.org/board/raspberry_pi_pico/). *Updated to 9.2.1 2. Download [CircuitPython for the Raspberry Pi Pico](https://circuitpython.org/board/raspberry_pi_pico/). *Updated to 10.0.3
Download [CircuitPython for the Raspberry Pi Pico W](https://circuitpython.org/board/raspberry_pi_pico_w/). *Updated to 9.2.1 Download [CircuitPython for the Raspberry Pi Pico W](https://circuitpython.org/board/raspberry_pi_pico_w/). *Updated to 10.0.3
Download [CircuitPython for the Raspberry Pi Pico 2](https://circuitpython.org/board/raspberry_pi_pico2/). *Updated to 9.2.1 Download [CircuitPython for the Raspberry Pi Pico 2](https://circuitpython.org/board/raspberry_pi_pico2/). *Updated to 10.0.3
Download [CircuitPython for the Raspberry Pi Pico 2W](https://circuitpython.org/board/raspberry_pi_pico2_w/). *Updated to 9.2.1 Download [CircuitPython for the Raspberry Pi Pico 2W](https://circuitpython.org/board/raspberry_pi_pico2_w/). *Updated to 10.0.3
3. Plug the device into a USB port while holding the boot button. It will show up as a removable media device named `RPI-RP2`. 3. Plug the device into a USB port while holding the boot button. It will show up as a removable media device named `RPI-RP2`.
4. Copy the downloaded `.uf2` file to the root of the Pico (`RPI-RP2`). The device will reboot and after a second or so, it will reconnect as `CIRCUITPY`. 4. Copy the downloaded `.uf2` file to the root of the Pico (`RPI-RP2`). The device will reboot and after a second or so, it will reconnect as `CIRCUITPY`.
5. Download `adafruit-circuitpython-bundle-9.x-mpy-YYYYMMDD.zip` [here](https://github.com/adafruit/Adafruit_CircuitPython_Bundle/releases/latest) and extract it outside the device. 5. Download `adafruit-circuitpython-bundle-10.x-mpy-YYYYMMDD.zip` [here](https://github.com/adafruit/Adafruit_CircuitPython_Bundle/releases/latest) and extract it outside the device.
6. Navigate to `lib` in the recently extracted folder and copy `adafruit_hid` to the `lib` folder on your Raspberry Pi Pico. 6. Navigate to `lib` in the recently extracted folder and copy `adafruit_hid` to the `lib` folder on your Raspberry Pi Pico.
@@ -105,7 +105,7 @@ Install and have your USB Rubber Ducky working in less than 5 minutes.
10. Copy `boot.py` from your clone to the root of your Pico. 10. Copy `boot.py` from your clone to the root of your Pico.
11. Copy `duckyinpython.py`, `code.py`, `webapp.py`, `wsgiserver.py` to the root folder of the Pico. 11. Copy `duckyinpython.py`, `code.py`, `pins.py`, `webapp.py`, `wsgiserver.py` to the root folder of the Pico.
12. *For Pico W Only* Create the file `secrets.py` in the root of the Pico W. This contains the AP name and password to be created by the Pico W. 12. *For Pico W Only* Create the file `secrets.py` in the root of the Pico W. This contains the AP name and password to be created by the Pico W.
`secrets = { 'ssid' : "BadAPName", 'password' : "badpassword" }` `secrets = { 'ssid' : "BadAPName", 'password' : "badpassword" }`
@@ -248,7 +248,7 @@ You can find the tool [here](https://github.com/ryo-yamada/PicoDuckyBuilder)
### Docs ### Docs
[CircuitPython](https://circuitpython.readthedocs.io/en/6.3.x/README.html) [CircuitPython](https://docs.circuitpython.org/en/latest/README.html)
[CircuitPython HID](https://learn.adafruit.com/circuitpython-essentials/circuitpython-hid-keyboard-and-mouse) [CircuitPython HID](https://learn.adafruit.com/circuitpython-essentials/circuitpython-hid-keyboard-and-mouse)
@@ -266,4 +266,3 @@ You can find the tool [here](https://github.com/ryo-yamada/PicoDuckyBuilder)
## Related Projects ## Related Projects
[Defcon31-ducky](https://github.com/iot-pwn/defcon31-ducky) [Defcon31-ducky](https://github.com/iot-pwn/defcon31-ducky)
There are still a few of these available to purchase, US only.

19
boot.py
View File

@@ -7,7 +7,20 @@ from board import *
import board import board
import digitalio import digitalio
import storage import storage
import os
def is_exfil_enabled(payload_path="payload.dd"):
try:
with open(payload_path, "r") as f:
for line in f:
if "$_EXFIL_MODE_ENABLED" in line and "TRUE" in line.upper():
return True
except OSError:
pass
return False
exfil_enabled = is_exfil_enabled()
loot_exists = "loot.bin" in os.listdir("/")
noStorage = False noStorage = False
noStoragePin = digitalio.DigitalInOut(GP15) noStoragePin = digitalio.DigitalInOut(GP15)
noStoragePin.switch_to_input(pull=digitalio.Pull.UP) noStoragePin.switch_to_input(pull=digitalio.Pull.UP)
@@ -23,7 +36,9 @@ noStorageStatus = noStoragePin.value
# Pico W: # Pico W:
# GP15 not connected == USB NOT visible # GP15 not connected == USB NOT visible
# GP15 connected to GND == USB visible # GP15 connected to GND == USB visible
if exfil_enabled:
if not loot_exists:
storage.disable_usb_drive()
if(board.board_id == 'raspberry_pi_pico' or board.board_id == 'raspberry_pi_pico2'): if(board.board_id == 'raspberry_pi_pico' or board.board_id == 'raspberry_pi_pico2'):
# On Pi Pico, default to USB visible # On Pi Pico, default to USB visible
noStorage = not noStorageStatus noStorage = not noStorageStatus
@@ -39,3 +54,5 @@ if(noStorage == True):
else: else:
# normal boot # normal boot
print("USB drive enabled") print("USB drive enabled")

View File

@@ -28,6 +28,7 @@ supported_boards = ["raspberry_pi_pico",
files_to_bundle = ["boot.py", files_to_bundle = ["boot.py",
"code.py", "code.py",
"duckyinpython.py", "duckyinpython.py",
"pins.py",
"wsgiserver.py", "wsgiserver.py",
"webapp.py", "webapp.py",
"secrets.py", "secrets.py",

40
code.py
View File

@@ -5,8 +5,8 @@
import supervisor import supervisor
import os
import pwmio
import time import time
import digitalio import digitalio
from board import * from board import *
@@ -47,36 +47,42 @@ elif(board.board_id == 'raspberry_pi_pico_w' or board.board_id == 'raspberry_pi_
led = digitalio.DigitalInOut(board.LED) led = digitalio.DigitalInOut(board.LED)
led.switch_to_output() led.switch_to_output()
async def run_payload_on_startup():
progStatus = False
progStatus = getProgrammingStatus()
print("progStatus", progStatus)
if(progStatus == False):
print("Finding payload")
if "loot.bin" in os.listdir("/"):
print("loot.bin exists, skipping payload execution.")
else:
payload = selectPayload()
await asyncio.sleep(0.1)
print("Running")
await runScript(payload)
else:
print("Done")
progStatus = False
progStatus = getProgrammingStatus()
print("progStatus", progStatus)
if(progStatus == False):
print("Finding payload")
# not in setup mode, inject the payload
payload = selectPayload()
print("Running ", payload)
runScript(payload)
print("Done")
else:
print("Update your payload")
led_state = False led_state = False
async def main_loop(): async def main_loop():
global led,button1 global led,button1
button_task = asyncio.create_task(monitor_buttons(button1)) button_task = asyncio.create_task(monitor_buttons(button1))
payload_task = asyncio.create_task(run_payload_on_startup())
led_task = asyncio.create_task(monitor_led_changes())
if(board.board_id == 'raspberry_pi_pico_w' or board.board_id == 'raspberry_pi_pico2_w'): if(board.board_id == 'raspberry_pi_pico_w' or board.board_id == 'raspberry_pi_pico2_w'):
pico_led_task = asyncio.create_task(blink_pico_w_led(led)) pico_led_task = asyncio.create_task(blink_pico_w_led(led))
print("Starting Wifi") print("Starting Wifi")
startWiFi() startWiFi()
print("Starting Web Service") print("Starting Web Service")
webservice_task = asyncio.create_task(startWebService()) webservice_task = asyncio.create_task(startWebService())
await asyncio.gather(pico_led_task, button_task, webservice_task) await asyncio.gather(pico_led_task, button_task, webservice_task, payload_task, led_task)
else: else:
pico_led_task = asyncio.create_task(blink_pico_led(led)) pico_led_task = asyncio.create_task(blink_pico_led(led))
await asyncio.gather(pico_led_task, button_task) await asyncio.gather(pico_led_task, button_task, payload_task, led_task )
asyncio.run(main_loop()) asyncio.run(main_loop())

View File

@@ -5,7 +5,6 @@
# TODO: ADD support for the following: # TODO: ADD support for the following:
# Add jitter # Add jitter
# Add LED functionality # Add LED functionality
import re import re
import time import time
import random import random
@@ -14,12 +13,12 @@ from digitalio import DigitalInOut, Pull
from adafruit_debouncer import Debouncer from adafruit_debouncer import Debouncer
import board import board
from board import * from board import *
import pwmio
import asyncio import asyncio
import usb_hid import usb_hid
from adafruit_hid.keyboard import Keyboard from adafruit_hid.keyboard import Keyboard
from adafruit_hid.consumer_control import ConsumerControl from adafruit_hid.consumer_control import ConsumerControl
from adafruit_hid.consumer_control_code import ConsumerControlCode from adafruit_hid.consumer_control_code import ConsumerControlCode
from pins import *
# comment out these lines for non_US keyboards # comment out these lines for non_US keyboards
from adafruit_hid.keyboard_layout_us import KeyboardLayoutUS as KeyboardLayout from adafruit_hid.keyboard_layout_us import KeyboardLayoutUS as KeyboardLayout
@@ -39,6 +38,24 @@ def _numOn():
def _scrollOn(): def _scrollOn():
return kbd.led_on(Keyboard.LED_SCROLL_LOCK) return kbd.led_on(Keyboard.LED_SCROLL_LOCK)
def pressLock(key):
kbd.press(key)
kbd.release(key)
def SaveKeyboardLedState():
variables["$_INITIAL_SCROLLLOCK"] = _scrollOn()
variables["$_INITIAL_NUMLOCK"] = _numOn()
variables ["$_INITIAL_CAPSLOCK"] = _capsOn()
def RestoreKeyboardLedState():
if(variables["$_INITIAL_CAPSLOCK"] != _capsOn()):
pressLock(Keycode.CAPS_LOCK)
if(variables["$_INITIAL_NUMLOCK"] != _numOn()):
pressLock(Keycode.NUM_LOCK)
if(variables["$_INITIAL_SCROLLLOCK"] != _scrollOn()):
pressLock(Keycode.SCROLL_LOCK)
duckyKeys = { duckyKeys = {
'WINDOWS': Keycode.GUI, 'RWINDOWS': Keycode.RIGHT_GUI, 'GUI': Keycode.GUI, 'RGUI': Keycode.RIGHT_GUI, 'COMMAND': Keycode.GUI, 'RCOMMAND': Keycode.RIGHT_GUI, 'WINDOWS': Keycode.GUI, 'RWINDOWS': Keycode.RIGHT_GUI, 'GUI': Keycode.GUI, 'RGUI': Keycode.RIGHT_GUI, 'COMMAND': Keycode.GUI, 'RCOMMAND': Keycode.RIGHT_GUI,
'APP': Keycode.APPLICATION, 'MENU': Keycode.APPLICATION, 'SHIFT': Keycode.SHIFT, 'RSHIFT': Keycode.RIGHT_SHIFT, 'APP': Keycode.APPLICATION, 'MENU': Keycode.APPLICATION, 'SHIFT': Keycode.SHIFT, 'RSHIFT': Keycode.RIGHT_SHIFT,
@@ -71,7 +88,7 @@ duckyConsumerKeys = {
'MK_PP': ConsumerControlCode.PLAY_PAUSE, 'MK_STOP': ConsumerControlCode.STOP 'MK_PP': ConsumerControlCode.PLAY_PAUSE, 'MK_STOP': ConsumerControlCode.STOP
} }
variables = {"$_RANDOM_MIN": 0, "$_RANDOM_MAX": 65535} variables = {"$_RANDOM_MIN": 0, "$_RANDOM_MAX": 65535,"$_EXFIL_MODE_ENABLED": False,"$_EXFIL_LEDS_ENABLED": False,"$_INITIAL_SCROLLLOCK": False, "$_INITIAL_NUMLOCK": False, "$_INITIAL_CAPSLOCK": False}
internalVariables = {"$_CAPSLOCK_ON": _capsOn, "$_NUMLOCK_ON": _numOn, "$_SCROLLLOCK_ON": _scrollOn} internalVariables = {"$_CAPSLOCK_ON": _capsOn, "$_NUMLOCK_ON": _numOn, "$_SCROLLLOCK_ON": _scrollOn}
defines = {} defines = {}
functions = {} functions = {}
@@ -172,15 +189,26 @@ def _getCodeBlock(linesIter):
code.append(line) code.append(line)
return code return code
def replaceBooleans(text): #< fix capitalization mistakes in true and false (for evaluating with booleans)
# Replace any letter-by-letter match for "true" with the proper "True"
text = re.sub(r'[Tt][Rr][Uu][Ee]', 'True', text)
# Replace any letter-by-letter match for "false" with the proper "False"
text = re.sub(r'[Ff][Aa][Ll][Ss][Ee]', 'False', text)
return text
def evaluateExpression(expression): def evaluateExpression(expression):
"""Evaluates an expression with variables and returns the result.""" """Evaluates an expression with variables and returns the result."""
# Replace variables (e.g., $FOO) in the expression with their values expression = replaceVariables(expression)
expression = re.sub(r"\$(\w+)", lambda m: str(variables.get(f"${m.group(1)}", 0)), expression) expression = replaceBooleans(expression) #< Cant use re due its limitation in circutpython
print(expression)
expression = expression.replace("^", "**") #< Replace ^ with ** for exponentiation expression = expression.replace("^", "**") #< Replace ^ with ** for exponentiation
expression = expression.replace("&&", "and") expression = expression.replace("&&", "and")
expression = expression.replace("||", "or") expression = expression.replace("||", "or")
expression = expression.replace("TRUE", "True")
expression = expression.replace("FALSE", "False")
return eval(expression, {}, variables) return eval(expression, {}, variables)
def deepcopy(List): def deepcopy(List):
@@ -238,7 +266,7 @@ def replaceDefines(line):
line = line.replace(define, value) line = line.replace(define, value)
return line return line
def parseLine(line, script_lines): async def parseLine(line, script_lines):
global defaultDelay, variables, functions, defines global defaultDelay, variables, functions, defines
line = line.strip() line = line.strip()
line = line.replace("$_RANDOM_INT", str(random.randint(int(variables.get("$_RANDOM_MIN", 0)), int(variables.get("$_RANDOM_MAX", 65535))))) line = line.replace("$_RANDOM_INT", str(random.randint(int(variables.get("$_RANDOM_MIN", 0)), int(variables.get("$_RANDOM_MAX", 65535)))))
@@ -257,6 +285,7 @@ def parseLine(line, script_lines):
commandKeycode = duckyKeys.get(key, None) commandKeycode = duckyKeys.get(key, None)
if commandKeycode: if commandKeycode:
kbd.press(commandKeycode) kbd.press(commandKeycode)
else: else:
print(f"Unknown key to HOLD: <{key}>") print(f"Unknown key to HOLD: <{key}>")
elif line.startswith("RELEASE"): elif line.startswith("RELEASE"):
@@ -347,6 +376,7 @@ def parseLine(line, script_lines):
expression = match.group(2) expression = match.group(2)
value = evaluateExpression(expression) value = evaluateExpression(expression)
variables[varName] = value variables[varName] = value
else: else:
raise SyntaxError(f"Invalid variable update, declare variable first: {line}") raise SyntaxError(f"Invalid variable update, declare variable first: {line}")
elif line.startswith("DEFINE"): elif line.startswith("DEFINE"):
@@ -369,13 +399,12 @@ def parseLine(line, script_lines):
loopCode = list(_getCodeBlock(script_lines)) loopCode = list(_getCodeBlock(script_lines))
while evaluateExpression(condition) == True: while evaluateExpression(condition) == True:
currentIterCode = deepcopy(loopCode) currentIterCode = deepcopy(loopCode)
print(loopCode) # print(loopCode)
while currentIterCode: while currentIterCode:
loopLine = currentIterCode.pop(0) loopLine = currentIterCode.pop(0)
currentIterCode = list(parseLine(loopLine, iter(currentIterCode))) #< very inefficient, should be replaced later. currentIterCode = list(parseLine(loopLine, iter(currentIterCode))) #< very inefficient, should be replaced later.
elif line.upper().startswith("IF"): elif line.upper().startswith("IF"):
# print("ENTER IF")
script_lines, ret = IF(_getIfCondition(line), script_lines).runIf() script_lines, ret = IF(_getIfCondition(line), script_lines).runIf()
print(f"IF returned {ret} code") print(f"IF returned {ret} code")
elif line.upper().startswith("END_IF"): elif line.upper().startswith("END_IF"):
@@ -403,6 +432,17 @@ def parseLine(line, script_lines):
sendString(random.choice(letters + letters.upper() + numbers + specialChars)) sendString(random.choice(letters + letters.upper() + numbers + specialChars))
elif line == "RESET": elif line == "RESET":
kbd.release_all() kbd.release_all()
elif line == "SAVE_HOST_KEYBOARD_LOCK_STATE":
SaveKeyboardLedState()
elif line == "RESTORE_HOST_KEYBOARD_LOCK_STATE":
RestoreKeyboardLedState()
elif line == "WAIT_FOR_SCROLL_CHANGE":
last_scroll_state = _scrollOn()
while True:
current_scroll_state = _scrollOn()
if current_scroll_state != last_scroll_state:
break
await asyncio.sleep(0.01)
elif line in functions: elif line in functions:
updated_lines = [] updated_lines = []
inside_while_block = False inside_while_block = False
@@ -428,33 +468,17 @@ kbd = Keyboard(usb_hid.devices)
consumerControl = ConsumerControl(usb_hid.devices) consumerControl = ConsumerControl(usb_hid.devices)
layout = KeyboardLayout(kbd) layout = KeyboardLayout(kbd)
#init button
button1_pin = DigitalInOut(GP22) # defaults to input
button1_pin.pull = Pull.UP # turn on internal pull-up resistor
button1 = Debouncer(button1_pin)
#init payload selection switch
payload1Pin = digitalio.DigitalInOut(GP4)
payload1Pin.switch_to_input(pull=digitalio.Pull.UP)
payload2Pin = digitalio.DigitalInOut(GP5)
payload2Pin.switch_to_input(pull=digitalio.Pull.UP)
payload3Pin = digitalio.DigitalInOut(GP10)
payload3Pin.switch_to_input(pull=digitalio.Pull.UP)
payload4Pin = digitalio.DigitalInOut(GP11)
payload4Pin.switch_to_input(pull=digitalio.Pull.UP)
def getProgrammingStatus(): def getProgrammingStatus():
# check GP0 for setup mode
# see setup mode for instructions # see setup mode for instructions
progStatusPin = digitalio.DigitalInOut(GP0)
progStatusPin.switch_to_input(pull=digitalio.Pull.UP)
progStatus = not progStatusPin.value progStatus = not progStatusPin.value
return(progStatus) return(progStatus)
defaultDelay = 0 defaultDelay = 0
def runScript(file): async def runScript(file):
global defaultDelay global defaultDelay
duckyScriptPath = file duckyScriptPath = file
@@ -479,7 +503,7 @@ def runScript(file):
restart = False restart = False
break break
else: else:
parseLine(line, script_lines) await parseLine(line, script_lines)
previousLine = line previousLine = line
time.sleep(float(defaultDelay) / 1000) time.sleep(float(defaultDelay) / 1000)
except OSError as e: except OSError as e:
@@ -489,10 +513,6 @@ def selectPayload():
global payload1Pin, payload2Pin, payload3Pin, payload4Pin global payload1Pin, payload2Pin, payload3Pin, payload4Pin
payload = "payload.dd" payload = "payload.dd"
# check switch status # check switch status
# payload1 = GPIO4 to GND
# payload2 = GPIO5 to GND
# payload3 = GPIO10 to GND
# payload4 = GPIO11 to GND
payload1State = not payload1Pin.value payload1State = not payload1Pin.value
payload2State = not payload2Pin.value payload2State = not payload2Pin.value
payload3State = not payload3Pin.value payload3State = not payload3Pin.value
@@ -524,45 +544,53 @@ async def blink_led(led):
elif(board.board_id == 'raspberry_pi_pico_w' or board.board_id == 'raspberry_pi_pico2_w'): elif(board.board_id == 'raspberry_pi_pico_w' or board.board_id == 'raspberry_pi_pico2_w'):
blink_pico_w_led(led) blink_pico_w_led(led)
async def blink_pico_led(led): async def blink_pico_led(led):
print("starting blink_pico_led") print("starting blink_pico_led")
led_state = False led_state = False
while True: while True:
if led_state: if(variables.get("$_EXFIL_LEDS_ENABLED")):
#led_pwm_up(led) led.duty_cycle = 65535
#print("led up")
for i in range(100):
# PWM LED up and down
if i < 50:
led.duty_cycle = int(i * 2 * 65535 / 100) # Up
await asyncio.sleep(0.01)
led_state = False
else: else:
#led_pwm_down(led) if led_state:
#print("led down") #led_pwm_up(led)
for i in range(100): #print("led up")
# PWM LED up and down for i in range(100):
if i >= 50: # PWM LED up and down
led.duty_cycle = 65535 - int((i - 50) * 2 * 65535 / 100) # Down if i < 50:
await asyncio.sleep(0.01) led.duty_cycle = int(i * 2 * 65535 / 100) # Up
led_state = True await asyncio.sleep(0.01)
led_state = False
else:
#led_pwm_down(led)
#print("led down")
for i in range(100):
# PWM LED up and down
if i >= 50:
led.duty_cycle = 65535 - int((i - 50) * 2 * 65535 / 100) # Down
await asyncio.sleep(0.01)
led_state = True
await asyncio.sleep(0) await asyncio.sleep(0)
async def blink_pico_w_led(led): async def blink_pico_w_led(led):
print("starting blink_pico_w_led") print("starting blink_pico_w_led")
led_state = False led_state = False
while True: while True:
if led_state: if(variables.get("$_EXFIL_LEDS_ENABLED")):
#print("led on")
led.value = 1 led.value = 1
else:
if led_state:
#print("led on")
led.value = 1
await asyncio.sleep(0.5)
led_state = False
else:
#print("led off")
led.value = 0
await asyncio.sleep(0.5)
led_state = True
await asyncio.sleep(0.5) await asyncio.sleep(0.5)
led_state = False
else:
#print("led off")
led.value = 0
await asyncio.sleep(0.5)
led_state = True
await asyncio.sleep(0.5)
async def monitor_buttons(button1): async def monitor_buttons(button1):
global inBlinkeyMode, inMenu, enableRandomBeep, enableSirenMode,pixel global inBlinkeyMode, inMenu, enableRandomBeep, enableSirenMode,pixel
@@ -588,8 +616,51 @@ async def monitor_buttons(button1):
# Run selected payload # Run selected payload
payload = selectPayload() payload = selectPayload()
print("Running ", payload) print("Running ", payload)
runScript(payload) await runScript(payload)
print("Done") print("Done")
button1Down = False button1Down = False
await asyncio.sleep(0) await asyncio.sleep(0)
async def monitor_led_changes():
print("starting monitor_led_changes")
while True:
if variables.get("$_EXFIL_MODE_ENABLED"):
try:
bit_list = []
last_caps_state = _capsOn()
last_num_state = _numOn()
last_scroll_state = _scrollOn()
with open("loot.bin", "ab") as file:
while variables.get("$_EXFIL_MODE_ENABLED"):
caps_state = _capsOn()
num_state = _numOn()
scroll_state = _scrollOn()
if caps_state != last_caps_state:
bit_list.append(0)
last_caps_state = caps_state
elif num_state != last_num_state:
bit_list.append(1)
last_num_state = num_state
if len(bit_list) == 8:
byte = 0
for b in bit_list:
byte = (byte << 1) | b
file.write(bytes([byte]))
bit_list = []
if scroll_state != last_scroll_state:
variables["$_EXFIL_LEDS_ENABLED"] = False
break
await asyncio.sleep(0.001)
except Exception as e:
print(f"Error occurred: {e}")
await asyncio.sleep(0.0)

View File

@@ -1,6 +1,6 @@
REM The next four lines open Notepad in Windows and type "Hello World!" REM The next five lines open Notepad in Windows and type "Hello World!"
GUI r GUI r
STRING notepad STRING notepad
ENTER ENTER
DELAY 250 DELAY 250
STRING Hello World! STRING Hello World!

29
pins.py Normal file
View File

@@ -0,0 +1,29 @@
import digitalio
from digitalio import DigitalInOut, Pull
from board import *
from adafruit_debouncer import Debouncer
#init button
button1_pin = DigitalInOut(GP22) # defaults to input
button1_pin.pull = Pull.UP # turn on internal pull-up resistor
button1 = Debouncer(button1_pin)
# payload1 = GPIO4 to GND
# payload2 = GPIO5 to GND
# payload3 = GPIO10 to GND
# payload4 = GPIO11 to GND
#init payload selection switch
payload1Pin = digitalio.DigitalInOut(GP4)
payload1Pin.switch_to_input(pull=digitalio.Pull.UP)
payload2Pin = digitalio.DigitalInOut(GP5)
payload2Pin.switch_to_input(pull=digitalio.Pull.UP)
payload3Pin = digitalio.DigitalInOut(GP10)
payload3Pin.switch_to_input(pull=digitalio.Pull.UP)
payload4Pin = digitalio.DigitalInOut(GP11)
payload4Pin.switch_to_input(pull=digitalio.Pull.UP)
# check GP0 for setup mode
progStatusPin = digitalio.DigitalInOut(GP0)
progStatusPin.switch_to_input(pull=digitalio.Pull.UP)

108
webapp.py
View File

@@ -14,66 +14,75 @@ import wifi
from duckyinpython import * from duckyinpython import *
payload_html = """<!DOCTYPE html> payload_html = """<html>
<html> <head>
<head> <title>Pico W Ducky</title> </head> <title>Pico W Ducky</title>
<body> <h1>Pico W Ducky</h1> <meta name="viewport" content="width=device-width, initial-scale=1.0">
<table border="1"> <tr><th>Payload</th><th>Actions</th></tr> {} </table> <style>button{{margin:0.2em}}html{{font-family:'Open Sans', sans-serif;margin:2%}}table{{width:30%;max-width:20vh;margin-bottom:1em;border-collapse:collapse}}</style>
<br> </head>
<a href="/new">New Script</a> <body>
<h1>Pico W Ducky</h1>
<table border="1"><tr><th>Payload</th><th>Actions</th></tr>{}</table><br>
<a href="/new"><button>New Script</button></a>
</body> </body>
</html> </html>
""" """
edit_html = """<!DOCTYPE html> edit_html = """<!DOCTYPE html>
<html> <html>
<head> <head>
<title>Script Editor</title> <title>Script Editor</title>
</head> <meta name="viewport" content="width=device-width, initial-scale=1.0">
<body> <style>button{{margin-top:1em}}.main{{font-family:'Open Sans', sans-serif;margin:2%}}textarea{{width:100%;max-width:80vh;margin-bottom:1em;height:50vh}}</style>
<form action="/write/{}" method="POST"> </head>
<textarea rows="5" cols="60" name="scriptData">{}</textarea> <body>
<br/> <form action="/write/{}" method="POST">
<input type="submit" value="submit"/> <textarea rows="5" name="scriptData">{}</textarea><br/>
</form> <input type="submit" value="submit"/>
<br> </form>
<a href="/ducky">Home</a> <br>
</body> <a href="/ducky"><button>Home</button></a>
</body>
</html> </html>
""" """
new_html = """<!DOCTYPE html> new_html = """<!DOCTYPE html>
<html> <html>
<head> <head>
<title>New Script</title> <title>New Script</title>
</head> <meta name="viewport" content="width=device-width, initial-scale=1.0">
<body> <style>button{margin-top:1em}.main{font-family:'Open Sans', sans-serif;margin:2%}textarea{width:100%;max-width:80vh;margin-bottom:1em}#ducky-input{height:50vh}</style>
<form action="/new" method="POST"> </head>
Script Name<br> <body>
<textarea rows="1" cols="60" name="scriptName"></textarea> <div class="main">
Script<br> <form action="/new" method="POST">
<textarea rows="5" cols="60" name="scriptData"></textarea> <p>New Script:</p>
<br/> <textarea rows="1" name="scriptName" placeholder="script name"></textarea><br>
<input type="submit" value="submit"/> <textarea id="ducky-input" rows="5" name="scriptData" placeholder="script"></textarea>
</form> <br><input type="submit" value="Submit"/>
<br> </form>
<a href="/ducky">Home</a> <a href="/ducky"><button>Go Back</button></a>
</body> </div>
</body>
</html> </html>
""" """
response_html = """<!DOCTYPE html> response_html = """<!DOCTYPE html>
<html> <html>
<head> <title>Pico W Ducky</title> </head> <head>
<body> <h1>Pico W Ducky</h1> <title>Pico W Ducky</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<style>button{{margin-top:1em}}body{{font-family:'Open Sans', sans-serif;margin:2%}}</style>
</head>
<body>
<h1>Pico W Ducky</h1>
{} {}
<br> <br><a href="/ducky"><button>Home</button></a>
<a href="/ducky">Home</a>
</body> </body>
</html> </html>
""" """
newrow_html = "<tr><td>{}</td><td><a href='/edit/{}'>Edit</a> / <a href='/run/{}'>Run</a></tr>" newrow_html = "<tr><td>{}</td><td><a href='/edit/{}'>Edit</a> / <a href='/delete/{}'>Delete</a> / <a href='/run/{}'>Run</a></tr>"
def setPayload(payload_number): def setPayload(payload_number):
if(payload_number == 1): if(payload_number == 1):
@@ -94,7 +103,7 @@ def ducky_main(request):
for f in files: for f in files:
if ('.dd' in f) == True: if ('.dd' in f) == True:
payloads.append(f) payloads.append(f)
newrow = newrow_html.format(f,f,f) newrow = newrow_html.format(f,f,f,f)
#print(newrow) #print(newrow)
rows = rows + newrow rows = rows + newrow
@@ -172,8 +181,8 @@ def write_script(request, filename):
textbuffer = form_data['scriptData'] textbuffer = form_data['scriptData']
textbuffer = cleanup_text(textbuffer) textbuffer = cleanup_text(textbuffer)
#print(textbuffer) #print(textbuffer)
for line in textbuffer: for line in textbuffer.splitlines():
f.write(line) f.write(line + '\n')
f.close() f.close()
storage.remount("/",readonly=True) storage.remount("/",readonly=True)
response = response_html.format("Wrote script " + filename) response = response_html.format("Wrote script " + filename)
@@ -193,17 +202,28 @@ def write_new_script(request):
form_data[key] = value form_data[key] = value
#print(form_data) #print(form_data)
filename = form_data['scriptName'] filename = form_data['scriptName']
if ".dd" not in filename:
filename = filename + ".dd"
textbuffer = form_data['scriptData'] textbuffer = form_data['scriptData']
textbuffer = cleanup_text(textbuffer) textbuffer = cleanup_text(textbuffer)
storage.remount("/",readonly=False) storage.remount("/",readonly=False)
f = open(filename,"w",encoding='utf-8') f = open(filename,"w",encoding='utf-8')
for line in textbuffer: for line in textbuffer.splitlines():
f.write(line) f.write(line + '\n')
f.close() f.close()
storage.remount("/",readonly=True) storage.remount("/",readonly=True)
response = response_html.format("Wrote script " + filename) response = response_html.format("Wrote script " + filename)
return("200 OK",[('Content-Type', 'text/html')], response) return("200 OK",[('Content-Type', 'text/html')], response)
@web_app.route("/delete/<filename>")
def delete(request, filename):
print("Deleting ", filename)
storage.remount("/",readonly=False)
os.remove(filename)
response = response_html.format("Deleted script " + filename)
storage.remount("/",readonly=True)
return("200 OK",[('Content-Type', 'text/html')], response)
@web_app.route("/run/<filename>") @web_app.route("/run/<filename>")
def run_script(request, filename): def run_script(request, filename):
print("run_script ", filename) print("run_script ", filename)