制作Wi-Fi Ducky远程HID攻击设备

首页 > 代码库 > 制作Wi-Fi Ducky远程HID攻击设备

制作Wi-Fi Ducky远程HID攻击设备

2024-10-12 14:33:02 219人阅读

1、介绍WIFI DUCKY

它是一个Wi-Fi控制的BadUSB设备来远程执行Ducky Scripts。

使用充当键盘的USB设备来注入攻击，Hak5 的 USB Rubber Ducky 是这种攻击的黑客小工具。它引入了一个简单的脚本语言，称为Ducky Script，这个项目也是这样使用的。

该设备使用 ESP8266 + ATMEGA32U4 创建WIFI信号，进行远程上传、保存和运行脚本进行攻击

但是为什么要添加Wi-Fi，你可能会问。

使用Wi-Fi，您可以远程上传并运行Ducky Script。

只需将设备插入，连接到其Wi-Fi网络，即可完全控制目标机器。

它还给你一个比其他BadUSB更大的优势，你可以测试你的脚本！您不需要将它们复制到micro-sd卡或编译它们。您可以通过web界面直接运行它们，这使得它非常容易测试和改进脚本。

它还为不同的攻击增加了很多可能性。您可以使目标从Wi-Fi网络下载可执行文件，而不是互联网。或者执行不同的攻击并将结果发回。或者打开ESP8266s Wi-Fi上的反向Shell。

等等...有这么多的可能性，赶快动手做起来吧！

技术分享

2、所需材料：

1.CJMCU-Beetle Leonardo USB ATMEGA32U4
2.ESP8266-12F
3.AMS1117-3.3V电源模块

3、所需软件：

ARDUINO IDE 下载地址：https://www.arduino.cc/en/Main/Software
NodeMCU Flasher 下载地址：https://github.com/nodemcu/nodemcu-flasher

4、接线图：

技术分享

5、写入固件到ESP8266

首先，然后将下列代码上传到Arduino：

int program_pin = 12;int enable_pin = 13;void setup(){  Serial1.begin(115200);  Serial.begin(115200);  pinMode(enable_pin, OUTPUT);  pinMode(program_pin, OUTPUT);  digitalWrite(program_pin, LOW);  digitalWrite(enable_pin,HIGH);}void loop(){  while(Serial1.available()){    Serial.write((uint8_t)Serial1.read());  }  if(Serial.available()){    while(Serial.available()){      Serial1.write((uint8_t)Serial.read());    }  }}

将设备连接PC，打开Arduino IDE，选择开发板和端口

技术分享

然后点击上传将代码写入Arduino

技术分享

写入成功后，前往 https://github.com/spacehuhn/wifi_ducky/releases 下载 esp8266_wifi_duck_4mb.bin 固件

然后打开 NodeMCU Flasher 写入软件

技术分享

将参数设置如下

技术分享

然后选择固件

技术分享

选择端口，点击 Flash 开始写入固件

技术分享

写入完成后需要将 GPIO0 的线断开，变成如下的接线，即可进行下一步写入代码

技术分享

6、写入代码到ATMEGA32U4

#include <Keyboard.h>#define BAUD_RATE 57200#define ExternSerial Serial1String bufferStr = "";String last = "";int defaultDelay = 0;void Line(String _line){  int firstSpace = _line.indexOf(" ");  if(firstSpace == -1) Press(_line);  else if(_line.substring(0,firstSpace) == "STRING"){    for(int i=firstSpace+1;i<_line.length();i++) Keyboard.write(_line[i]);  }  else if(_line.substring(0,firstSpace) == "DELAY"){    int delaytime = _line.substring(firstSpace + 1).toInt();    delay(delaytime);  }  else if(_line.substring(0,firstSpace) == "DEFAULTDELAY") defaultDelay = _line.substring(firstSpace + 1).toInt();  else if(_line.substring(0,firstSpace) == "REM"){} //nothing :/  else if(_line.substring(0,firstSpace) == "REPLAY") {    int replaynum = _line.substring(firstSpace + 1).toInt();    while(replaynum)    {      Line(last);      --replaynum;    }  } else{      String remain = _line;      while(remain.length() > 0){        int latest_space = remain.indexOf(" ");        if (latest_space == -1){          Press(remain);          remain = "";        }        else{          Press(remain.substring(0, latest_space));          remain = remain.substring(latest_space + 1);        }        delay(5);      }  }  Keyboard.releaseAll();  delay(defaultDelay);}void Press(String b){  if(b.length() == 1) Keyboard.press(char(b[0]));  else if (b.equals("ENTER")) Keyboard.press(KEY_RETURN);  else if (b.equals("CTRL")) Keyboard.press(KEY_LEFT_CTRL);  else if (b.equals("SHIFT")) Keyboard.press(KEY_LEFT_SHIFT);  else if (b.equals("ALT")) Keyboard.press(KEY_LEFT_ALT);  else if (b.equals("GUI")) Keyboard.press(KEY_LEFT_GUI);  else if (b.equals("UP") || b.equals("UPARROW")) Keyboard.press(KEY_UP_ARROW);  else if (b.equals("DOWN") || b.equals("DOWNARROW")) Keyboard.press(KEY_DOWN_ARROW);  else if (b.equals("LEFT") || b.equals("LEFTARROW")) Keyboard.press(KEY_LEFT_ARROW);  else if (b.equals("RIGHT") || b.equals("RIGHTARROW")) Keyboard.press(KEY_RIGHT_ARROW);  else if (b.equals("DELETE")) Keyboard.press(KEY_DELETE);  else if (b.equals("PAGEUP")) Keyboard.press(KEY_PAGE_UP);  else if (b.equals("PAGEDOWN")) Keyboard.press(KEY_PAGE_DOWN);  else if (b.equals("HOME")) Keyboard.press(KEY_HOME);  else if (b.equals("ESC")) Keyboard.press(KEY_ESC);  else if (b.equals("BACKSPACE")) Keyboard.press(KEY_BACKSPACE);  else if (b.equals("INSERT")) Keyboard.press(KEY_INSERT);  else if (b.equals("TAB")) Keyboard.press(KEY_TAB);  else if (b.equals("END")) Keyboard.press(KEY_END);  else if (b.equals("CAPSLOCK")) Keyboard.press(KEY_CAPS_LOCK);  else if (b.equals("F1")) Keyboard.press(KEY_F1);  else if (b.equals("F2")) Keyboard.press(KEY_F2);  else if (b.equals("F3")) Keyboard.press(KEY_F3);  else if (b.equals("F4")) Keyboard.press(KEY_F4);  else if (b.equals("F5")) Keyboard.press(KEY_F5);  else if (b.equals("F6")) Keyboard.press(KEY_F6);  else if (b.equals("F7")) Keyboard.press(KEY_F7);  else if (b.equals("F8")) Keyboard.press(KEY_F8);  else if (b.equals("F9")) Keyboard.press(KEY_F9);  else if (b.equals("F10")) Keyboard.press(KEY_F10);  else if (b.equals("F11")) Keyboard.press(KEY_F11);  else if (b.equals("F12")) Keyboard.press(KEY_F12);  else if (b.equals("SPACE")) Keyboard.press(‘ ‘);  //else Serial.println("not found :‘"+b+"‘("+String(b.length())+")");}void setup() {    Serial.begin(BAUD_RATE);  ExternSerial.begin(BAUD_RATE);  pinMode(13,OUTPUT);  digitalWrite(13,HIGH);  Keyboard.begin();}void loop() {  if(ExternSerial.available()) {    bufferStr = ExternSerial.readStringUntil("END");    Serial.println(bufferStr);  }    if(bufferStr.length() > 0){        bufferStr.replace("\r","\n");    bufferStr.replace("\n\n","\n");        while(bufferStr.length() > 0){      int latest_return = bufferStr.indexOf("\n");      if(latest_return == -1){        Serial.println("run: "+bufferStr);        Line(bufferStr);        bufferStr = "";      } else{        Serial.println("run: ‘"+bufferStr.substring(0, latest_return)+"‘");        Line(bufferStr.substring(0, latest_return));        last=bufferStr.substring(0, latest_return);        bufferStr = bufferStr.substring(latest_return + 1);      }    }        bufferStr = "";    ExternSerial.write(0x99);    Serial.println("done");  }}