Home 0P3N Blog Hacking with Arduino: Build Your Own USB Payload
Ready to Start Your Career?
Create Free Account
markpepapa s profile image
By: markpepapa
November 8, 2016

Hacking with Arduino: Build Your Own USB Payload

By: markpepapa
November 8, 2016
markpepapa s profile image
By: markpepapa
November 8, 2016
pixabayprinted-circuit-board-1539113_640Arduino is an open-source project that created micro-controller based kits for building digital devices and interactive objects that can sense and control physical devices.Arduino boards are available commercially in preassembled form, or as do-it-yourself kits. Some of them are really small and have a built-in USB connector which makes sketch upload easier.Some of you may be thinking, how can Arduino be used to hack something?Well, since Arduino supports keyboard emulation we can build sketch which contains keyboard instruction to type command and executes it just like the popular USB Rubber Ducky (https://usbrubberducky.com/).In this article, I will show you how to turn an Arduino Pro Micro into a USB Rubber Ducky, using a simple Arduino script.You can execute almost anything using keyboard emulation and autorun, even with antivirus installed and updated. From just typing simple commands to coding an executable from scratch.All of it will be done automatically, starting right after Arduino is installed on the target computer. This typically takes about 3 - 5 seconds.First, let's see it in action!PreparationTools you'll need:
  • Arduino Pro Micro ATMega32U4 5V/16MHz (or any Arduino with ATMega32U4 chip)
  • USB Micro Adapter Cable (you don't need this one if the Arduino you use comes with builtin USB A male connector)
Software you'll need:
  • https://www.arduino.cc/en/Main/Software
Sketch:
  • https://github.com/cdmsoftware/ArduinoDuckyScript/tree/master/AddAdmin_Payload
Step by step InstructionsHow does it work?A sketch file is just a regular script file with .ino extension. It contains 2 main procedures: setup() and loop(). Below is the basic structure for doing keyboard emulation:#include <HID.h>#include <Keyboard.h>void setup() {// put your setup code here, to run once:}void loop() {// put your main code here, to run repeatedly:}setup() procedure will only be executed once when Arduino is powered on and initialized, while the loop() procedure will be executed repeatedly, over and over again until Arduino is powered off.When giving instructions to type something, always add delay() command to let the computer process the instructions. You also need to add delay() command when pressing a key combination. For example, here are the commands to press the Windows Key.Keyboard.press(KEY_LEFT_GUI);delay(1000);  // the processor need time to register key pressKeyboard.press('x');Keyboard.releaseAll();delay(500);  // approximate time needed to process our intructionFor complete list of modifier key, see this link https://www.arduino.cc/en/Reference/KeyboardModifiersPrevention?To prevent this kind of attack, you can hold down the Alt key while plugging in a suspicious device.
Schedule Demo

Build your Cybersecurity or IT Career

Accelerate in your role, earn new certifications, and develop cutting-edge skills using the fastest growing catalog in the industry