Make Your Own Evil USB - 21MCA143_CHIRAG_SONAIYA

 

USB Rubber Ducky — a device which resembles a regular USB flash drive. When connected to a computer, it claims to be a keyboard and quickly enters all its commands. It’s a pretty cool thing and very useful for Pentests, but why pay 40 dollars or more if a regular USB flash drive can be taught the same tricks?

WARNING

Don’t forget that making the described changes to your USB flash drive may not only void the device’s warranty but may also kill it. Experiment at your own risk!

Introduction

Last year’s Black Hat was full of many interesting reports. One of the most discussed was a report on the fatal vulnerability of USB devices, which allows regular USB flash drives to be turned into a tool for spreading malware. The attack was called BadUSB, but later jokes appeared on the Internet referring to USBola, comparing this attack to the well-known virus.

Similar ideas for using HID devices for malicious purposes have been around for a while. It’s a sin not to use the fact that the OS trusts devices connected to a USB interface. If we search the magazine’s archives, we can find an article on a similar topic describing the technique of using a special Teensy device to control a PC running Windows 7 (actually, with any OS). The device disguised itself as a regular USB flash drive. All this suggested that the same trick could also be played with flash drives.

Essentials

A USB is a truly all inclusive connection point. Simply think the number of gadgets we interface it to and the number of gadgets it works with! Mouses, consoles, printers, scanners, gamepads, modems, passages, web cameras, phones, and so forth. Automatically, we plug the USB into the attachment and the OS consequently decides the kind of gadget and load the necessary drivers.

However, how can it make it happen?

How flash drives work

In fact, the OS knows nothing about the connected device. It has to wait until the device tells it what kind it is. Let’s consider a simple example. When we plug a USB flash drive into a USB socket, the flash drive informs the operating system of its type and volume. It is worth remembering our shrewd Chinese colleagues, who learned how to produce higher capacity flash drives (some almost 2 TB). To figure out how this is possible, let’s remember (or learn) how the OS recognizes USB devices.

Bad USB or some history

At the last year’s Black Hat conference, two researchers (Karsten Nohl and Jakob Lell) shared their experience on how to install a personal upgrade to the firmware of the USB flash drive controller. After a while, this USB flash drive was registered as a keyboard and entered the selected commands. Due to the serious nature of the problem, the guys decided not to make the code for this available. However, soon after, two other researchers (Adam Caudill and Brandon Wilson) presented to the whole world at Derbycon conference an operable PoC tailored to Phison 2251-03 microcontroller The code is available at GitHub.

Transformation

As you might have guessed, today we will try to turn a regular USB flash drive into a pentester’s secret weapon!

First of all, we will need a suitable device. As the code has been uploaded for the specific microcontroller only, we have two options — either find a USB flash drive managed by this controller, or perform some very challenging work researching and upgrading the firmware of another microcontroller. This time, we will select an easier way and try to find a suitable USB flash drive (here is the list of vulnerable equipment). The controller is quite popular, so, miraculously, I found a suitable USB flash drive among the dozen I have at home.

Starting the magic

Having found the suitable device (which we won’t miss if it fails), we can start its transformation. First of all, we need to download the sources which the guys made available. Actually, the content is described in detail on their official wiki page, but, just in case, I will remind you what they have uploaded to GitHub:

• DriveCom — an app for communicating with Phison USB flash drives;
• EmbedPayload — an app for embedding Rubber Ducky inject.bin key scripts into custom firmware for subsequent execution when the USB flash drive is connected;
• Injector — an app that extracts addresses from the firmware and embeds the patching code in the firmware;
• firmware — custom 8051 firmware written in C;
• patch — collection of 8051 patches written in C.

INFO

When you use Ducky scripts, you should remember that the DELAY command, which performs a delay for a set number of milliseconds, will work a little differently on the USB flash drive than on Rubber Ducky, so you will have to adjust the delay time.

Preparing the system

Having downloaded the archive with sources from GitHub, you will find that most of them have been written in C# and require compilation, so you will need a studio. Another tool you will need is the Small Device C Compiler, or SDCC. Install it in C:\Program Files\SDCC, you will need it to compile firmware and patches.

Having compiled all the tools contained in the archive, check again if this USB flash drive is suitable for firmware upgrade:

DriveCom.exe /drive=F /action=GetInfo

where F is the letter of the drive.

Getting the burner image

The next important step is to select an appropriate burner image (8051 binary file, responsible for dumping activities and uploading firmware to the device). They are typically named:

BNxxVyyyz.BIN

where xx is the controller version (for instance, for PS2251-03 it will be 03), yyy is version number (not important), and z reflects the memory page size and can look like:

• 2KM — for 2K NAND chips;
• 4KM — for 4K NAND chips;
• M — for 8K NAND chips.

You can look for a suitable burner image for your USB flash drive here.

Dumping the original firmware

Before commencing your dirty experiments which could kill the USB flash drive, it is strongly recommended to dump the original firmware, so that if something goes wrong you can try to recover the device. First, switch the device to boot mode:

tools\DriveCom.exe /drive=F /action=SetBootMode

Then, use the DriveCom utility, passing the drive letter, the path to the burner image, and the path to the file where the original dumped firmware will be saved. It will look like this:

tools\DriveCom.exe /drive=F /action=DumpFirmware /burner=BN03V104M.BIN /firmware=fw.bin

If you have done everything correctly, the source firmware will be saved to the fw.bin file.

Preparing the payload

Now it’s time to think about the functions we want our USB flash drive to have. Teensy has a separate Kautilya toolkit, which can be used to automatically create payloads. For USB Rubber Ducky, there is a whole website, with a friendly interface, which lets you create any scripts for your device online. This is in addition to the list of finished scripts, which are available on the project’s GitHub. Fortunately, Ducky scripts may be converted into binary to embed them then into firmware. To do this, we will need a utility Duck Encoder.

As for the scripts, there are several options:

• you can write the required script yourself, as the used syntax is easy to master (see the project’s official website);
• use finished ones uploaded to GitHub. As they have a reverse shell and other goodies — you will only have to make minor corrections and convert them into binary form;
• or use the above-mentioned website, which will lead you step-by-step through all the settings and will let you download the finished script in the form of a Ducky script (or already in converted binary form).
• To convert the script into binary, execute the following command:

java -jar duckencoder.java -i keys.txt -o inject.bin

where keys.txt is a Ducky script, and inject.bin is the source binary file.

Flashing the firmware

As soon as we have the finished payload, it’s time to embed it into the firmware. This is done with the following two commands:

1 copy CFW.bin hid.bin 

2 tools\EmbedPayload.exe inject.bin hid.bin

Please note that the firmware is first copied to hid.bin, and only then is it flashed. This is because the payload can only be embedded into the firmware once, so the original CFW.bin must be left untouched.

After this manipulation, we will have a hid.bin custom firmware file with an embedded payload. You will only have to place the obtained firmware in the flash drive:

tools\DriveCom.exe /drive=F /action=SendFirmware /burner=BN03V104M.BIN /firmware=hid.bin

where F is the drive letter.

Result

We have reached our goal. Moreover, I hope you now understand that USB flash drives (and other USB devices) can no longer be seen simply as a drive that stores your information. In fact, it is almost a computer, which can be taught to execute specific tasks. Although, PoC has so far only been made available for a specific controller, you can be sure that, as you are reading this article, someone is definitely working on others.

So, be careful when you plug in a USB device and keep your eyes open.