What is a USB Rubber Ducky?

The Rubber Ducky is a USB stick with some special features. Unlike a normal USB stick, where you can store files, photos, etc., the Rubber Ducky is a device that injects predefined keystrokes. It was developed by hak5 and can currently be bought on their website for $79.99.

What makes it so dangerous is that antivirus software doesn’t detect it, because computers see it as a keyboard.

The Rubber Ducky has appeared in some TV shows, such as Mr. Robot.

(Mr. Robot scene)

How to use it?

1. The first step is to take out the microSD card inside it and put it in the adapter to connect it to the computer

2. Now it’s time to write the scripts that tell it what to do at each moment. For this, the Duckyscript programming language is used

DuckyScript

It is a very simple language that can be written in any text editor. It also works with other hak5 devices, for example:

REM (Comments)

REM is used to write comments

REM Esto no se va a interpretar

DELAY

The DELAY command tells the USB to pause for a moment. This is useful for scripts that, for example, open a window or an application and have to wait for it to load

DELAY 1000

STRING

STRING makes it type a phrase or word. The USB automatically presses shift for uppercase letters and the space bar for spaces, but it doesn’t handle trailing spaces

STRING Hello world!

What the Rubber Ducky will type

Hello world!

STRINGLN

It is like STRING, but it presses enter at the end

Movement keys

They can be used to move around a window or application.

• UP DOWN LEFT RIGHT
• UPARROW DOWNARROW LEFTARROW RIGHTARROW
• PAGEUP PAGEDOWN HOME END
• INSERT DELETE DEL BACKSPACE
• TAB
• SPACE

System keys

They are mainly used by the operating system for special functions, and they can be used to interact with text areas and navigate the user interface.

• ENTER
• ESCAPE
• PAUSE BREAK
• PRINTSCREEN
• MENU APP
• F1 F2 F3 F4 F5 F6 F7 F8 F9 F0 F11 F12

Modifier keys

Basic

These are keys that are combined with another key to perform a special function

• SHIFT
• ALT
• CONTROL CTRL
• COMMAND
• WINDOWS GUI

REM Ejemplo de teclas de modificación

REM Windows Run
GUI r

REM Cerrar Ventana
ALT F4

REM Pegar
CTRL c

Advanced

They can be combined with each other

• CTRL SHIFT
• ALT SHIFT
• COMMAND CTRL
• COMMAND CTRL SHIFT
• COMMAND OPTION
• COMMAND OPTION SHIFT
• CONTROL ALT DELETE

Standalone

To press a modifier key on its own, you have to put INJECT_MOD before it

REM Ejemplo presionando la tecla de Windows sola

INJECT_MOD
WINDOWS

Lock keys

Lock keys toggle between on and off

• CAPSLOCK
• NUMLOCK
• SCROLLOCK

Button

Inside the Rubber Ducky there is a small button that can be used in scripts. By default, pressing it restarts the loaded script, but its function can be changed:

WAIT_FOR_BUTTON_PRESS

Pauses the script until the button is pressed

REM Ejemplo uso de WAIT_FOR_BUTTON_PRESS

STRING Hello World!
WAIT_FOR_BUTTON_PRESS
STRING Has presionado el botón...

BUTTON_DEF

Defines a function that will run whenever the button is pressed at any point in the script, as long as the button isn’t already being used by the WAIT_FOR_BUTTON_PRESS command or a similar function.

BUTTON_DEF
    STRING Has presionado el botón.
END_BUTTON

DISABLE_BUTTON and ENABLE_BUTTON

As their names suggest, they disable and enable the button.

DISABLE_BUTTON
REM Botón desactivado

ENABLE_BUTTON
REM Botón activado

LED

The Rubber Ducky has a small LED inside that can be controlled from scripts

LED_OFF

Turns the LED off

LED_R

Turns the LED red

LED_G

Turns the LED green

Where to program it?

In the Rubber Ducky support section you can download a JSEncoder, which is a file with the .html extension. On Linux you open it with firefox jsencoder.html, and on Windows: right click, open with, browser

Changing the script language

The Rubber Ducky uses the English keyboard layout by default. To change it, you have to download the language you want from https://github.com/hak5/usbrubberducky-payloads/tree/master/languages and then load it into the jsencoder

First hello world

To make the Rubber Ducky do a hello world, put the following into the jsencoder:

DELAY 200
STRING Hola Mundo!!!

Now all you have to do is click generate payload, and a file called inject.bin will be downloaded. It has to go on the microSD card (there can only be one inject.bin, so delete the old ones).

How to protect yourself

The first and most obvious thing is not to leave computers, phones, printers, etc. unlocked.

There is a Windows program that runs in the background and protects you from the Rubber Ducky and similar devices. I haven’t tried it, but from what I’ve seen online, when it detects the Rubber Ducky it stops it, locks the computer and logs all the Rubber Ducky’s keystrokes so you can see what the attacker intended

https://lospi.net/beamgun/