Updated docs/readme.txt for firmware v1.3

This commit is contained in:
Sebastian Kinne
2017-05-08 16:15:04 +10:00
parent dd2013ef9d
commit 4dbc20f972

View File

@@ -1,278 +1,334 @@
_____ _____ _____ _____ _____ _____ _____ _____ __ __ _____ _____ _____ _____ _____ _____ _____ _____ __ __
(\___/) | __ || _ || __|| | | | __ || | || | || | || | | (\___/) | __ || _ || __|| | | | __ || | || | || | || | |
(='.'=) | __ -|| ||__ || | | __ -|| | || | | || | | ||_ _| (='.'=) | __ -|| ||__ || | | __ -|| | || | | || | | ||_ _|
(")_(") |_____||__|__||_____||__|__| |_____||_____||_|___||_|___| |_| (")_(") |_____||__|__||_____||__|__| |_____||_____||_|___||_|___| |_|
Bash Bunny by Hak5 USB Attack/Automation Platform Bash Bunny by Hak5 USB Attack/Automation Platform
-+- QUICK REFERENCE GUIDE v1.3 -+- -+- QUICK REFERENCE GUIDE v1.4 -+-
+-----------------+ +-----------------+
+---- | The Bash Bunny by Hak5 is a simple and powerful +---- | The Bash Bunny by Hak5 is a simple and powerful
| : | Boot Modes | multi-function USB attack and automation platform | : | Boot Modes | multi-function USB attack and automation platform
+---- * | for penetration testers and systems administrators. +---- * | for penetration testers and systems administrators.
+--|||------------+ +--|||------------+
||| |||
||+-- (sw1) Switch Position 1: Customizeable Payload. ||+-- (sw1) Switch Position 1: Customizeable Payload.
|+-- (sw2) Switch Position 2: Customizeable Payload. |+-- (sw2) Switch Position 2: Customizeable Payload.
+-- (sw3) Switch Position 3: Arming Mode - Serial + Mass Storage. +-- (sw3) Switch Position 3: Arming Mode - Serial + Mass Storage.
Welcome & Updating the Bash Bunny Software Welcome & Updating the Bash Bunny Software
------------------------------------------------------------------------------ ------------------------------------------------------------------------------
Congratulations on your new Bash Bunny by Hak5! For the best experience, we Congratulations on your new Bash Bunny by Hak5! For the best experience, we
recommend updating to the latest framework version and payload set from the recommend updating to the latest framework version and payload set from the
downloads section of https://www.bashbunny.com. There you will find a wealth downloads section of https://www.bashbunny.com. There you will find a wealth
of knowledge and a helpful community of creative penetration testers and of knowledge and a helpful community of creative penetration testers and
IT professionals. Welcome! IT professionals. Welcome!
Mass-Storage Directory Structure Default Settings Mass-Storage Directory Structure Default Settings
-------------------------------------------- ----------------------------- -------------------------------------------- -----------------------------
. .
|-payloads/ Username: root |-config.txt - Global config script Username: root
| |-library/ Password: hak5bunny | Sourced by all payloads Password: hak5bunny
| | |-* Payloads from Bash Bunny repository |-payloads/ Hostname: bunny
| | |-extensions/ - Additional Bunny Script Hostname: bunny | |-library/
| | commands/functions. | | |-* Payloads from Bash Bunny repository IP Address: 172.16.64.1
| |-switch1/ IP Address: 172.16.64.1 | | DHCP Range: 172.16.64.10-12
| | |-payload.txt - Bunny Script executed on DHCP Range: 172.16.64.10-12 | |-extensions/ - Additional Bunny Script
| | boot in switch position 1 | | commands/functions. LED Status:
| |-switch2/ LED Status: | |-switch1/ Green Solid - Boot up
| |-payload.txt - Bunny Script executed on Green Solid - Boot up | | |-payload.txt - Bunny Script executed on Blue Blink - Arming Mode
| boot in switch position 2 Blue Blink - Arming Mode | | boot in switch position 1 Red/Blue Blink - Recovery
|-loot/ - Where payloads store logs and data Red/Blue Blink - Recovery | |-switch2/
|-docs/ - EULA, License, this readme.txt | | |-payload.txt - Bunny Script executed on
|-tools/ - Contents placed here will be copied | | boot in switch position 2
| to /tools at boot in arming mode. | |-arming/
| *.deb packages will be installed. | |-payload.txt - Override payload for
|-languages/ - HID languages placed here will | Arming Mode *USE CAUTION*
install at boot in arming mode. |
|-loot/ - Where payloads store logs and data
|-docs/ - EULA, License, this readme.txt
|-tools/ - Contents placed here will be copied
Partitions Recovery | to /tools at boot in arming mode.
-------------------------------------- ------------------------------------- | *.deb packages will be installed.
/dev/root - Main Linux file system If the Bash Bunny Setup Mode fails to |-languages/ - HID languages placed here will
/dev/nandg - Recovery file systems boot >3 times the file system will install at boot in arming mode.
do not modify recover automatically. DO NOT UNPLUG
/dev/nandf - Mass storage partition while the LED is blinking in an
Mounted at /root/udisk alternating Red/Blue pattern. This
/root/udisk - Mass storage mount point process requires 5-10 minutes. Partitions Recovery
-------------------------------------- -------------------------------------
/dev/root - Main Linux file system If the Bash Bunny Setup Mode fails to
/dev/nandg - Recovery file systems boot >3 times the file system will
Bunny Script Builtin Commands Ducky Script do not modify recover automatically. DO NOT UNPLUG
----------------------------------------------------------- --------------- /dev/nandf - Mass storage partition while the LED is blinking in an
ATTACKMODE Specifies the USB devices to emulate. REM Mounted at /root/udisk alternating Red/Blue pattern. This
Accepts combinations of three: SERIAL, DELAY /root/udisk - Mass storage mount point process requires 5-10 minutes.
ECM_ETHERNET, RNDIS_ETHERNET, STORAGE, HID STRING
WINDOWS/GUI
LED Control the RGB LED. Accepts color and pattern MENU/APP
or predefined payload state. SHIFT Bunny Script Builtin Commands Ducky Script
See detail from LED section. ALT ----------------------------------------------------------- ---------------
CONTROL/CTRL ATTACKMODE Specifies the USB devices to emulate. REM
QUACK Injects specified keystrokes via Ducky Script UPARROW/UP Accepts combinations of three: SERIAL, DELAY
Accepts file relative to /payloads/ path DOWNARROW/DOWN ECM_ETHERNET, RNDIS_ETHERNET, STORAGE, HID, STRING
Accepts inline Ducky Script LEFTARROW/LEFT RO_STORAGE or disable all USB with OFF SPACE
RIGHTARROW/RIGHT WINDOWS/GUI
Q Alias for QUACK PAUSE/BREAK LED Control the RGB LED. Accepts color and pattern MENU/APP
DELETE or predefined payload state. SHIFT
Example: END See detail from LED section. ALT
QUACK helloworld.txt Inject keystrokes from file ESCAPE/ESC CONTROL/CTRL
Q STRING Hello World Inject keystrokes from Ducky Script HOME QUACK Injects specified keystrokes via Ducky Script UPARROW/UP
INSERT Accepts file relative to /payloads/ path DOWNARROW/DOWN
DUCKY_LANG=us Sets keystroke injection language PAGEUP P Accepts inline Ducky Script LEFTARROW/LEFT
PAGEDOWN RIGHTARROW/RIGHT
PRINTSCREEN Q Alias for QUACK PAUSE/BREAK
SPACE DELETE
Bunny Script Environment Variables TAB Example: END
---------------------------------------------------------- NUMLOCK QUACK helloworld.txt Inject keystrokes from file ESCAPE/ESC
$TARGET_IP IP Address of the computer received SCROLLOCK Q STRING Hello World Inject keystrokes from Ducky Script HOME
by the Bash Bunny DHCP Server. CAPSLOCK INSERT
$TARGET_HOSTNAME Host name of the computer on the F1...F12 DUCKY_LANG=us Sets keystroke injection language PAGEUP P
Bash Bunny network. PAGEDOWN
$HOST_IP IP Address of the Bash Bunny PRINTSCREEN
(Default: 172.16.64.1) SPACE
$SWITCH_POSITION "switch1", "switch2" or "switch3" Bunny Script Environment Variables TAB
---------------------------------------------------------- NUMLOCK
$TARGET_IP IP Address of the computer received SCROLLOCK
by the Bash Bunny DHCP Server. CAPSLOCK
Bash Bunny Extensions $TARGET_HOSTNAME Host name of the computer on the F1...F12
----------------------------------------------------------------------------- Bash Bunny network.
The Bash Bunny scripting language is further enhanced by additional commands, $HOST_IP IP Address of the Bash Bunny
known as extensions. Sourced from payloads/library/extensions/* at run-time, (Default: 172.16.64.1)
payloads may make use of these command. Similar to payloads, the extensions $SWITCH_POSITION "switch1", "switch2" or "switch3"
can be obtain and updated from the Bash Bunny repository.
Example extension: RUN - Simplifies command execution for HID attacks.
Usage: RUN [OS] [Command] Bash Bunny Extensions
RUN WIN notepad.exe -----------------------------------------------------------------------------
RUN WIN "powershell -Exec Bypass \"tree c:\\ > tree.txt; type tree.txt\" The Bash Bunny scripting language is further enhanced by additional commands,
RUN OSX http://www.example.com known as extensions. Sourced from payloads/library/extensions/* at run-time,
payloads may make use of these command. Similar to payloads, the extensions
can be obtain and updated from the Bash Bunny repository.
Connecting to the Linux Serial Console from Windows Serial Settings RUN - Simplifies command execution for HID attacks.
--------------------------------------------------------- --------------- Usage: RUN [OS] [Command]
Find the COM# from Device Manager > Ports (COM & LPT) 115200/8N1 RUN WIN notepad.exe
Look for USB Serial Device (COM#). Example: COM3 RUN WIN "powershell -Exec Bypass \"tree c:\\ > tree.txt; type tree.txt\"
Or run the following powershell command to list ports: Baud: 115200 RUN OSX http://www.example.com
[System.IO.Ports.SerialPort]::getportnames() Data Bits: 8
Parity Bit: No
Open Putty (putty.org) and select Serial. Enter COM# for Stop Bit: 1 CUCUMBER - CPU Control (May be specified globally in /config.txt)
serial line and 115200 for Speed. Clock Open. Usage: CUCUMBER [Mode]
CUCUMBER ENABLE Single CPU core mode with governor set to ondemand
*Best thermal option for long-term deployments
CUCUMBER DISABLE Quad CPU core mode with governor set to ondemand
Connecting to the Linux Serial Console from Linux/Mac *Default behavior. Best overall power/performance
----------------------------------------------------------------------------- CUCUMBER PLAID Quad CPU core mode with governor set to performance
Find the device from the terminal with: "ls /dev/tty*" or "dmesg | grep tty" *Ludicrous speed. Not intended for long-term deployments.
On Linux the Bash Bunny may be /dev/ttyUSB0 or /dev/ttyACM0
Connect to the serial device with screen. (apt-get install screen if needed)
Example: "sudo screen /dev/ttyACM0 115200" DUCKY_LANG - Specifies HID injection language for QUACK commands
Disconnect with keyboard combo: CTRL+a followed by CTRL+\ Usage: DUCKY_LANG [Language]
DUCKY_LANG us
* Specified in two letter language abbreviation
* Uses language json file from langauge database (updated via /languages)
Example Payload Structure
-------------------------
payloads/switch#/ REQUIRETOOL - Checks if a tool is installed. Exits with LED FAIL if not.
|-payload.txt Primary payload file executed on boot in Usage: REQUIRETOOL [tool]
| specified switch position REQUIRETOOL impacket
|-readme.txt Optional payload documentation * Checks /tools/ for named directory or system installed tool name
|-config.txt Optional payload configuration for variables
| sourced by complex payloads
|-install.sh Installation script for complex payloads GET - Returns variable
| requiring initial setup (may require Internet) Usage: GET [variable]
|-remove.sh Uninstall/Cleanup script for complex payloads GET TARGET_IP Returns $TARGET_IP
GET TARGET_HOSTNAME Returns $TARGET_HOSTNAME
GET HOST_IP Returns $HOST_IP
GET SWITCH_POSITION Returns $SWITCH_POSITION
Share Internet Connection with Bash Bunny from Windows
-----------------------------------------------------------------------------
- Configure a payload.txt for ATTACKMODE RNDIS_ETHERNET
- Boot Bash Bunny from RNDIS_ETHERNET set payload on the host Windows PC Connecting to the Linux Serial Console from Windows Serial Settings
- Open Control Panel > Network Connections (Start > Run > "ncpa.cpl" > Enter) --------------------------------------------------------- ---------------
- Identify Bash Bunny interface. Device name: "USB Ethernet/RNDIS Gadget" Find the COM# from Device Manager > Ports (COM & LPT) 115200/8N1
- Right-click Internet interface (e.g. Wi-Fi) and click Properties. Look for USB Serial Device (COM#). Example: COM3
- From the Sharing tab, check "Allow other network users to connect through Or run the following powershell command to list ports: Baud: 115200
this computer's Internet connection", select the Bash Bunny from the [System.IO.Ports.SerialPort]::getportnames() Data Bits: 8
Home networking connection list (e.g. Ethernet 2) and click OK. Parity Bit: No
- Right-click Bash Bunny interface (e.g. Ethenet 2) and click Properties. Open Putty (putty.org) and select Serial. Enter COM# for Stop Bit: 1
- Select TCP/IPv4 and click Properties. serial line and 115200 for Speed. Clock Open.
- Set the IP address to 172.16.64.64. Leave Subnet mask as 255.255.255.0 and
click OK on both properties windows. Internet Connection Sharing is complete
Connecting to the Linux Serial Console from Linux/Mac
-----------------------------------------------------------------------------
Share Internet Connection with Bash Bunny from Linux Find the device from the terminal with: "ls /dev/tty*" or "dmesg | grep tty"
----------------------------------------------------------------------------- On Linux the Bash Bunny may be /dev/ttyUSB0 or /dev/ttyACM0
- Download the Internet Connection Sharing script from bashbunny.com/bb.sh Connect to the serial device with screen. (apt-get install screen if needed)
e.g: wget bashbunny.com/bb.sh Example: "sudo screen /dev/ttyACM0 115200"
- Run the bb.sh connection script with bash as root Disconnect with keyboard combo: CTRL+a followed by CTRL+\
e.g: sudo bash ./bb.sh
- Follow the [M]anual or [G]uided setup to configure iptables and routing
- Save settings for future sessions and [C]onnect
Example Payload Structure
-------------------------
/config.txt - Sourced by all payloads enabling global configurations
ATTACKMODE Command Example: DUCKY_LANG us
----------------------------------------------------------------------------- /payloads/switch#/
ATTACKMODE sets the device emulation parameters for the Bash Bunny. |-payload.txt Primary payload file executed on boot in
Three of five attack modes may be executed simultaneously. | specified switch position
|-readme.md Payload documentation in markdown for github
Parameter Type Target/Use |-install.sh Installation script for complex payloads
-------------- ------------------------------------ ------------------- requiring initial setup (may require Internet)
SERIAL ACM Abstract Control Model Serial Console /payloads/arming/
ECM_ETHERNET ECM Ethernet Control Model Linux/Mac/Android |-payload.txt Special payload executed when switch is in
RNDIS_ETHERNET RNDIS Remote Network Dvr Int Spec Windows (some *nix) position 3 (arming mode). Overrides default
STORAGE UMS USB Mass Storage Flash Drive STORAGE+SERIAL mode. For advanced users only.
HID HID Human Interface Device Keystroke Injection WARNING: Be careful not to lock yourself out
of the Bash Bunny by disabling access via
STORAGE or SERIAL when using this feature.
LED Command
----------------------------------------------------------------------------- Share Internet Connection with Bash Bunny from Windows
The multi-color LED enables at-a-glance information on payload status. -----------------------------------------------------------------------------
The LED is controlled via the LED command, from the console or payload.txt - Configure a payload.txt for ATTACKMODE RNDIS_ETHERNET
- Boot Bash Bunny from RNDIS_ETHERNET set payload on the host Windows PC
Usage: LED [COLOR] [PATTERN] or LED [STATE] - Open Control Panel > Network Connections (Start > Run > "ncpa.cpl" > Enter)
- Identify Bash Bunny interface. Device name: "USB Ethernet/RNDIS Gadget"
COLORS - Right-click Internet interface (e.g. Wi-Fi) and click Properties.
------ - From the Sharing tab, check "Allow other network users to connect through
In addition to Red, Green and Blue, additive color mixing is possible. this computer's Internet connection", select the Bash Bunny from the
Home networking connection list (e.g. Ethernet 2) and click OK.
-------- -------------------------------------------- - Right-click Bash Bunny interface (e.g. Ethenet 2) and click Properties.
R Red - Select TCP/IPv4 and click Properties.
G Green - Set the IP address to 172.16.64.64. Leave Subnet mask as 255.255.255.0 and
B Blue click OK on both properties windows. Internet Connection Sharing is complete
Y, R G Yellow (Commonly known as Amber)
C, G B Cyan (Commonly known as Light Blue)
M, R B Magenta (Commonly known as Violet or Purple)
W, R G B White (Combination of R + G + B) Share Internet Connection with Bash Bunny from Linux
-----------------------------------------------------------------------------
PATTERNS - Download the Internet Connection Sharing script from bashbunny.com/bb.sh
-------- -------------------------------------------------------- e.g: wget bashbunny.com/bb.sh
SOLID *Default. No blink. Used if pattern argument is ommitted - Run the bb.sh connection script with bash as root
e.g: sudo bash ./bb.sh
SLOW Symmetric 1000ms ON, 1000ms OFF, repeating - Follow the [M]anual or [G]uided setup to configure iptables and routing
FAST Symmetric 100ms ON, 100ms OFF, repeating - Save settings for future sessions and [C]onnect
VERYFAST Symmetric 10ms ON, 10ms OFF, repeating
SINGLE 1 100ms blink(s) ON followed by 1 second OFF, repeating
DOUBLE 2 100ms blink(s) ON followed by 1 second OFF, repeating ATTACKMODE Command
TRIPLE 3 100ms blink(s) ON followed by 1 second OFF, repeating -----------------------------------------------------------------------------
QUAD 4 100ms blink(s) ON followed by 1 second OFF, repeating ATTACKMODE sets the device emulation parameters for the Bash Bunny.
QUIN 5 100ms blink(s) ON followed by 1 second OFF, repeating Three attack modes may be executed simultaneously.
ISINGLE 1 100ms blink(s) OFF followed by 1 second ON, repeating Parameter Type Target/Use
IDOUBLE 2 100ms blink(s) OFF followed by 1 second ON, repeating -------------- ------------------------------------ ------------------------
ITRIPLE 3 100ms blink(s) OFF followed by 1 second ON, repeating SERIAL ACM Abstract Control Model Serial Console
IQUAD 4 100ms blink(s) OFF followed by 1 second ON, repeating ECM_ETHERNET ECM Ethernet Control Model Linux/Mac/Android
IQUIN 5 100ms blink(s) OFF followed by 1 second ON, repeating RNDIS_ETHERNET RNDIS Remote Network Dvr Int Spec Windows (some *nix)
STORAGE UMS USB Mass Storage Flash Drive
SUCCESS 1000ms VERYFAST blink followed by SOLID RO_STORAGE UMS USB Mass Storage Read-Only Flash Drive
# Custom value in ms for continuous symmetric blinking HID HID Human Interface Device Keystroke Injection
STATES ATTACKMODE Advanced Parameters
--------------------------------------------------------------------- ------------- ----------------------------------------------------------------
In addition to the combinations of COLORS and PATTERNS listed above, PID_ Specifies the USB device product ID
these standardized LED STATES may be used to indicate payload status: VID_ Specifies the USB device vendor ID
MAN_ Specifies the USB device manufacturer
---------- ------------- --------------------------------------------- SN_ Specifies the USB device serial number
SETUP M SOLID Magenta solid OFF Disables all USB emulaiton
FAIL R SLOW Red slow blink Example:
FAIL1 R SLOW Red slow blink ATTACKMODE HID STORAGE VID_0XF000 PID_0X1234 SN_12345678 MAN_HAK5
FAIL2 R FAST Red fast blink
FAIL3 R VERYFAST Red very fast blink
ATTACK Y SINGLE Yellow single blink LED Command
STAGE1 Y SINGLE Yellow single blink -----------------------------------------------------------------------------
STAGE2 Y DOUBLE Yellow double blink The multi-color LED enables at-a-glance information on payload status.
STAGE3 Y TRIPLE Yellow triple blink The LED is controlled via the LED command, from the console or payload.txt
STAGE4 Y QUAD Yellow quadruple blink
STAGE5 Y QUIN Yellow quintuple blink Usage: LED [COLOR] [PATTERN] or LED [STATE]
SPECIAL C ISINGLE Cyan inverted single blink COLORS
SPECIAL1 C ISINGLE Cyan inverted single blink ------
SPECIAL2 C IDOUBLE Cyan inverted double blink In addition to Red, Green and Blue, additive color mixing is possible.
SPECIAL3 C ITRIPLE Cyan inverted triple blink
SPECIAL4 C IQUAD Cyan inverted quadriple blink -------- --------------------------------------------
SPECIAL5 C IQUIN Cyan inverted quintuple blink R Red
G Green
CLEANUP W FAST White fast blink B Blue
FINISH G SUCCESS Green 1000ms VERYFAST blink followed by SOLID Y, R G Yellow (Commonly known as Amber)
C, G B Cyan (Commonly known as Light Blue)
OFF Turns the LED off M, R B Magenta (Commonly known as Violet or Purple)
W, R G B White (Combination of R + G + B)
-----------------------------------------------------------------------------
PATTERNS
(\___/) Find further documentation, repository of payloads, (\___/) -------- --------------------------------------------------------
(='.'=) tutorial videos and community support forums at (='.'=) SOLID *Default. No blink. Used if pattern argument is ommitted
(")_(") bashbunny.com. (C) Hak5 LLC (")_(")
SLOW Symmetric 1000ms ON, 1000ms OFF, repeating
FAST Symmetric 100ms ON, 100ms OFF, repeating
VERYFAST Symmetric 10ms ON, 10ms OFF, repeating
SINGLE 1 100ms blink(s) ON followed by 1 second OFF, repeating
DOUBLE 2 100ms blink(s) ON followed by 1 second OFF, repeating
TRIPLE 3 100ms blink(s) ON followed by 1 second OFF, repeating
QUAD 4 100ms blink(s) ON followed by 1 second OFF, repeating
QUIN 5 100ms blink(s) ON followed by 1 second OFF, repeating
ISINGLE 1 100ms blink(s) OFF followed by 1 second ON, repeating
IDOUBLE 2 100ms blink(s) OFF followed by 1 second ON, repeating
ITRIPLE 3 100ms blink(s) OFF followed by 1 second ON, repeating
IQUAD 4 100ms blink(s) OFF followed by 1 second ON, repeating
IQUIN 5 100ms blink(s) OFF followed by 1 second ON, repeating
SUCCESS 1000ms VERYFAST blink followed by SOLID
# Custom value in ms for continuous symmetric blinking
STATES
---------------------------------------------------------------------
In addition to the combinations of COLORS and PATTERNS listed above,
these standardized LED STATES may be used to indicate payload status:
---------- ------------- ---------------------------------------------
SETUP M SOLID Magenta solid
FAIL R SLOW Red slow blink
FAIL1 R SLOW Red slow blink
FAIL2 R FAST Red fast blink
FAIL3 R VERYFAST Red very fast blink
ATTACK Y SINGLE Yellow single blink
STAGE1 Y SINGLE Yellow single blink
STAGE2 Y DOUBLE Yellow double blink
STAGE3 Y TRIPLE Yellow triple blink
STAGE4 Y QUAD Yellow quadruple blink
STAGE5 Y QUIN Yellow quintuple blink
SPECIAL C ISINGLE Cyan inverted single blink
SPECIAL1 C ISINGLE Cyan inverted single blink
SPECIAL2 C IDOUBLE Cyan inverted double blink
SPECIAL3 C ITRIPLE Cyan inverted triple blink
SPECIAL4 C IQUAD Cyan inverted quadriple blink
SPECIAL5 C IQUIN Cyan inverted quintuple blink
CLEANUP W FAST White fast blink
FINISH G SUCCESS Green 1000ms VERYFAST blink followed by SOLID
OFF Turns the LED off
-----------------------------------------------------------------------------
(\___/) Find further documentation, repository of payloads, (\___/)
(='.'=) tutorial videos and community support forums at (='.'=)
(")_(") bashbunny.com. (C) Hak5 LLC (")_(")