androidmalware / android_hid

Use Android as Rubber Ducky against another Android device

android_hid

Use Android as Rubber Ducky against targeted Android device or PC

HID attack using Android

Using Android as Rubber Ducky against Android or Windows. This is not a new technique, just a demo how to perform HID attack using Android instead of rubber ducky. For targeted Android device it is not necessary to be rooted, have ADB/USB debugging enabled and device authorized, since attacker's smartphone behaves as connected keyboard.

hid_attack - script contains customized commands that are executed (typed) against targeted Android device hid_pc - script contains customized commands that are executed (typed) against targeted Windows 10

How to prevent this happening on Android

1. charge you smartphone using you own adapter
2. use none trivial PIN or password lockscreen protection
3. use mobile security software that will detect and prevent from launching payloads

How to prevent this happening on PC

1. Don't let anyone charge their smartphones in your PC
2. Use security software that will detect Metasploit payload
3. USB condom should help

PoC

Android: https://youtu.be/aOWr6rWhsIs
PC: https://youtu.be/PJbqZm73MOc

Prerequisites

• rooted Android with HID kernel support (e.g. NetHunter ROM)
• OTG cable

Video Tutorial using NetHunter

In the video was used "part1/msf_install" PoC script. Tested payload is removed.

Video Tutorial without using NetHunter

USB Gadget Tool: https://github.com/tejado/android-usb-gadget
HID gadgets: https://github.com/pelya/android-keyboard-gadget/tree/master/hid-gadget-test
For easy access, I copied USB Gadget Tool and HID gadget to https://github.com/androidmalware/android_hid/tree/main/part2

Script info

This is custom script, which might not work on your testing case scenario. Because of that, you must play around with pressed keys that are sent to targeted device. Website with my testing payload is not active anymore. List of all possible keys can be found on the link below.

Execute command

bash hid_attack bash hid_pc

How to flash custom ROM with HID support

https://github.com/pelya/android-keyboard-gadget

Brute-force pin using Android as HID

https://github.com/urbanadventurer/Android-PIN-Bruteforce

List of all keys

https://github.com/anbud/DroidDucky/blob/master/droidducky.sh

android_hid's Issues

Android hid & rubber ducky

Android

It is not working

hid_attack: line 3: ./hid-gadget-test: not found

Permission for Contribution

Hi, I want to contribute to this repository, I have fixed some of the typos in README.md file. But I am having a permission denied issue and unable to push the code to a new branch in your repository. Please grant me access to your repository so that I can open PR.

How the msf_install script works?

The script is applied to a Samsung Galaxy S8 with a 4-digit pin code. Used by nethanter(nexus 6p). The first number presses are skipped. The last 2 digits are typed and the OK button is pressed. Further the script does not fulfill. What parameters of the script need to be changed for the full operation of the brute.

Hack phone

Pin

Duck hunter

Question about waiting time on wrong PIN

How this works? I mean, Androdi has a basic security that is when wrong PIN/Pattern entered, we got to wait 30 seconds to enter next then 30 seconds for each wrong try after that. How is this method gonna get over it I wonder?

App ko download kese kare

Bhai app ko download kese kare

Use pc to run HID script.

Hi, shall we use a normal Linux machine to do HID attack instead of using nethunter phone?
Literally am asking, How to convert a Linux machine to a rubber ducky?

Androidmalware

Where can I download the program

A h

Android

Twitter

Ined. Hack twitter bro ❤️