This Quickpost is for my Bash Bunny with the original firmware. Since my first Bash Bunny post a couple of days ago, firmware 1.1 was released, but I have not yet upgraded.
When I used my Bash Bunny as a keyboard emulator (attackmode HID) to type string Attack! (QUACK STRING Attack!), I got the same result as with my Teensy: the string Qttqck1 was typed. That’s because by default, Bash Bunny emulates a US keyboard, and my computers are configured for a BE keyboard layout.
A keyboard doesn’t send characters to the computer when typed upon, but it sends so-called scancodes identifying the typed keys. Then the operating system converts those scancodes to characters, depending on the configured keyboard layout. So I have two solutions to fix my problem: change the keyboard layout of my machines to US, or have my Bash Bunny send the scancodes corresponding to a BE keyboard.
Solution 1 is not practical for me, so let’s take a look at solution 2. With my Teensy, I would send characters Qttqck8. Doing the same with my Bash Bunny, command “QUACK STRING Qttqck8” sends the correct scancodes for a BE keyboard to type Attack!.
Fortunately, the Bash Bunny can be configured to use keyboard layouts other than US, so that I don’t have to convert strings. But first, The DuckToolKit needs to be installed on the Bash Bunny via the DuckyInstall payload. After the toolkit is installed, you will find a folder (/root/tools/DuckToolkit/ducktoolkit/languages) with json files for different keyboard layouts on the Bash Bunny:
OK, so how do we use this in a payload? With command QUACK SET_LANGUAGE, like this:
#!/bin/bash
ATTACKMODE HID
QUACK SET_LANGUAGE be
QUACK STRING Attack!
SET_LANGUAGE will use the selected keyboard layout, and translate the strings to the correct scancodes. Remark that if you select a keyboard layout for which there is no corresponding json file on your Bash Bunny, then the HID key injection will not work. You will have to find or create a json file for your keyboard layout, and add it to the folder.
This is the be.json file (BE keyboard layout):
Notice that the scancodes for letter q are: 00, 00 and 04. The first byte (00) is the modifier key (indicating SHIFT for example), the second byte (00) is reserved, and the third byte (04) is the keycode.
This is the us.json file (US keyboard layout):
Notice that the same scancodes for letter q on a BE keyboard (00, 00 and 04) correspond to letter a on a US keyboard.
BTW, when my Bash Bunny is plugged-in for a couple of hours, it gets a little bit hot:
Article Link: https://blog.didierstevens.com/2017/04/09/quickpost-bash-bunny-keyboard-layouts/