Use phone As Rubber Ducky Against Another phone

Posted by

Use Android as Rubber Ducky against another Android device

HID attack using Android
Using Android as Rubber Ducky against Android. This is not a new technique, just a demo how to perform HID attack using Android instead of rubber ducky. For targeted Android device it is not necessary to be rooted, have ADB/USB debugging enabled and device authorized, since attacker’s smartphone behaves as connected keyboard.

How to prevent this happening

  1. charge you smartphone using your own adapter
  2. use none trivial PIN or password lockscreen protection
  3. use mobile security software that will detect and prevent from launching payloads



Prerequisites

  • rooted Android with HID kernel support (e.g. NetHunter ROM)
  • OTG cable

Script info
This is custom script, which might not work on your testing case scenario. Because of that, you must play around with pressed keys that are sent to targeted device. Website with my testing payload is not active anymore. List of all possible keys can be found on the link below.

Execute command
bash hid_attack

How to flash custom ROM with HID support
https://github.com/pelya/android-keyboard-gadget

Brute-force pin using Android as HID
https://github.com/urbanadventurer/Android-PIN-Bruteforce

List of all keys
https://github.com/anbud/DroidDucky/blob/master/droidducky.sh

Feel free to leave a comment below or reach me on Instagram @iamshubhamkumar__.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.