iotsploit-exploits 0.0.6__py3-none-any.whl

iotsploit_exploits/greatfet_rubber_duck.py

@@ -0,0 +1,417 @@
+#!/usr/bin/python3
+
+import pluggy
+from typing import Optional, Any
+import asyncio
+import os
+import re
+from importlib.resources import files
+from facedancer.errors import EndEmulation
+from iotsploit_core.core.exploit_spec import ExploitResult, AsyncExploitResult
+from iotsploit_core.core.base_plugin import BasePlugin
+from facedancer.devices.keyboard import USBKeyboardDevice
+from facedancer.classes.hid.keyboard import KeyboardModifiers
+from iotsploit_core.utils import iots_logger
+
+hookimpl = pluggy.HookimplMarker("exploit_mgr")
+
+class RubberDuckPlugin(BasePlugin):
+    def __init__(self):
+        super().__init__({
+            'Name': 'Rubber Duck',
+            'Description': 'Emulates a USB keyboard to type keystrokes automatically (USB Rubber Duck).',
+            'License': 'GPL',
+            'Author': ['iotsploit'],
+            'RequiresRoot': False,
+            'Parameters': {
+                'payload': {
+                    'type': 'str',
+                    'required': False,
+                    'description': 'Commands to type (each line will be executed as a separate command)',
+                    'default': 'echo Hello from Rubber Duck!\nid\nls -la\n'
+                },
+                'delay_before_typing': {
+                    'type': 'int',
+                    'required': False,
+                    'description': 'Time to wait in seconds before starting to type',
+                    'default': 2
+                },
+                'delay_between_lines': {
+                    'type': 'float',
+                    'required': False,
+                    'description': 'Time to wait in seconds between typing each line',
+                    'default': 0.5
+                },
+                'delay_after_typing': {
+                    'type': 'int',
+                    'required': False,
+                    'description': 'Time to wait in seconds after typing completes before ending the emulation',
+                    'default': 1
+                },
+                'script_file': {
+                    'type': 'str',
+                    'required': False,
+                    'description': 'Path to a script file containing commands to type',
+                    'default': ''
+                },
+                'payload_format': {
+                    'type': 'str',
+                    'required': False,
+                    'description': 'Format of the payload: "plain" for plain text or "ducky" for DuckyScript format',
+                    'default': 'plain'
+                },
+                'target_os': {
+                    'type': 'str',
+                    'required': False,
+                    'description': 'Target operating system for built-in scripts: "windows", "linux", or "none" for custom script',
+                    'default': 'none'
+                }
+            }
+        })
+        self.device = None
+        self.running = False
+        self.logger = iots_logger.get_logger("rubber_duck")
+        
+        # Resolve built-in payloads from packaged resources.
+        _scripts = files("iotsploit_exploits") / "rubber_duck_scripts"
+        self.script_files = {
+            'windows': str(_scripts / 'windows_payload.txt'),
+            'linux': str(_scripts / 'linux_infogather.txt')
+        }
+        
+        # Define special key mappings
+        self.special_keys = {
+            'CTRL': KeyboardModifiers.MOD_LEFT_CTRL,
+            'SHIFT': KeyboardModifiers.MOD_LEFT_SHIFT,
+            'ALT': KeyboardModifiers.MOD_LEFT_ALT,
+            'GUI': KeyboardModifiers.MOD_LEFT_META,
+            'WINDOWS': KeyboardModifiers.MOD_LEFT_META,
+            'COMMAND': KeyboardModifiers.MOD_LEFT_META,  # Mac Command key
+            'OPTION': KeyboardModifiers.MOD_LEFT_ALT,   # Mac Option key
+            'ESC': 0x29,
+            'ESCAPE': 0x29,
+            'ENTER': 0x28,
+            'RETURN': 0x28,
+            'TAB': 0x2B,
+            'SPACE': 0x2C,
+            'BACKSPACE': 0x2A,
+            'DELETE': 0x4C,
+            'INSERT': 0x49,
+            'HOME': 0x4A,
+            'END': 0x4D,
+            'PAGEUP': 0x4B,
+            'PAGEDOWN': 0x4E,
+            'UP': 0x52,
+            'DOWN': 0x51,
+            'LEFT': 0x50,
+            'RIGHT': 0x4F,
+            'F1': 0x3A,
+            'F2': 0x3B,
+            'F3': 0x3C,
+            'F4': 0x3D,
+            'F5': 0x3E,
+            'F6': 0x3F,
+            'F7': 0x40,
+            'F8': 0x41,
+            'F9': 0x42,
+            'F10': 0x43,
+            'F11': 0x44,
+            'F12': 0x45,
+            'CAPSLOCK': 0x39,
+        }
+
+    @hookimpl
+    def initialize(self, device_plugin: Optional[Any] = None):
+        self.logger.info("Initializing RubberDuckPlugin")
+
+    def custom_facedancer_main(self, device, coroutine):
+        """
+        Custom implementation of Facedancer's main function that doesn't parse command line arguments.
+        This is needed when running inside Django where sys.argv contains Django's arguments.
+        """
+        self.logger.info("Starting custom Facedancer emulation")
+        try:
+            # Directly call the device's emulate method with our coroutine
+            device.emulate(coroutine)
+            self.logger.info("Facedancer emulation completed successfully")
+        except EndEmulation as e:
+            self.logger.info(f"Facedancer emulation ended: {str(e)}")
+        except KeyboardInterrupt:
+            self.logger.info("Facedancer emulation interrupted by user")
+        except Exception as e:
+            raise e
+
+    async def _parse_ducky_script(self, script):
+        """Parse a DuckyScript formatted script into executable commands"""
+        commands = []
+        delay = 0.5  # Default delay in seconds
+        
+        for line in script.splitlines():
+            line = line.strip()
+            if not line or line.startswith('REM'):  # Comment line
+                continue
+            
+            # Handle delay commands
+            if line.startswith('DELAY '):
+                try:
+                    delay_ms = int(line.split(' ', 1)[1])
+                    commands.append(('DELAY', delay_ms / 1000))  # Convert to seconds
+                except (ValueError, IndexError):
+                    self.logger.warning(f"Invalid delay command: {line}")
+                continue
+            
+            # Handle STRING command (regular typing)
+            if line.startswith('STRING '):
+                text = line[7:]  # Extract text after 'STRING '
+                commands.append(('STRING', text))
+                continue
+            
+            # Handle modifier + key combinations like "GUI r"
+            parts = line.split()
+            if len(parts) == 2 and parts[0] in self.special_keys:
+                modifier = parts[0]
+                key = parts[1]
+                commands.append(('MOD_KEY', (modifier, key)))
+                continue
+            
+            # Handle multiple special keys like "CTRL ALT DELETE"
+            if all(part in self.special_keys for part in parts):
+                commands.append(('KEYS', parts))
+                continue
+            
+            self.logger.warning(f"Unrecognized DuckyScript command: {line}")
+        
+        return commands
+
+    async def _execute_special_keys(self, key_combination):
+        """Execute a special key combination"""
+        modifiers = 0
+        keys = []
+        
+        for key in key_combination:
+            if key in ['CTRL', 'SHIFT', 'ALT', 'GUI', 'WINDOWS', 'COMMAND', 'OPTION']:
+                modifiers |= self.special_keys[key]
+            else:
+                keys.append(self.special_keys[key])
+        
+        if not keys:  # If only modifiers, add a blank key
+            keys = [0]
+            
+        for key in keys:
+            # Use type_scancode instead of press_key/release_all_keys
+            await self.device.type_scancode(key, modifiers=modifiers, duration=0.05)
+
+    def _prepare_payload(self, parameters):
+        """Prepare payload from parameters - works both in sync and async contexts"""
+        parameters = parameters or {}
+        delay_before_typing = int(parameters.get('delay_before_typing', 
+                                            self.info['Parameters']['delay_before_typing']['default']))
+        delay_between_lines = float(parameters.get('delay_between_lines', 
+                                            self.info['Parameters']['delay_between_lines']['default']))
+        delay_after_typing = int(parameters.get('delay_after_typing',
+                                            self.info['Parameters']['delay_after_typing']['default']))
+        payload_format = parameters.get('payload_format',
+                                       self.info['Parameters']['payload_format']['default'])
+        target_os = parameters.get('target_os',
+                                  self.info['Parameters']['target_os']['default'])
+        
+        # Determine payload source (target_os, script_file, or direct payload)
+        script_file = parameters.get('script_file', self.info['Parameters']['script_file']['default'])
+        
+        # If target_os is specified, use the corresponding built-in script
+        if target_os != 'none' and target_os in self.script_files:
+            script_file = self.script_files[target_os]
+            self.logger.info(f"Using built-in {target_os} script: {script_file}")
+            # For built-in scripts, automatically set payload format to ducky
+            payload_format = 'ducky'
+        
+        payload = parameters.get('payload', self.info['Parameters']['payload']['default'])
+        
+        if script_file and os.path.exists(script_file):
+            self.logger.info(f"Reading payload from script file: {script_file}")
+            try:
+                with open(script_file, 'r') as f:
+                    payload = f.read()
+            except Exception as e:
+                self.logger.error(f"Error reading script file: {str(e)}")
+                return None, None, None, f"Failed to read script file: {str(e)}"
+        elif script_file and not os.path.exists(script_file):
+            self.logger.error(f"Script file not found: {script_file}")
+            return None, None, None, f"Script file not found: {script_file}"
+        
+        return payload, payload_format, {
+            'delay_before_typing': delay_before_typing,
+            'delay_between_lines': delay_between_lines,
+            'delay_after_typing': delay_after_typing
+        }, None
+
+    @hookimpl
+    def execute(self, target: Optional[Any] = None, parameters: Optional[dict] = None):
+        """
+        Primary execution method - synchronous version.
+        This is the preferred entry point for Celery tasks.
+        """
+        self.logger.info("Executing RubberDuckPlugin")
+        
+        try:
+            # Check if we already have a running instance
+            if self.running:
+                return ExploitResult(False, "An instance is already running", {})
+                
+            # Prepare payload and get configuration
+            payload, payload_format, config, error = self._prepare_payload(parameters)
+            if error:
+                return ExploitResult(False, error, {})
+            
+            # Initialize USB device
+            self.logger.info("Initializing USB keyboard device...")
+            try:
+                self.device = USBKeyboardDevice()
+                self.logger.info(f"USB keyboard device initialized")
+            except Exception as e:
+                self.logger.error(f"Failed to initialize USB keyboard device: {str(e)}")
+                return ExploitResult(False, f"Failed to initialize USB keyboard device: {str(e)}", {})
+            
+            # Set running flag
+            self.running = True
+            
+            # Define our typing coroutine
+            async def process_commands():
+                try:
+                    self.logger.info(f"Waiting {config['delay_before_typing']} seconds before typing...")
+                    await asyncio.sleep(config['delay_before_typing'])
+                    
+                    # Parse the payload based on format
+                    if payload_format.lower() == 'ducky':
+                        self.logger.info("Parsing payload as DuckyScript")
+                        commands = await self._parse_ducky_script(payload)
+                    else:
+                        # Plain text format - each line is a command to type
+                        self.logger.info("Using plain text payload format")
+                        commands = [('STRING', line) for line in payload.splitlines()]
+                    
+                    # Process typing commands
+                    self.logger.info("Running typing commands...")
+                    
+                    total_commands = len(commands)
+                    for i, (cmd_type, cmd_data) in enumerate(commands):
+                        if not self.running:
+                            self.logger.info("Typing interrupted")
+                            break
+                        
+                        try:
+                            if cmd_type == 'DELAY':
+                                self.logger.info(f"Waiting for {cmd_data} seconds...")
+                                await asyncio.sleep(cmd_data)
+                            elif cmd_type == 'STRING':
+                                self.logger.info(f"Typing text ({i+1}/{total_commands}): {cmd_data}")
+                                await self.device.type_string(cmd_data)
+                                # Add enter key at the end of each command line for plain text mode
+                                if payload_format.lower() == 'plain':
+                                    await self.device.type_scancode(0x28)  # ENTER key
+                                await asyncio.sleep(0.05)
+                            elif cmd_type == 'KEYS':
+                                self.logger.info(f"Executing key combination ({i+1}/{total_commands}): {' '.join(cmd_data)}")
+                                await self._execute_special_keys(cmd_data)
+                                
+                            # Handle MOD_KEY (modifier + regular key)
+                            elif cmd_type == 'MOD_KEY':
+                                modifier, key = cmd_data
+                                self.logger.info(f"Executing modifier + key ({i+1}/{total_commands}): {modifier} {key}")
+                                modifiers = self.special_keys[modifier]
+                                
+                                # If key is a special key, use its scancode
+                                if key.upper() in self.special_keys:
+                                    scancode = self.special_keys[key.upper()]
+                                # Otherwise, type it as a regular character
+                                else:
+                                    # First press the modifier key
+                                    await self.device.type_string(key, modifiers=modifiers)
+                                    await asyncio.sleep(0.05)
+                                    continue
+                                
+                                # Use type_scancode with modifier
+                                await self.device.type_scancode(scancode, modifiers=modifiers, duration=0.05)
+                                
+                            # Report progress
+                            progress = (i + 1) / total_commands
+                            self.logger.info(f"Progress: {progress:.1%}")
+                            
+                            # Wait between commands
+                            if i < total_commands - 1:
+                                await asyncio.sleep(config['delay_between_lines'])
+                                
+                        except Exception as e:
+                            self.logger.error(f"Error executing command {i+1}: {str(e)}")
+                    
+                    self.logger.info(f"Typing complete. Waiting {config['delay_after_typing']} seconds before ending...")
+                    await asyncio.sleep(config['delay_after_typing'])
+                    
+                    # Clean end of the emulation
+                    self.logger.info("Exiting facedancer emulation...")
+                    raise EndEmulation("Typing completed successfully")
+                    
+                except Exception as e:
+                    self.logger.error(f"Error in command processing: {str(e)}")
+                    if hasattr(e, '__traceback__'):
+                        import traceback
+                        self.logger.error(''.join(traceback.format_tb(e.__traceback__)))
+                    raise  # Re-raise the exception
+            
+            try:
+                # Use our custom Facedancer main function to avoid argument parsing issues
+                self.logger.info("Starting Facedancer execution...")
+                self.custom_facedancer_main(self.device, process_commands())
+                self.logger.info("Facedancer execution completed successfully")
+            except Exception as e:
+                self.logger.error(f"Error in Facedancer execution: {str(e)}")
+                if hasattr(e, '__traceback__'):
+                    import traceback
+                    self.logger.error(''.join(traceback.format_tb(e.__traceback__)))
+                self.running = False
+                return ExploitResult(False, f"Facedancer execution failed: {str(e)}", {})
+            
+            # Return success - at this point the operation is complete
+            return ExploitResult(True, "RubberDuck executed successfully", {
+                "status": "complete",
+                "message": "Device has typed all commands"
+            })
+            
+        except Exception as e:
+            self.running = False
+            self.logger.error(f"Error during RubberDuck execution: {str(e)}")
+            if hasattr(e, '__traceback__'):
+                import traceback
+                self.logger.error(''.join(traceback.format_tb(e.__traceback__)))
+            return ExploitResult(False, f"RubberDuck failed: {str(e)}", {})
+        finally:
+            # Reset the running flag
+            self.running = False
+
+    @hookimpl
+    def cleanup(self):
+        """Clean up resources when plugin execution is finished"""
+        self.logger.info("Cleaning up RubberDuckPlugin")
+        
+        try:
+            # Signal any running operations to stop
+            self.running = False
+            
+            # Disconnect the device if it exists
+            if hasattr(self, 'device') and self.device:
+                try:
+                    self.logger.info("Disconnecting USB keyboard device...")
+                    self.device.disconnect()
+                    self.logger.info("Keyboard Device disconnected")
+                except Exception as e:
+                    self.logger.error(f"Error disconnecting device: {str(e)}")
+                finally:
+                    self.device = None
+                
+            self.logger.info("Cleanup completed successfully")
+            
+        except Exception as e:
+            self.logger.error(f"Error during cleanup: {str(e)}")
+            if hasattr(e, '__traceback__'):
+                import traceback
+                self.logger.error(''.join(traceback.format_tb(e.__traceback__)))