Many of you don't even know about my existence here on Null Byte, so I thought of contributing something rather interesting. In addition, it would be nice to have something related on our WonderHowTo world. So here it is! This allows us hackers to reprogram the microcontroller in them to act as a human interface device HID , e. In this tutorial, we are going to determine the microcontroller of your USB flash drive, compile the source code published in GitHub for the tools we need, and move over to building a custom firmware with an embedded HID payload that will turn our harmless USB flash drive into a malicious keyboard designed to help us compromise our victim machine. The process is kind of like compiling and flashing ROMs to your Android device. You can find a list of known supported devices on. I will use an drive in this tutorial. Sometimes owning a confirmed device doesn't mean the PS2251-03 is actually being used, as manufacturers seem to use different controllers even within same device models. One of my friends had to literally saw up his USB device because he was too hasty. Please continue at your own risk; there is no guarantee that your device will work, even though there shouldn't be any issues. Determining the Microcontroller of Our USB Flash Drive Before starting, we want to make sure our USB uses the supported controller. We can use a program called to gather the required information about our USB. It doesn't require any installation. If your drive uses the Phison 2303 2251-03 controller, the output should look similar to this: However, if your USB device has a different one, it is most likely that you cannot reprogram it to an HID device with this exploit. Make sure to check in order to get one that will work. Setting Up the Build-Environment The developer of the code recommends us to use any version of to compile the tools and for building custom firmware. Visual Studio will probably take multiple hours to download and cannot be paused, so make sure you have enough time available. It also claims multiple gigabytes on your primary drive, about 10 GB on my SSD, which is annoying. The source code is. Actually, Visual Studio comes with an neat feature that lets us clone the whole repository. You can even interact with VS from the GitHub site: After cloning and opening the repostitory. You are most likely to see three solutions. If opened, you can compile with Ctrl + Shift + B or Menu bar - Build - Build Solution. If you cannot clone the repository through Visual Studio, and open the. DriveCom and EmbedPayload should be in the... Burner images for Phison controllers. Do not forget to install. Creating Custom Firmware At this point, all our preparations are done and we can continue using the tools. In this step, we simply have to go to our... If everything goes right, you will see a new folder with many different files inside. Writing a Script You may ask yourself in which language we are going to write our script. The syntax is rather easy. We will go ahead and create a. Keep in mind that we have to change the Windows layout to U. Don't be confused of the input. You can even use custom scripts and do some reverse engineering. Converting It into an HID Payload It is time to start using the Windows terminal - cmd. Embed the Payload in the Firmware Now we need to use the tools we built with Visual Studio. Obviously, EmbedPayload is to embed payloads. You can also overwrite the firmware by executing build. Dumping the Current Firmware of the USB Flash Drive I strongly advise you to make a copy of the current firmware on your USB flash drive in case you want to restore it. Now that our USB flash drive has become a keyboard, we cannot switch modes any more with our tools, nor access to the memory, but that is a minor problem. In the next section, I will focus how to resolve this issue. We need to open the case of our USB drive and connect two pins of the microcontroller while plugging the drive into our PC. Since the circle is on the top left corner of my controller from this perspective , I have to connect the two pins of the left bottom side: You may need to open the picture in a new tab and zoom in. I usually use the edge of a USB connector to connect these two pins. In addition, a USB extension cable can be very useful in this scenario. It seems to be difficult, but you will get used to this. Use whatever you feel most comfortable with, without damaging your USB flash drive. If you do it correctly, the drive will show up in Windows again: And we can modify our drive or flash the original firmware again. If not, your PC will shut down— try harder next time. Final Thoughts The Bad USB is a very powerful tool if you have access to your victim's PC, even though Windows can be crap at loading the USB drivers. In addition, it avoids AV detection since it is a keyboard rather than a virus. If you're considering to do a simple pretext to insert our USB into one PC at the company of your choice, please note to have a real USB flash drive for the case that you will most likely get caught, so you can escape easily. Furthermore, I would like to mention that I really appreciate constructive feedback from you guys. So feel free to PM me if you find any mistake or want me to improve something! Related Ah, I do know how precise and careful you are. Well done, easy to follow and gives a good first impact. Also like the fact that you included further insights on the hardware side, I should try this out some time. Also, notes about details really show how much you out yourself into it. Hope you'll be able to tell us more about your experience. When I saw this exploit on github I almost immediately checked all my USB flash drives for the supported controller. I had one, but because I didn't want to sacrifice it I ordered another one from the known supported devices list. In the end I accidentally flashed the first USB flash drive, because windows changed the drive letters. Finding and downloading all the required tools took a bit of effort, but building and executing everything went smoothly. It was also fun showing the Bad USB to my friends, even thought they didn't find it particularly funny when their pc shut down. I also want to mention that since I love photography as much as hacking I enjoyed taking the pictures for this article. Please share your experience as well when you decide to try this out : Reply FATAL: System. InvalidOperationException: Header not accepted at DriveCom. Can you give some marks on which pins should i connect? My base language isn't english so i a little bit confused bout how u wrote here, sory : Reply Hey I bought a 16Gb version of the USB you used. I found out that this had a 2307 microcontroller, which I think should work according to github. After hours of trying to write the firmware I had to give up because it generates an error at switching to boot mode. Would it work if short circuit the pins? Reply Hi First off, I've been a frequent visitor of your wonderful and informative site, only this is first time I am writing. Okay, about the badusb walkthrough above, I have two questions. Will this USB work? I downloaded the repos but still the DriveCom is in. How can I change it to exe as shown above? Many thanks, Marry Xmas! Reply When I try to run build. Is there some workaround or do I need to do something else? Maybe it just wont work with Windows 10 anymore? I have not tested on other machines yet. I was not able to get BN03V117M to work.
