Log Keystrokes In LIVE Time!! | DucKeyhook USB Rubber Ducky Payload

[@IamJakoby]

This is what I like to see!

[@CosmodiumCS]

@I am Jakoby hahaha appreciate it!! This is an old video that i only now uploaded. So unfortunately your discord function didn’t exist yet😭. So i will def make an updated version!!💚

[@virusvirus1484]

@@CosmodiumCS Hi can you make one that records keystrokes onto a text tile in a secret location in the computer? What happen if computer is not connected to internet? All your previous keyloggers won't work if there is no internet.

[@Echownz]

Amazing guide thank you!

[@andrewkimery7056]

Finally got a minute to try this out but before i do i have to ask does this require admin privileges on the target machine or will a new guest account outside of admin group be fine for a quick test?

[@PenAce]

Nice work bro!

[@CosmodiumCS]

Thank ya!!

[@IntrestedInPy]

And it not sending the logs automatically, I have to run c.cmd and it sends whole logs that it stored once

[@laurentiumocacoca175]

Does the discord Webhook still work like that?

[@CosmodiumCS]

It should, havent touched the project in a while tho

[@infinit3i]

love the idea!

[@CosmodiumCS]

Appreciate it ha! I’ll probably make some updates to it sometime soon

[@douwedidi]

I don't have a Rubber Ducky but I do have an Arduino micro pro. The way I'm thinking of doing it is I plug in a USB with the files and then the Arduino micro with the payload. So my question is, can 'L' be any storage device? So in this case, can it be my other USB?

[@CosmodiumCS]

yea totally, but you are probably better off modifying the payload to download the files off the internet and execute them onto the system, rather than loading them from a device. it'd make your execution flow quicker

[@douwedidi]

@@CosmodiumCS thank you very much for your reply

[@fbifa9717]

Would you be able to edit the payload so that on the newest rubber ducky the v3 with ducky script 3.0 just set the attack mode to hid and storage mode and then once it is done moving files it would switch back to hid mode instead of twin duck firmware?

[@CosmodiumCS]

Yep 👍

[@Kaotix_music]

I just tested this myself, just put "ATTACKMODE HID STORAGE" at the top of the payload and then at the end if you want it to go back into HID mode, just put a line after the payload that says "ATTACKMODE HID" and its right back to HID mode

[@eighteendelta8101]

Whenever I follow the link to the Twin-Duck firmware page it pops up with a 404 error is there still a way I would be able to download it?

[@CosmodiumCS]

i put it on the maldna repository :) github.com/CosmodiumCS/MalwareDNA/tree/main/rubberducky/ducky-flasher

[@alexvanhoboken]

thanks, nice demo. however even the simplest virus scanners will block the execution. Is there a way to prevent that from happening?

[@CosmodiumCS]

yes exactly, this was meant to be a PoC to showcase what is possible. to avoid it from being detected, try working on different obfuscation methods or AV evasion. maybe something other than powershell

[@3rjx800]

The logger doesn’t work for me. I did every step but somehow it doesn’t send the logs into my discord server.

[@IntrestedInPy]

I'm using Raspberry pi pico instead of Rubber ducky because I can not find Ducky in my country, so I wanted to know what does exactly TwinDuck does on the Ducky ? Do I need to follow that step ?

[@Derek-ve6ch]

Hey, great videos but I wanted to ask if this still works? I just tried it a couple times but it doesn't seem to work for me? When it executes PowerShell the commands just give errors before it closes down and nothing happens?

[@CosmodiumCS]

It works, but AV has certainly built detections for it by now (as it should) ha!

[@faresremmouche4307]

​@@CosmodiumCSdo you know any new or updated ways to make a keylogger using it??

[@CosmodiumCS]

@@faresremmouche4307 yeah u can try obfuscating the code more, or u can make one and send the logs with the discord api

[@Derek-ve6ch]

@@CosmodiumCS do you have a tutorial or can recommend anyone who has a payload for a working keylogger? Even if it saves it to the USB. I'm still new in ethical hacking.

[@AT-ci5bb]

Would love to see this for Mac

[@3rjx800]

Great video 👍👍

[@CosmodiumCS]

Appreciate it brotha :D

[@3rjx800]

is twin duck still needed with the new "ATTACKMODE HID STORAGE" that let's the rubber ducky function both as keyboard and flashdrive

[@CosmodiumCS]

Nope 👍

[@gerwinperez4960]

it is possible to inject it with flipper zero?

[@CosmodiumCS]

yes, but you would have to modify the code

[@douwedidi]

hey so i was finally able to try it with my new arduino, i changed the script so the files would get downloaded from the internet and it works. Altough the logged keys do not get sent to the discord webhook. Ill try to check out what goes wrong and ill let you know

[@CosmodiumCS]

Dude…this is easily one of the best comments i have ever received!! Not only did u take the initiative to figure out the problem urself (instead of asking me the obvious), you are also tackling the new error at hand. If you need any help you are more than welcome to reach out to me on discord

[@douwedidi]

@@CosmodiumCS thank you! I think I might've found the issue, not sure though. I posted about it in the question channel in your discord :D

[@claudio1206z]

@@douwedididid the win defender blocked it?

[@douwedidi]

@@claudio1206z i dont think so, i added the files to allowed threats

[@claudio1206z]

@@douwedidi hmm thats nice u using a digispark?

[@computeroid6162]

Windows Defender seems to detect it :( (windows 11) I think I'll just run a windows defender deactivator script before hand

[@scrappycoco3641]

did u get it working?

[@luismarrero9293]

Great Cosmo good video. We the novice appreciate your effort making quality content. I wonder if any way we can copy files or password back to the rubber ducky , once it is flash to the twin firmware,? like copy the wifi password for example without using webhook or any server, thanks

[@CosmodiumCS]

Hey thanks!! Yes, using twinduck or the new usb rubberducky with built in storage access, you can have the creds be saved straight to the ducky's storage 🔥

[@luismarrero9293]

@@CosmodiumCS could you make. Short A video about it please

[@CosmodiumCS]

@luismarrero9293 yeah i covered it a little while ago 👍, you can check out this video: kzbin.info/www/bejne/l6CWY3WJbcuql68

[@hack-talk9098]

We are waiting for more tutorials on rubber ducky and wifi pineapple

[@Jeremy-uo3tf]

Couldn’t discord itself be a vulnerability, I thought about that as-well but you’d be putting yourself at risk if anyone ever used this illegitimately

[@CosmodiumCS]

Why would you use this illegitimately?😉

[@неотмирасего-в5з]

если честно, вообще ничего не работает

[@funkymonk2254]

Thanks Blue. 💻🪓

[@CosmodiumCS]

Hahahahah, always😝