Storage Activity

Overview
Storage activity is an experimental feature which may be used to detect whether or not the storage device, when using ATTACKMODE STORAGE is in use. This can be helpful when performing USB exfiltration. It can also be used to determine whether the storage device has been activated, useful for VID and PID enumeration.
Results may vary greatly depending on target OS. Some operating systems may keep storage active for an exceptionally long time.
WAIT_FOR_STORAGE_ACTIVITY
The WAIT_FOR_STORAGE_ACTIVITY command blocks all further payload execution until activity on the USB Rubber Ducky storage has been detected.
Example
REM Example WAIT_FOR_STORAGE_ACTIVITY Payload
​
ATTACKMODE HID STORAGE
DELAY 2000
LED_OFF
STRINGLN Waiting for the disk to be read from or written to...
$_STORAGE_ACTIVITY_TIMEOUT = 10000
WAIT_FOR_STORAGE_ACTIVITY
LED_OFF
LED_R
Result
The LED will light red after storage activity has been detected.
WAIT_FOR_STORAGE_INACTIVITY
The WAIT_FOR_STORAGE_INACTIVITY command blocks all further payload execution until the storage device is determined to be inactive.  
Example
REM Example WAIT_FOR_STORAGE_INACTIVITY Payload
​
ATTACKMODE HID STORAGE
DELAY 2000
LED_OFF
​
GUI r
DELAY 100
STRING powershell "$m=(Get-Volume -FileSystemLabel 'DUCKY').DriveLetter;
STRINGLN echo $env:computername >> $m:\computer_names.txt" 
​
$_STORAGE_ACTIVITY_TIMEOUT = 10000
WAIT_FOR_STORAGE_INACTIVITY
LED_OFF
LED_R
Result
The LED will light red when the storage device becomes inactive.
​
Internal Variables
The following internal variables relate to storage activity and may be used in your payload for advanced functions.
$_STORAGE_ACTIVITY_TIMEOUT
As payload is running, this value decrements if storage activity is not detected.
Default value is 1000.
​

Last modified 1yr ago