DuckyScript for Packet Squirrel
DuckyScript is the payload language of Hak5 gear.
Originating on the Hak5 USB Rubber Ducky as a standalone language, the Packet Squirrel uses DuckyScript commands to bring the ethos of easy-to-use actions to the payload language.
DuckyScript commands are always in all capital letters to distinguish them from other system or script language commands. Typically, they take a small number of options (or sometimes no options at all).
Payloads can be constructed of DuckyScript commands alone, or combined with the power of bash scripting and system commands to create fully custom, advanced actions.
While the Packet Squirrel supports multiple languages for payloads (such as Python), all example use of the DuckyScript commands will be shown using a bash based payload. For other, custom payloads, the DuckyScript commands should be executed as system commands.
Ducky Script commands for the Packet Squirrel include:
| Command | Documentation | Description |
|---|---|---|
BUTTON | button.md | Pauses the payload for the specified number of seconds or until the button is pressed. |
C2EXFIL | c2exfil.md | Send a file via Cloud C² |
C2NOTIFY | c2notify.md | Send a notification via Cloud C² |
C2WATCHDIR | c2watchdir.md | Watch for new files in a directory and automatically send them to Cloud C² |
DYNAMICPROXY | dynamicproxy.md | Create a dynamic man-in-the-middle TCP proxy to intercept traffic in NAT and BRIDGE modes. |
KILLPORT | killport.md | Kill any traffic seen on one or several ports by injecting TCP RST packets. |
KILLSTREAM | killstream.md | Kill any streams on or several ports by injecting TCP RST packets. |
LED | led.md | Control the RGB LED on the front of the Packet Squirrel; parameters include color and pattern. |
MATCHPORT | matchport.md | Pause the payload until traffic is matched on one or more ports. |
MATCHSTREAM | matchstream.md | Pause the payload until traffic matching a regular expression is seen. |
NETMODE | netmode.md | Set the network mode of the Packet Squirrel. |
SELFDESTRUCT | selfdestruct.md | Wipe the Packet Squirrel internal storage and attached USB, and reboot into lockdown mode with transparent bridging only. |
SSH_START | ssh_start.md | Launch the SSH server |
SSH_STOP | ssh_stop.md | Stop the SSH server |
SPOOFDNS | spoofdns.md | Overwrite DNS queries |
SWITCH | switch.md | Reports the current switch position. (This is NOT necessarily the payload currently running, if the switch was moved after boot!) |
UI_START | ui_start.md | Launch the Packet Squirrel web UI |
UI_STOP | ui_stop.md | Stop the Packet Squirrel web UI |
USB_FREE | usb_free.md | Return how much USB storage is available, in bytes |
USB_STORAGE | usb_storage.md | Detect if USB storage is present |
USB_WAIT | usb_wait.md | Wait until USB storage is attached |
A simple payload
As an extremely simple demo of payload capabilities, this payload sets the LED color, waits for a button press, then changes the LED color:
#!/bin/bash
NETMODE NAT
LED C SINGLE
BUTTON
LED B TRIPLE