rubber_duck_macos.py

# Rubber Ducky

# http://www.math.harvard.edu/computing/macintro/keys.html
# use command-H to close a bunch of windows
# use command-Shift to launch search finder thingy
# type 'terminal'  is there a way to launch it hidden?
# command-N for new terminal window in case another is up
# type whatever the heck we want in the terminal
# e.g., use curl to download an image file or script
# curl -o ~/Desktop/image.png https://www.python.org/static/apple-touch-icon-144x144-precomposed.png
# change the background
# hide all windows
# https://lifehacker.com/set-your-macs-wallpaper-with-a-terminal-command-1728551470
# osascript -e 'tell application "System Events" to set picture of every desktop to ("/Users/admin/Pictures/jepChewbaccaWorkshop.jpg" as POSIX file as alias)'
# photo booth: https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payload---OSX-Photo-Booth-Prank

# TO DO: add a jumper that prevents payload injection while programming!

from digitalio import DigitalInOut, Direction, Pull
import board
import time
from adafruit_hid.keyboard import Keyboard
from adafruit_hid.keycode import Keycode
from adafruit_hid.keyboard_layout_us import KeyboardLayoutUS
# be sure you have proper version of adafruit_hid library for your CPy
# The button pins we'll use, each will have an internal pullup
buttonpins = [board.D2, board.D1, board.D0]
# our array of button objects
buttons = []
# The keycode sent for each button, will be paired with a control key
buttonkeys = [Keycode.SPACE, Keycode.H, "Hello World!\n"]
controlkey = Keycode.GUI  # this is the command key on Mac OS
# Keycode.ALT may be the Mac OS option key...

# the keyboard object!
kbd = Keyboard()
# we're americans :)
layout = KeyboardLayoutUS(kbd)

# make all pin objects, make them inputs w/pullups
for pin in buttonpins:
    button = DigitalInOut(pin)
    button.direction = Direction.INPUT
    button.pull = Pull.UP
    buttons.append(button)

led = DigitalInOut(board.D13)
led.direction = Direction.OUTPUT

payload_delivered = 0  # keep track of run state

#  Delay a moment after insertion to make sure things settle down
time.sleep(8)

#  print("Keyboard Injection Payload...")
pause = 0.25

def launch_terminal():
    # open finder search
    kbd.press(Keycode.GUI, Keycode.SPACE)  # the macos command key, aka "GUI"
    # print("command-space search keys pressed... ")
    kbd.release_all()
    # print("released... ")
    time.sleep(pause)  # short delay

    # open terminal
    layout.write("terminal")
    # layout.write("terminal\n")  # or, do it all in one go with this
    # print("terminal typed... ")
    time.sleep(pause)

    kbd.press(Keycode.ENTER)
    kbd.release_all()
    # print("ENTER pressed")
    time.sleep(pause)

    kbd.press(Keycode.GUI, Keycode.N)  # command-N new terminal window, in case
    # terminal was already open
    kbd.release_all()
    # print("command-n new terminal window... ")
    time.sleep(pause)

    # say Hello
    layout.write("say \'Hello friend\' -i -r 20")
    time.sleep(pause)
    kbd.press(Keycode.ENTER)
    kbd.release_all()
    time.sleep(5)

    layout.write("clear")
    time.sleep(pause)
    kbd.press(Keycode.ENTER)
    kbd.release_all()
    time.sleep(2)

def download_image():
    # run this after running 'launch_terminal'
    layout.write("cd ~/Desktop")
    time.sleep(pause)
    kbd.press(Keycode.ENTER)
    kbd.release_all()

    layout.write("ls")
    time.sleep(pause)
    kbd.press(Keycode.ENTER)
    kbd.release_all()
    time.sleep(pause)

    #this says where to save image, and where to get it
    layout.write('curl -o ~/Desktop/hackimage.jpg https://cdn-learn.adafruit.com/guides/images/000/001/718/medium800/3501_top_lit_demo_ORIG.jpg')
    time.sleep(pause)
    kbd.press(Keycode.ENTER)
    kbd.release_all()

    time.sleep(6)  # this needs to go away once I figure out how to check for finished download

    print("done sleeping... ")

    # set permissions so image can be made a bacground
    layout.write('chmod 777 hackimage.jpg')
    time.sleep(pause)
    kbd.press(Keycode.ENTER)
    kbd.release_all()


def replace_background():
    # run this after download_image (which ran after launch_terminal)
    # it uses actionscript to change the background
    # layout.write('osascript -e \'tell application \"System Events\" to set picture of every desktop to (\"~/Desktop/image.png\" as POSIX file as alias)\'')
    layout.write('osascript -e \'tell application \"System Events\" to set picture of every desktop to (POSIX path of (path to home folder) & \"/Desktop/hackimage.jpg\" as POSIX file as alias)\'')
    time.sleep(pause)
    kbd.press(Keycode.ENTER)
    kbd.release_all()
    time.sleep(4)

    # refresh
    layout.write('killall Dock')
    time.sleep(0.5)
    kbd.press(Keycode.ENTER)
    kbd.release_all()
    time.sleep(3)  # give it a moment to refresh dock and BG

def hide_everything():
    # print("Hiding stuff... ")
    kbd.press(Keycode.F11)

    time.sleep(10)
    kbd.release_all()
    '''
    for h in range(60):
        kbd.press(Keycode.GUI, Keycode.H)
        kbd.release_all()
        time.sleep(0.1)'''

# check for presence of jumper from GND to D2
if buttons[0].value is False:
    print("jumpered safely")

if buttons[0].value is True and payload_delivered is 0:
    print("release the bees")
    time.sleep(2)
    launch_terminal()
    time.sleep(2)
    download_image()
    time.sleep(2)
    replace_background()
    hide_everything()

    payload_delivered = 1