KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#developer-tools #typescript #codex #ai-agents #claude-code #dsh #dsh-plugin #cli #macos #ai-agent #deepseek-harness #open-source

WiFi-password-stealer

★ 598 Open GitHub ↗

Simple Windows and Linux keystroke injection tool that exfiltrates stored WiFi data (SSID and password).

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<img width="150" align="right" src="./resources/wifi-stealer_logo.png"></img>
# WiFi password stealer
[![License: GPL v2](https://img.shields.io/badge/license-GPL_v2-blue.svg)](https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html)
![](https://img.shields.io/github/v/release/AleksaMCode/WiFi-password-stealer)
![](https://img.shields.io/github/downloads/AleksaMCode/WiFi-password-stealer/total.svg)

Have you ever seen a movie where a hacker plugs a seemingly ordinary USB drive into a computer and instantly steals data? Today, you'll be building a device that does exactly that.

> :warning: **Disclaimer**: All content in this project is intended for security research purposes only.

## Table of contents
- [WiFi password stealer](#wifi-password-stealer)
  - [Table of contents](#table-of-contents)
  - [Introduction](#introduction)
  - [Setup](#setup)
    - [Prerequisites](#prerequisites)
  - [Rubber Ducky attack](#rubber-ducky-attack)
    - [Requirements - What you'll need](#requirements---what-youll-need)
    - [Keystroke injection tool](#keystroke-injection-tool)
      - [Keystroke injection](#keystroke-injection)
      - [Delays](#delays)
    - [Exfiltration](#exfiltration)
      - [Windows exploit](#windows-exploit)
        - [Sending stolen data over email](#sending-stolen-data-over-email)
      - [Linux exploit](#linux-exploit)
        - [Storing stolen data to USB flash drive](#storing-stolen-data-to-usb-flash-drive)
        - [Bash script](#bash-script)
        - [Quick overview of the payload](#quick-overview-of-the-payload)
      - [Exfiltrated data formatting](#exfiltrated-data-formatting)
    - [USB Mass Storage Device Problem](#usb-mass-storage-device-problem)
    - [Payload Writer](#payload-writer)
  - [Bash Bunny attack](#bash-bunny-attack)
  - [Limitations/Drawbacks](#limitationsdrawbacks)
  - [References](#references)

## Introduction
In the summer of 2022, I set out to build a device capable of extracting data from a target computer. But how exactly does one deploy malware and exfiltrate information? In the following sections, I’ll walk through the essential steps, underlying concepts, and technical nuances involved in creating a custom keystroke injection tool. While this project specifically targets WiFi credentials, the payload can easily be modified for more advanced or malicious purposes—the only real limits are your creativity and technical expertise.

## Setup
Over time, the project has grown to include a wide variety of scripts and tools. It was originally created to demonstrate the capabilities of a Rubber Ducky—specifically, a cost-effective version using the Raspberry Pi Pico (RPi Pico). Currently, the two main components of the project are:

<ol>
 <li>Rubber Ducky attack</li>
 <li>Bash Bunny attack
 </li>
</ol>

### Prerequisites
<ul>
<li>Physical access to the unlocked victim's computer.</li>
<li>The computer has to have internet access in order to send the stolen data using <a href="https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol">SMTP</a> for exfiltration over a network medium.</li>
<li>Knowledge of the victim's computer password for the Linux exploit.</li>
</ul>

## Rubber Ducky attack

After creating a pico-ducky, you only need to copy the modified payload (adjusted for your SMTP details for the Windows exploit and/or adjusted for the Linux password and a USB drive name) to the RPi Pico.

### Requirements - What you'll need
<img src="./resources/RPi-pico.png?raw=true" width="150" title="RPi pico illustration" align="left" hspace="5" vspace="5">
 
<ul>
<li>RPi Pico</li>
<li>Micro USB to USB Cable</li>
<li>Jumper Wire (optional)</li>
<li>pico-ducky: Transformed RPi Pico into a USB Rubber Ducky</li>
<li>USB flash drive (for the exploit over a physical medium only)</li>
</ul>

> [!NOTE]
> <ul><li>It is possible to build this tool using the Rubber Ducky, but keep in mind that <a href="https://www.raspberrypi.com/products/raspberry-pi-pico/">RPi Pico</a> costs about $4.00 and the <a href="https://shop.hak5.org/products/usb-rubber-ducky">Rubber Ducky</a> costs $80.00.</li>
> <li>However, while pico-ducky is a good and budget-friendly solution, Rubber Ducky does offer things like stealthiness and usage of the latest DuckyScript version.</li>
> <li>In order to use Ducky Script to write the payload on your RPi Pico, you first need to convert it to a pico-ducky. Follow these <a href="https://github.com/dbisu/pico-ducky">simple steps</a> in order to create pico-ducky.</li>
> </ul>

### Keystroke injection tool
A keystroke injection tool, once connected to a host machine, executes malicious commands by running code that mimics keystrokes entered by a user. While it looks like a USB drive, it acts like a keyboard that types in a preprogrammed payload. Tools like Rubber Ducky can type over 1,000 words per minute. Once created, anyone with physical access can deploy this payload with ease.

#### Keystroke injection
The payload uses <code>STRING</code> command to processes injection keystrokes. It accepts one or more alphanumeric/punctuation characters and will type the remainder of the line exactly as-is into the target machine. The <code>ENTER</code>/<code>SPACE</code> will simulate a press of keyboard keys.

#### Delays
We use <code>DELAY</code> command to temporarily pause execution of the payload. This is useful when a payload needs to wait for an element, such as a Command Line, to load. Delay is useful when used at the very beginning, when a new USB device is connected to a targeted computer. Initially, the computer must complete a set of actions before it can begin accepting input commands. In the case of <a href="https://en.wikipedia.org/wiki/Human_interface_device">HIDs</a> setup time is very short. In most cases, it takes a fraction of a second because the drivers are built-in. However, in some instances, a slower PC may take longer to recognize the pico-ducky. The general advice is to adjust the delay time according to your target.

### Exfiltration
Data exfiltration is the unauthorized transfer of data from a computer/device. Once the data is collected, an adversary can package it to avoid detection while sending data over the network using encryption or compression. Two most common ways of exfiltration are:
<ul>
<li>Exfiltration over the network medium.</li>
 <ul>
 <li>This approach was used for the Windows exploit. The whole payload can be seen <a href="https://github.com/AleksaMCode/WiFi-password-stealer/blob/main/payload/payload_windows.template.dd">here</a>.</li>
 </ul>
<li>Exfiltration over a physical medium.</li>
 <ul>
 <li>This approach was used for the Linux exploit. The whole payload can be seen <a href="https://github.com/AleksaMCode/WiFi-password-stealer/blob/main/payload/payload_linux.template.dd">here</a>.</li>
 </ul>
</ul>

#### Windows exploit
In order to use the Windows payload (<code>payload1.dd</code>), you don't need to connect any jumper wire between pins.

##### Sending stolen data over email
Once passwords have been exported to the <code>.txt</code> file, payload will send the data to the appointed email using Yahoo SMTP. For more detailed instructions, visit the following <a href="https://github.com/AleksaMCode/university-notices-email-notifier#yahoo-smtp">link</a>. Also, the payload template needs to be updated with your SMTP information, meaning that you need to update <code>RECEIVER_EMAIL</code>, <code>SENDER_EMAIL</code>, and your email <code>PASSWORD</code>. In addition, you could also update the body and the subject of the email.

https://github.com/AleksaMCode/WiFi-password-stealer/blob/25cf7c56a7df4a9811b4d3eab8d6e6dad4282055/payload/payload_windows.template.dd#L31

> [!NOTE]
> <ul>
> <li>After sending data over the email, the <code>.txt</code> file is deleted.</li>
> <li>You can also use an SMTP from another email provider, but you should be mindful of the SMTP server and port numbers you will write in the payload.</li>
> <li>Keep in mind that some networks could be blocking the usage of an unknown SMTP at the firewall.</li>
> </ul>
>

#### Linux exploit
In order to use the Linux payload (<code>payload2.dd</code>) you need to connect a jumper wire between <code>GND</code> and <code>GPIO5</code> in order to comply with the code in <a href="https://github.com/dbisu/pico-ducky/blob/main/duckyinpython.py"><code>code.py</code></a> on your RPi Pico. For more information about how to setup multiple payloads on your RPi Pico, visit this <a href="https://github.com/dbisu/pico-ducky#multiple-payloads">link</a>.

<img
src="./resources/linux-mint_exploit.gif"
alt="Exploit on Linux Mint"
width="100%"
class="center"
/>

 <label>Fig. 1: Exploit on Linux</label>

##### Storing stolen data to USB flash drive
Once passwords have been exported from the computer, data will be saved to the designated USB flash drive. In order for this payload to function properly, it needs to be updated with the correct name of your USB drive, meaning you will need to replace <code>USBSTICK</code> with the name of your USB drive in two places.

https://github.com/AleksaMCode/WiFi-password-stealer/blob/25cf7c56a7df4a9811b4d3eab8d6e6dad4282055/payload/payload_linux.template.dd#L3

https://github.com/AleksaMCode/WiFi-password-stealer/blob/25cf7c56a7df4a9811b4d3eab8d6e6dad4282055/payload/payload_linux.template.dd#L11

In addition, you will also need to update the Linux <code>PASSWORD</code> in the payload in three places. As stated above, in order for this exploit to be successful, you will need to know the victim's Linux machine password, which makes this attack less plausible.

https://github.com/AleksaMCode/WiFi-password-stealer/blob/a90ffb208e6a09d1b0ae44d1afe81d82248ba3fe/payload/payload_linux.template.dd#L7

https://github.com/AleksaMCode/WiFi-password-stealer/blob/a90ffb208e6a09d1b0ae44d1afe81d82248ba3fe/payload/payload_linux.template.dd#L9

##### Bash script
In order to run the <a href="https://github.com/AleksaMCode/WiFi-password-stealer/blob/main/scripts/wifi_passwords_print.sh"><code>wifi_passwords_print.sh</code></a> script you will need to update the script with the correct name of your USB stick after which you can type in the following command in your terminal:

```bash
echo PASSWORD | sudo -S sh wifi_passwords_print.sh USBSTICK
```

where `PASSWORD` is your account's password and `USBSTICK` is the name for your USB device.

##### Quick overview of the payload
NetworkManager is based on the concept of connection profiles, and it uses plugins for reading/writing data. It uses <code>.ini-style</code> keyfile format and stores network configuration profiles. The keyfile is a plugin that supports all the connection types and capabilities that NetworkManager has. The files are located in /etc/NetworkManager/system-connections/. Based on the keyfile format, the payload uses the <code>grep</code> command with regex in order to extract data of interest. For file filtering, a modified positive lookbehind assertion was used (<code>(?<=keyword)</code>). While the positive lookbehind assertion will match at a certain position in the string, <a href="https://en.wikipedia.org/wiki/Viz.">sc.</a> at a position right after the keyword without making that text itself part of the match, the regex <code>(?<=keyword).*</code> will match any text after the keyword. This allows the payload to match the values after SSID and psk (<a href="https://en.wikipedia.org/wiki/Pre-shared_key">pre-shared key</a>) keywords.

For more information about NetworkManager here is some useful links:

- [Manually creating NetworkManager profiles in keyfile format](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/assembly_networkmanager-connection-profiles-in-keyfile-format_configuring-and-managing-networking#proc_manually-creating-a-networkmanager-profile-in-keyfile-format_assembly_networkmanager-connection-profiles-in-keyfile-format)
- [Description of keyfile settings plugin](https://developer-old.gnome.org/NetworkManager/stable/nm-settings-keyfile.html)

#### Exfiltrated data formatting
Below is an example of the exfiltrated and formatted data from a victim's machine in a <code>.txt</code> file.

https://github.com/AleksaMCode/WiFi-password-stealer/blob/f5b3b11328764eb07d765a210fbf25db3a828455/resources/wifi_pass.txt#L1-L5

### USB Mass Storage Device Problem
One of the advantages of Rubber Ducky over RPi Pico is that it doesn't show up as a USB mass storage device once plugged in. Once plugged into the computer, all the machine sees it as a USB keyboard. This isn't a default behavior for the RPi Pico. If you want to prevent your RPi Pico from showing up as a USB mass storage device when plugged in, you need to connect a jumper wire between pin 18 (<code>GND</code>) and pin 20 (<code>GPIO15</code>). For more details visit this <a href="https://github.com/dbisu/pico-ducky#usb-enabledisable-mode">link</a>.

> :bulb: **Tip**:
> <ul>
> <li>Upload your payload to RPi Pico before you connect the pins.</li>
> <li>Don't solder the pins because you will probably want to change/update the payload at some point.</li>
> </ul>

### Payload Writer
When creating a functioning payload file, you can use the <a href="https://github.com/AleksaMCode/WiFi-password-stealer/blob/main/payload/writer.py"><code>writer.py</code></a> script, or you can manually change the template file. In order to run the script successfully you will need to pass, in addition to the script file name, a name of the OS (windows or linux) and the name of the payload file (e.q. <a href="https://github.com/AleksaMCode/WiFi-password-stealer/releases/latest/download/payload1.dd">payload1.dd</a>). Below you can find an example how to run the writer script when creating a Windows payload.

```bash
python3 writer.py windows payload1.dd
```

## Bash Bunny attack

With a few minor modifications, the previously used scripts can also be adapted to run on the Bash Bunny. The Bash Bunny works by emulating a trusted USB device [1]. For this project, we’ll configure it to emulate a flash storage device using the following command [1, 2]:

```
ATTACKMODE HID STORAGE
```

Using the DuckyScript <code>ATTACKMODE</code> command, we can define which type of device the Bash Bunny should emulate [1]. Each attack mode registers with the system using a unique USB Vendor ID (VID) and Product ID (PID) [1]. It's also possible to combine multiple attack modes by chaining them together.

<img
src="./resources/bash_bunny.jpg?raw=true"
alt="Bash Bunny plugged in a PC"
width="100%"
class="center"
/>

 <label>Fig. 2: Bash Bunny Mark I plugged in a PC</label>

The Bash Bunny supports the original DuckyScript commands, which is why I was able to reuse the script from the Rubber Ducky section. To use these commands inline, we need to prefix them with the <code>QUACK</code> command [1]. For example, instead of writing <code>WINDOWS r</code>, we write <code>Q WINDOWS r</code>.

To load payloads onto the Bash Bunny, the device must be set to arming mode (switch position 3—the one closest to the USB plug) [1]. Once connected, copy <code>payload.txt</code> and <code>exfil.txt</code> to either <code>payloads\switch1</code>. Payloads must be named <code>payload.txt</code> [1,2], while any supporting files referenced by the payload can be named freely.

For reference, the Bash Bunny mass storage directory structure is as follows [2]:

```
BashBunny/
├── loot/
│ └── (data exfiltrated from payloads will be saved here)
└── payloads/
 ├── library/
 │ └── (reusable scripts or modules)
 ├── switch1/
 │ ├── payload.txt
 │ └── (optional files, e.g., exfil.txt, scripts, etc.)
 └── switch2/
 ├── payload.txt
 └── (optional files)
```

 <label>Fig. 3: Bash Bunny Mass Storage Directory Structure</label>

Once the script has finished executing, the results will be saved in <code>loot\wifi_pass.txt</code>. If the target computer has no saved WiFi passwords, the file will be empty.

> [!NOTE]
> Since the Bash Bunny attack relies on a PowerShell script (<code>exfil.txt</code>), it can only be used on Windows systems. To use a similar approach on Linux, you'll need to modify the payload and replacing the PowerShell script with the Bash script referenced in the Linux section above.

## Limitations/Drawbacks
<ul>
<li><s>This pico-ducky currently works only on Windows OS.</s></li>
<li>This attack requires physical access to an unlocked device in order to be successfully deployed.</li>
<li>The Linux exploit is far less likely to be successful, because in order to succeed, you not only need physical access to an unlocked device, you also need to know the admins password for the Linux machine.</li>
<li>Machine's firewall or network's firewall may prevent stolen data from being sent over the network medium.</li>
<li>Payload delays could be inadequate due to varying speeds of different computers used to deploy an attack.</li>
<li>The pico-ducky device isn't really stealthy, actually it's quite the opposite, it's really bulky especially if you solder the pins.</li>
<li>Also, the pico-ducky device is noticeably slower compared to the Rubber Ducky running the same script.</li>
<li><s>If the <code>Caps Lock</code> is ON, some of the payload code will not be executed and the exploit will fail.</s></li>
<li>If the computer has a non-English Environment set, this exploit won't be successful.</li>
<li>Currently, pico-ducky doesn't support DuckyScript 3.0, only DuckyScript 1.0 can be used. If you need the 3.0 version you will have to use the Rubber Ducky. For this exploit version 3.0 isn't needed!</li>
</ul>

## References

1. [Bash Bunny by Hak5 Documentation](https://docs.hak5.org/bash-bunny/bash-bunny-by-hak5/)
2. [Bash Bunny Basics Wiki](https://wiki.bashbunny.com/#!index.md)

WiFi-password-stealer

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README