Arduboy Rubber Ducky

#1

Just as a heads up the Arduboy like every other Leonardo can emulate a keyboard when it is connected to your pc.

I wrote a quick example that opens the windows console when you press the a button.

#include <Arduboy2.h>
#include "Keyboard.h"

Arduboy2 arduboy;

const unsigned char duck[] PROGMEM = {
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x80, 0x70, 0x88,
  0x04, 0x04, 0x14, 0x04, 0x88, 0xb0, 0xa0, 0xa0, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x20, 0x26, 0xa9, 0xb1, 0xa0, 0xa0, 0xa0, 0xa0,
  0xa1, 0xa1, 0xa1, 0xa1, 0xa0, 0xa0, 0x30, 0x30, 0x09, 0x86, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00,
  0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x02, 0x02, 0x02, 0x02,
  0x0a, 0x0a, 0x2a, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00,
};

byte screen = 0;

void setup() {
  arduboy.boot();
  arduboy.display();
  arduboy.flashlight();
  arduboy.systemButtons();
  arduboy.audio.begin();
  arduboy.setFrameRate(30);
  arduboy.initRandomSeed();
}

void loop() {
  if (!(arduboy.nextFrame())) {
    return;
  }
  
  
  arduboy.pollButtons();
  arduboy.clear();

  if (screen == 0) {
    arduboy.drawBitmap(48, 16, duck, 32, 32, WHITE);
      if (arduboy.justPressed(A_BUTTON)) {
      Keyboard.begin();
      Keyboard.press(KEY_LEFT_GUI);
      Keyboard.press('r');
      Keyboard.releaseAll();
      delay(100);
      Keyboard.print("cmd");
      Keyboard.press(KEY_RETURN);
      Keyboard.releaseAll();
      Keyboard.end();
    }
  }
  arduboy.display();
}

void typeKey(int key)
{
  Keyboard.press(key);
  delay(50);
  Keyboard.release(key);
}


//Key  Hexadecimal value Decimal value
//KEY_LEFT_CTRL 0x80  128
//KEY_LEFT_SHIFT  0x81  129
//KEY_LEFT_ALT  0x82  130
//KEY_LEFT_GUI  0x83  131
//KEY_RIGHT_CTRL  0x84  132
//KEY_RIGHT_SHIFT 0x85  133
//KEY_RIGHT_ALT 0x86  134
//KEY_RIGHT_GUI 0x87  135
//KEY_UP_ARROW  0xDA  218
//KEY_DOWN_ARROW  0xD9  217
//KEY_LEFT_ARROW  0xD8  216
//KEY_RIGHT_ARROW 0xD7  215
//KEY_BACKSPACE 0xB2  178
//KEY_TAB 0xB3  179
//KEY_RETURN  0xB0  176
//KEY_ESC 0xB1  177
//KEY_INSERT  0xD1  209
//KEY_DELETE  0xD4  212
//KEY_PAGE_UP 0xD3  211
//KEY_PAGE_DOWN 0xD6  214
//KEY_HOME  0xD2  210
//KEY_END 0xD5  213
//KEY_CAPS_LOCK 0xC1  193
//KEY_F1  0xC2  194
//KEY_F2  0xC3  195
//KEY_F3  0xC4  196
//KEY_F4  0xC5  197
//KEY_F5  0xC6  198
//KEY_F6  0xC7  199
//KEY_F7  0xC8  200
//KEY_F8  0xC9  201
//KEY_F9  0xCA  202
//KEY_F10 0xCB  203
//KEY_F11 0xCC  204
//KEY_F12 0xCD  205

This can be abused for example when you have uploaded a malicious game and connect your arduboy to your pc to upload another game.

Of course you can als use this to have some fun and control your pc with your Arduboy :slight_smile:

EDIT: please do not do anything bad with this information

3 Likes
#2

I thought it was a debugging tool.

1 Like
#3

I guess it could be used that way.
I just got interested in the Rubber Ducky this day and found out that the Arduboy also has this capability and had to think back to all those times in the past when I connected my Arduboy to my pc when I had someone elses code on it.
I am probably just being paranoid but I felt like it should atleast be mentioned in the forum.

#4

I believe #include "Keyboard.h" should be #include <Keyboard.h> if Keyboard is the external keyboard library I’m assuming it is.

The former will still work as long as nobody makes a local Keyboard.h file,
but generally you should use <> for external libraries.

Thankfully nobody has done this so far.

But it’s one of the reasons why I always compile from source,
and I never play a game if the source code isn’t available.

If anybody actually did make a malicious program,
they wouldn’t just be facing a ban from the forum,
they’d also probably be facing legal proceedings.

You might actually want to mention what that is. I for one had to look it up.

Also it uses an Atmel chip, so it’s plausible that it might also be an ATmega32u4 like the Arduboy.
(ATmega32u4 is the chip model, ‘Leonardo’ refers to Arduino’s specific board using the chip.)

It has been mentioned before eons ago:

And of course, for less malicious things:

#5

That’s exactly what I think of when I read Rubber Ducky… A script kiddie’s lame ass tool for trying to do malicious stuff.

1 Like
#6

this reminds me of the “teacher key” and stuff

My friend have this Razer Naga mouse (fancy stuff) with 12 function keys on the side. He assign stuff (like Alt+Tab and Alt + F4) to it so when teacher come to have a look he can just use his thumb and nudge one or two of the buttons on the side

I might add this function to my stuff…

1 Like