O.MG: From zero to hero

Key Takeaways

in a previous video which i've linked here and below i showed you how to use an omg cable to capture the wi-fi passwords from a laptop i demonstrated how i could send keystrokes to a laptop using one of these omg cables and get that laptop to send all of its passwords so all the ssids and passwords to a server hosted on the internet or in my example a cali virtual machine running on my mac now a lot of you asked me how i did that so in this video i'm going to show you step by step how to set up an omg cable now let me warn you this is going to be a very technical video i'm going to be going into a lot of detail on how to set up these omg cables from xero basically to a working payload in other words how to run a payload and launch an attack on a windows device as an example you don't have to use these just as windows devices you could use it with a mac as an example just depends on the payload that you run depends on the attack that you want to run but please note this is going to be a technical video it's going to be detailed i'm going to be running a kali linux server here i'm going to be running a python web server i'm going to be programming these cables to launch payloads now again it's a fairly technical video showing you how to set these up so it's going to be quite a long video you might want to use this menu to jump to a specific topic of interest or use the menu below so if you've already got the cable flashed you might want to jump to a different part of the video but i'm going to show you all the steps when i purchased these cables originally i found that there wasn't much documentation online showing you all the steps so i'm going to show you from basically you get the cable how do you set it up from beginning to end and i'll show you all those steps okay let's get started [Music] you can purchase the omg cables from hack 5. there are various cables such as the a lightning cable that i demonstrated so lightning to usba there's a usbc to usba micro usb to usba and you've got a cable programmer now in this example i've got the usba to lightning cable this is the cable that i demonstrated in my video so i plugged this into a windows laptop and manipulated the windows laptop this cable impersonates a keyboard and sends keystrokes to the laptop pretending to be a keyboard and that's how i managed to manipulate the laptop the lightning connection to the phone is just a decoy i wasn't doing anything on the phone a lot of people said but david i would never charge my iphone on a windows laptop i wouldn't plug my iphone into a laptop that was just a decoy the manipulation or the attack was done using the usb side of the cable now you may not decide to use an iphone cable but notice in this example i've also got a usba to usbc cable so this cable could also be used to launch the attack some people have said well david does it only apply to windows computers and the answer is no these cables pretend to be keyboards so they send keystrokes to a device which could be a mac could be a windows computer pretending to be a keyboard this is based on the original work done with the usb rubber ducky i'll demonstrate the usb rubber ducky in a separate video the usb rubber ducky as they say here looks like a thumb drive types like a keyboard so pretends to be a keyboard and will send keystrokes to a computer pretending to be a keyboard keyboards are often trusted so when you plug a keyboard into a laptop or a computer that device is often trusted and the keystrokes sent from these cables are trusted one of the things you will need to buy is the programmer you need the omg programmer you cannot program these cables without the programmer when they arrive they don't support access point mode or ap mode you have to configure them to run as an ap so that you can connect to the cable using another device and control the device remotely so you need to have both the programmer and the relevant cable that you want to buy so maybe you want to have the usba to usbc or the lightning cable etc so from a purchasing point of view you need to have at least one of these cables and you need to have the programmer device i'll once again demonstrate the usb rubber ducky in a separate video so we won't concern ourselves with that now but please note the omg cables are based on the usb rubber ducky so the commands used on all of these cables is the same so once you can program the usb rubber ducky you could program the omg cables and vice versa so i'll spend some time showing you the various scripts we'll start with a very basic script and then i'll show you more advanced scripts so again jump to the relevant point in this video if you want to skip some of the basics i'm going to use this usb cable because it's a brand new cable no configuration has been done on this cable yet i've previously configured this lightning cable with payloads and scripts so that's already been configured so i won't use that cable i'm going to use this usb cable now you need to plug this into the programming device so into the programmer and there you go and then you need to put this into a laptop to do the configuration now for this demonstration i'm going to be doing everything on this windows laptop most people use windows laptops so i'll use that for the demonstration but it still works if you want to use mac os or if you want to use linux so i'll plug this into the windows laptop and then i'm going to remotely control the windows laptop from my mac just makes it easier to do the recordings so all i need to do is plug it into the usb port on the laptop now that it's plugged in i can go to the url on the packaging so the url that they give us to configure the device is https omg lol setup and then we asked to select our cable type so they're different types of cables including a malicious cable detector a number of people have asked me so how do you stop this nonsense i notice there is a cable that they're producing to stop this kind of nonsense so i'm going to select the omg cable and that takes me to github so here's the link on github to get the firmware this was last edited about 14 days ago at the time of this recording and we told a little bit about the cable that it acts like a normal cable down to the millimeter so you wouldn't visually be able to see if there's any difference between this cable and other cables it behaves just like a normal cable supports high speed data transfer supports charging etc but and this is the important piece is that it allows you to perform key stroke injection attacks using an 802.11 wireless interface so again it supports ducky script payloads so if you have a rubber ducky same kind of scripts are used okay but that's enough of the documentation first thing we need to do is flash to the latest stable firmware so i'm going to open up another tab to go to that link and this was released about eight days ago so i'm going to get that latest release of firmware 1.5.2 in this example and save it to my local hard drive that's about 27 meg in size so i'll open that up so here's the zip file and what i'll do is extract the contents to my downloads directory okay so we have two directories now mac os or this directory i'll take this because i'm using windows and notice there's a flash 164 executable in the documentation we told that most computers will require a driver for the programmer to be detected i didn't have to do that so it was automatically detected by my computer but they do recommend that you install it you need to plug in the programmer to the computer and plug the cable into the program which i've done and then run one of these flashes so you can use the python script the official flashing utility so if you've got linux you could just use that you do need python 3.7 or higher you can use flash these are pre-made binaries for convenience most but not all environments should work fine with these if you have issues use the flash.py flasher that software has worked well for me in my previous testing so i'll run that double click on the flash dot win 64 executable windows complains that i didn't get the software from the windows store but i don't care about that i'm going to say install anyway and then i'm going to say yes to run the software and notice what it's doing it's detecting the serial port that the cable is connected to so scrolling up we can see the firmware version we can see that updates are available on github it cycles through this various serial ports and then it connects to the cable and then it says flash operation complete now you need to choose which wi-fi mode you want in my example i want it to act as an access point you won't be able to connect to the wireless access point on the cable until you configure it as a wireless access point and that's what i demonstrated previously that's probably what most people want to do but you can use it as a station so i'll press enter there wi-fi idle set to fbi like my demo and then i'll just set it to secure fbi 123 and what i'll do here is just take a copy of that so that i remember what i set it to you're obviously going to want to use something more secure than that but that's what i'll use for this demo press enter and as you can see patch success everything looks good writing to the cable all you need to do now basically is wait for the cable to be updated with this utility so just give it a little bit of time to update and there you go we told that operation has been completed we can see our details once again so i'll copy that to notepad just to have a backup and then we told that processfinish remove programmer and press enter to continue so i've removed the programmer from the laptop and then i can press enter to continue okay so cable has been updated and now we told to connect to the omg cable web ui in station mode you do it that way or in access mode you connect to this ip address so i'll connect the cable again without the programmer so on my mac i can search for wi-fi networks and i see the fbi network i need to put in my password so secure fbi123 obviously not a very good example but there you go and it's trying to connect to that network and there you go i've connected so now that i've connected to that network i can browse to 192.1684 so what i'm doing now is i'm connecting to the wi-fi network on that cable from my mac directly so through wi-fi to that cable and i could do the same with an iphone that's what i demonstrated in my previous video but in this example i've simply connected through my mac okay so now it's time to have some fun let's start with a very basic script in this example this script is simply going to open up notepad and write something so i'll copy the script to the omg cable i'll paste it in what i'll do is save the script you don't have to save the script but it does make it easier if you're out in the field and you simply want to launch a script very quickly rather than trying to paste it in it's ready to go and what i'll do now is run that script and what we should see is something happens on the windows laptop and as you can see there notepad opened up and some text was written very basic example so basically the omg cable is impersonating a keyboard it's sending keystrokes to the computer impersonating a keyboard okay that was very basic let's do something else so this script here and by the way i'll put all the links to the scripts below this video you can get a lot of these scripts if you search for rubber ducky scripts or have a look online but i'll put some links to the scripts that i used as the basis for what i'm doing here a lot of other guys have done the hard work and i've simply taken their scripts and then edited them to make it easier to use this one will open a browser and get the computer to browse to a certain website now one thing i'll tell you is that it loses connection to the wireless network when you run a script so on your computer you might have to connect back to it so i've connected back to the omg cable and you'll get something like this so what you might have to do is just make sure that you've connected back to the wi-fi network and then you need to refresh your browser so i've had to open another tab here to get it to work so just be aware that you lose your connection to the cable when you run a script you you just have to reconnect so i'll paste my second script in i'm going to save that to slot 2 so that's been saved so basically what we're going to do here is run chrome and then get it to browse to a specific url and then i'm going to use f11 to make it full screen so i'll click run and on the windows laptop we should see that chrome opens up and there you go and that the url is selected and that the screen is put to full screen i've stopped it being full screen but there you go i've managed to get it to open up a web browser and browse somewhere and that's really important because i can get it to browse and download malicious scripts i'll show you that in the rubber ducky demo that i do where i will get the computer to download stuff and i'll take remote control using a reverse shell on the computer but i'll show you now how i managed to get the computer to send me all the wi-fi passwords as i demonstrated in this video okay so to get to the computer to upload all of its wi-fi credentials to a web server i need a web server somewhere that can accept put commands this is a simple python script that allows me to run an http web server that once again accepts rest put commands i'm basically going to use rest commands to get to the windows laptop to put its configuration on a web server so i'm going to run this simple web server and i'm going to run it on port 80 rather than port 8080 as they've got it in this example again the scripts to all of this stuff is below this video so use the github links to download the scripts yourself so to run that i'm going to use sudo python simple http put server and the port number that i'm going to use is port 80. so that server is now running i'll open another window ip address of the server has been manually configured as the following 192.168.1.239 but what i've done is i've set up a dns server locally in my network to map the domain name the boss.lol to that ip address so on the windows laptop as an example if i open a command prompt and i ping the boss dot ll notice it resolves to that ip address 192.1681 239 which is my kali linux server now i'm running a pie hole server as my dns server locally here so all my devices are pointing to this dns server which allows me to block malicious domains and advertising and whatnot so under my local dns records on the server i've mapped that domain the boss.lol to this ip address now on this laptop the dns server is configured as that pi hole server so if i look at the wireless configuration of this laptop and look at ipv4 notice this is the dns server dhep in this network is allocating that as the dns server but if you resolve that domain name i actually own that domain name so you could just register a domain name and then point it somewhere so to apply publicly i've just done that locally in my local network but the boss.lol is actually my domain name that i registered and i could point that anywhere i've just done that so that people don't try and copy what i've done here so this device is going to send the wi-fi information to the kali linux server and put that in a temp file now this script i got from github it's a rubber ducky script it's basically going to run powershell and it's got some delays here and then it's going to use powershell to get all the pre-shed and export them into a directory so they're going to be put into this temp directory and then that's going to be copied to the web server so i mean i could copy this entire script rem is just comments so you could get rid of those i'll connect back to my omg cable and then open up a browser i'm using brave here so that sometimes causes problems but basically i can paste that script in i'll save it to slot 4 here just to be consistent with my previous video but there's the whole script now let's see it work so i'll run the script and what we should see is something happens on the windows laptop okay so windows did something something happened user's not quite sure what went on but the important piece now is on my kali linux server we can see that something happened so something happened here a windows device connected to our server and in cali now type ls here's the temp directory and if i unzip that temp directory there are all my wi-fi passwords on that laptop so all the wi-fi passwords from that laptop have been copied here and if i cat wi-fi my secure wi-fi network there is the ssid and there is the password now just in case you don't believe me i'm going to remove all the xml files and i'm going to remove that temp zip file so previously i had all these xml files and the zip file but they are all gone now so alice shows me that those files don't exist and what i'll do is connect back to the omg cable so go back to the fbi network and what i'll do now is run that script again okay so we've connected i'll load the script stored in slot 4 and then i'm going to run it and hopefully what we should see is something happens on the windows laptop and there you go commands have been copied to the windows laptop and now the information is being copied to my web server and then the script deletes the information and shuts the powershell down so the user doesn't realize what's going on and back in cali now notice ls shows me the zip file is back unzip temp dot zip they are all my wifi networks cat wi-fi my secure wi-fi there's the ssid there's the password okay so that was quite a long video but i've shown you all the steps now how to go from xero to a working omg cable how to send commands to the omg cable to get it to do things very basic scripts initially but then i showed you more advanced script where we could copy all the wi-fi passwords from a windows computer to a server somewhere on the internet if you like now some guys have asked okay what about antivirus you can bypass a lot of the antivirus through this because this is emulating a keyboard an antivirus will normally accept keystrokes from a keyboard the cable and the same is true for the rubber ducky these are emulating keyboards they are pretending to be a keyboard they are basically automating keystrokes so a lot of antivirus will accept keystrokes now there are some cases like with reverse shell where it won't allow those kind of connections it will think it's a hack but a lot of the standard stuff like copying files to an internet server is seen as normal behavior and that would be permitted but let me know did your antivirus block this what is what is your experience been what have you had to do to get this to work i hope you enjoyed this video if you did please like it please consider subscribing to my youtube channel and please click on the bell to get notifications when i post a new video i'm david bomble want to wish you all the very new best [Music] [Music] [Music] it's