BASH BUNNY from Hak5
The world's most powerful USB attack platform. Mimic multiple trusted devices simultaneously. Possibility to arrange multiple loads.
With Bash Bunny, you can physically access your device and go from Plug to Take Over in seconds.
If you can physically access your device, Hak5 Bash Bunny will give you electronic access. In short - it is the world's most powerful USB attack platform.
Specifically, it is a cross-platform and multi-tool device capable of simultaneously emulating and abusing trusted devices - input devices, storage devices, network devices.
Under the guise of a simple USB stick, infinitely customizable and backed by the Hak5 payload repository , Bash Bunny is a one-stop physical hacking tool.
Mode of action:
Regardless of the operating system (MacOS, Linux, Windows, Android) - all modern systems use the concept of trusted devices - that is, devices that the system will automatically trust and accept without the need for confirmation or drivers.
There are several categories of trusted devices, including:
HID ("Human Input Devices") - keyboards, mice, etc.
Storage devices - flash drives, etc.
Network devices - Ethernet adapters, etc.
Bash Bunny can emulate all of these devices at once - and then abuse the trust with scripted payloads.
Easily write or customize your own payload, or use one of the hundreds available in the Hak5 repository.
Multiple loads can be stored and selected with a physical switch. The RGB LED provides instant, hidden feedback on charge status.
Bash Bunny is a powerful, quad-core, full-featured Linux machine in a small form factor - accessible via a serial interface.
While it is infinitely configurable, typical use cases include:
NETWORK INFILTRATION
Automatically trust blocked or unblocked devices as the best network device. Performing QuickCreds attacks. Completely cross-platform (RNDIS and ECM) - supported by full TCP/IP stack and rooted Linux system.
KEYSTROKE INJECTION
Leverage keystroke injection with storage emulation for automatic program installation, data exfiltration, and more.
The full-featured scripting language provides a huge attack surface.
DATA EXFILTRATION
8GB high-speed flash memory enables fast data exfiltration and provides enough space to deliver binary and structured payloads.
ACCESS TO THE ROOT CONSOLE
Bash Bunny provides a permanent root console over the serial port so you can go to a fully functional Linux machine.
Technical Specifications:
- Weight: 30g
- Quad-core ARM Cortex A7 processor
- 512MB DDR3 RAM
- 16 MB built-in flash memory
- 8GB SLC NAND memory
- 1x LED indicator light
- 1x 3-position switch
Helpful materials:
Below our video, we invite you to subscribe and check out the whole channel, because there will be at least a few episodes recorded with Bash Bunny. :)
