The Bash Bunny is a Linux-powered physical penetration testing and automation platform disguised as a standard USB flash drive. Developed by Hak5, it tricks target computers into trusting it by emulating combinations of standard USB devices—such as human interface devices (keyboards), USB-to-Ethernet adapters, serial interfaces, and mass storage drives.
Unlike traditional single-purpose keystroke injection devices (such as the original USB Rubber Ducky), the Bash Bunny runs a full Linux environment (OpenWrt/Debian-based). This allows pentesting payloads to combine rapid keyboard keystroke injection (via QUACK commands) directly within native Bash scripting logic, TCP/IP network attacks, conditional execution paths, and local data collection pipelines.
TOOL CLASSIFICATION
Category: Hardware / Physical Penetration Testing & Red Teaming Tool
Primary Attack Vectors: Keystroke Injection (HID), Network Hijacking (USB Ethernet Adapter), Mass Storage / Data Exfiltration, Serial Shell Access
KEY CAPABILITIES & TECHNICAL FEATURES
Multi-Vector Device Emulation (ATTACKMODE):
HID (Human Interface Device): Injects keystrokes at machine speeds via DuckyScript (QUACK commands).
Ethernet (RNDIS / ECM): Emulates high-speed USB network adapters to capture network traffic, poison DNS/LLMNR/NBT-NS, or hijack local credentials using tools like Responder.
Mass Storage (STORAGE): Exfiltrates files, delivers local scripts/binaries, or stages multi-stage payloads.
Serial (SERIAL): Provides root shell access over terminal for configuration and debugging.
Physical Hardware Interface:
3-Position Switch: Positions 1 and 2 run custom user payloads on boot; Position 3 (closest to USB plug) boots into Arming Mode for device configuration and file management via Mass Storage or SSH/Serial.
Multi-color RGB LED: Provides immediate visual feedback on execution state, setup, and payload success or failure.
Bash Bunny Mark II Additions:
MicroSD Storage Expansion: Supports high-capacity mass data exfiltration.
Bluetooth Low Energy (BLE): Enables wireless geofencing (WAIT_FOR_PRESENT) and remote trigger functionality.
CPU Governor Control (CUCUMBER): Allows scaling between low-power single-core mode and full-performance quad-core mode.
BEST USES & SCENARIOS
Physical Red Team Engagements: Demonstrating instant compromise of unattended or locked workstations with open USB ports.
Credential Harvesting: Intercepting hashed NTLM credentials over emulated network interfaces or stealing logged credentials via script injection.
Automated System Reconnaissance: Silently dumping IP configurations, active process lists, local user accounts, and network shares to the onboard storage in seconds.
Endpoint Security & Policy Auditing: Testing the effectiveness of Endpoint Detection and Response (EDR), Data Loss Prevention (DLP), and USB device control policies.
Security Awareness Demonstrations: Showcasing how fast physical access can compromise systems during employee security training.
DIFFICULTY RATING: INTERMEDIATE
Basic Usage (Beginner to Intermediate): Simple DuckyScript payloads (typing commands, opening command prompts) are straightforward and easy to deploy using existing community libraries.
Advanced Usage (Intermediate to Advanced): Writing custom multi-stage payloads combining network hijacking (e.g., Responder), Bash scripting logic, exfiltration pipelines, and BLE geofencing requires a solid understanding of Linux administration, networking, and Windows endpoint mechanics.
SUPPORTED TARGET ENVIRONMENTS
Windows: Supported across all attack modes (uses RNDIS for Ethernet emulation).
macOS: Supported (uses ECM for Ethernet emulation).
Linux / Android: Supported (uses ECM for Ethernet emulation).
KEY DEFENSIVE MITIGATIONS
Enforce USB Device Control Policies: Restrict or block unauthorized USB classes (especially new HID devices and unrecognized network adapters) via GPO, EDR, or physical port blockers.
Workstation Lockouts: Configure short screen-lock timeouts and strictly enforce locking unattended machines.
PowerShell & Script Hardening: Enable PowerShell Constrained Language Mode, Script Block Logging, and Execution Policies.
EDR / Behavioral Monitoring: Deploy endpoint detection rules configured to identify rapid keystroke patterns, suspicious command-line executions (e.g., hidden PowerShell windows), and unexpected network interface additions.