Difference in Attack vectors between Bash Bunny and USB Rubber DUcky

Question

Can someone please explain to me the difference between the USB Rubber Ducky and the Bash Bunny. I understand that the Bash Bunny can emulate more trusted devices then just the keyboard like the USB Rubber Ducky, but why does that make it more dangerous for a lack of a better word at the moment. For say, what can be done with the Bash Bunny that cannot be done with the Rubber Ducky?

Also, does the Bash Bunny allow you to plug it in an execute a payload/reverse shell and immediatley remove the device or do you need to leave the device plugged in for some attacks.

Answer 1

Rubber Ducky is a keyboard emulator, plug it in and it executes pre-defined keystrokes.

Bash Bunny is a Flash drive, an Ethernet adapter, a serial device, and a keyboard. It can be any of these things, it can even be all of them at once. It's fully programmable and can be set to make logical decisions.

Per your edit

It used to be that the Rubber Ducky would begin virtual typing within about 2 seconds of being plugged in, where Bash Bunny took around 20 seconds to fully activate. I understand there's a newer Bash Bunny that comes up in 7 seconds.

Whether you leave Bash Bunny plugged in or can remove it shortly is a function of your program. It depends upon what you are doing. Bash Bunny is a computer, how long do you have to run a computer?

Answer 2

This is taken from the Rubber Ducky description page:

The USB Rubber Ducky injects keystrokes at superhuman speeds, violating the inherent trust computers have in humans by posing as a keyboard.

This is taken from the Bash Bunny description page:

Simultaneously mimic multiple trusted devices to trick targets into divulging sensitive information without triggering defenses.

While Bash Bunny is arguably more ambiguous in what it actually does, it is a far more capable device. Aside from emulating a keyboard, it can also be one of the following:

• Serial Device
• Ethernet Device
• USB Mass Storage
• HID (Human Interface Device)

You can find more information about possible attack vectors of the Bash Bunny in the Bash Bunny Payload Development Documentation.

---

To answer your follow-up question: It depends on the payload you write. For example, this payload launches a reverse shell, simply by starting a new hidden PowerShell instance, and then creating a reverse shell. It should be rather quick (read, under a minute) before you have a reverse connection. You don't need to keep the Bash Bunny plugged in after a connection has been established.