INTRODUCTION
Over the years, the capabilities of O.MG cables has evolved rapidly, becoming more and more advanced.
Scripting, payloads, keystroke injection, wireless administration, stealth modes, self-destruct, geo-fencing, remote triggers and so much more - have turned these cables into a deeply comprehensive physical payload platform.
After much demand, the power of O.MG cables is available in other form-factors!
The O.MG plug appears to be a simple USB Drive on your keychain - but hidden inside are the full O.MG capabilities! Available in Basic and Elite versions, depending on your budget and requirements.
Important: The O.MG Plug is shipped in deactivated mode - it requires flashing before use. We recommend using the O.MG Programmer - which is compatible with all O.MG devices and cables. Flashing is performed easily via any web-browser.
FEATURES
-
WebUI over WiFi: Control everything remotely with a web browser. Desktop or mobile.
-
Keystroke Injection: Instant DuckyScript payloads. No recompiling or reprogramming, just click run! And with industry-leading 890keys/sec speeds.
-
Lots of Payload slots: Basic model comes with 8 slots. Elite's extra storage allows up to 300 slots!
-
Global Keymaps: With 192 keymaps already built in, you can target machines across the world.
-
Built in IDE: The WebUI not only provides 100% of the controls, but also gives you helpful feedback to catch syntax errors while rapidly building payloads.
-
Stealth: Spoof any USB identifier (VID/PID), extended USB Identifier, and network MAC address. Port Stealthing (Elite Models) lets the Plug stay dormant until a payload is deployed. No logs. No detections.
-
HIDX StealthLink: Elite model: setup a bidirectional tunnel from Target Host > O.MG > Control Machine.
-
Encrypted Network C2: Elite models: Use an encrypted connection to access & control your O.MG from anywhere. Then disable the onboard WebUI to hide and protect your O.MG on untrusted networks. Compatible with any server that runs python.
-
Self-Destruct: Elite model: Make your legal team happy by ensuring sensitive payloads & loot are gone, and the O.MG Plug is fully inert. (recoverable with O.MG Programmer)
-
Geo-Fencing: Trigger payloads or other actions based on location. Keep your tool from falling out of scope! Ex: self-destruct if someone takes the O.MG Plug out of scope.
- WiFi Triggers: Trigger payloads at long range with a single beacon.
BASIC vs ELITE
| Feature | Basic | Elite |
|---|---|---|
| Keystroke Injection | DuckyScript 2 | DuckyScript 3 |
| Mouse Injection | ✔ | ✔ |
| Payload Slots | 8 | 50-300 |
| Max Payload Size | 4,000 keystrokes | 1,500,000 keystrokes |
| Max Payload Speed | 120 keys/sec | 890 keys/sec |
| Geo-Fencing | ✔ | ✔ |
| WiFi Triggers | ✔ | ✔ |
| Port Stealthing | ✔ | |
| Self-Destruct | ✔ | |
| HIDX StealthLink | ✔ | |
| Encrypted Network C2 | ✔ | |
| All specs are based on devices using the latest Beta firmware | ||
Usage Instructions
The O.MG Plug has three distinct modes:
-
Programming
Because the device acts as a standard USB device, it needs to be pushed into programming / DFU mode. This is done by using the "Programming Shield".
The Programming Shield is connected to a host device, and the O.MG Plug is plugged into the Shield.
The O.MG Plug can now be programmed: Its WIFI settings can be configured, and payloads and trigger settings can be uploaded to the device.
Programming is possible via a web-interface or smartphone app.
-
Deployed
The device is 'Deployed' when it is connected to the target machine.
It can be configured to have any USB identifier (VID/PID) or network MAC address. In this mode, the device is dormant until triggered.
-
Triggered
The device is triggered wirelessly via Wifi. It can be triggered by smartphone, or by dedicated remote control.
Technical Specifications
-
Physical Characteristics
- Color: Black or White
- Connector: USB-A
- Color: Black or White
- Wifi, 802.11b/g/n (2.4GHz)
- Alternative to remote control for triggering payload
- Open source and freely available
- Payload Script: DuckyScript compatible with additional features.
- Smartphone interface
- In-Browser interface