Metasploit features a USB history recovery module that figures out which USB devices were used on the target system. This module is handy in scenarios where USB protection is set in place, and only specific devices are allowed to connect. Spoofing the USB descriptors and hardware IDs becomes a lot easier with this module.
For more on Spoofing USB descriptors and bypassing endpoint protection, refer to https://www.slideshare.net/the_netlocksmith/defcon-2012-hacking-using-usb-devices.
Let's see how we can use the module:
